Privacy Policy — Radiology Prime

Last Updated: May 2026

This Privacy Policy describes how Radiology Prime (“we,” “us,” or “our”) collects, uses, and discloses your information when you use our specialist neuroradiology second-opinion platform, and explains your privacy rights and how applicable law protects you.

We process your personal data solely to provide and improve our service. By using the service, you agree to the collection and use of information in accordance with this Privacy Policy.

Service availability

The Radiology Prime platform is offered to patients resident in any country other than Portugal. The service is not offered to residents of Portugal. Where the service is offered, eligibility is also subject to the operational availability set out at the point of upload — including any country-of-residence confirmation in the checkout flow — and to your consent to the data processing described in this Privacy Policy.

How to read this policy: key terms explained

The words of which the initial letter is capitalised have meanings defined under the following conditions. The following definitions shall have the same meaning regardless of whether they appear in singular or in plural.

Definitions

For the purposes of this Privacy Policy:

Account means a unique account created for you to access our service or parts of our service.

Clinical Lead refers to the consultant radiologist with sub-specialty focus in neuroradiology engaged by Radiology Prime as the platform’s reviewing radiologist. The Clinical Lead acts as an independent Data Controller for clinical record-keeping and professional liability purposes under the medical laws of their own jurisdiction. The Clinical Lead’s profile, credentials, and registrations are published on the Clinical Lead & Medical Review page.

Company (referred to as “Radiology Prime,” “we,” “us,” or “our” in this Policy) refers to Radiology Prime, a platform business registered and operating in Portugal at Rua Cristiano Cruz 9, 2820-056, Aroeira, Portugal. For the purposes of the GDPR, Radiology Prime acts as the Data Controller for platform-level processing of your Personal Data.

Cookies are small files placed on your computer, mobile device, or any other device by a website, containing details of your browsing activity on that website among their many uses.

Data Controller, for the purposes of the GDPR (General Data Protection Regulation), refers to the legal person which, alone or jointly with others, determines the purposes and means of the processing of Personal Data. Radiology Prime is the Data Controller for the operation of the platform. The Clinical Lead, and any additional Reviewing Radiologist subsequently engaged by the platform, acts as an independent Data Controller for clinical record-keeping and professional liability purposes under the medical laws of their own jurisdiction.

Data Protection Officer (DPO) refers to the person appointed by Radiology Prime under GDPR Article 37 to oversee data protection compliance and act as the point of contact for data subjects and supervisory authorities. The DPO for Radiology Prime is Peter Pohlmann, contactable at dpo@radiologyprime.com.

Data Subject means any identified or identifiable natural person whose Personal Data is processed by Radiology Prime.

Device means any device that can access the service, such as a computer, a mobile phone, or a digital tablet.

Health Data means any Personal Data relating to the physical or mental health of a natural person, including medical imaging files and clinical information submitted through the platform. Health Data is classified as special category data under GDPR Article 9 and is processed only with your explicit consent and solely for the purpose of facilitating an independent specialist neuroradiology second opinion.

Personal Data is any information that relates to an identified or identifiable individual. For the purposes of GDPR, Personal Data means any information relating to you such as a name, an identification number, location data, an online identifier, or factors specific to your physical, physiological, genetic, mental, economic, cultural, or social identity.

Platform refers to the technology, software, and related services operated by Radiology Prime that enable you to submit medical imaging for independent specialist neuroradiology review and to receive a written radiology report from a Reviewing Radiologist.

Reviewing Radiologist means an independently licensed medical radiologist contracted by Radiology Prime to provide independent specialist neuroradiology second-opinion review of medical imaging submitted through the platform. As at the date of this Privacy Policy, the platform’s Reviewing Radiologist is the Clinical Lead, who is registered in Germany. As the platform’s reviewing team grows, additional Reviewing Radiologists may be engaged in other jurisdictions; any such additions, and the resulting changes to international data transfers, will be disclosed on the Clinical Lead & Medical Review page and reflected in an updated version of this Privacy Policy. Each Reviewing Radiologist is individually registered with, and regulated by, the competent medical authority of their jurisdiction.

Service refers to the Radiology Prime platform and online specialist neuroradiology second-opinion service, accessible at radiologyprime.com.

Service Provider means any natural or legal person who processes data on behalf of Radiology Prime. This refers to third-party companies or individuals engaged to facilitate the platform, to provide services on behalf of Radiology Prime, or to perform services related to the operation and analysis of the platform. For the purposes of GDPR, Service Providers are considered Data Processors.

Usage Data refers to data collected automatically, either generated by use of the service or from the service infrastructure itself (for example, the duration of a page visit).

You means the individual accessing or using the service. Under GDPR, you may be referred to as the Data Subject or the User.

What data we collect and why

Personal Data

When you register for or use our service, we may collect the following categories of personally identifiable information:

Full name (for account registration)
Email address (for account access and report delivery)
Country of residence (to confirm service eligibility)
Medical imaging files uploaded by you for second-opinion review
Clinical context or supporting information submitted alongside your scan
Payment information (processed exclusively by Stripe; not stored on our servers)

We collect only the data necessary to operate the platform and facilitate the second-opinion service. Users are encouraged to upload only scans relevant to their request and to avoid including unnecessary personal information in uploaded files.

Usage Data

Usage Data is collected automatically when you use the service. This may include your device’s IP address, browser type and version, the pages you visit, the time and date of your visit, the time spent on those pages, unique device identifiers, and other diagnostic data.

When you access the service via a mobile device, we may additionally collect information such as your mobile device type, mobile device unique ID, mobile operating system, and mobile browser type.

Tracking technologies and cookies

We use cookies and similar tracking technologies to track activity on our service and store certain information. The technologies we use may include:

Session cookies are deleted automatically when you close your browser. We use these to authenticate users and maintain service functionality during your visit.

Persistent cookies remain on your device when you go offline. We use these to remember your preferences and to recognise returning users.

We use the following categories of cookies:

Necessary / essential cookies — Type: Session Cookies | Administered by: Radiology Prime. These cookies are essential to provide you with services available through the website and to enable core features. Without these cookies, the services you have requested cannot be provided.

Cookie policy / notice acceptance cookies — Type: Persistent Cookies | Administered by: Radiology Prime. These cookies record whether you have accepted the use of cookies on the website.

Functionality cookies — Type: Persistent Cookies | Administered by: Radiology Prime. These cookies allow us to remember choices you make when you use the website, such as your login details or language preference, to provide a more personalised experience.

Analytics cookies — Type: Persistent Cookies | Administered by: Third Parties. These cookies are used to collect anonymised information about how visitors use the website. The information gathered helps us improve the service. See the Third-party services and data processing section below for further details.

For full details on the cookies we use and your choices regarding them, please refer to our Cookie Policy.

How Radiology Prime uses your Personal Data

Radiology Prime may use Personal Data for the following purposes:

To operate and maintain the platform, including to monitor usage and ensure service continuity.

To manage your account, enabling you to access the features available to registered users.

To transmit your imaging and clinical information to a Reviewing Radiologist for independent specialist neuroradiology second-opinion review.

To deliver the resulting radiology report to you, typically by email as a PDF attachment through the platform.

To fulfil a contract, including processing your service package purchase and any associated follow-up reports.

To contact you, by email or other agreed electronic communication methods, regarding updates, security notices, or information directly related to your contracted service.

To manage your requests, including responding to queries, complaints, or follow-up questions submitted to us.

For service improvement, including anonymised data analysis, usage trend identification, and evaluation of platform performance. No identifiable Health Data is used for this purpose.

For business continuity, in the event of a merger, acquisition, or asset transfer, Personal Data held by us may form part of the transferred assets. We will provide notice before your Personal Data becomes subject to a different privacy policy.

We do not use your Personal Data to send unsolicited marketing communications. We do not sell, share, or reuse your Personal Data or Health Data for secondary commercial purposes.

How we share your Personal Data

Radiology Prime shares your Personal Data only in the following circumstances:

With the Reviewing Radiologist — The core purpose of the platform is to facilitate independent specialist neuroradiology review of your imaging by a licensed radiologist. As at the date of this Privacy Policy, the platform’s Reviewing Radiologist is the Clinical Lead, who is registered in Germany. The Reviewing Radiologist is independently licensed and regulated by the competent medical authority of their jurisdiction, is bound by professional secrecy obligations under their national medical laws, and acts as an independent Data Controller for clinical record-keeping and professional liability purposes relating to their review. The Reviewing Radiologist receives only the imaging and clinical information necessary to perform the review, and is contractually prohibited from using your data for any purpose other than providing your second-opinion radiology report.

As the platform’s reviewing team grows, additional Reviewing Radiologists may be engaged. Any such additions, and the resulting changes to data flows and international data transfers, will be disclosed on the Clinical Lead & Medical Review page and reflected in an updated version of this Privacy Policy. We will notify users of material changes in line with the Changes to this Privacy Policy section below.

With Service Providers — We use third-party Service Providers to operate the platform. The principal Service Providers are:

Google Cloud (infrastructure and hosting, EU regions)
Stripe (payment processing)
Google Analytics (anonymised usage analysis)

Each Service Provider processes data on our behalf under a GDPR-compliant Data Processing Addendum (Article 28 GDPR) and is contractually prohibited from using your data for any other purpose. See the Third-party services and data processing section below for details.

In connection with a business transfer, where Radiology Prime is involved in a merger, acquisition, or asset sale. You will be notified before your Personal Data becomes subject to a different privacy policy.

To comply with legal obligations, where we are required by law or valid public authority request to disclose your data, including to comply with a legal obligation, protect the rights or property of Radiology Prime, prevent or investigate wrongdoing in connection with the service, or protect the personal safety of users or the public.

With your explicit consent, for any other purpose not described above.

How long we keep your data

Radiology Prime retains your Personal Data only for as long as is necessary for the purposes set out in this Privacy Policy. We retain and use your data to the extent necessary to comply with our legal obligations, resolve disputes, and enforce our agreements and policies.

Uploaded medical imaging files are retained on the platform for a limited period following delivery of your radiology report, after which they are securely deleted from Radiology Prime’s systems. The standard retention period for uploaded imaging files on the platform is three months from the date of report delivery, unless earlier deletion is requested by you or a longer period is required by applicable law.

Radiology reports retained by the Reviewing Radiologist may be held for longer periods in line with the professional record-keeping and liability obligations applicable to the radiologist under the national medical laws of their own jurisdiction. These retention periods are determined by the Reviewing Radiologist in their capacity as independent Data Controller for clinical records, not by Radiology Prime.

Account data (such as name and email address) is retained for as long as your account is active and for a reasonable period thereafter for administrative, security, and legal purposes.

Usage Data is generally retained for a shorter period, except where required to maintain service security or where we are legally obligated to retain it longer.

For specific retention periods applicable to your data, please contact our Data Protection Officer using the details in the Contact section below.

International data transfers

Radiology Prime processes your Personal Data and Health Data in accordance with GDPR Chapter V. Transfers occur as follows:

Infrastructure and storage — All imaging uploads, platform data, and radiology reports on the platform itself are hosted on Google Cloud Platform within EU regions. Your data does not leave the European Economic Area at the infrastructure level.

Review by the Reviewing Radiologist — As at the date of this Privacy Policy, the platform’s Reviewing Radiologist is the Clinical Lead, who is registered in Germany. Germany is a Member State of the European Union and the European Economic Area; transfers to the German-registered Reviewing Radiologist do not constitute an international transfer under GDPR.

As the platform’s reviewing team grows, additional Reviewing Radiologists may be engaged in other jurisdictions. Where this occurs:

Transfers to a Reviewing Radiologist registered in an EEA Member State will not constitute an international transfer under GDPR.
Transfers to a Reviewing Radiologist registered in the United Kingdom will be made under the EU Commission adequacy decision for the United Kingdom under Article 45 GDPR.
Transfers to a Reviewing Radiologist registered in Switzerland will be made under the EU Commission adequacy decision for Switzerland under Article 45 GDPR.
Transfers to a Reviewing Radiologist registered in any other jurisdiction will only be made on the basis of an adequacy decision or appropriate safeguards as required under GDPR Chapter V, and the change in international data flows will be disclosed in advance through an updated version of this Privacy Policy.

Payments and analytics — Limited Personal Data processed by Stripe (for payments) and Google Analytics (for anonymised usage analysis) may be handled by sub-processors whose operations fall under the EU-US Data Privacy Framework or EU Standard Contractual Clauses, as required under GDPR Chapter V.

No transfers of your Personal Data will take place to an organisation or country without an adequacy decision or appropriate safeguards in place.

Disclosure of your Personal Data

Business transactions

If Radiology Prime is involved in a merger, acquisition, or asset sale, your Personal Data may be transferred. We will provide advance notice before your Personal Data is transferred and becomes subject to a different Privacy Policy.

Law enforcement

Under certain circumstances, Radiology Prime may be required to disclose your Personal Data if required to do so by law or in response to valid requests by public authorities, such as a court or government agency.

Other legal requirements

Radiology Prime may disclose your Personal Data in the good-faith belief that such action is necessary to comply with a legal obligation, protect and defend the rights or property of Radiology Prime, prevent or investigate possible wrongdoing in connection with the service, protect the personal safety of users or the public, or protect against legal liability.

Security of your Personal Data

The security of your Personal Data is important to us. Radiology Prime applies appropriate technical and organisational measures, as required under GDPR Article 32, to protect your Personal Data against unauthorised access, loss, alteration, or disclosure.

Our security measures include:

Encryption in transit: all uploads and data transfers are protected with TLS 1.2 or higher.
Encryption at rest: all stored imaging files and Personal Data are encrypted using AES-256.
EU data residency: all platform data is stored within EU regions of Google Cloud Platform, which is certified to ISO 27001, ISO 27017, and ISO 27018 and is audited annually under SOC 2 Type II.
Access controls: the Reviewing Radiologist accesses imaging only through authenticated, audit-logged sessions, and only for cases explicitly assigned to them.
Sub-processor controls: all third-party processors are bound by GDPR-compliant Data Processing Addendums under Article 28 GDPR.
Organisational safeguards: administrative, physical, and organisational measures are reviewed in line with current EU data protection standards.

As with all internet-based services, no method of electronic transmission or storage can eliminate all security risk. These limitations are transparently disclosed so you can make informed decisions about your use of the service. For full details, please refer to the Risk Mitigation section of our Terms and Conditions.

Third-party services and data processing

Service Providers have access to your Personal Data only to perform their tasks on our behalf and are contractually obligated not to disclose or use it for any other purpose.

Infrastructure and hosting

Radiology Prime’s platform and all patient imaging data on the platform are hosted on Google Cloud Platform within the European Union. Google Cloud acts as our data processor under a GDPR-compliant Data Processing Addendum (Article 28 GDPR). Google Cloud is certified to ISO 27001, ISO 27017, and ISO 27018 (the international standard for protecting personally identifiable information in the cloud), and is audited annually under SOC 2 Type II. Data is stored in EU regions to ensure EU data residency.

For Google Cloud’s privacy and data processing practices, please visit: https://cloud.google.com/privacy

Analytics

Radiology Prime uses Google Analytics to monitor and analyse usage of our service. Google Analytics is configured with IP anonymisation enabled. Advertising and remarketing features are disabled. Data collected through Google Analytics is used solely for service improvement purposes and is not linked to identifiable Health Data.

You can opt out of Google Analytics tracking by installing the Google Analytics opt-out browser add-on, available at: https://tools.google.com/dlpage/gaoptout

For more information on Google’s privacy practices, please visit: https://policies.google.com/privacy

Payment processing

All payments are processed by Stripe, a PCI-DSS certified payment processor. Radiology Prime does not store credit card or payment account information on its servers. For Stripe’s privacy practices, please visit: https://stripe.com/privacy

Your rights under GDPR and UK GDPR

Radiology Prime is committed to respecting the confidentiality of your Personal Data and to ensuring you can exercise your rights under applicable law.

If you are located in the European Economic Area or the United Kingdom, you have the following rights:

Right of access — You have the right to request a copy of the Personal Data we hold about you and information about how we process it.

Right to rectification — You have the right to have any incomplete or inaccurate Personal Data we hold about you corrected.

Right to object — You have the right to object to our processing of your Personal Data where we are relying on a legitimate interest as the legal basis for processing, or where we are processing your data for direct marketing purposes.

Right to erasure — You have the right to request that we delete or remove your Personal Data where there is no longer a valid legal basis for us to continue processing it.

Right to restrict processing — You have the right to request that we restrict the processing of your Personal Data in certain circumstances, such as where you contest the accuracy of the data or object to processing.

Right to data portability — You have the right to receive your Personal Data in a structured, commonly used, machine-readable format, or to have it transferred to a third party of your choice, where technically feasible and where the processing was based on your consent or on a contract.

Right to withdraw consent — Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal. Please note that if you withdraw consent while a review is already in progress, we may be required to close the case without delivering a report, and the service fee may be non-refundable at that stage in accordance with our Terms and Conditions.

To exercise any of these rights, please contact our Data Protection Officer using the details in the Contact section below. We may ask you to verify your identity before responding to your request. We will respond as promptly as possible and within the timeframes required by applicable law.

You also have the right to lodge a complaint with your local Data Protection Authority. If you are in the EEA, you may contact the supervisory authority in your country of residence. If you are in the United Kingdom, the relevant authority is the Information Commissioner’s Office (ICO): www.ico.org.uk

Legal basis for processing Personal Data under GDPR

Radiology Prime processes Personal Data under the following legal bases:

Explicit consent for Health Data (GDPR Article 9(2)(a)) — Health Data, including medical imaging files and associated clinical information, is processed exclusively on the basis of your explicit consent, given at the point of upload for the specific purpose of facilitating an independent specialist neuroradiology second opinion. You may withdraw this consent at any time by contacting our Data Protection Officer. Withdrawal will result in the deletion of your Health Data from the platform and the closure of any ongoing review; withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

Consent for account data (GDPR Article 6(1)(a)) — Your account information (such as name and email address) is processed on the basis of your consent, given at the time of account creation.

Performance of a contract (GDPR Article 6(1)(b)) — Processing is necessary to fulfil the service agreement between you and Radiology Prime, including facilitating the delivery of your radiology report and managing your account.

Legal obligations (GDPR Article 6(1)(c)) — Processing is necessary to comply with applicable legal obligations to which Radiology Prime is subject.

Legitimate interests (GDPR Article 6(1)(f)) — For non-Health Data only, processing may be necessary for the purposes of the legitimate interests pursued by Radiology Prime, such as platform security, fraud prevention, and service improvement, where these interests are not overridden by your rights and freedoms. Legitimate interests are never used as a legal basis for processing Health Data.

The Reviewing Radiologist processes Health Data under the legal bases available to them under the national medical laws of their own jurisdiction, in their capacity as independent Data Controller for clinical record-keeping purposes.

Radiology Prime will clarify the specific legal basis applicable to any particular processing activity upon request to our Data Protection Officer.

Links to other websites

Our service may contain links to third-party websites not operated by us. If you click on a third-party link, you will be directed to that party’s site. We strongly advise you to review the Privacy Policy of every site you visit. We have no control over and assume no responsibility for the content, privacy practices, or policies of any third-party sites or services.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the updated Privacy Policy on this page and updating the “Last updated” date at the top of this document. Where changes are material — including changes to international data transfers, the categories of recipients of your Personal Data, or the legal bases for processing — we will notify you by email or by a prominent notice on our service prior to the change becoming effective.

You are advised to review this Privacy Policy periodically. Changes become effective when posted on this page.

How to contact Radiology Prime about your privacy

If you have any questions about this Privacy Policy, wish to exercise your data protection rights, or wish to make a complaint, please contact our Data Protection Officer:

Data Protection Officer: Peter Pohlmann Email: dpo@radiologyprime.com General privacy enquiries:info@radiologyprime.com

By post: Radiology Prime Attn: Data Protection Officer Rua Cristiano Cruz 9 2820-056 Aroeira Portugal