1. Data We Collect

We collect: (a) Account data — email address, subscription plan, usage counts. (b) Analysis history — clinical text, lab values, and AI-generated summaries that you submit for analysis. (c) Technical data — IP address, browser type, and access logs for security purposes. We do not collect data you do not explicitly submit.

• Your data is used only to produce and show your analysis and your history.
• STRUCTA does not train AI models, on your data or anyone else's. Our AI provider, Anthropic, does not train on data sent through its API under its commercial terms.
• We do not sell data, do not share it for advertising and show no ads. It is processed only by the providers listed below.
• No research, marketing or any other use without your explicit consent. There is no such use today, and no opt-in to switch on.

One anonymous measurement

To measure how well reports are read, the app sends anonymous counts: how many markers a reading produced and how many rows could not be read; and, when a clinician corrects a result, the marker key and whether its value, range or severity was changed. Each record also carries the input type (PDF or manual entry) and the interface language. It never contains a value, a patient detail or an account identifier, and it is not linked to you.

2. Legal Basis for Processing

We process your data based on: (a) Contract performance — to provide the analysis service you requested. (b) Legitimate interest — to maintain security and improve the service. (c) Consent — for optional features. Laboratory and clinical data constitutes special category data under Art. 9 GDPR. By submitting such data, you explicitly consent to its processing for the purpose of generating your analysis results.

3. Data Storage & Retention

Account data is stored for the duration of your account. Analysis history (submitted lab data and results) is stored in your personal case history to allow you to review past analyses. No PDF files are stored on our servers — they are processed in memory and discarded immediately. You may delete individual analyses at any time from your history. Upon account deletion, all associated data is permanently removed.

4. Data Security

(a) All data is transmitted only over HTTPS/TLS. (b) The database and its backups are encrypted at rest (AES-256). (c) Database access is protected by Row Level Security (RLS) — each user can only access their own data. (d) Medical data is processed only by the providers that run the service: hosting (Vercel), database (Supabase) and the AI model (Anthropic) — and by the email provider (Resend) only when you send results by email yourself. Under Anthropic's commercial terms, API data is not used to train models and is deleted within 30 days. Payments go to Stripe and contain no medical data. (e) Report text is not written to server logs. Details: structamed.com/security.

5. Your Rights under GDPR, PIPEDA & LGPD

You have the right to: Access your data (Art. 15 GDPR) — request a copy of all data we hold about you. Rectification (Art. 16) — correct inaccurate data. Erasure (Art. 17) — request deletion of your account and all associated data. Portability (Art. 20) — receive your data in a structured format. Objection (Art. 21) — object to processing. To exercise any right, contact: support@structamed.com. We will respond within 30 days. Users in Canada have substantially similar rights under PIPEDA — including access, correction, and withdrawal of consent — and may file a complaint with the Office of the Privacy Commissioner of Canada (priv.gc.ca). Users in Brazil have the rights of Art. 18 of the General Data Protection Law (LGPD, Law No. 13,709/2018): confirmation that we process your data, access, correction, anonymisation, blocking or deletion of unnecessary or excessive data, portability, deletion of data processed on the basis of consent, information about whom we share data with, and withdrawal of consent. Health data are sensitive personal data (LGPD Art. 11) and are processed only to produce the analysis you request. Your data are processed on servers outside Brazil (Art. 33), with the safeguards described in section 4. Contact for data-protection matters (encarregado): support@structamed.com. You may also lodge a complaint with the National Data Protection Authority (ANPD, gov.br/anpd).

6. Account & Data Deletion

You may delete your account at any time from your profile settings. Upon deletion, all analysis history, account data, and associated records are permanently and irreversibly deleted from our systems within 30 days. To request manual deletion, contact support@structamed.com.

7. Cookies

STRUCTA MED uses only essential cookies required for authentication and session management. We do not use tracking, advertising, or analytics cookies. No cookie consent banner is required as we only use strictly necessary cookies.

8. Contact & Data Controller

Data Controller: STRUCTA MED. Email: support@structamed.com. Website: structamed.com. For any privacy-related requests, contact us at support@structamed.com.