CCPA Notice for California Residents

This California Consumer Privacy Act (CCPA) Notice provides information to California residents about how RadPro AI collects, uses, and discloses personal information, and explains the rights available to California consumers under the CCPA. This notice supplements our Privacy Policy and applies solely to residents of California.

As a California resident, you have specific rights regarding your personal information under the California Consumer Privacy Act. These rights are designed to give you control over your personal data and transparency about how we use it.

Right to Know: You have the right to request that we disclose what personal information we collect, use, disclose, and sell about you. You may request this information up to twice in a 12-month period.

Right to Delete: You have the right to request deletion of personal information we have collected from you, subject to certain exceptions under the CCPA and other applicable laws (such as HIPAA retention requirements for healthcare records).

Right to Opt-Out of Sale: You have the right to opt out of the sale of your personal information. However, RadPro AI does NOT sell personal information to third parties, so this right does not currently apply to our practices.

Right to Non-Discrimination: You have the right not to receive discriminatory treatment for exercising any of your CCPA rights. We will not deny you services, charge different prices, provide different quality of service, or suggest you will receive different services solely because you exercised your CCPA rights.

In the preceding 12 months, we have collected the following categories of personal information from California consumers:

Identifiers: Real name, email address, IP address, unique personal identifier, online identifier, account name, and similar identifiers. We collect this information when you create an account, use our services, or contact us for support.

Professional or Employment-Related Information: Medical credentials, specialty information, institutional affiliation, DEA number (if provided), medical license numbers, and other professional qualifications necessary to verify you are a licensed healthcare professional authorized to use our radiology reporting services.

Commercial Information: Records of subscription plans, payment history, credits purchased, services used, reports generated, and other transaction history related to your use of RadPro AI.

Internet or Other Electronic Network Activity: Information about your interaction with our Service including usage logs, features accessed, reports created, time spent on platform, search queries, browsing history within our application, and error logs. This information helps us improve our services and troubleshoot issues.

Geolocation Data: Approximate location information derived from your IP address to provide region-appropriate services, comply with data localization requirements, and detect fraudulent activity. We do not collect precise geolocation data.

Inferences: We may create profiles reflecting your preferences, characteristics, trends, and behavior based on your usage patterns to improve your experience and provide personalized recommendations for report templates and workflows.

We collect personal information from the following sources:

Directly from You: When you create an account, update your profile, use our services, upload reports, contact customer support, or communicate with us via email or other channels.

Automatically from Your Device: When you access or use our Service, we automatically collect certain information about your device, browser, and interaction with our platform through cookies, log files, and similar technologies.

Third-Party Services: We may receive information from third-party services such as payment processors (Stripe), authentication providers (Google OAuth), and AI service providers (OpenRouter, AWS) that we use to deliver our services.

Healthcare Institutions: If you access RadPro AI through an institutional account, we may receive information from your healthcare organization as necessary to provide and support the Service.

We use the personal information we collect for the following business and commercial purposes:

Service Provision: To provide, maintain, improve, and personalize our radiology reporting assistant services, including AI-powered report generation, template management, and clinical decision support tools.

Account Management: To create and manage your account, authenticate your identity, verify your professional credentials, process payments, and provide customer support.

Communication: To send you service-related notices, updates, security alerts, administrative messages, billing information, and respond to your inquiries. We may also send you marketing communications if you opt in, which you can unsubscribe from at any time.

Analytics and Improvement: To understand how users interact with our Service, analyze usage patterns, identify trends, troubleshoot technical issues, improve our AI models, enhance user experience, and develop new features.

Security and Fraud Prevention: To protect against unauthorized access, detect and prevent fraud, ensure data security, maintain HIPAA compliance, and protect the rights and safety of our users and RadPro AI.

Legal Compliance: To comply with applicable laws, regulations, legal processes, and governmental requests, including HIPAA, CCPA, and other healthcare privacy requirements.

Business Operations: To conduct internal research, auditing, data analysis, and testing to improve our services and business operations.

In the preceding 12 months, we have disclosed the following categories of personal information for business purposes to the following categories of third parties:

Service Providers: We share identifiers, commercial information, and internet activity with third-party service providers who perform services on our behalf, such as payment processing (Stripe), AI model hosting (OpenRouter), cloud hosting (Fly.io), audit-log archiving (AWS S3), email delivery, and analytics. These service providers are contractually obligated to protect your information and use it only for the specific services they provide to us.

AI Service Providers: We share de-identified or anonymized report data with AI service providers (OpenRouter, OpenAI) to process radiology reports and generate clinical content. We automatically scrub all 18 HIPAA Safe Harbor PHI identifiers before sending any data to AI services.

Healthcare Partners: If you access RadPro AI through a healthcare institution, we may share certain information with that institution as necessary to provide the Service and comply with institutional policies.

Legal and Regulatory Authorities: We may disclose personal information to government agencies, law enforcement, or other third parties as required by law, in response to subpoenas or court orders, to protect our rights, or in connection with legal proceedings.

Business Transfers: In the event of a merger, acquisition, reorganization, bankruptcy, or sale of assets, your personal information may be transferred as part of that transaction, subject to the same privacy protections outlined in this notice.

RadPro AI does NOT sell your personal information. We have not sold personal information in the preceding 12 months, and we do not have actual knowledge of selling personal information of consumers under 16 years of age.

We are committed to protecting your privacy and maintaining your trust. Your personal information, including medical credentials, usage data, and report history, is never sold, rented, or traded to third parties for monetary or other valuable consideration.

While we do not sell personal information, we do share certain information with service providers as described in Section 5 above. These disclosures are made solely for business purposes and are governed by strict contractual agreements that prohibit the service providers from using your information for any purpose other than providing the specified services to RadPro AI.

Because we do not sell personal information, there is no need to submit an opt-out request for the sale of personal information. However, if you have questions about our data sharing practices or want to limit certain uses of your information, please contact us at admin@radpro.ai.

California residents may exercise their CCPA rights by submitting a verifiable consumer request to us through the following methods:

Email: Send a request to admin@radpro.ai with the subject line "CCPA Request" and specify whether you are requesting to know, delete, or exercise other CCPA rights. Include your full name, email address associated with your RadPro AI account, and a description of your request.

Online Form: You may submit a request through your RadPro AI account settings under "Privacy & Data Rights" or through our contact form at https://radpro.ai/contact.

Written Request: You may mail a written request to: RadPro AI CCPA Compliance RadPro AI Canada

When submitting a request, please provide sufficient information to allow us to verify your identity and locate your records in our system. This typically includes your name, email address, and account information.

You may designate an authorized agent to submit requests on your behalf. If you use an authorized agent, we may require proof of the agent's authority and verification of your identity before processing the request.

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine a fee is warranted, we will notify you of the reasons and cost before completing your request.

To protect your privacy and security, we must verify your identity before processing your CCPA request. The verification process varies depending on the type of request and the sensitivity of the personal information involved.

For Requests to Know (Categories and Sources): We will match at least two data points you provide with information we maintain about you. This typically includes verifying your email address and account information.

For Requests to Know (Specific Pieces of Information) and Requests to Delete: We require a higher level of verification due to the sensitivity of these requests. We will match at least three data points and may require additional verification such as confirming your professional credentials, answering security questions, or providing government-issued identification.

Account Holders: If you have a password-protected account with RadPro AI, we may verify your identity through your existing account authentication credentials. You may need to log in to your account to submit or confirm your request.

Non-Account Holders: If you do not have an account or have closed your account, we may require additional information to verify your identity, such as providing documentation that demonstrates you are the person about whom we collected personal information.

Authorized Agents: If you use an authorized agent to submit a request on your behalf, we will require proof that the agent is authorized to act on your behalf (such as a signed power of attorney) and verification of your identity. We may contact you directly to confirm the agent's authority.

We will only use the information provided in a verifiable consumer request to verify your identity and will not retain it longer than necessary for verification purposes. If we cannot verify your identity, we will notify you and explain why we cannot process your request.

We are committed to responding to your CCPA requests in a timely manner and in accordance with California law.

Response Deadline: We will respond to verifiable consumer requests within 45 days of receipt. If we require more time (up to an additional 45 days), we will inform you of the reason for the extension and the expected response date within the initial 45-day period.

Confirmation of Receipt: We will confirm receipt of your request within 10 business days and provide information about how we will process your request, including our verification process.

Format of Response: We will deliver our written response electronically unless you request a different method. If you have a RadPro AI account, we may provide the response through your secure account portal. The response will cover the 12-month period preceding our receipt of your request.

Information Provided: For requests to know, we will disclose the categories of personal information collected, sources of collection, business or commercial purposes for collection, categories of third parties with whom we share information, and the specific pieces of personal information we have collected about you (if requested).

Deletion Confirmation: For requests to delete, we will confirm which personal information was deleted and inform you of any information we are required to retain under HIPAA, tax laws, or other legal obligations.

Inability to Comply: If we cannot comply with your request, we will explain the reasons in our response. Common reasons include inability to verify your identity, legal requirements to retain certain information, or conflicts with HIPAA or other healthcare privacy laws.

No Fee: We do not charge a fee to process or respond to verifiable consumer requests unless they are excessive, repetitive, or manifestly unfounded. If we determine a fee is warranted, we will notify you before processing the request.

You have the right to designate an authorized agent to submit CCPA requests on your behalf. We will process requests from authorized agents in accordance with CCPA requirements.

Requirements for Authorized Agents: If you use an authorized agent to submit a request, the agent must provide proof that they are authorized to act on your behalf. Acceptable proof includes:

• A valid power of attorney signed by you that grants the agent authority to act on your behalf regarding personal information matters • A signed written authorization from you that specifically authorizes the agent to submit CCPA requests on your behalf • Proof of registration with the California Secretary of State to conduct business in California (if the agent is a business entity)

Verification: In addition to verifying the agent's authority, we may require you to directly verify your identity and confirm that you provided the agent permission to submit the request. This helps protect your privacy and ensures that unauthorized parties cannot access your personal information.

Communication: We may communicate directly with you to confirm the request and verify the agent's authority, even if the request was submitted by an authorized agent. This may include sending a confirmation email or requiring you to log in to your RadPro AI account.

Exception: If you have provided the authorized agent with a valid power of attorney pursuant to California Probate Code sections 4000 to 4465, we may not require you to separately verify your identity or confirm the request, provided the agent submits a copy of the power of attorney with the request.

Denial of Agent Requests: We reserve the right to deny requests from agents who cannot provide sufficient proof of authorization or when we cannot verify your identity. If we deny a request, we will notify the agent and explain the reasons for denial.

How to Submit as an Authorized Agent: Authorized agents should submit requests via email to admin@radpro.ai with the subject line "CCPA Request - Authorized Agent" and include: • The consumer's name, email address, and account information (if applicable) • A description of the request (right to know, delete, etc.) • Proof of authorization (power of attorney or signed authorization) • Contact information for the authorized agent

RadPro AI is designed to be HIPAA-compliant and handles Protected Health Information (PHI) as defined under the Health Insurance Portability and Accountability Act (HIPAA). The interaction between CCPA and HIPAA is important to understand when exercising your privacy rights.

HIPAA Takes Precedence: For information that constitutes Protected Health Information under HIPAA, HIPAA regulations take precedence over CCPA. This means certain PHI may be subject to different retention, disclosure, and deletion requirements than other personal information.

Right to Access Under HIPAA: Healthcare providers and covered entities have separate obligations under HIPAA to provide patients with access to their medical records. Your rights under CCPA complement, but do not replace, your rights under HIPAA.

Retention Requirements: HIPAA requires us to retain certain audit logs and compliance documentation for a minimum of 6 years. When you submit a deletion request, we will delete your personal information where legally permitted, but may be required to retain certain records to comply with HIPAA, medical record laws, and other healthcare regulations.

Business Associate Agreements: We enter into Business Associate Agreements (BAAs) with covered entities as required by HIPAA. These agreements govern how we handle PHI and may impose additional restrictions on how we use and disclose information beyond what is described in this CCPA notice.

De-identification: Before sending any report data to AI services, we automatically detect and scrub all 18 HIPAA Safe Harbor identifiers to de-identify the information. De-identified information is not subject to HIPAA restrictions and is handled in accordance with CCPA requirements.

Questions About HIPAA Rights: If you have questions about your HIPAA rights or how HIPAA interacts with CCPA protections, please contact us at admin@radpro.ai or consult with your healthcare provider.

We may update this CCPA Notice from time to time to reflect changes in our practices, legal requirements, or for other operational, legal, or regulatory reasons.

Notification of Changes: When we make material changes to this notice, we will notify California residents by: • Posting the updated notice on our website at https://radpro.ai/ccpa • Updating the "Last Updated" date at the top of this notice • Sending an email notification to the email address associated with your account (for material changes) • Displaying a prominent notice on our platform when you log in

Effective Date: Any changes to this notice will become effective on the date specified in the updated notice. Your continued use of RadPro AI after the effective date constitutes acceptance of the updated notice.

Review: We encourage you to review this CCPA Notice periodically to stay informed about how we collect, use, and protect your personal information and the rights available to you under California law.

Historical Versions: We maintain historical versions of this notice for your reference. If you would like to review a previous version, please contact us at admin@radpro.ai.