Privacy Notice

This notice explains how Smatch Cases handles personal data. It covers member account data and the professional case material members upload.

1. Account and profile data

• We process your e-mail address, password hash, professional profile (name, profession, specialties, country, workplace) and credential data submitted for verification.
• Legal basis: performance of the service contract and our legitimate interest in a verified professional community.

2. Case material

• Members must upload only de-identified case material or material they hold a legal basis for, and attest to this at publishing. The attestation (version, time, legal basis type) is stored.
• Clinical files are stored privately and delivered only through authorization-checked responses; they are never publicly accessible or indexed.

3. Security

• TLS in transit, access control on every request, server-side upload validation, rate limiting and an append-only audit log for sensitive actions.
• Access by administrators is limited to documented moderation/support reasons and is audited.

4. Retention and your rights

• You can export your data as JSON and delete your account in Settings; deletion detaches your identity and removes your profile.
• Residual case material is purged according to the documented retention schedule unless a legal obligation requires otherwise.
• You may request access, rectification or erasure at any time.

5. Contact

Data controller: Smatch. Contact: privacy@smatch.cloud