Privacy Policy

Introduction

Zapx Solutions Limited ("we", "our", or "us") operates Radily. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our service. We are committed to protecting your privacy and handling your data in an open and transparent manner.

Information We Collect

Medical Reports

When you upload a radiology report, we temporarily store the document to process it through our AI system. This may include:

• Text content from your medical reports
• Images or PDFs of medical scans and reports
• Metadata associated with uploaded files

Account Information

If you create an account, we collect:

• Email address
• Password (encrypted)
• Account preferences

Usage Data

We automatically collect certain information about your device and how you interact with our service, including IP address, browser type, pages visited, and time spent on pages.

How We Use Your Information

We use your information to:

• Process your radiology reports and provide explanations
• Maintain and improve our service
• Send you service-related communications
• Ensure the security and integrity of our platform
• Comply with legal obligations

Data Storage and Security

We implement industry-standard security measures to protect your data:

• All data is encrypted in transit using TLS/SSL
• Uploaded reports are encrypted at rest
• Access to medical data is strictly controlled and logged
• Regular security audits and updates

Important: All uploaded medical reports and generated explanations are automatically deleted from our servers after 30 days.

Using Radily inside ChatGPT, Claude and other AI assistants

Radily can be connected as an app inside third-party AI assistants such as ChatGPT and Claude. This section explains exactly what happens to your data when you use it that way. It applies in addition to the rest of this policy.

What we receive

We receive only the report text that you choose to paste or upload into the conversation, plus your explicit confirmation that the report is your own or that you are authorised to share it. We do not read your chat history, and we do not connect to your electronic health record, your hospital, or any medical records provider.

Identifying details are removed before storage

Before a report received through an AI assistant is stored or processed, we automatically remove direct identifiers, including patient name, medical record number, date of birth, accession number, clinician names, postal address, postcode, email address, telephone number and any age over 89. We keep the clinical narrative (the findings and impression) because that is what we explain. We record only a count of how many items were removed, never the removed values themselves.

This is a data-minimisation measure, not a guarantee of anonymity: free-text reports can contain identifying details in unpredictable places. That is why it is paired with the short retention period below.

How long we keep it

Reports received through an AI assistant are permanently deleted within 24 hours of being submitted. This is a hard deletion, not an archive or a flag. It is shorter than the retention period that applies to reports uploaded on our website.

The assistant itself

Importantly, the AI assistant you are using is operated by another company, not by us. When you paste a report into ChatGPT or Claude, that company receives the text you typed under its own privacy policy and retention rules, before it ever reaches us. Our controls described above govern what Zapx Solutions Limited does with your data; they cannot govern what the assistant provider does with it. Please read that provider's privacy policy as well.

Connecting and disconnecting

Connecting the app links it to your Radily account using OAuth. We store an access token so the assistant can return your explanation to you; we never receive your password from the assistant. You can disconnect at any time, from your account settings or from within the assistant, which immediately revokes that access.

Not a medical service

Explanations produced through an AI assistant are educational only. They are not a diagnosis, not medical advice, and not a substitute for your doctor or radiologist. This service is intended for adults aged 18 or over explaining their own reports.

Data Sharing and Disclosure

The processors below are the only parties that receive report content or personal data, and each receives only what its task requires:

• OpenAI — receives the text of your report to write the plain-English explanation and the glossary.
• Anthropic — receives PDFs and images of reports you upload, to extract the text from them. It does not receive reports you paste in as text.
• Vercel — hosts the service, and its AI Gateway carries our requests to the AI providers above and below.
• Black Forest Labs — receives the narration script written from your explanation, to generate the narrated video. It is sent only when you ask for a video, and it does not receive the original report.
• Supabase — stores your report, explanation and video on our behalf, for the retention periods described above.
• Stripe — handles payments. It receives your payment details directly and we never see or store your card number.
• Resend — sends service emails, such as a link to a finished report, and receives your email address to do so.
• Google, Reddit, Quora and PostHog — measure visits and conversions on the website, as described under Cookies and Tracking. They never receive your report or its explanation.
• Legal Requirements: We may disclose information if required by law or to protect our rights.
• Business Transfers: In the event of a merger or acquisition, your information may be transferred to the new entity.

We do not sell your personal information, and we never share report content with advertising platforms. Each processor is bound by contract to protect your data and to use it only to provide its service to us.

One limit you should know about: our retention periods govern our own systems. The AI providers above keep request data under their own API terms for their own abuse monitoring, and that retention is not something we control. Where a provider offers a zero-retention option we will say so here once it is in place.

Your Rights Under GDPR

If you are in the European Economic Area (EEA), you have the following rights:

• Right to Access: Request a copy of your personal data
• Right to Rectification: Request correction of inaccurate data
• Right to Erasure: Request deletion of your data
• Right to Restrict Processing: Request limitation of data processing
• Right to Data Portability: Receive your data in a portable format
• Right to Object: Object to processing of your data
• Right to Withdraw Consent: Withdraw consent at any time

To exercise these rights, contact us at hi@radily.ai

Cookies and Tracking

We use essential cookies to maintain your session and preferences. You can disable cookies in your browser settings, but this may affect the functionality of our service.

To understand how the website is used and whether our ads work, the website also uses Google Analytics (Google LLC), PostHog product analytics, the Reddit Pixel (Reddit, Inc.) and the Quora Pixel (Quora, Inc.). They record pages viewed and events such as starting an upload, creating an account and completing a purchase. Like any web request, these carry your IP address and browser details. None of them receives the content of your report or its explanation.

Quora Pixel and your choice

• Depends on where you are. If your browser's time zone is in the UK or the European Economic Area, the Quora Pixel is not loaded at all until you press Allow on the notice. Everywhere else it is on by default unless you have declined. Your choice is remembered in this browser's local storage.
• What it reports: page views on public pages, clicks on the upload and sign-up buttons, and that an account was created. It is never loaded on report, payment or sign-in pages, and we do not send it your email address, report details or anything you upload.
• What it stores: the Quora Pixel sets no cookie on this site, though Quora may read its own cookies on quora.com if you are signed in there.
• Where it goes: to Quora, Inc., under the Quora Privacy Policy.
• Turning it off: press No thanks on the notice, or use the button below. Nothing more is sent to Quora from this browser.

The Quora Pixel only runs on radily.ai.

Children's Privacy

Our service is not intended for children under 16. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date.