Privacy Policy

1. Who is responsible

GetData ("GetData", "we") runs getdataspot.com and is the controller of the personal data described in this policy. We process it under the data protection law that applies to us and, where it applies to people in the European Union, under the GDPR. Contact for every privacy question: office@getdataspot.com. We have not appointed a data protection officer.

2. What this policy covers

This policy covers visitors to getdataspot.com, data requesters ("clients": research companies and other organisations that ask for medical data), data providers ("hospitals": healthcare institutions that provide data), and anyone who writes to us through the contact form. Doctors who register as annotators are covered by the separate annotator privacy notice. Use of the platform is also governed by our Terms of Service.

3. What we collect

Depending on how you use GetData, we process:

• Client accounts: your login email and password (stored only as a one-way hash), company name, company type, industries, company country, and contact person name and email.
• Hospital accounts: your login (business) email and password (hashed), institution name, country and type, website, and contact person name and function.
• For every account: when you accepted these terms and which version, whether and when you confirmed your email address, when the account was approved, and when you last logged in.
• What you give us through the platform: data requests (description, data categories, quantities, budget, deadline), commitments to provide data, and the dataset descriptions and declared volumes hospitals add to their private catalog.
• Contact form messages: your name, email, company (optional) and message.
• Security information: IP addresses and the email or username entered, when a login fails, when a rate limit blocks a request, or when the spam check fails; and, for every download of a protected file (medical scans, annotations, annotator credentials), who downloaded it, from which IP address and when.
• Usage statistics: pages visited, referring site, and browser, device and country information collected by our analytics tool (see section 6).

4. Medical data shared through GetData

GetData is built to exchange de-identified medical data. Hospitals must remove all information that identifies a patient before they share any data (see the Terms of Service). Medical scan files are not exchanged through the website: the GetData team receives, checks and delivers them, and they are stored in protected storage that only authorised GetData staff can open, with every download logged. If a file nevertheless turns out to contain personal data, we restrict access to it, inform the hospital, and delete or return it.

5. Why we use it and on what legal basis

• To create, secure and run your account, review registrations before approving them, and provide the service you asked for (legal basis: performing our contract with you, or steps you asked for before one).
• To send you service emails: confirming your address, resetting your password, telling you your account is approved, and replying to you about your requests (legal basis: our contract with you).
• To answer contact form messages and follow up on them (legal basis: our legitimate interest in answering enquiries, and steps before a contract).
• To protect the platform, our users and the data on it against abuse, fraud and unauthorised access, and to keep an audit trail of access to protected files (legal basis: our legitimate interest in security and accountability).
• To understand how the website is used and improve it (legal basis: our legitimate interest; the analytics tool collects no information that identifies you directly).
• To meet legal obligations and to establish, exercise or defend legal claims.

6. Analytics, spam protection and browser storage

Analytics: on the production website we use Umami, an analytics tool run on our own infrastructure (analytics.apparo.rs), not a third-party advertising service. It records which pages are visited (including the address of the page), the referring site, and the browser, device, screen, language and country. We do not load it on pages whose address carries a one-time code (email confirmation, password reset, content previews).

Spam protection: our registration, password reset and contact forms use Google reCAPTCHA to tell people from bots. On those pages reCAPTCHA collects information about your device and how you interact with the page (such as your IP address and browser details) and sends it to Google, which may set cookies. The Google Privacy Policy and Terms of Service apply.

Browser storage: when you log in, your browser stores your session tokens and a copy of your account details in its local storage, so you stay logged in. They are removed when you log out. A session ends at the latest 30 days after login, and when you change or reset your password. We do not use advertising or tracking cookies.

7. Who receives it

Your personal data is accessible to the GetData team. We do not sell it. We use service providers that process it on our behalf:

• DigitalOcean: hosting of the website, database and files.
• Resend: delivery of our emails (account emails and contact notifications).
• Google: the reCAPTCHA spam check described above.

8. Other disclosures

Beyond our service providers, we disclose personal data only:

• to courts, authorities and other public bodies, when the law requires it or to establish, exercise or defend legal claims, and only to the extent required;
• to a company that takes over all or part of GetData's business, for example in a reorganisation, a move of our registered seat, a merger or an acquisition. That company continues to use the data only as this policy describes, and we will tell you before it happens if the change materially affects how your data is handled.

9. What other users see

Clients and hospitals do not see each other's identity through the platform. Hospitals see a request without the name of the client who made it; clients see who provides data only as an anonymous label (for example "Provider 1"); and clients who browse the dataset catalog see a dataset's description, categories, declared volumes and the hospital's country, not the hospital's name. When a project needs the parties to know each other, we arrange it with them first.

10. International transfers

Some of our providers (such as Google and Resend) may process data outside the country where you are and outside the European Economic Area, including in the United States. Where they do, we rely on the transfer safeguards these providers offer, such as standard contractual clauses, or on another basis the law allows.

11. How long we keep it

• Account data: as long as your account exists. When an account is closed, we delete its personal data within 3 months, unless we must keep some of it to meet a legal obligation or to settle a dispute.
• Email confirmation links expire after 7 days and password reset links after 1 hour; each confirmation link works once.
• Contact form messages: as long as needed to handle your enquiry and any business relationship that follows from it, and at most 3 years after our last contact with you, unless the law requires us to keep them longer.
• File access log (who downloaded which protected file, from which IP address, when): 2 years, then deleted automatically.
• Security and server logs: only as long as needed to investigate abuse and keep the service secure.

12. How we protect it

The website is served over an encrypted connection (HTTPS). Passwords are stored only as one-way hashes. Medical files and annotator credentials are kept in storage that is not publicly reachable and are served only to authorised people, with each download logged. Login, registration and password reset are rate limited, and sessions end after at most 30 days or when the password changes. Only authorised members of the GetData team can access personal data, and only as far as their work requires; everyone with access is bound by a duty of confidentiality.

13. Your rights

Under applicable data protection law, including the GDPR where it applies, you have the right to access your personal data and get a copy, to have it corrected, to have it deleted, to restrict its processing, to receive it in a portable format, to object to processing based on our legitimate interest, and to withdraw any consent you gave at any time (this does not affect processing before the withdrawal). We do not make decisions about you based solely on automated processing.

You can see and correct most of your account details on your account page. For anything else, including closing your account or changing the login email, write to office@getdataspot.com from the email address of your account. We answer within one month; we may ask you to confirm your identity first.

You also have the right to complain to a data protection supervisory authority, in particular the one in the country where you live or work.

14. Children

GetData is a service for organisations and professionals. It is not meant for anyone under 18, and we do not knowingly collect their personal data.

15. Changes to this policy

We may update this policy. The version date above shows when it last changed. If a change materially affects how we use your data, we tell registered users by email before it takes effect.