Privacy Policy

This Privacy Policy describes how EchoReview ("we", "us") collects, uses, and shares information when you use our website, marketing pages, pilot application form, and the EchoReview research-preview platform (collectively, the "Service").

PHI processed under an executed Business Associate Agreement (BAA) is governed by that agreement and by HIPAA, not solely by this policy.

• Account information: name, email, organization, role, hashed password, sign-in provider identifiers.
• Pilot application data: hospital name, contact details, program metadata, notes you submit.
• Study data: images and available cine frames you upload, reference fields, entered metadata, notes, experimental AI outputs, cardiologist annotations, addendums, and audit-trail metadata. Uploads are intended to be permitted and de-identified; the app does not guarantee removal of every identifier.
• Usage data: IP address, user-agent, timestamps, feature interactions, error diagnostics.
• Communications: messages you send us, email delivery events (bounces, complaints, unsubscribes).

• Provide, secure, and improve the Service.
• Authenticate users, enforce access controls, and maintain audit trails.
• Respond to pilot applications and support requests.
• Send transactional and account emails (confirmations, alerts, account notices).
• Comply with legal obligations and enforce our Terms.

We do not sell personal information. We do not use PHI to train models except as expressly permitted by an executed BAA and DUA.

Where GDPR applies, we process personal data on the bases of contract performance, legitimate interests (product security, service improvement, direct B2B outreach in response to inbound inquiries), consent (where required), and legal obligation.

The app uses Lovable Cloud for accounts, database, and storage, and Cloudflare Workers for application hosting. Routine uploads and connector deliveries do not invoke experimental AI; routine reporting excludes AI findings and AI-seeded drafts. Separate, explicitly requested research benchmarks can send permitted study images through Lovable AI Gateway. AI is in development and is not part of the workflow-only offer.

Before a hospital patient-data pilot, verify the approved data flow and a complete recipient inventory, including hosting, storage, authentication, and email. Provider identity, processing regions, retention, confidentiality terms, and PHI coverage require confirmation; this page is not proof of those arrangements.

Site-specific retention, export, deletion, backup retention, and any legally required records must be agreed and verified before a hospital evaluation. This page does not assert automatic deletion, a fixed log-retention period, or a completed restoration test. Contact us to discuss data requests and applicable obligations.

Workspace access, review records, and audit features are implemented in the app, but hospital suitability requires evidence and acceptance testing. Encryption settings, provider coverage, risk assessment, access revocation, incident procedures, and recovery arrangements require verification. See Security evidence and the readiness checklist. No HIPAA compliance or certification is asserted.

Depending on your jurisdiction, you may have the right to access, correct, delete, port, or restrict processing of your personal data, and to object to certain processing. To exercise these rights, email contact@echoaireview.com. We will respond within 30 days.

We use strictly necessary cookies for authentication and session management. We do not currently use advertising or cross-site tracking cookies.

The Service is not directed to children under 13, and we do not knowingly collect personal information from them.

Actual processing regions and any international-transfer requirements must be confirmed for each provider and approved data flow. Do not assume US-only processing.

Material changes to this policy will be posted here with an updated date. Continued use after changes constitutes acceptance.

Data protection questions: contact@echoaireview.com