Privacy Policy

This policy explains how Boring Radiology, Inc. (“we”) handles personal information collected through boringrad.com, m2radiology.com, bor.ing, and our hosted products (together, the “Services”). It does not cover Customer Data: the content our customers and their users submit to or generate in our products, including dictation audio, transcripts, documents, and protected health information (PHI). We handle Customer Data, including PHI, only as our customers direct, under our Master Terms and the Business Associate Agreement in place with each customer. Our standard agreements are at boringrad.com/legal/terms and boringrad.com/legal/baa.

What we collect

• Account information: name, work email, organization, and role, provided by you or your organization’s administrator.
• Sign-in and security data: one-time sign-in codes, IP address, browser and device information, and timestamps, used to authenticate you and protect accounts.
• Usage and diagnostic data: feature use, session and volume counts, service and audit logs, and error reports.
• Correspondence: anything you send to a boringrad.com address.

Our website has no forms, advertising, or analytics trackers. We and our hosting provider use only the cookies needed for sign-in, security, and keeping the sites working.

How we use it

To provide, secure, support, and bill for the Services; to communicate with you about your account; to analyze and improve the Services; and to meet legal obligations. We do not sell or rent personal information, and we do not use it for advertising.

Who we share it with

Your organization: its account administrators can see account information and activity records for its users.

Service providers that host and operate the Services for us (for example, cloud hosting, email delivery, and error monitoring), under contracts that limit their use of the data. Our current subprocessor list is available on request.

Others, when required by law or legal process, to protect the rights, property, or safety of our users, the public, or us, or as part of a merger, acquisition, or sale of assets. In that last case, this policy continues to apply to the information transferred.

Retention and security

We keep account information while your organization’s account is active and delete it as described in our Terms after the account ends, except where we must keep records (such as audit logs) longer by law. We protect information with encryption in transit and at rest, access controls limited to staff who need it, and multi-factor authentication for all staff accounts.

Your choices

You can ask to access, correct, or delete your personal information by emailing legal@boringrad.com. We may need to verify your identity. If your account is managed by your organization, we may refer your request to them. The Services are for healthcare professionals and staff and are not directed to children under 16, and we do not knowingly collect information from them.

Changes and contact

We’ll post changes here and update the effective date. Questions: legal@boringrad.com · Boring Radiology, Inc., 1207 Delaware Ave #5445, Wilmington, DE 19806.