Privacy Policy

Who We Are

MyResultLab is operated by SOLRISE LTD, a company registered in England and Wales.

• Registered address: Suite 196, 61 Bridge Street, Kington, Herefordshire, HR5 3DJ, United Kingdom
• Contact email: support@myresultlab.com
• Data controller: SOLRISE LTD is the data controller for personal information collected through this service.

Introduction

We respect your privacy and are committed to protecting your personal and health-related information. This Privacy Policy explains how we collect, use, store, share, and safeguard your information when you use MyResultLab.

By using the service, you acknowledge and agree to the practices described in this policy.

Information We Collect

We collect the following types of information to provide and improve our service:

1. Account Information — Your name, email address, and other details you provide when creating an account.
2. Medical Scan Data — DICOM folders, X-ray, CT, MRI, ultrasound images, and associated metadata you upload for analysis. These are treated as sensitive health-related data.
3. Analysis Inputs & Results — Text reports or clinical notes you provide, and the AI-generated explanations, summaries, and structured findings we produce.
4. Usage Data — Information about how you interact with the service, including features accessed, pages viewed, and upload activity.
5. Device & Browser Information — Device type, operating system, browser type, and IP address, used to optimize compatibility, performance, and security.
6. Cookies & Similar Technologies — Small data files stored on your device to remember preferences, maintain sessions, and improve your experience.
7. Payment Information — Billing details handled by trusted third-party payment processors. We do not store full card numbers on our servers.

How We Use Your Information

We use the data we collect to:

• Provide AI-powered analysis of your medical scans and reports.
• Generate plain-language explanations and structured findings.
• Maintain, improve, and secure the service.
• Process transactions and send related confirmations.
• Send technical notices, security alerts, and support messages.
• Respond to your questions, feedback, and support requests.
• Detect, prevent, and address fraud, abuse, and unauthorized access.
• Comply with legal obligations.

Legal Basis for Processing

Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, we process your personal data on the following legal bases:

• Contract — Processing necessary to provide the service you requested.
• Consent — Where you explicitly agree, for example to optional communications or AI model improvement programs.
• Legitimate Interests — For security, fraud prevention, service improvement, and analytics, provided your rights and interests are not overridden.
• Legal Obligation — To comply with applicable laws, regulations, or lawful requests.

Medical Scan Data & AI Processing

• Your uploaded scans and reports are processed by AI models, including Google MedGemma and OpenAI GPT, to generate explanations.
• Scans and results are stored securely and associated with your account so you can review, re-analyze, and download them.
• You can delete your uploaded scans and analysis history from your account settings at any time.
• For free users, raw scan files (DICOM, X-ray, CT, MRI, ultrasound images) are automatically deleted 30 days after upload. Analysis reports remain available until you delete them or close your account.
• For paid users, raw scan files and analysis reports are retained until you delete them or close your account.
• We do not use your scan data to train third-party AI models unless you explicitly opt in.
• AI outputs are informational only and are not a substitute for professional medical advice. See our Terms of Service for our medical disclaimer.

Data Sharing & Sub-processors

We do not sell your personal information or medical scan data.

We may share data only with trusted service providers who help us operate the service, under strict confidentiality and data-processing agreements. These include:

| Provider | Role | Location | | ---------------- | ------------------------------------------- | --------------------------- | | Cloudflare, Inc. | Hosting, CDN, security, D1 database | United States / global edge | | Google LLC | AI inference (MedGemma / medical AI models) | United States / global | | OpenAI, L.L.C. | AI inference (GPT language models) | United States | | Stripe, Inc. | Payment processing (when enabled) | United States / regional |

We may also disclose information:

• To comply with legal obligations or respond to lawful requests from public authorities.
• To protect our rights, property, or safety, or that of our users.
• In connection with a business transfer, merger, or acquisition, subject to confidentiality obligations.

International Data Transfers

Some of our service providers are located outside the United Kingdom. When we transfer personal data internationally, we rely on appropriate safeguards such as Standard Contractual Clauses (SCCs) or adequacy decisions, as permitted under UK GDPR.

Data Retention

We retain different categories of data for different periods:

| Data Category | Retention Period | | --------------------------- | ---------------------------------------------------------------------------- | | Account information | As long as your account is active; deleted within 30 days of account closure | | Raw scan files (free users) | Automatically deleted 30 days after upload | | Raw scan files (paid users) | Until you delete them or close your account | | Analysis reports | Until you delete them or close your account | | Payment records | As required by UK tax and accounting law (typically 6 years) | | Usage logs & analytics | Up to 90 days, unless needed for security or legal purposes | | Support correspondence | Up to 2 years after the issue is resolved |

Data Security

We implement industry-standard security measures, including:

• Encryption in transit using TLS/SSL.
• Encrypted storage for data at rest where supported by our infrastructure providers.
• Access controls and per-user data isolation.
• Regular security reviews and monitoring.

No method of transmission over the Internet is 100% secure, but we work continuously to protect your information.

Your Rights

Depending on your location, you may have the right to:

• Access the personal information we hold about you.
• Correct inaccurate or incomplete information.
• Delete your personal information and uploaded scans.
• Restrict or object to certain types of processing.
• Export your data in a portable format.
• Withdraw consent where processing is based on consent.

To exercise your rights, contact us at support@myresultlab.com. We may ask you to verify your identity before fulfilling your request.

Cookies & Tracking Technologies

We use cookies and similar technologies to:

• Keep you signed in and maintain your preferences.
• Understand how visitors use the site and improve functionality.
• Protect the security of the service.

You can manage or disable cookies through your browser settings. Please note that some features may not work properly if cookies are disabled.

Children's Privacy

The service is intended for users aged 18 and over. We do not knowingly collect personal information from children under 18. If you believe we have collected data from a minor, please contact us and we will delete it.

Medical Disclaimer

MyResultLab provides AI-generated explanations for informational and educational purposes only. It is not a medical device and does not provide diagnoses or treatment recommendations. Always consult a qualified healthcare provider for medical advice.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by updating the date at the top of this page and, where appropriate, sending a notice through the service.

Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us at:

• Email: support@myresultlab.com
• Post: SOLRISE LTD, Suite 196, 61 Bridge Street, Kington, Herefordshire, HR5 3DJ, United Kingdom

Complaints

If you are based in the United Kingdom and have concerns about how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at https://ico.org.uk.