Data Security

Our Security Commitment

At MyResultLab, we take data security and privacy seriously. Your medical documents, images, and personal information are protected through multiple layers of security, encryption, and strict data-handling policies.

This page explains how we safeguard your sensitive health information.

1. We Never Sell Your Data

We never sell your data. Your medical documents, images, personal information, and analysis results are never sold, rented, or traded to advertisers, data brokers, or any other third party, and we never use them for advertising.

Your personal data is used solely to provide the AI-powered analysis you request and to operate and improve the Service.

2. Trusted Infrastructure Providers

To run the Service, we rely on a small number of trusted providers that process data only on our behalf and under strict data-processing agreements:

| Provider | Role | Location | |---|---|---| | Cloudflare, Inc. | Hosting, CDN, D1 database, security | Global edge network | | Google LLC | AI inference (MedGemma medical AI) | United States / global | | OpenAI, L.L.C. | AI inference (GPT language models) | United States | | Stripe, Inc. | Payment processing (when enabled) | Regional |

We only share the minimum data necessary for each provider to perform its function. All providers are contractually prohibited from using your data for their own purposes.

3. Data Storage and Deletion

We apply different storage policies depending on the type of data you upload:

• Account information — Stored as long as your account is active; deleted within 30 days of account closure.
• Medical scan files (DICOM, X-ray, CT, MRI, ultrasound) — Stored so you can view, re-analyze, and download them. You can delete them at any time from your account settings.
• Analysis reports — Stored so you can access your results. Reports are deleted when you delete the related upload or close your account.
• Usage data and logs — Retained for up to 90 days for security and operational purposes, unless longer retention is required by law.

Free User Retention

To keep the free tier sustainable and protect your privacy, raw scan files uploaded by free users are automatically deleted 30 days after upload. Analysis reports remain available in your account until you delete them or close your account. You can also manually delete any upload at any time before the 30-day period.

Paid User Retention

For paid users, raw scan files and analysis reports are retained until you manually delete them or close your account.

User-controlled deletion: You may delete any upload or your entire account at any time. Deletion permanently removes related files from our active servers.

4. Encryption

• In transit: All communication between your browser and our servers is encrypted using TLS/SSL (HTTPS).
• At rest: Stored data is encrypted at rest where supported by our infrastructure providers, including Cloudflare D1 and object storage.
• API calls: All requests to AI inference services are transmitted over encrypted channels.

5. Access Control and Isolation

• Each user account is isolated from others.
• You can only access scans and reports associated with your own account.
• Administrative access to production systems is restricted and protected by strong authentication.
• Server access is restricted via SSH key authentication and firewall rules.

6. Data Breach Protection

We implement multiple layers of protection to safeguard your data:

• Regular dependency and security updates.
• Automated threat detection and DDoS protection via Cloudflare.
• Encrypted backups with restricted access.

In the unlikely event of a security incident, we will notify affected users and relevant regulators as required by applicable law.

7. Google Sign-In and OAuth

If you choose to sign in with Google or another OAuth provider, we receive only the minimum identity information needed to create and access your account:

• Your name
• Your email address
• A unique provider account identifier

We do not receive your password, read your email, or access any other data from your provider account.

8. Minimal Data Collection

We only collect and store the information necessary to provide you with analysis results, maintain conversation history, and respond to support inquiries. We do not build advertising profiles or track you across third-party websites.

9. Research and Statistics

We may use anonymized, aggregated data to improve the Service. This never includes your personal or medical data, and we do not use scan data to train third-party AI models unless you explicitly opt in.

10. How to Verify Our Security

• Look for the padlock icon in your browser's address bar when visiting MyResultLab.
• Check that the URL begins with https://myresultlab.com.
• Review our Privacy Policy and Terms of Service for detailed legal terms.

Questions About Security?

If you have questions about our data security practices, please contact us at support@myresultlab.com.