Privacy Policy

1. Who We Are

RadTracker, LLC is a Virginia limited liability company that provides radiology practice management software, including scheduling, productivity tracking, and compensation-related tools. Questions about this policy may be directed to legal@radtracker.org.

2. Information We Collect

Depending on how your practice uses the Services, we may process categories of information such as:

• Account information: name, email address, role (for example administrator, radiologist, or viewer), and related authentication identifiers needed to operate your account.
• Productivity and operations data: work relative value units (wRVUs), CPT codes, modality, timestamps, and similar operational metrics. Where sourced from clinical workflows, exam records are treated as PHI and protected under BAAs, as described in Section 3.
• Event and audit logs: security-relevant and administrative events to support accountability, troubleshooting, and compliance.
• Usage data: technical information such as device type, app version, and interaction patterns used to maintain and improve the Services.

3. How We Handle Protected Health Information (PHI)

RadTracker is not a clinical diagnosis application. To measure radiologist productivity, turnaround times and compensation, RadTracker receives exam activity data from our customers' imaging systems. We treat these exam records as Protected Health Information under HIPAA and handle them as follows:

• Minimum necessary. An automated filter removes direct patient identifiers, such as names, medical record numbers, dates of birth and contact details, before any data is stored. We keep only what the service needs: exam type, timing, and the reading radiologist.
• Still treated as PHI. The exam timestamps we keep (order, exam and report-signed times) can still be considered identifiers under HIPAA. We therefore treat stored exam records as PHI and apply full HIPAA safeguards to them. Accession numbers are replaced with a keyed one-way hash.
• Business Associate Agreements. We sign a BAA with each covered-entity customer before receiving data. PHI is stored and processed only by infrastructure providers that have signed a BAA with us.
• Security. Data is encrypted in transit and at rest. Access is limited to authorized users with multi-factor authentication, restricted to each practice's own data, and logged. RadTracker personnel access PHI only when needed to support the service.
• AI features. Some features use an AI service to suggest billing codes from exam names. Only the exam name is sent, never patient identifiers, accession numbers or exam times.
• Retention. Exam data is kept while the practice is a customer, and deleted within 90 days after the relationship ends. Encrypted backups are kept for up to one year.
• Aggregated statistics. We may produce aggregated statistics across practices only when they are de-identified under HIPAA standards and no patient, practice or radiologist can be identified.

4. How We Use Your Information

We use information to provide and operate the Services, including productivity tracking, scheduling, compensation workflows, push notifications you or your practice enable, platform improvement, and customer support. We do not sell your personal information and we do not use it for third-party advertising.

5. Information Sharing

Information may be visible within your practice according to role and permissions (for example, administrators may access group-level operational data). We share data with service providers that help us run the Services, such as Supabase, Vercel, and Amazon Web Services, under contracts that include data protection commitments (for example, DPAs) appropriate to the processing. We may also disclose information when required by law or to protect the rights, safety, and integrity of RadTracker, our customers, and the public.

6. Data Security

We implement administrative, technical, and organizational measures designed to protect information, including TLS 1.2+ for data in transit, encryption at rest where supported by our infrastructure, row-level security and access controls in the product data layer, AES-256-GCM for stored SFTP-related secrets where applicable, and encrypted secure storage for certain mobile tokens on supported devices. No method of transmission or storage is completely secure; we work to apply reasonable safeguards for our architecture.

7. Data Retention

We retain information while your practice's subscription is active and as needed to provide the Services and meet legal obligations. Exam data is kept while the practice is a customer and deleted within 90 days after the relationship ends. Encrypted backups are kept for up to one year, as described in Section 3.

8. Push Notifications

With your permission and your practice's configuration, we may send push notifications related to scheduling, coverage, productivity, and similar operational topics. You can disable push notifications at any time through your device settings or in-app controls where available.

9. Children's Privacy

The Services are not directed to individuals under 18, and we do not knowingly collect personal information from children. If you believe we have collected information from a child, contact us and we will take appropriate steps.

10. Your Rights

Subject to your role, your practice's policies, and applicable law, you may have rights to access, correct, or delete certain information. To exercise these rights or ask questions, contact legal@radtracker.org. We will respond consistent with applicable law and verify requests as appropriate.

11. California Privacy Rights (CCPA)

We do not sell personal information as defined by the California Consumer Privacy Act (CCPA). California residents may have additional rights regarding access, deletion, and correction. To submit a request, contact legal@radtracker.org.

12. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will provide notice through the Services (for example, in the application) and/or by email to administrators, as appropriate, before the changes take effect unless notice is not required by law.

13. Contact Us

RadTracker, LLC
Email: legal@radtracker.org
Website: radtracker.org