This Privacy Policy explains how the WPW Detector website and demonstration tool ("the Service", "we", "I") handle personal information. It is written to comply with Quebec's Act respecting the protection of personal information in the private sector (Law 25), and to be honest and clear about exactly what happens to the data you send.
The single most important thing to understand: the Service does not store your electrocardiogram. It is processed once, in memory, to produce a result, and then it is discarded.
1Who is responsible for your information
This project is run by an individual, not a company.
Person in charge of the protection of personal information (Privacy Officer):
Nathael Altman
Email: nathaelaltman@gmail.com
If you have any question about this policy, or if you want to exercise any of your rights described below, you can write to that address.
2What this Service is
The WPW Detector is a research and screening demonstration. It lets you upload a 12-lead electrocardiogram (ECG) and returns a suspicion level from 1 to 100 for Wolff-Parkinson-White pre-excitation, along with an explanation of what features influenced that level.
It is not a diagnosis, not a medical device, and not clinically validated. It exists to demonstrate a machine learning research project. Its full limitations are described in the Terms and Conditions.
3What information is involved
There are two kinds of information to be transparent about.
a) The ECG you choose to upload.
An ECG is health information, and health information is sensitive personal information under Law 25. When you upload an ECG file, its contents are read and analyzed by the model to produce your result. This is the only sensitive information the Service processes, and you only provide it if you actively choose to.
b) Technical connection data recorded by the hosting infrastructure.
Like every website and online service, the Service runs on hosting providers whose systems automatically record technical information when your browser connects, such as your IP address, the time of the request, and your browser type. This happens at the infrastructure level (see Section 6), not because the Service asks for it. An IP address can, in some circumstances, be considered personal information, so we disclose this plainly.
The Service does not ask for your name, your email, your date of birth, or any account. There is no login. There are no advertising cookies or trackers.
4What we do with the ECG, and what we do not do
When you upload an ECG:
- The file is received by the analysis server.
- It is extracted into a temporary working folder that exists only for the duration of your request.
- The model reads the signal and computes your result.
- The temporary folder and the file are deleted immediately after the response is sent, in every case, including when an error occurs.
We do not:
- store your ECG after the response,
- keep a copy, a backup, or an archive of it,
- record the file's name or its contents in any log,
- use your ECG to train, re-train, or improve any model,
- link your ECG to you in any way,
- sell, rent, or share your ECG with anyone.
The application's own logs contain only generic technical warnings (for example, "report generation failed"). They never contain the file, its name, or any part of the signal.
5Consent
Because an ECG is sensitive health information, Law 25 requires your express, specific, and informed consent before it is processed. Before you can run an analysis, the demonstration asks you to actively confirm, with a checkbox that is never pre-checked, that:
- you have read and agree to the Terms and Conditions,
- you have read and agree to this Privacy Policy,
- you expressly consent to your ECG being processed, in memory and without being stored, for the sole purpose of returning your suspicion-level result, including processing on servers located outside Quebec (see Section 6).
You are free to not give this consent, in which case you simply do not run an analysis. You may withdraw from the process at any time before submitting, by not uploading a file or by leaving the page. Because nothing is stored, there is nothing left to withdraw once your result has been shown.
Please only upload an ECG that is yours, or one you are authorized to submit. Do not upload another person's health information without their consent.
6Where your information is processed, and processing outside Quebec
The Service is operated using two hosting providers:
- The website is served by Vercel.
- The analysis server that processes your ECG runs on Railway, in a data center located in Amsterdam, in the Netherlands (European Union).
This means that when you submit an ECG, it is processed on a server outside Quebec and outside Canada, in the European Union.
Law 25 requires that, before personal information is processed outside Quebec, an assessment be made of whether the destination offers protection equivalent to that provided under Quebec law. That assessment has been carried out for this Service. The Netherlands is subject to the European Union's General Data Protection Regulation (GDPR), which provides protections that are recognized as equivalent to, and in several respects stronger than, those of Quebec law, including a right of access, a right of rectification, an independent supervisory authority, and effective remedies. The assessment concluded that processing in the Netherlands offers an equivalent level of protection.
The nature of the processing also limits the exposure: the ECG is processed transiently, in memory, and is not stored by the Service.
The hosting providers themselves record technical connection data (such as IP addresses) in their own systems, under their own privacy policies:
We do not control those providers' internal logs, but we have chosen providers that publish privacy commitments, and we minimize what our own application records to essentially nothing about you.
7How long information is kept
- Your ECG: not kept. It is deleted immediately after your result is returned. Retention is effectively zero.
- The result shown to you: displayed in your browser during your session only. It is not saved on the server.
- Application logs: contain only generic technical messages with no personal information.
- Infrastructure connection logs (IP, timestamps): retained by the hosting providers according to their own policies, for the time they need to keep their systems running securely.
8Security
The connection between your browser and the Service is encrypted using HTTPS. The analysis is performed transiently and the file is destroyed after use, which is itself a strong protection: information that is not kept cannot be leaked later. Access to the hosting accounts is protected by authentication.
No system is perfectly secure, and because this is an individual research project rather than a certified medical platform, you should treat it accordingly and not rely on it for medical decisions.
9Your rights
Under Law 25, you have rights over your personal information, including the right to access it, to have it corrected, and to withdraw your consent.
Because the Service does not store your ECG, there is in practice no stored personal information about you to access, correct, or delete once your result has been shown. This is by design: the strongest privacy protection is not collecting or keeping the information in the first place.
If you nonetheless have a question or a request about your personal information, or if you believe your privacy rights have not been respected, you can contact the Privacy Officer at the address in Section 1.
You also have the right to file a complaint with Quebec's privacy regulator, the Commission d'accès à l'information du Québec (CAI), whose contact information is available at https://www.cai.gouv.qc.ca.
10Children
This Service is not directed at children, and is intended for use by adults, or by a minor with the involvement of a parent, guardian, or health professional. Please do not upload a child's ECG without the authorization of the person responsible for them.
11Changes to this policy
This policy may be updated, for example if the hosting arrangements change. When it changes in a meaningful way, the "Last updated" date at the top will change, and the new version will be posted on this page. If the change affects where or how your ECG is processed, that will be reflected here before you are asked to consent again.
12Contact
For any question about this Privacy Policy or about how your information is handled:
Nathael Altman
nathaelaltman@gmail.com
This policy is written in plain language on purpose, as Law 25 requires. If anything here is unclear, please ask.