Privacy Policy

Last updated: June 10, 2026

By installing or using DICOM ScalarMetrics (“the App”) on Android or iOS, you agree to this Privacy Policy. If you do not agree, do not use the App.

Research Use Only: No Clinical Use

DICOM ScalarMetrics is provided strictly for research, educational, and informational purposes. The App has not received FDA 510(k) clearance, CE marking, or any regulatory approval in any jurisdiction for use as a medical device. The App must not be used for clinical diagnosis, treatment planning, treatment decisions, or any other clinical purpose. All outputs, including but not limited to measurements, renderings, quantitative values, SUV calculations, and reconstructions, are approximations without clinical warranty and may contain errors. ScalarMetrics assumes no liability for any decisions or actions taken based on information displayed by the App.

Data Processing

The App processes DICOM medical imaging files that you load from your device. These files may contain Protected Health Information (PHI) including patient names, IDs, dates of birth, and clinical metadata. All file processing occurs locally on your device. The App does not transmit, upload, or otherwise transfer your files or their contents to any server operated by ScalarMetrics, except as described in Peer-to-Peer Transfer below.

Data We Collect

The App itself does not collect personal data. All DICOM file processing occurs locally on your device. When you use the Peer-to-Peer Transfer feature, the following technical identifiers are transmitted to Google (Firebase) solely to establish and authenticate the transfer connection:

• An anonymous user identifier (Firebase anonymous auth UID), not linked to your name, email, or any real-world identity
• A per-install device identifier (Firebase Installations ID) and a hardware attestation token (Apple DeviceCheck) used to verify the request comes from a legitimate installation of the App

These identifiers are used exclusively for App functionality (transfer authentication and API security). They are not used for analytics, advertising, or tracking. The App contains:

• No analytics or usage tracking
• No crash reporting or automated error telemetry
• No advertising or ad-tracking SDKs

Payments & Billing

The App requires a paid subscription or one-time lifetime purchase. All payment processing is handled entirely by Google Play Billing (on Android) or Apple App Store / StoreKit (on iOS). ScalarMetrics does not collect, receive, process, or store any payment information, including credit or debit card numbers, bank account details, billing addresses, or any other financial data.

The only billing-related information the App accesses is your purchase status (i.e., whether you hold a valid subscription or lifetime license), which is queried from the platform's billing system to determine access. This purchase status is cached locally on your device for offline use and is periodically re-verified with the platform when an internet connection is available. No purchase status information is transmitted to ScalarMetrics servers.

Subscriptions and purchases are tied to the platform and account through which they were originally made (e.g., your Google Play account on Android, or your Apple ID on iOS). Purchases made on one platform are not transferable to other platforms. For all billing inquiries, payment disputes, or refund requests, please contact the platform through which the purchase was made (e.g., Google Play Support on Android, or Apple Support on iOS).

Peer-to-Peer Transfer & Study Sharing

The App includes an optional feature that lets you share a DICOM study directly with another device over an encrypted peer-to-peer connection. Study sharing works across all supported platforms and devices:

• Android → Android
• Android → iOS
• iOS → Android
• iOS → iOS

How it works:

The sender generates a unique, short-lived token and a shareable link. A minimal handshake is performed using a temporary cloud-based signaling mechanism to establish a direct encrypted connection between devices. The signaling record contains only the metadata necessary to set up the connection, never file contents or patient data, and is automatically deleted once the transfer completes, is revoked, or expires. Once connected, files transfer directly between devices over an encrypted channel. No file data passes through any ScalarMetrics server.

Only the minimal metadata required to establish and authenticate the connection is temporarily stored during an active transfer. This includes no file contents, no pixel data, and no patient information. All such records are automatically deleted once the transfer completes, is revoked, or expires. The shareable link provides a way for the recipient to initiate the connection; no file data is accessible through it.

You bear sole responsibility for:

• Ensuring you have lawful authorization to transfer any files, including files containing PHI
• Compliance with all applicable laws and regulations (including but not limited to HIPAA, GDPR, and local data protection laws) when transferring files
• Anonymizing or de-identifying files before transfer as required by your institution or applicable regulations

ScalarMetrics has no access to, control over, or knowledge of the contents of any files you transfer. ScalarMetrics is not liable for any unauthorized disclosure of PHI or other data resulting from your use of the transfer feature.

Web PACS Browser

The App includes an optional built-in web browser that allows you to connect to web-based PACS (Picture Archiving and Communication System) servers and DICOMweb endpoints to browse and download DICOM files directly into the viewer. By using this feature, you acknowledge and agree that:

• You are solely responsible for ensuring you have lawful authorization to access any PACS server or DICOMweb endpoint you connect to
• Authentication credentials, session cookies, and login data are stored locally on your device by the browser component and are never transmitted to ScalarMetrics
• The App stores a local history of recently visited PACS URLs (up to 20 entries) on your device for convenience; this history is never transmitted to ScalarMetrics
• Files downloaded from PACS servers are cached temporarily in the App's private storage and processed locally; no downloaded content is transmitted to ScalarMetrics
• The App may accept self-signed or untrusted SSL/TLS certificates for PACS servers when you explicitly approve the connection; you assume all risk associated with connecting to servers using non-standard certificates
• ScalarMetrics has no access to, control over, or visibility into the PACS servers you connect to, the credentials you use, or the data you download
• You are solely responsible for compliance with all applicable regulations (including HIPAA, GDPR, and institutional policies) when accessing PACS servers and downloading medical imaging data

On-Device Storage

Files you open or download from PACS servers may be temporarily cached in the App's private storage for performance purposes. This cache is managed automatically. The App does not write data to shared device storage or expose files to other applications unless you explicitly initiate a share action through standard operating system mechanisms.

Data Retention & Deletion

The following describes what data is stored locally, how long it is kept, and how you can delete it:

• Temporary file cache: cleared automatically when you load new files or uninstall the App; not persisted between sessions
• PACS connection history: stored locally on your device until you clear it in-app or uninstall the App (maximum 20 entries; never transmitted to ScalarMetrics)
• Purchase / subscription status: cached locally and refreshed from Google Play (Android) or App Store (iOS) on each launch; cleared automatically on uninstall

To delete all local App data: on Android, go to Settings → Apps → DICOM ScalarMetrics → Storage & Cache, then tap Clear Storage (removes all local data and history) or Clear Cache (removes the temporary file cache only); on iOS, go to Settings → General → iPhone Storage → DICOM ScalarMetrics, then tap Delete App (removes all local data). Uninstalling the App removes all local data permanently.

ScalarMetrics does not collect or store any personal data on its own servers. Because no user data is held remotely by ScalarMetrics, there is no remote data-deletion request process. All user data is on-device only and fully under your control. For any data-related questions, contact scalarmetricsdev@gmail.com.

Permissions

The App does not access your contacts, camera, microphone, location, photos, or any data outside of files you explicitly open within the App.

Third-Party Services

The App relies on third-party services in the following areas:

Platform billing: All subscription and purchase transactions are processed entirely by the platform through which the App was obtained (Google Play or Apple App Store). ScalarMetrics does not receive or store any payment details.

Peer-to-peer transfer infrastructure: The transfer feature uses Google Firebase for connection signaling and an encrypted data channel. Firebase temporarily stores connection metadata (anonymous user IDs, transfer tokens) to establish the peer-to-peer connection. This metadata never includes file contents or patient data and is automatically deleted after transfer completion or expiry. Google's privacy policy applies to data processed by Firebase: https://policies.google.com/privacy.

Web PACS servers: When you use the built-in browser to connect to a PACS server or DICOMweb endpoint, you are connecting directly to a third-party server that is not operated by ScalarMetrics. The privacy practices, security measures, and data handling of those servers are entirely outside ScalarMetrics' control and responsibility.

Any third-party services used are governed by their own privacy policies, which ScalarMetrics does not control. ScalarMetrics is not responsible for the privacy practices or security of any third-party service.

HIPAA & Regulatory

ScalarMetrics is not a HIPAA-covered entity, business associate, or healthcare provider. The App is not designed, intended, or warranted for use in environments requiring HIPAA compliance. If you process files containing PHI, you do so entirely at your own risk and are solely responsible for all applicable regulatory compliance, including but not limited to HIPAA, GDPR, PIPEDA, and any institutional review board (IRB) requirements.

Children's Privacy

The App is not directed at individuals under 13 years of age. We do not knowingly collect information from anyone, including children.

Disclaimer of Warranties

The App is provided “as is” and “as available” without warranties of any kind, express or implied, including but not limited to warranties of merchantability, fitness for a particular purpose, accuracy, or noninfringement. ScalarMetrics does not warrant that the App will be error-free, that measurements or calculations will be accurate, or that the App is suitable for any particular use.

Limitation of Liability

To the maximum extent permitted by applicable law, ScalarMetrics shall not be liable for any indirect, incidental, special, consequential, or punitive damages, or any loss of data, profits, or goodwill, arising out of or related to your use of the App, regardless of the theory of liability. In no event shall ScalarMetrics' total liability exceed the amount you paid for the App.

Changes to This Policy

ScalarMetrics reserves the right to modify this Privacy Policy at any time, for any reason, at its sole discretion. Changes become effective immediately upon posting the revised policy within the App or on our website. Your continued use of the App after any changes constitutes acceptance of the revised policy. It is your responsibility to review this policy periodically. We will update the “Last updated” date at the top when changes are made, but we are not obligated to provide individual notice of changes.

Governing Law

This Privacy Policy shall be governed by and construed in accordance with the laws of the jurisdiction in which ScalarMetrics operates, without regard to conflict of law principles.

Severability

If any provision of this policy is found to be unenforceable or invalid, that provision shall be limited or eliminated to the minimum extent necessary, and the remaining provisions shall remain in full force and effect.

Contact

ScalarMetrics: scalarmetricsdev@gmail.com