Privacy Policy

1. Introduction

StrokeLab ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website and services. Please read this policy carefully. By using StrokeLab, you consent to the data practices described herein.

2. Information We Collect

2.1 Personal Data

We may collect personal information that you voluntarily provide to us when you register, use our services, or contact us, including:

• Name and email address (via Google OAuth sign-in)
• Profile picture (via Google OAuth)
• Payment information (processed securely by Stripe; we do not store card details)
• Usage data and analysis history

2.2 Automatically Collected Data

When you access StrokeLab, we may automatically collect:

• Device information (browser type, operating system, device identifiers)
• Log data (IP address, access times, pages viewed, referring URL)
• Cookies and similar tracking technologies

2.3 Uploaded Content

Photos you upload for stroke analysis are processed in real-time and stored temporarily for the purpose of providing our service. Keypoint data and analysis results are retained in your account history. You may request deletion of this data at any time.

3. How We Use Your Information

We use the information we collect for the following purposes:

• To provide, operate, and maintain our services
• To process and complete analysis requests
• To manage your account and subscription
• To communicate with you regarding updates, support, and security notices
• To improve our services, user experience, and performance
• To detect, prevent, and address technical issues or fraudulent activity
• To comply with legal obligations

4. Legal Basis for Processing (GDPR)

If you are a resident of the European Economic Area (EEA), we process your personal data based on the following legal grounds:

• Consent: You have given explicit consent for specific purposes
• Contract: Processing is necessary for the performance of our service agreement
• Legitimate Interests: We have a legitimate interest in providing and improving our services, provided your rights are not overridden
• Legal Obligation: Processing is required to comply with applicable laws

5. Data Sharing and Disclosure

We do not sell, trade, or rent your personal information to third parties. We may share your data only in the following circumstances:

• Service Providers: Trusted third-party vendors who assist in operating our services (e.g., Cloudflare for storage, Stripe for payments, Vercel for hosting)
• Legal Requirements: When required by law, regulation, or legal process
• Business Transfers: In connection with a merger, acquisition, or sale of assets
• With Your Consent: When you have explicitly authorized us to do so

6. International Data Transfers

Your data may be transferred to and processed in countries outside of your country of residence, including the United States. We ensure appropriate safeguards are in place to protect your data in accordance with applicable data protection laws, including Standard Contractual Clauses where required.

7. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required by law. Uploaded photos are processed and deleted after analysis unless you choose to save them. Account data is retained while your account is active; you may request deletion at any time.

8. Your Rights (GDPR & CCPA)

Depending on your location, you may have the following rights:

• Right of Access: Request a copy of the personal data we hold about you
• Right to Rectification: Request correction of inaccurate data
• Right to Erasure: Request deletion of your personal data ("right to be forgotten")
• Right to Restrict Processing: Request that we limit how we use your data
• Right to Data Portability: Request transfer of your data to another service
• Right to Object: Object to processing based on legitimate interests
• Right to Withdraw Consent: Withdraw consent at any time where we relied on it

To exercise any of these rights, please contact us at privacy@strokelab.app. We will respond to your request within 30 days.

9. Cookies

We use cookies and similar technologies to enhance your experience, remember your preferences, and analyze usage patterns. You can control cookies through your browser settings; however, disabling certain cookies may limit your ability to use some features of our service.

10. Security

We implement industry-standard security measures to protect your data, including encryption in transit (TLS/SSL), secure authentication via OAuth, and restricted access to personal information. However, no method of transmission over the Internet is 100% secure, and we cannot guarantee absolute security.

11. Children's Privacy

StrokeLab is not directed to children under the age of 13. We do not knowingly collect personal information from children. If we become aware that a child under 13 has provided us with personal data, we will take steps to delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date. Continued use of the service after changes constitutes acceptance of the revised policy.

13. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy, please contact us at: