LEGAL

Privacy policy

Effective date: 4 November 2026 · Last updated: 4 November 2026

1. Who we are

SpineDraft is developed and provided by SpineDraft, a company based in Brazil ("SpineDraft", "we", "us"). For the personal data described in this policy we are the data controller under Brazil's General Data Protection Law (LGPD, Law 13.709/2018) and, where they apply, the EU/UK General Data Protection Regulation (GDPR) and other privacy laws.

2. What this policy covers

This policy covers the SpineDraft desktop app for macOS and Windows (the "app"), the website spinedraft.com, and the communications you have with us, for example by email. SpineDraft is intended for use by healthcare professionals.

3. Patient data

SpineDraft does not send patient data to us or to anyone else, and we have no access to it.

When you use the app, the following stays only on your computer, in an encrypted library:

• copies of the radiographs you open (DICOM or image files) and small previews of them;
• the patient name and Patient ID, and exam details such as study date and description;
• the landmark points you place, your plans and settings;
• an encrypted activity log of actions in the library (record IDs only, never names).

The library is encrypted with AES-256 using keys protected by your library password and a recovery code that only you hold. If you lose both, nobody, including us, can recover the library.

Patient data leaves the library only when you choose to create a copy, for example a backup, a record export or an exported image. The app asks you to confirm before each of these. Those copies, and the patient data in your library, are under your control. You, or the institution you work for, are the controller of that data and are responsible for complying with the laws that apply to it, such as LGPD, HIPAA or GDPR.

4. Data we collect

4.1 Account and subscription

To sign in and to check your subscription, the app sends our licence service:

• your email address, and your password when you create an account or sign in (sent encrypted over HTTPS and stored only as a secure hash, never in readable form);
• an installation ID: a random number created when the app is installed. It is not derived from your hardware and is used to limit the number of computers per subscription;
• the app version;
• your subscription plan and period, which our service returns to the app.

Pre-release and beta versions that do not connect to a licence service send none of this information.

4.2 Purchases and updates

SpineDraft is sold and updated only through the Mac App Store (Apple) and the Microsoft Store (Microsoft). They process your payment, invoices, refunds and taxes under their own privacy policies, and deliver app updates. We never receive your payment details or card number. The store tells us only what we need to confirm your subscription: the product, its start and end dates, its status, a transaction identifier and the store country.

You manage or cancel your subscription in your Apple or Microsoft account settings.

4.3 Support and feedback

If you email us, we receive your email address, name and whatever you include in the message. If you choose to send us a diagnostic report from the app (Help → Save diagnostic report), it contains technical information such as the app version, operating system, settings and error messages. It is designed to contain no patient data; please check it before you send it, and do not attach patient images or records to emails.

4.4 Website

The website does not use cookies or advertising trackers. It is hosted by Cloudflare, which processes your IP address and browser details to deliver the pages and protect them from attacks, and provides us with aggregate visitor statistics that do not identify you.

5. What we never do

• We do not collect, view or store patient data.
• We do not sell or rent personal data.
• We do not show advertising, and we do not use your data for advertising.
• We do not track you across apps or websites owned by other companies, and we do not share your data with data brokers.
• The app contains no third-party analytics or advertising code.
• We do not use your data, or any patient data, to train artificial intelligence models.
• The app does not use Apple HealthKit or collect health and fitness data about you.

6. How and why we use data

We will only send you news or marketing emails if you ask for them, and you can stop them at any time.

7. Who we share data with

We share personal data only with service providers that help us run SpineDraft, and only as far as they need it:

• Apple and Microsoft: distribution of the app, payments, invoices, taxes and updates, through their stores;
• Cloudflare, Inc.: website hosting, security and email forwarding;
• Our email service provider: our email inbox.

Each provider is bound by a contract to process the data only on our instructions and to protect it at least as well as this policy requires. We may also disclose data when required by law or a court order, to protect the rights and safety of users or others, or as part of a merger or sale of the business, in which case this policy will continue to protect your data.

8. International transfers

Some of our providers process data outside Brazil, for example in the United States or the European Union. When this happens, we rely on the safeguards allowed by LGPD (Art. 33) and GDPR, such as standard contractual clauses.

9. How long we keep data

• Account and licence data: while your account is active. When you delete your account, within 30 days.
• Subscription records: for as long as tax and accounting laws require (in Brazil, generally 5 years).
• Support emails and diagnostic reports: up to 24 months after the conversation ends.
• Server and security logs: up to 30 days.

10. Your rights and choices

Depending on where you live, you have the right to:

• confirm whether we process your data and get a copy of it;
• correct incomplete or wrong data;
• delete your data, or have it anonymised or blocked;
• receive your data in a portable format;
• know who we share it with;
• withdraw consent where we rely on it, and object to processing based on legitimate interest;
• complain to a data protection authority, such as Brazil's ANPD (gov.br/anpd).

To exercise any of these rights, email contact@spinedraft.com from the address linked to your account. We will answer within 15 days. We may ask you to confirm your identity first.

Requests about patient data should go to the surgeon or institution that holds it, because we do not have it.

11. Deleting your account

You can delete your account in the app (Account → Delete account) or by emailing contact@spinedraft.com. Deleting your account removes your account and licence data from our service. Subscription records we must keep by law are retained for the period above. Deleting your account does not cancel your subscription: cancel it in your Apple or Microsoft account settings so that you are not charged again.

Your patient library is on your computer, not with us, so deleting your account does not delete it. You can empty it in the app (Library → Empty library) or remove the library folder, and you are responsible for any backups or exports you made.

12. Security

We protect data with encryption in transit (HTTPS), passwords stored only as secure hashes, limited access for our staff, and providers chosen for their security practices. In the app, the patient library is encrypted, locks automatically after a period without use, and the part of the app you interact with has no access to the network. No system is perfectly secure: if a breach affects your personal data, we will notify you and the authorities as required by law.

13. Children

SpineDraft is a professional tool for healthcare professionals and is not directed at children. We do not knowingly collect personal data from anyone under 18.

14. App Store privacy details

For the app's privacy label in the Mac App Store, we declare:

Diagnostic reports are sent only if you choose to send them.

15. Changes to this policy

If we change this policy, we will update the date at the top. If the change is significant, we will let you know in the app or by email before it takes effect.

16. Contact

If you have any questions about our Privacy Policy, our security practices, or if you wish to request the deletion of your personal data, please contact us directly through the following channels:

• Email: contact@spinedraft.com