Privacy Policy
1. About the application
RadJ is a private web application that helps a radiologist prepare an imaging examination report from dictation and their own templates. The application is used exclusively by its owner; access is password protected.
2. Data controller and contact
The data controller is the owner of the application. Contact: biuro@noting.pl.
3. Data processed
- Dictation and report text – entered by the user to generate a report. Do not enter information that could identify a patient.
- Voice recording – speech recognition takes place in the browser (Web Speech API) or, in fallback mode, a recording is sent once to the transcription provider.
- Google account data – after connecting Drive: the account email address (to display which account is connected) and an access token.
- Cookies – technical cookies only: an encrypted, signed login session cookie and a short-lived cookie securing the Google connection process. No advertising or analytics cookies.
4. Processing by the AI provider
Dictation and report text, together with correction instructions, are sent to the language model provider xAI solely to generate or refine the report. The application does not store dictation or report content on the server. A working draft is kept only in the browser tab (sessionStorage) and is cleared when the tab is closed or the user logs out.
5. Google Drive access
The application uses the Google API solely with the Drive scope https://www.googleapis.com/auth/drive.file (along with openid and email for account identification). This means access only to files the application itself creates in the user's Drive: the radiology reports folder and the reports saved there. The application has no access to other files in Drive.
The Google refresh token is stored encrypted (AES-256-GCM) in a protected, non-public directory on the hosting server and is used solely to save reports at the user's request.
The use of information received from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements.
6. Data sharing
Data is not sold, used for advertising or profiling, or shared with third parties, except for the technical providers necessary to operate the application: hosting (LH.pl, Poland), language model (xAI), Google (Drive, at the user's request), and the email provider (sending reports by email at the user's request).
7. Revoking access and deleting data
- In the application: the “Disconnect Drive” button revokes Google permissions and deletes the stored token.
- In your Google account: myaccount.google.com/permissions → RadJ → “Remove access”.
- Files saved in Drive remain the user's property and can be deleted at any time directly in Google Drive.
8. Security and rights
Connections are encrypted (HTTPS). The user has the right to access, correct and delete their data and to restrict processing. To exercise these rights, contact biuro@noting.pl.