Legal
Data & Privacy
Last updated: July 2026
The short version: your data lives on servers we own and run ourselves, it is never sold or shared, connections are encrypted, and this site loads no third-party scripts, analytics, or ads.
This page explains in plain language what happens to your data on TraceOrg: what we store, where it lives, who can see it, how long we keep it, and how to get it deleted. If anything is unclear, email us — the address is at the bottom.
1. Your data stays on our own servers
TraceOrg is self-hosted. Your images, reports, and account records are stored on server hardware that we own and operate ourselves — not on Amazon, Google, Microsoft, or any other third-party cloud.
AI analysis runs on our own GPU servers in the same infrastructure, so your images are never sent to an external AI service. The storage servers are not directly reachable from the internet; traffic arrives only through an encrypted gateway.
2. What we store
We keep four kinds of data, and nothing else:
- Account details: your email address, a salted-and-hashed password (we never store the password itself), and an optional name and affiliation.
- Imaging you upload: DICOM or NIfTI studies, plus the segmentations and reports generated from them.
- Study details you enter for the analysis, such as the study month or a subject’s height and birth year.
- Basic security logs: sign-ins, job runs, and administrator actions.
3. What we never do with it
Simple rules, no fine print:
- We never sell your data.
- We never share your images or reports with third parties.
- We never send your images to external AI or cloud services.
- We never run advertising trackers or analytics scripts on this site.
The two narrow exceptions
Sign-in codes and notification emails are delivered through our @traceorg.com mailbox provider; those emails never contain imaging data. And aggregated, fully de-identified measurements may be used to improve our segmentation models. Nothing identifiable ever leaves our servers without your explicit consent.
4. Encryption and account security
All traffic between your browser and TraceOrg is encrypted in transit with HTTPS/TLS, and the internal link between our public gateway and the storage servers is encrypted as well.
Passwords are stored only as salted hashes. Signing in takes your password plus a one-time code sent to your email.
5. Who can see your data
Only you can see your subjects, studies, and reports; accounts are isolated from each other.
A small number of platform administrators can access data when maintenance, support, or quality assurance requires it, and administrator actions are recorded in an audit log. Nobody else has access — no advertisers, no partners, no data buyers.
6. How long we keep it
Your data stays as long as your account is active, so longitudinal tracking keeps working across years of studies.
Delete a study and its images and reports are removed from our storage along with it. Delete your account and everything goes — we keep no shadow copies for marketing or resale.
7. How to get your data deleted
You can delete any study yourself from its study page. For anything more — specific files, whole subjects, or your entire account — email support@traceorg.com from your account email and tell us what to remove.
We confirm every deletion request by email within 30 days. Deletion covers uploaded images, generated reports, and account records alike.
8. No third-party scripts, no analytics, no ads
Every page on this site is served entirely from our own servers — scripts, styles, and fonts included. There is no Google Analytics, no advertising pixel, no social-media widget, and no third-party CDN.
We set exactly one cookie: the session cookie that keeps you signed in. There are no tracking cookies, which is why there is no cookie banner to click away.
9. Your part: upload anonymized data
TraceOrg is built for anonymized research imaging. Please remove identifying details — names, medical record numbers, exact dates of birth — before uploading; hospital DICOM exports often contain them.
If you realize you uploaded identifiable data by mistake, delete the study, or email us and we will remove it.
10. Research use and changes to this page
TraceOrg is a research platform, not a medical device. Reports are for research review and must not be used for clinical diagnosis or treatment decisions.
If our data practices ever change, we will update this page — and the date at the top — before the change takes effect.
Contact
Questions about data handling, or a deletion request? Email support@traceorg.com.