Privacy Policy

Effective from [publication date]. Template last updated: September 2026.

This Policy describes what data the Ceph service (the “Service”) collects and processes, for what purpose, on what legal basis, how long it keeps it, and what rights users and data subjects have. By using the Service you confirm that you have read this Policy.

1. What data we process

• User (specialist) account data: username, email, password hash (the password itself is not known to the server and is not stored), access recovery backup codes (also stored only as hashes).
• Patients’ medical data that the user (doctor/clinic) uploads for analysis: X-ray images (cephalograms), full name, date of birth, sex, markup results and generated reports. This is data that the Service user processes as an independent operator/controller in relation to their own patients — see section 6 for details.
• Technical data: session data (cookies, see the Cookie Policy), the IP address and technical logs of requests to the server, and correspondence in the support chat inside the Service.

2. Purposes of processing

• user registration and authentication, operation of the personal account;
• providing image analysis functionality and generating reports;
• technical support for users (chat with the administrator);
• ensuring security (protection against password guessing, logging of administrator actions, preventing fraudulent use of invitation codes);
• compliance with applicable law.

3. Russian Federation — Federal Law No. 152-FZ “On Personal Data”

Personal data of users and data subjects located in the Russian Federation is processed in accordance with 152-FZ:

• Legal basis — the consent of the data subject (Art. 9); medical data, which belongs to a special category (Art. 10 of 152-FZ), requires separate written consent — see the Consent to the Processing of Personal Data.
• Localisation (Art. 18.1, Federal Law No. 242-FZ): when processing personal data of Russian citizens, recording, systematisation, accumulation, storage, clarification and retrieval of such data are carried out using databases located in the Russian Federation. [the operator states the actual location of the servers and confirms compliance with this requirement, or the basis for an exemption].
• Rights of the data subject (Chapter 3 of 152-FZ): to obtain information about the processing of their data, to demand clarification, blocking or destruction if the data is inaccurate or processed unlawfully, and to withdraw consent at any time.
• Notification of Roskomnadzor about the processing of personal data is filed by the operator under Art. 22 of 152-FZ, except in the cases listed in part 2 of that article. [the operator states the notification number / the basis for exemption].

4. European Union — GDPR (Regulation (EU) 2016/679)

If you are in the EU/EEA, the GDPR applies to the processing of your data:

• Legal bases for processing (Art. 6 GDPR) — consent, performance of the contract for the Service, and a legitimate interest in ensuring the security of the Service.
• Special categories of data (Art. 9 GDPR) — patients’ health data is processed on the basis of explicit consent (Art. 9(2)(a)) or for the purposes of providing healthcare / preventive medicine (Art. 9(2)(h)), depending on the user’s role as the operator of this data.
• Rights of the data subject (Chapter III GDPR): access (Art. 15), rectification (Art. 16), erasure / “right to be forgotten” (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), objection to processing (Art. 21).
• Retention period — see the Personal Data Retention and Protection Policy.
• Data Protection Officer (DPO, Art. 37 GDPR) — in the case of large-scale systematic processing of special categories of data (patients’ medical data), appointing a DPO is as a rule mandatory. Contact: [email/contact details of the DPO or a note “not appointed because …”].
• EU representative (Art. 27 GDPR) — if the Service operator is not established in the EU but regularly processes the data of EU subjects, an EU representative must be appointed. [contact details of the EU representative or a note that this is not applicable].
• Complaints — you have the right to lodge a complaint with the data protection supervisory authority of your EU country (list: edpb.europa.eu).

5. USA — CCPA/CPRA (California Consumer Privacy Act / California Privacy Rights Act) and HIPAA

• If you are a California resident, you have the right to: know what data about you is collected and how it is used; request deletion of your data; request correction of inaccurate data; opt out of the sale or “sharing” of your personal data with third parties; and not be discriminated against for exercising these rights.
• We do not sell or share personal data with third parties for targeted advertising. The formal “Do Not Sell or Share My Personal Information” notice is given here as confirmation of this fact; a separate opt-out form is not required because no sale/sharing takes place.
• HIPAA. The Service is not certified and does not guarantee out-of-the-box compliance with the Health Insurance Portability and Accountability Act (HIPAA). If the Service is used by a medical organisation subject to HIPAA (a Covered Entity), processing patient data from the USA requires a separate Business Associate Agreement (BAA) between the organisation and the Service operator. [the operator states whether it concludes a BAA on request].
• COPPA. The Service is not intended for persons under 18 and does not knowingly collect children’s data directly from them (data of minor patients is entered by their treating doctor/clinic, not by the children themselves).

6. The specialist user’s role as an independent operator of patient data

Patient data (full name, date of birth, sex, images) is entered into the Service by the registered specialist (doctor, clinic) for their own professional purposes. In respect of this data the Service operator acts as a technical processor on behalf of the specialist, and the specialist acts as the independent operator (controller), responsible for having a lawful basis and the patient’s consent to the processing of their data in this particular Service (see the consent form). The Service operator provides technical protection of this data (encryption, access separation) in accordance with this Policy and the Retention Policy.

7. Other jurisdictions

If you are in a country not mentioned above (for example, Brazil — LGPD, Canada — PIPEDA, Singapore — PDPA, and other jurisdictions with similar personal data protection rules), we process your data guided by the general principles set out in this Policy: minimisation of processing, purpose limitation, security of storage and respect for the data subject’s rights of access, rectification and erasure. To exercise rights specific to your jurisdiction, please use the contact details given at the beginning of this document.

8. Protection measures

• encryption of medical data “at rest” on the server (a separate encryption key for each user, wrapped by the server’s root key);
• data transfer over HTTPS;
• separate, isolated sessions for regular users and administrators;
• hashing of passwords and recovery backup codes;
• rate limiting of sign-in attempts (protection against password guessing);
• access to users’ data by Service administrators only through the administration panel, with logging of access to correspondence/exports.

9. How to exercise your rights

To request access to your data, its correction or deletion, or to withdraw consent to processing, please contact us through the built-in support chat in the Service’s personal account or by email [operator contact email]. We respond to such requests within the periods established by applicable law (as a rule, no later than 30 days).

10. Changes to this Policy

We may update this Policy to reflect changes in the Service or in the law. The date of the last update is shown at the beginning of the document.