Privacy policy for Atlas
Last updated: 25 October 2026
This is a translation. The German version is authoritative.
Atlas is a radiology teaching platform at https://atlasrad.app. It is used for teaching with de-identified images. This policy explains which personal data is processed, why, and for how long.
1. Controller
[LEGAL_NAME]
[LEGAL_ADDRESS]
E-mail: [LEGAL_EMAIL]
Atlas is run privately, not on behalf of a hospital or university. No data-protection officer has been appointed because none is required (Art. 37 GDPR, § 38 German Federal Data Protection Act, BDSG). Send data-protection requests to the e-mail address above.
2. What data we process
2.1 Registered users
- Account: e-mail address, display name, role (e.g. admin), language, colour theme, optionally a country (shown as a flag on leaderboards), and your consult handle (
/consult/<handle>). - Sign-in: you sign in with a one-time code that we send by e-mail. The code is valid for 10 minutes. There is no password.
- Session: a session token, expiry time, and the IP address and browser identifier (user agent) of the device you signed in with.
- Content: cases, case lists, slides, notes, annotations, uploaded image series, chat messages, answers to questions (including answer time), consult requests and share links. For each item we store who created it.
- Memberships and invitations: which spaces you belong to, with which role; for invitations, the invited person's e-mail address.
- Notifications: content and read status, and your e-mail notification settings.
2.2 Guests (joining with a code or link, without an account)
- A display name you choose (a nickname is fine), optionally a country.
- A session with IP address and user agent, as above.
- Your answers (including answer time) and chat messages.
- If you later sign in with an account, your guest answers and messages move to that account and the guest profile is deleted.
2.3 Images
Uploaded DICOM images are de-identified in your browser before they reach the server: names, identifiers, dates of birth, institutions, free text and real examination dates are removed, and UIDs are replaced. The server checks again and rejects images that are not de-identified. Ultrasound, screenshots and other images that may carry burned-in text are not accepted. For head scans the face is removed, or the series stays locked until someone confirms that no face is recognisable.
Technical details (modality, body region, acquisition parameters) are kept, as are body weight and height if present in the image. We process these images as anonymous teaching data. Personal patient data must not be uploaded (see the terms of use).
2.4 Technical data
- Server logs: per request the time, method, page (without parameters), status code and duration. No IP address, no user identifier. Error logs may contain technical details.
- Abuse protection (rate limiting): counters tied to IP address, user identifier or e-mail address, for at most 24 hours.
- Audit log: security-relevant actions such as role changes, deletions, an admin acting as another account ("impersonation") and "no face" confirmations, each with the person acting and the time.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Account, sign-in, providing the platform and its features (cases, presentations, homework, chat, consults, notifications) | Art. 6(1)(b) GDPR (the user relationship under the terms of use) |
| Taking part as a guest in presentations and homework, being shown on leaderboards | Art. 6(1)(b) GDPR |
| Security, abuse protection, troubleshooting, audit log, backups | Art. 6(1)(f) GDPR (legitimate interest in secure and stable operation) |
| Restricting sign-up to certain e-mail domains | Art. 6(1)(f) GDPR (closed user group) |
The cookies and local storage in section 6 are strictly necessary for operation (§ 25(2) no. 2 German Telecommunications Digital Services Data Protection Act, TDDDG), so no consent is needed for them.
4. Who sees your data
- Other users, as far as a feature needs it: members of a space see your name on your content and messages. In presentations and homework, all participants see the leaderboard with names and country flags. The creator of a presentation sees answers and statistics per person and can export them as CSV. Recipients of a consult see the question and the sender.
- Platform administrators: can manage accounts and, for troubleshooting, temporarily act as an account; this is recorded in the audit log.
- Processors (Art. 28 GDPR), all based or hosted in the EU:
- Hosting: [hosting provider, country]
- E-mail delivery: [mail provider, country]
- Off-site backup: [backup provider, country]
- Uptime monitoring: Uptime Kuma, run by us on a server at [provider, country] (only calls status pages and receives technical status messages, no user data)
We do not transfer data outside the EEA, sell data or show advertising. Fonts and libraries are loaded from our own server; there are no third-party analytics or tracking services.
5. Retention
| Data | How long |
|---|---|
| Account and content | until you delete your account or we shut the platform down |
| Deleted content (trash) | 30 days, then deleted for good |
| One-time code | 10 minutes |
| Session (incl. IP address, user agent) | until it expires (usually 7 days after last use), then at most 30 more days |
| Guest profile | 30 days after joining, once no session is valid |
| Guests' answers and chat messages | kept without a name after the guest profile is deleted |
| Unsent consult drafts | 24 hours |
| Abuse-protection counters | 1 minute to 24 hours |
| Server logs | rotated, typically a few days, at most [30] days |
| Audit log | 2 years |
| Database backups | 14 days |
Account deletion: you can delete your account yourself (settings). This deletes your personal space and its images, your answers, notifications, memberships and the account itself. Content you created in other people's spaces (e.g. cases in a team space), chat messages and presentations are kept but assigned to a "Deleted user", so other people's work is not lost. The data disappears from backups within 14 days.
6. Cookies and local storage
| Name | Purpose | Duration |
|---|---|---|
better-auth.session_token |
keeps you signed in | session lifetime |
admin_session (admins only) |
the admin's own session while acting as another account | about 1 hour |
atlas-theme |
light/dark theme | 1 year |
PARAGLIDE_LOCALE |
interface language | about 13 months |
atlas:last-studio (local storage) |
last opened workspace | until you clear it |
atlas:tour-welcome-done (local storage) |
intro tour already seen | until you clear it |
7. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and to object to processing based on legitimate interests (Art. 21). Write to [LEGAL_EMAIL]. You can delete your account yourself at any time.
You can lodge a complaint with a data-protection supervisory authority (Art. 77 GDPR), in particular in the member state where you live or work. The authority responsible for us is [state data-protection authority], [address], [website].
8. Obligation to provide data
For an account we need your e-mail address; without it you can't sign in. As a guest we only need a display name, which does not have to be your real name. There is no automated decision-making under Art. 22 GDPR; leaderboards only rank answers by correctness and time.
9. Security
Encrypted transfer (HTTPS), images only through short-lived signed access tokens, private image storage, limits on sign-in attempts, protection against cross-site attacks, daily backups. Servers and backups are in the EU.
10. Changes
We update this policy when the platform changes. The current version is at https://atlasrad.app/privacy.