Privacy policy

1. Who is responsible for your information

Nurrad Health Limited, based in Abuja, Nigeria, is the data controller for the account, professional and usage information described in this notice. We decide why and how that information is processed. Contact support@nurrad.com with a privacy question or request.

This notice covers radiologists enrolling in and using the current pilot, including related support communications. The pilot permits only synthetic study data. The Data processing agreement separately describes how study data is handled.

2. Information we collect and its sources

We receive information from you, from Microsoft when you sign in, and from your use of Nurrad:

• Sign-in information: your email address and the account identifier and name provided by Microsoft Entra External ID.
• Personal information: your given names, surname, date of birth and state of residence.
• Professional information: your MDCN registration number, year of first registration, practising-licence attestation, medical and radiology qualifications, fellowship year and uploaded MDCN certificate.
• Practice and contact information: your subspecialties, modalities, WhatsApp number, usual availability and stated concurrent-study capacity.
• Optional profile photo: the image you choose to upload. The browser re-encodes it to remove camera metadata, and the server checks the resulting file. A photo can still identify you through its visible content.
• Agreement records: each document's version, your acceptance or acknowledgement status, timestamps, and recorded IP address and browser information.
• Account activity: preferences, presence and availability for second opinions, report attribution, and audit events recording actions such as enrolment, study creation, signing and deletion.
• Support communications: information you send when asking us for help. Do not include real patient data.

Your professional name is associated with the work you sign and consultations you contribute to. Audit events are designed to record actions and identifiers without report text, clinical history or AI output.

3. Why we use it and our lawful bases

We use sign-in information, your name, account preferences and agreement records to provide your account, administer enrolment, operate reporting and collaboration features, and respond to account requests. Our lawful basis is performance of our agreement with you, including steps needed to enter that agreement.

We use professional information and your certificate to administer the pilot's eligibility requirements and review the information you provide. We rely on performance of our agreement and our legitimate interest in restricting professional features to appropriate participants. Enrolment and file validation are not independent confirmation of your registration or licence.

We rely on legitimate interests to protect accounts, investigate misuse, maintain an accountable record of pilot activity and handle disputes. We must assess these interests against your rights before relying on them. Where a specific law requires processing, we rely on that legal obligation.

Practice and contact fields are stored as part of the profile you submit. They do not currently automate work allocation or freelance matching, and the pilot does not send WhatsApp messages. Your live presence for second opinions is separate from your stored usual availability.

We do not sell your personal information or use it for advertising. Acknowledging this notice is not consent to every form of processing. Where processing relies on consent, you have the right to withdraw that consent.

4. Who receives information

Your name and optional profile photo are visible to eligible pilot colleagues in collaboration features. A colleague involved in a consultation can access the study content shared through that feature. Your other profile answers and certificate are not presented as a public directory.

Access by Nurrad staff is limited to relevant account administration, support, security and other authorised duties. We may disclose information where required by law or reasonably necessary to establish, exercise or defend legal rights.

Our service providers support these functions:

• Microsoft Azure: application services, database and file storage. The pilot's Azure infrastructure is configured in South Africa North.
• Microsoft Entra External ID: sign-in and identity processing. Azure resource location does not, by itself, establish the location of all identity processing.
• Vercel: hosting of the website and web application and processing needed to deliver them.
• Modal: AI processing of study images and study text passed through the platform's filtering steps. Automatic filtering is not a guarantee that all identifying information has been removed.
• Resend: email delivery. Second-opinion notification messages contain the recipient address, request priority and a link to Nurrad; they omit report text, the consultation question and patient details.

5. Processing outside Nigeria

The pilot uses providers that process information outside Nigeria, including in South Africa and the United States. A configured Azure region is not a guarantee that every provider's support, identity or operational processing occurs there.

Cross-border processing must have a lawful transfer basis and the protections required by the Nigeria Data Protection Act 2023. Contact support@nurrad.com for information about the arrangements applicable to your data. This notice does not certify a provider or establish that a country has been approved by the Nigeria Data Protection Commission.

6. Retention and deletion

We retain account and profile information while it is needed to administer your account and participation. You can replace a certificate or photo in Settings and remove an optional photo. A certificate remains required for an active enrolled profile. Storage recovery copies may remain after a file is replaced or removed.

If you ask to close your account or delete information, we assess the records concerned and the applicable retention grounds. Account closure and the end of participation do not automatically erase all records.

Signed evaluation records, agreement evidence and audit records are retained where necessary to preserve attribution, establish what was accepted, investigate incidents, resolve disputes or meet a specific legal requirement. The need to retain them depends on their purpose, the relevant obligation, and any unresolved dispute or preservation requirement. Records must be deleted or anonymised once there is no lawful ground to retain them.

An unsigned study moved to Trash can normally be restored for seven days, unless you purge it sooner. The retention process then removes its clinical content and requests deletion of the associated files. Failed cleanup is retried. Signed studies cannot be deleted through this process.

Limited study identifiers, status history and audit records remain after purge. Storage recovery copies and service-provider records can have separate retention periods. The Trash period is not a promise that every copy or associated record disappears within seven days.

7. Security and its limits

The pilot uses encrypted connections, private file storage, restricted access and short-lived file links. Authorisation checks restrict access to permitted accounts and study operations. Clinical actions are audited. Sign-in uses Microsoft Entra External ID and an email one-time passcode.

Images undergo technical metadata filtering in the browser and validation on the server. Study text passed to AI is filtered for common identifiers. These controls cannot establish that every person has been anonymised, and metadata filtering does not remove identifying text burned into image pixels. Use only synthetic study data.

No online service can guarantee complete security. Tell support@nurrad.com promptly if you suspect an account compromise, unauthorised disclosure or accidental submission of prohibited information.

8. AI, access checks and browser storage

AI assists with study interpretation, comparisons and drafting. It does not sign reports or replace the radiologist's judgment.

The application automatically applies invitation, enrolment and profile-completion checks to allow or restrict access. These checks do not independently verify professional credentials. Contact support@nurrad.com if you believe an access restriction is incorrect.

Nurrad uses cookies and browser-held information needed to maintain sign-in, protect the session and remember relevant settings. Blocking necessary sign-in cookies can prevent access to the account.

9. Your rights and how to use them

Under the Nigeria Data Protection Act 2023, applicable rights include access, correction, deletion, restriction, objection, portability and withdrawal of consent. You can also challenge qualifying automated decisions and complain to the Nigeria Data Protection Commission. The availability of a particular right can depend on the lawful basis and relevant legal conditions.

Write to support@nurrad.com. Explain what you want us to do without sending unnecessary identity documents or patient information. We may need proportionate information to verify your identity and locate the records. We will respond within the applicable legal time limit and explain any lawful restriction or refusal.

You can complain directly to the Nigeria Data Protection Commission. You do not have to obtain our permission to do so.

10. The version of this notice

The published version and effective date identify the notice applicable to the pilot. Material changes to how personal information is used must be brought to your attention. A request to acknowledge an updated notice does not replace a lawful basis or any separate consent required for processing.