Privacy Policy

The controller responsible for the direct-to-consumer Falcon Patients processing described in this Policy is:

iCat Solutions Ltd
Company number: 08680808
The Union Building
51–59 Rose Lane
Norwich NR1 1BY
United Kingdom

Privacy contact: info@icat.solutions

This Policy applies to account holders and, where applicable, other people whose medical information is managed through a Falcon Patients account.

Falcon Patients can be used locally without Falcon Cloud.

Local-only medical information remains on the device unless the user chooses a function that transmits it, such as Falcon Cloud, sharing, support or another network feature.

Falcon Cloud is an optional additional feature. A person can decline Falcon Cloud and continue using the local Falcon Patients functionality that is otherwise available.

Under the participation model, enabling Falcon Cloud requires affirmative acceptance of the Terms, including their medical-data and anonymisation provisions. There is no separate in-app contribution switch. This acceptance covers only the account holder’s own eligible records. Another person’s records require the declaration described in section 13 and the underlying permission or legal authority; a declaration does not create that authority.

Falcon Cloud is made available to users who choose to participate in the Falcon Cloud data-use model.

That model has two identifiable-data processing purposes:

1. Cloud service processing: receiving, storing, protecting, organising, synchronising, retrieving and sharing the medical information covered by the user’s cloud permission.
2. Anonymisation processing: processing separate eligible copies of covered medical information for the specific purpose of creating genuinely anonymised information for Falcon’s independent commercial and non-commercial use.

Both purposes are described in the Terms accepted during Falcon Cloud account creation.

A person who does not agree to the anonymisation processing can decline Falcon Cloud and continue using Falcon Patients locally.

Depending on how Falcon Patients is used, we may process:

Account information

• name;
• email address;
• account identifiers;
• authentication information;
• country or region;
• settings;
• consent records;
• subscription and entitlement status; and
• communication preferences.

Medical and health information

• DICOM studies;
• medical images;
• reports;
• DICOM metadata;
• patient and study identifiers;
• examination dates;
• modality and anatomical information;
• annotations;
• healthcare-provider information contained in files; and
• other medical information contained in uploaded or received records.

Information about other people

A Falcon Patients account may contain medical information about family members, children, dependants, friends or other people where the account holder has appropriate authority.

Authority and consent information

We may process:

• identity of the account holder giving consent or making an authority declaration;
• identity of the person represented;
• relationship or representative capacity stated by the account holder;
• declared scope of authority;
• consent and declaration wording, document versions and timestamps;
• statements about informing the person represented;
• withdrawal requests and related correspondence; and
• supporting evidence supplied in response to an authority query or dispute.

A recorded declaration is an account holder's statement, not an independent verification of their authority.

Technical information

This may include:

• device and operating-system information;
• application version;
• IP address;
• security events;
• crash and diagnostic information;
• timestamps;
• storage usage;
• upload/download events;
• sharing events; and
• network and transfer information.

Purchase information

We may receive transaction identifiers, plan information, renewal/cancellation status and entitlement information from an app store or payment provider.

Support information

We process information supplied in support requests and information reasonably necessary to investigate them.

Information may come from:

• you;
• another person lawfully acting for you;
• a person whose records you are authorised to manage;
• your device;
• healthcare organisations or systems from which information is sent at the relevant person’s direction;
• transfer recipients and senders;
• payment platforms;
• authentication/security systems; and
• contracted service providers.

Where UK GDPR or EU GDPR applies, we identify the applicable Article 6 basis and, for health information, an applicable Article 9 condition.

Under this model, Falcon records acceptance of the Terms, including their health-data statement, as evidence of the account holder’s agreement to the processing described above.

Falcon Patients remains usable locally if Falcon Cloud is declined.

Declining the Falcon Cloud participation model does not:

• disable the local medical-image functionality otherwise available in Falcon Patients;
• delete local studies;
• reduce local image quality;
• impose a charge for continuing local-only use; or
• prevent a user from exporting or managing local information through local features.

Falcon Cloud is an additional optional benefit rather than a requirement for using the local application.

If a user withdraws permission for future identifiable processing, Falcon Cloud participation ends prospectively, but local Falcon Patients functionality remains available. We provide a reasonable cloud-export period and do not continue new anonymisation processing after withdrawal.

We maintain records of the Terms version and the circumstances in which it was accepted.

The Falcon Cloud terms cover the health-data processing needed to provide the requested Falcon Cloud functions, including:

• upload;
• storage;
• encryption;
• indexing and organisation;
• synchronisation;
• retrieval;
• sharing at the user’s request;
• access control;
• operational resilience; and
• authorised technical support.

Permission for cloud service processing alone does not authorise anonymisation. Under the participation model described in section 3, the single Terms acceptance expressly covers both purposes for the account holder’s own eligible records. For another person’s records, the declaration and underlying authority described in section 13 must cover both purposes.

The Falcon Cloud participation terms cover identifiable processing of eligible copies for one stated purpose:

creating genuinely anonymised information for Falcon’s independent commercial and non-commercial use.

The processing may include:

• copying eligible source information;
• removing or transforming identifiers;
• treating DICOM metadata and private attributes;
• treating dates and unique identifiers;
• treating free-text information;
• treating information embedded in image pixels;
• defacing or otherwise treating recognisable visual characteristics where appropriate;
• separating information from account identifiers;
• assessing re-identification risk; and
• validating whether the output meets the applicable anonymous/deidentified standard.

The purpose is not limited to a named research project.

Once information has been genuinely anonymised so that it is no longer personal information under the applicable standard, Falcon may retain and use it independently worldwide, subject to applicable law and rights in the source material.

Uses may include:

• scientific, medical, technical and statistical research;
• product and software development;
• AI and machine-learning training, fine-tuning, testing, validation and benchmarking;
• creation, analysis, combination and commercialisation of datasets;
• medical and anatomical education;
• creation of visual or digital materials;
• publications and demonstrations;
• advertising, marketing and public product demonstrations, including websites, app stores, social media, presentations and trade shows;
• anonymous 2D images, 3D and volumetric reconstructions, VR/AR visualisations, rendered images, animations and videos;
• licensing, transfer, supply and sale of anonymous datasets or anonymous materials;
• commercialisation of models, algorithms, software, products and services; and
• other lawful commercial or non-commercial uses of genuinely anonymous information.

Falcon may receive financial benefit. Contributors are not ordinarily paid and do not acquire ownership of products or outputs merely because their source information contributed to them.

We do not sell identifiable medical records under this model.

We assess the specific material before public display. An anonymous source study does not automatically make a derived rendering anonymous if it contains recognisable features or other identifying detail.

Removing a name or account identifier is not enough.

We assess whether the output can reasonably be linked to an identified or identifiable person in the context in which the output will be used or disclosed.

The assessment takes account of:

• retained source information;
• available matching information;
• metadata;
• embedded text;
• visual characteristics;
• recipient access;
• proposed release method; and
• other reasonably available means of identification.

Information that remains reasonably linkable is not treated as anonymous and is not released under the anonymous-output provisions.

We publicly commit to processing qualifying anonymous/deidentified information in that form and not intentionally attempting to re-identify the individual.

Where required by applicable law or appropriate to the release model, recipients are contractually required to:

• maintain applicable deidentification safeguards;
• not attempt re-identification;
• maintain appropriate security;
• comply with permitted-use restrictions; and
• report unexpectedly identifiable information.

An account holder may manage another person’s records only where the required permission or legal authority exists.

Before uploading another person’s records to Falcon Cloud, the account holder must make a separate, person-specific declaration confirming that they are authorised to give the permissions described in the Terms on that person’s behalf. This includes cloud service processing, sharing at the account holder’s request within that authority, and creating genuinely anonymous copies for the uses in section 10.

The account holder must make this Policy and the relevant Terms available to the person concerned where appropriate. Where that person’s explicit consent is required, the account holder must have obtained informed, explicit permission covering the stated processing and be able to demonstrate it. Where the account holder acts under another lawful representative arrangement, that authority must extend to the particular processing.

Falcon records the account holder’s declaration. The routine declaration process does not independently verify the other person’s consent or the account holder’s legal authority. Recording a declaration does not create authority, replace consent that the law requires from the person concerned, or remove Falcon’s own legal responsibilities.

A family relationship, possession of a medical record, profile name or account label does not by itself establish authority. Assigning a different person’s study to a profile does not bring that study within the profile holder’s permission.

A valid standing declaration may cover current and future records of the same person within the stated scope while the underlying authority remains valid. The account holder must stop making affected uploads and notify us if that authority ends or the relevant permission is withdrawn.

Where the necessary authority is missing, withdrawn or unresolved following a query or dispute, affected records are excluded from new cloud uploads and anonymisation processing. We may request proportionate supporting information and restrict affected processing while resolving an authority concern. Withdrawal and handling of existing cloud copies are addressed in sections 15–16 and 21–22.

Accounts are intended for adults.

An authorised adult may manage a child’s or dependant’s records where legally permitted.

We do not assume that parental responsibility, guardianship, power of attorney or another authority automatically covers every form of secondary commercial processing.

The account holder’s declaration does not extend the scope of their parental, guardian or other representative authority. Where that authority does not cover anonymisation for independent commercial use, the record is excluded from that processing.

A person may withdraw permission for future identifiable Falcon Cloud processing by emailing info@icat.solutions or writing to our postal address below. We also honour other legally valid requests received by us.

Withdrawal from the participation processing:

• stops new uploads covered by the withdrawn permission;
• stops new identifiable anonymisation processing;
• stops affected pending preparation jobs;
• ends eligibility for Falcon Cloud under the participation model;
• does not disable local-only Falcon Patients functionality; and
• does not make earlier lawful processing unlawful.

We normally provide a 30-day export period for cloud originals before deletion, unless a shorter period is legally required or a security/legal issue requires different handling.

We do not create a fresh anonymous copy after withdrawal merely to avoid deletion.

Information genuinely anonymised before withdrawal may continue to be retained and used later for the purposes described in this Policy while it remains anonymous.

The same applies if you delete the original study, the identifiable original is permanently deleted from Falcon’s active systems, or you close your account. A separate copy that was already genuinely anonymous may remain in Falcon’s datasets or marketing materials and may continue to be used, licensed or sold. We do not need to retain the identifiable original to do so. This does not permit us to keep a still-identifiable research copy after an applicable deletion request or to start anonymising it after withdrawal solely to avoid deletion.

Because such information may no longer contain an identifying link, Falcon may be unable to identify which anonymous records originated from a particular person.

Withdrawal does not require us to create a new identifying link solely to locate genuinely anonymous information.

A user may purchase additional Falcon Cloud capacity.

Purchasing additional capacity does not change the participation model or create a storage-only cloud plan.

Where iCat directly controls billing, we stop future subscription renewals when your Falcon Cloud participation ends. We do not retain payment for an unused future prepaid period solely because you withdrew permission; an appropriate pro-rata refund is made subject to applicable law.

For subscriptions purchased through Apple, withdrawing permission or deleting your Falcon account does not automatically cancel the subscription. Apple billing may continue until you cancel renewal through Apple subscription settings. Requests to refund Apple purchases follow Apple's refund process. Mandatory consumer rights and iCat's obligations under applicable law remain unaffected.

For another app store or payment platform, use that provider's cancellation and refund process where it controls those actions.

Cancelling subscription renewal and withdrawing health-data permission are separate actions. Cancelling renewal does not by itself withdraw that permission. We do not make withdrawal or deletion conditional on completing subscription cancellation or obtaining a refund.

We may disclose identifiable personal information to:

Contracted service providers

Providers of hosting, storage, authentication, security, monitoring, communications, customer support, controlled anonymisation tooling and other technical services.

They process identifiable information under contractual restrictions and may not use it for their own unrelated AI, research, advertising or commercial purposes.

People you choose to share with

Where you instruct Falcon Patients to share information, we process the information needed to carry out that instruction.

Payment and distribution platforms

These may receive purchase and entitlement information needed to process payments or distribute the application.

Professional advisers and authorities

Limited disclosure may occur where lawfully necessary for legal advice, legal claims, regulatory compliance or a binding legal requirement.

EU/EEA representative

Our representative, MEDIWARE CY LTD, may receive the personal information reasonably needed to handle an individual's privacy request or a supervisory authority's enquiry on our behalf. Its contact details are in section 31. This role does not give it permission to use identifiable medical information for unrelated commercial purposes.

Business successors

Information may be transferred as part of a lawful corporate transaction subject to applicable privacy protections.

Our main cloud storage for identifiable medical studies is hosted by Amazon Web Services in Frankfurt, Germany, within the EU. Technical service providers may help us operate and secure the Service. Any access or transfer outside the EU is addressed in section 20.

Recipients of genuinely anonymous information may include:

• research organisations;
• universities;
• healthcare organisations;
• medical-device companies;
• pharmaceutical and biotechnology organisations;
• software companies;
• AI and technology companies;
• publishers;
• educators;
• content producers;
• commercial partners; and
• other organisations receiving the anonymous information for lawful purposes.

Where the applicable deidentification regime requires recipient commitments, we impose those commitments contractually.

Identifiable personal information may be stored in or accessed from countries other than the person’s own.

Where UK or EEA transfer restrictions apply, we use an applicable transfer mechanism such as an adequacy arrangement, Standard Contractual Clauses, the UK International Data Transfer Agreement, the UK Addendum or another recognised safeguard.

Anonymous information is handled according to the legal status and contractual restrictions applicable to it.

Original cloud medical information

Retained for as long as the user chooses to keep it in an active Falcon Cloud account, subject to the applicable storage entitlement and legal requirements. When a user deletes a study or closes the account, we stop using the affected identifiable studies for new anonymisation work and remove remaining identifiable copies through our deletion process, normally no later than the next cleanup cycle, which may take up to 30 days after deletion. A lawful obligation or another applicable exception may require longer retention of particular information.

Anonymisation working copies

Retained only as long as reasonably necessary for authorised preparation and validation.

Account, purchase and security information

Retained for periods reasonably necessary for account administration, accounting, tax, fraud prevention, security, legal claims and compliance.

Consent evidence

Retained as necessary to demonstrate the permission on which processing relied.

Genuinely anonymous information

Falcon may keep it for as long as Falcon considers it useful, including indefinitely, while it remains genuinely anonymous and its use remains lawful. Deleting the original study or account does not remove a genuinely anonymous copy already created.

Users may delete studies or request account deletion using available functionality or by contacting us.

Where deletion is required, we begin the deletion process without undue delay. Identifiable copies awaiting the next cleanup cycle are restricted from ordinary use and are normally removed within 30 days after the user deletes the study or account, subject to lawful retention exceptions.

Restricted backup copies may remain until overwritten through the same cleanup cycle, normally up to 30 days after deletion. They are not used for new research, marketing or anonymisation while awaiting removal.

If a backup is restored, applicable deletion and withdrawal instructions must be reapplied.

We maintain technical and organisational measures appropriate to the sensitivity and risks of the information processed.

Measures may include:

• encryption;
• access control;
• authentication;
• logging and monitoring;
• secure development practices;
• resilience and backup controls;
• incident response;
• vendor controls; and
• security testing.

No system can provide absolute security.

We investigate suspected security incidents and comply with applicable notification duties.

This may include notification duties under UK/EU data-protection law, applicable US state law, HIPAA where applicable, and the FTC Health Breach Notification Rule.

Direct-to-consumer use of Falcon Patients does not automatically make iCat a HIPAA Covered Entity or Business Associate.

Where iCat receives or maintains PHI on behalf of a HIPAA Covered Entity or Business Associate, the applicable Business Associate Agreement and HIPAA requirements govern that processing.

PHI held in a Business Associate capacity is excluded from the consumer anonymisation programme unless the BAA expressly permits de-identification for the relevant purpose.

Once PHI has been de-identified in accordance with the HIPAA Privacy Rule, HIPAA no longer treats that output as PHI, but other laws and contractual restrictions may still apply.

Depending on applicable law and circumstances, individuals may have rights including:

• access;
• rectification;
• erasure;
• restriction;
• portability;
• objection;
• withdrawal of consent; and
• information about processing.

Withdrawal of consent does not affect the lawfulness of processing performed before withdrawal.

Rights over personal information do not necessarily apply to information that has already been genuinely anonymised and can no longer reasonably be linked to the individual.

Depending on applicable state law, individuals may have rights to access, confirm processing, correct, delete, withdraw consent, obtain portability, receive recipient information or appeal a refusal.

Washington consumer health data disclosure. Where Washington's My Health My Data Act applies, this section and the rest of this Policy form our consumer health data privacy disclosure. The categories of consumer health data collected are in section 4; their sources are in section 5; collection and use purposes are in sections 3 and 8–10; and categories of recipients are in sections 18–19. The categories of identifiable consumer health data shared with processors or recipients selected by the user may include medical images, reports, DICOM metadata, study and patient identifiers, and associated account or transfer information, to the extent needed for the disclosed purpose. We do not sell identifiable consumer health data under the anonymous-data programme. Consumers may request access, a list of relevant third parties and affiliates, withdrawal for future collection or sharing, or deletion by contacting us as stated in section 28, and may appeal an applicable refusal by replying to that decision.

Additional state-specific information may be included in this Policy or supplied through a jurisdiction-specific notice where required.

Privacy requests may be submitted by email to info@icat.solutions or by writing to iCat at the postal address in section 31. EEA individuals may also contact the EU/EEA representative listed there.

We may need to verify identity or representative authority before acting.

UK users may complain to the Information Commissioner’s Office. EEA users may complain to the competent supervisory authority.

Essential technologies may be used for authentication, security and requested functionality.

The Falcon Cloud anonymisation consent is not permission to use identifiable medical information for behavioural advertising or unrelated tracking.

We do not authorise health information to be exposed through advertising pixels or analytics systems contrary to this Policy.

Any additional non-essential tracking or marketing activity is subject to its own applicable disclosure and permission requirements.

We may update this Policy to reflect changes in the Service, law or our processing.

A revised Privacy Policy does not itself create fresh consent for a materially new identifiable health-data purpose.

Where fresh consent is legally required, we obtain it before the new processing begins.

Privacy contact:

iCat Solutions Ltd
The Union Building
51–59 Rose Lane
Norwich NR1 1BY
United Kingdom

info@icat.solutions

EU/EEA representative

MEDIWARE CY LTD
Cyprus company registration number: HE 461676
Flat/Office 2
27 Despoinas & Nikou Pattichi
3071 Limassol
Cyprus

Privacy email: info@mediware.cy

Individuals in the EEA and supervisory authorities may contact this representative about iCat’s processing under this Policy. iCat remains the controller responsible for that processing.

Data Protection Officer (DPO)

MEDIWARE CY LTD
Flat/Office 2
27 Despoinas & Nikou Pattichi
3071 Limassol
Cyprus

Email: info@mediware.cy