Personal data
Privacy notice.
This notice explains how personal data is used in the CoroEcho 3D account, submission, processing, and technical research proof-of-concept workflow.
Who is responsible?
The data controller is Independent CoroEcho 3D project operator — identity pending publication, professional address pending publication. Questions and rights requests may be sent to support@coroecho.com.
Data-protection contact: No DPO has been appointed. Privacy questions and rights requests may be sent to support@coroecho.com.
Project status: Independent preliminary technical and scientific proof of concept. It is not a formal clinical study, does not recruit patients, and currently claims no institutional sponsorship or ethics approval.
Data, purposes and legal bases
| Data | Why it is used | Legal basis |
|---|---|---|
| Account requests: name, professional email, institution, country, role, and message | Assess eligibility, answer the request, and prevent misuse of the portal | Provisional wording under review for account administration, professional contact, and portal security |
| Account and contact data, authentication events, and support correspondence | Create and secure participant accounts, provide access, and send service notifications | Provisional wording under review for account administration, professional contact, and portal security |
| Submitted clips, filenames, study and acquisition metadata, research participant and operator codes | Process the submitted study, produce an experimental reconstruction, perform quality review, and maintain scientific traceability | Provisional wording under review for the limited technical and scientific POC |
| Results, review decisions, pipeline versions, validation records, and technical logs | Release results securely, document provenance, troubleshoot failures, and protect the service | Provisional wording under review for the limited technical and scientific POC |
Required fields are identified in the relevant form. Without them, an account request or study submission cannot be processed.
De-identification and coded health data
The portal accepts only clips from which direct patient identifiers have been removed. No patient name, hospital identifier, date of birth, identifying filename, or identifying visible annotation may be submitted. Any re-identification key must remain under the control of the source professional or institution and outside this portal. A hospital patient identifier must never be used as a research participant code.
“De-identified” is an operational description, not a claim of irreversible legal anonymization. A coded, linkable, or otherwise re-identifiable clip may remain pseudonymized personal health data. It is handled as sensitive data whenever that possibility cannot reasonably be excluded.
The submitting professional confirms that they are authorized to disclose the data for this POC and that source-side information, consent, confidentiality, and other applicable requirements have been addressed. This confirmation does not remove the data controller's own legal and security responsibilities, and this website notice does not replace any information owed to the person concerned.
Who receives the data?
Access is limited to the project lead and authorized project personnel who need it for account management, processing, quality review, scientific traceability, support, or security. Source clips are processed by controlled local conversion and analysis workers.
The technical service providers are Vercel for the web application, Supabase for authentication, database and private file storage, and OVHcloud for transactional email. Their exact contracting entities, locations, roles, and safeguards must match the project configuration stated in the legal notice and applicable data-processing agreements.
Data is not sold and is not used for advertising. Any disclosure to another research team or external validator must be covered by the applicable protocol, authorization, agreement, and confidentiality safeguards.
Retention
- Rejected or unanswered account requests
- Provisional retention period under review
- Participant accounts and professional correspondence
- Provisional retention period under review
- Uploaded source clips
- Provisional retention period under review
- Results and research traceability records
- Provisional retention period under review
- Security and technical logs
- Provisional retention period under review
Data may be retained longer where required to document research integrity, comply with a legal obligation, establish or defend legal claims, or follow an approved archiving framework. The applicable rule must be documented before external use.
International transfers
The production regions and contracting entities of every provider must be checked against the signed contracts. If personal data is transferred outside the European Economic Area, the controller must document the relevant adequacy decision, contractual safeguards, and any supplementary measures before the transfer occurs.
Your rights
Depending on the legal basis and circumstances, you may have rights of access, rectification, erasure, restriction, objection, and data portability, and the right to withdraw consent where consent is used. Send a request to support@coroecho.com. You may also lodge a complaint with the competent supervisory authority; in France, this is the CNIL.
Rights concerning coded research data may require coordination with the submitting institution, because CoroEcho 3D is not intended to hold the correspondence between a research code and a patient identity.
Cookies and security
The portal uses only cookies and browser storage that are necessary for authentication, session continuity, and secure resumable uploads. It currently uses no advertising cookies and no audience-measurement tracker. To the extent these technologies remain strictly necessary for the service requested by the user, they are used without prior consent and are described here for transparency.
Access controls, private storage, expiring download links, and authenticated processing endpoints reduce risk but cannot eliminate it. Suspected unauthorized access or accidental disclosure should be reported immediately to support@coroecho.com.
Last updated: 27 July 2026.