1. Who we are
OncoXAI (‘we’, ‘us’) is a multidisciplinary oncology second-opinion service. Our registered office and full legal details are set out in the Imprint.
For any privacy question you may contact our Data Protection Officer at dpo@oncoxai.com, or reach our support team at support@oncoxai.com.
2. What data we collect
Identification data: name, date of birth, gender, country of residence, contact details.
Health data (‘special category’ under GDPR Art. 9): medical reports, imaging (DICOM), laboratory results, pathology, treatment history, medications, genetic data where relevant.
Technical data: IP address, device and browser type, cookies (see the Cookie Policy), pages visited.
Communication data: emails, chat messages and consultation recordings when you agree to them.
3. Legal basis for processing
Your explicit consent (GDPR Art. 6(1)(a) and Art. 9(2)(a)).
Provision of healthcare and medical diagnosis (GDPR Art. 9(2)(h)).
Compliance with legal obligations (GDPR Art. 6(1)(c)).
Our legitimate interest in operating and securing the service (GDPR Art. 6(1)(f)).
4. How we use your data
To review your case and produce your personalised report.
To coordinate consultations with our clinical specialists.
To communicate with you about your case and our services.
To meet legal, regulatory and quality-management requirements.
We do not sell your data. We do not use your health data for advertising.
5. Sharing and international transfers
Data may be shared with our clinical panel, IT sub-processors (hosting, secure storage, communication tools) and, where required, competent authorities.
Servers are located in the European Union. When data is transferred outside the EU/EEA we use Standard Contractual Clauses and additional safeguards where required by GDPR Chapter V.
6. Retention
Medical records are retained for the period required by applicable healthcare law (typically 10 years from the last treatment interaction in the EU).
Account and billing data are retained for statutory bookkeeping periods.
You may request earlier deletion where the law permits.
7. Your rights
Depending on your country, you may have the right to: access, rectify, erase, restrict or object to processing, data portability, and to withdraw consent at any time.
You may lodge a complaint with your local data protection authority.
To exercise any right, write to privacy@oncoxai.com. We respond within 30 days.
8. Security
Encryption in transit (TLS 1.2+) and at rest (AES-256).
Access control, audit logs, staff confidentiality obligations, regular penetration testing.
Incident notification within 72 hours to the competent authority where required.
9. Children
Paediatric cases are handled only with the explicit consent of a parent or legal guardian.
10. Changes to this policy
Material changes will be announced on this page and, where appropriate, by email at least 30 days before they take effect.
