In short: we use your report only to explain it to you. We don't sell personal data, we don't use your reports for advertising, and you can delete your data at any time.
1. Who we are
ScanSays (“we”, “us”) is operated by TrangoLabs Technologies FZ LLE, registered in United Arab Emirates under number 19087/2024, with its registered address at Twin Towers, Fujairah. We are the controller of the personal data described in this policy.
You can contact us about privacy at privacy@scansays.com.
2. What we collect
Information you give us
- Account details: name, email address, password (stored only as a secure hash), preferred language.
- Reports you upload: photos or PDFs of medical reports, and the text and findings we extract from them, including any corrections you make. This is health data and we treat it with extra care.
- People you scan for: a display name, sex and age or date of birth for each person you add, used to choose the right anatomy and reference ranges.
- Payment records: what you bought, when, and your wallet history. Card details are collected and stored by our payment provider, not by us.
- Messages: anything you send to our support or other addresses.
- Waitlist: your email address, if you join the waitlist.
Information collected automatically
- Technical data: IP address, device and browser type, and app version, used to keep the service secure and working.
- Usage data: basic events such as uploads and errors, used to fix problems. See our cookie policy.
3. How we use it
- To read your report, explain it and show it in 3D, and to keep your results available in My Scans.
- To run your account, process payments and refunds, and keep your wallet balance.
- To answer your messages and provide support.
- To keep the service secure and prevent fraud and misuse.
- To improve reading accuracy, but only using reports you have given us separate, explicit permission to use for this. You can withdraw that permission at any time.
- To email you about the service and, if you joined the waitlist, about our launch. You can unsubscribe at any time.
We do not sell personal data, use reports for advertising, or make decisions about you that have legal or similarly significant effects based only on automated processing.
4. Legal bases
Where data protection law requires a legal basis, we rely on:
- Contract: to provide the service you sign up for.
- Explicit consent: to process health data in your reports. You give this when you upload a report and can withdraw it by deleting the report or your account.
- Legitimate interests: to keep the service secure and to improve it, balanced against your rights.
- Legal obligation: to keep financial records and respond to lawful requests.
We apply the data protection laws that cover our users, including the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021), the UAE law on the use of ICT in health fields (Federal Law No. 2 of 2019), and the EU/UK GDPR where they apply.
5. Who we share it with
We share personal data only with service providers that help us run ScanSays, under contracts that require them to protect it and use it only on our instructions:
| Provider | What they do | Location |
|---|---|---|
| Hostinger | Hosting this website (no health data) | United Kingdom |
| Our cloud hosting provider (named here before the app opens) | Hosting, storage and databases for the ScanSays app (app.scansays.com) | The region you choose: UAE, European Union or United States |
| OpenAI (main reader) and Anthropic (backup reader) | Reading report text to extract findings (see section 6) | The same region as your reports |
| None: text recognition runs on our own servers | Turning photos of reports into text | The same region as your reports |
| Stripe | Card payments and refunds | United States and other countries where Stripe operates |
| Brevo | Account emails, receipts and the waitlist | European Union |
We may also disclose data if the law requires it, to protect someone's safety, or as part of a merger or sale of the business, in which case this policy will continue to apply.
6. How reports are read
To explain your report, we convert the photo or PDF into text and use automated language technology to identify each organ, finding and measurement. This processing is carried out by us and by the providers listed above. They may not use your reports to train their own models. Explanations and translations are produced from our own stored templates; your report is not sent to a translation service.
7. International transfers
Where your reports are kept: when you create an account, you choose whether your data is stored in the UAE, the European Union or the United States. We suggest a region based on your country, and you confirm it. Your reports, results and backups stay in that region, and the services that read your reports run there too. We move your data to another region only if you ask us to. More regions will be added, and you'll be able to choose them when they open.
Some providers may process data outside the country where you live. When that happens, we use safeguards required by law, such as standard contractual clauses or transfers to countries with adequate protection.
8. How long we keep it
- Reports and results: for as long as you keep them in your account. Delete a scan, or your account, and we delete it from our live systems within 30 days and from backups within 90 days.
- Payment records: for the period tax and accounting law requires, currently 7 years.
- Waitlist emails: until launch plus 6 months, or until you unsubscribe.
- Support messages: up to 2 years after the conversation ends.
9. Security
We encrypt data in transit and at rest, limit staff access to what each role needs, log access to health data, and test our systems regularly. No system is perfectly secure; if a breach affects your data, we will tell you and the relevant authorities as the law requires.
10. Your rights
Depending on where you live, you can ask to see, correct, download or delete your data, object to or restrict some processing, and withdraw consent. Most of this can be done in the app under Account. For anything else, email privacy@scansays.com. We reply within the time the law sets, normally one month. You can also complain to your data protection authority.
11. Other people's reports
If you upload a report for someone else, you must have their permission or the legal authority to act for them, for example as a parent or guardian. They can contact us directly to exercise their rights.
12. Children
You must be 18 or older to create an account. A parent or legal guardian may upload a child's report on the child's behalf.
13. Changes to this policy
If we make important changes, we will tell you by email or in the app before they take effect. The date at the top shows when this policy last changed.
14. Contact
Email privacy@scansays.com or write to TrangoLabs Technologies FZ LLE, Twin Towers, Fujairah.