Privacy Policy

Synthera Luminary Group ("we", "us", "our") operates EchoReport (the "Service"), accessible at https://echoreport.vip. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information and the personal health information of patients whose data is processed through the Service.

This Policy applies to all users of EchoReport, including registered healthcare practitioners, cardiac sonographers, cardiologists, and any other authorised users ("Practitioners"). It also describes the rights of patients ("Data Subjects") whose echocardiographic and clinical data is processed through the platform.

By accessing or using the Service, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy. If you do not agree, you must discontinue use of the Service immediately.

EchoReport is designed to support professional privacy and security obligations, including POPIA and applicable healthcare record-retention duties. It is not independently certified as compliant with HIPAA, GDPR, ISO/IEC 27001, or any other framework. Each practice remains responsible for its legal basis, patient notices and consents, retention schedule, clinical governance, and any required data-processing agreements with its service providers.

2.1 Practitioner Account Data. When a healthcare practitioner registers for the Service, we collect: full name, professional email address, practice name, practice address, professional registration number, contact telephone number, and subscription billing information. Website and PWA payments are processed securely via PayFast; eligible native-app subscriptions are processed through Google Play or the Apple App Store. We do not store full card details.

2.2 Patient Health Information (Special / Sensitive Data). Practitioners input patient data into the Service to generate echocardiogram reports. This constitutes Special Personal Information under POPIA, Special Category Data under GDPR, and Protected Health Information (PHI) under HIPAA. Such data includes: patient full name, date of birth, gender, patient identification number, ward and hospital details, referring physician details, clinical indications, and all echocardiographic measurements and findings (cardiac dimensions, ejection fraction, valve assessments, Doppler findings, and clinical conclusions).

2.3 Media Files. Practitioners may upload echocardiographic images and video clips as part of a report. These files are stored in private cloud object storage and are delivered only through authenticated, report-authorised application routes.

2.4 Usage and Technical Data. The application records limited operational and security events, such as account/session activity, rate-limit events using irreversible hashes, browser/device information supplied by the hosting environment, and error logs. These are used for service operation, security monitoring, and debugging.

2.5 AI-Processed Data. The Service includes an optional AI feature that allows practitioners to photograph a patient sticker to automatically extract patient demographic details. Images submitted for this purpose are processed by an AI model and are not retained beyond the immediate extraction task.

We process personal information only where a lawful basis exists. Depending on the applicable jurisdiction and the nature of the data, our lawful bases include:

We implement technical safeguards intended to reduce unauthorised access. Security controls are reviewed as the service changes; no security control guarantees absolute protection.

Transport and browser protections. Production traffic is served over HTTPS. The application uses restrictive browser security headers, trusted-origin checks for unsafe browser requests, and a native WebView content-security policy.

Access Controls. Patient media and source records are delivered through authenticated, report- and clinical-workspace-authorised routes. Role and workspace checks are enforced at the API layer. Direct object-storage URLs are not used as application delivery links.

Authentication. Passwords are stored as bcrypt hashes. Session and password-reset bearer tokens are stored as SHA-256 hashes, session cookies are HttpOnly and Secure in production, and login/reset attempts are persistently rate-limited.

Audit and continuity. The application records selected operational and security events. Operators must separately establish and test any required backup, disaster-recovery, data-processing, and clinical-audit arrangements with their hosting and service providers.

The Service is hosted on cloud infrastructure that may involve the transfer of personal data across international borders. Where such transfers occur, we ensure appropriate safeguards are in place as required by applicable law, including Standard Contractual Clauses (SCCs) under GDPR, adequacy decisions where available, and equivalent protections under POPIA's transborder information flow provisions (Section 72).

We do not transfer personal health information to third parties for marketing, advertising, or any purpose unrelated to the provision of the Service.

We do not sell, rent, or trade personal information to third parties. We may share information only in the following limited circumstances:

Service Providers. The service uses cloud hosting, payment processing, email delivery, and optional AI processing providers. The responsible practice/operator must review their current terms, locations, security documentation, and any required data-processing agreements before using them with patient data.

Legal Requirements. We may disclose information where required by applicable law, court order, or regulatory authority, including the South African Information Regulator, the EU supervisory authorities, or the U.S. Department of Health and Human Services (HHS).

Report Delivery. When a practitioner submits a completed echocardiogram report, the Service may send a copy of the PDF report to the report-owning registered account and, when selected by the practitioner, to the patient and/or referring physician email address entered in the report. The practitioner is responsible for verifying recipient addresses and authority to disclose.

Business Transfers. In the event of a merger, acquisition, or sale of assets, personal data may be transferred to the successor entity, subject to equivalent privacy protections and notification to affected users.

Depending on your jurisdiction, you may have the following rights with respect to your personal information. To exercise any of these rights, contact us at synthera.apps@gmail.com.

We will respond to all verified requests within the timeframes required by applicable law (generally 30 days under POPIA and GDPR; 30 days under HIPAA).

We retain personal information and patient health records for as long as necessary to provide the Service and to comply with applicable legal, regulatory, and professional obligations.

Echocardiogram reports and associated patient data are retained for a minimum period consistent with South African medical records legislation (generally 5 years for adult patients; longer for minors), HIPAA requirements (6 years from creation or last effective date), and equivalent international standards. Practitioners may delete individual reports at any time, subject to any applicable legal retention obligations in their jurisdiction.

Practitioner account data is retained for the duration of the subscription and for a reasonable period thereafter to facilitate account reactivation and financial record-keeping. Account-deletion requests can be submitted from Profile & Settings and are reviewed before action. We will respond within applicable legal timeframes, subject to mandatory clinical, financial, security, and audit-retention requirements.

In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of individuals, we will notify the relevant supervisory authority and affected data subjects in accordance with applicable law:

POPIA (South Africa): Notification to the Information Regulator and affected data subjects as soon as reasonably possible after becoming aware of a breach.

GDPR (EU): Notification to the relevant supervisory authority within 72 hours of becoming aware of the breach; notification to affected data subjects without undue delay where the breach is likely to result in a high risk.

HIPAA (USA): Notification to affected individuals within 60 days of discovery; notification to the Secretary of HHS; notification to prominent media outlets where a breach affects more than 500 residents of a state.

Other Jurisdictions: Notification in accordance with the applicable local law of the affected individuals' country of residence.

Practitioner Responsibility. Healthcare practitioners using EchoReport are independent data controllers in respect of their patients' health information. Synthera Luminary Group acts as a data processor on behalf of practitioners. Practitioners are responsible for ensuring they have obtained all necessary patient consents and authorisations required by their local law and professional regulatory body before entering patient data into the Service.

HIPAA Business Associate. For practitioners subject to HIPAA, Synthera Luminary Group is prepared to enter into a Business Associate Agreement (BAA) upon request. Contact us at synthera.apps@gmail.com to obtain a BAA.

POPIA Operator Agreement. For South African practitioners, Synthera Luminary Group operates as an Operator under POPIA. Our data processing activities are governed by the terms of this Policy and our Terms of Service, which together constitute the operator agreement contemplated by POPIA Section 20.

Minimum Necessary Standard. Consistent with HIPAA's minimum necessary standard and POPIA's data minimisation principle, we only process the patient health information that is directly necessary for the generation of echocardiogram reports and the provision of the Service.

No Secondary Use. Patient health information is never used for advertising, marketing, research, or any purpose other than the direct provision of the Service to the practitioner who entered the data.

The Service uses strictly necessary session cookies to maintain your authenticated session. We do not use advertising cookies, third-party tracking pixels, or behavioural analytics tools. For full details, please refer to our Cookie Policy.

The Service is intended for use by licensed healthcare professionals and is not directed at children under the age of 18. We do not knowingly collect personal information from children for account registration purposes. Patient records may include data relating to minor patients; such data is processed solely for the medical purpose of generating echocardiogram reports at the direction of the responsible practitioner.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. We will notify registered practitioners of material changes by email and by displaying a prominent notice within the Service. The updated Policy will take effect on the date indicated at the top of this document. Continued use of the Service after the effective date constitutes acceptance of the revised Policy.

For any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal information, please contact us:

If you are not satisfied with our response, you have the right to lodge a complaint with the relevant supervisory authority in your jurisdiction, including the South African Information Regulator (inforegulator.org.za), the relevant EU Data Protection Authority, or the U.S. Department of Health and Human Services Office for Civil Rights.