Compliance

Patient data
protection

Local data storage · EU-only AI processing · GDPR Art. 25 · HDS-Ready

Updated: October 2026

🔒
Local patient data
Reports and patient files are stored only on your machine. Only the AI features send the text or audio being processed to our AI sub-processor in the EU.
🛡️
One EU sub-processor
No cloud storage or analytics on health data. AI features rely on a single sub-processor, within the European Union.
🎙️
AI Dictation — processed in the EU
Sally AI audio is processed within the European Union. Audio is not stored by PISUM.

01 Data collected by PISUM

PISUM is designed according to the principle of Privacy by Design (GDPR Art. 25). The software distinguishes two fundamentally separate categories of data:

Account data (processed by PISUM)

Data Purpose Duration
Last name, First nameUser account creationSubscription duration + 12 months
Professional emailAuthentication & notificationsSubscription duration + 12 months
License keyActivation & anti-piracySubscription duration
OS / app versionCompatibility & technical supportRolling 12 months
✓ Health data — not collected by PISUM. Radiology reports, patient data (name, ID, date of birth), medical images and voice recordings are never transmitted to PISUM. Only the AI features send the dictated audio or the report text being processed to our AI sub-processor, which processes it within the European Union.

02 Secure architecture — local data

🔒 Patient data always local

Radiology reports, patient data and medical images are stored only on your machine. PISUM does not require an Internet connection for data entry and report export. Only the AI features (dictation, writing assistance) require network access: they send the audio or text being processed to our AI sub-processor in the European Union.

🎙️ AI Voice Dictation — processed in the EU

Sally AI voice dictation sends the dictated audio to our AI sub-processor, which processes it within the European Union; the text is sent back to your local machine. PISUM does not store the audio, and the sub-processor does not use it to train models. Do not dictate direct patient identifiers (name, date of birth, national ID number): type them on the keyboard.

Storage. Medical data is stored only on your machine and in your RIS/PACS. AI processing (dictation audio, report text for writing assistance) is carried out by our AI sub-processor within the European Union, without storage by PISUM.

03 Sovereignty and telemetry

🛡️ A single sub-processor, in the EU

The software runs on the user's workstation: no cloud host or analytics service stores medical data. The only sub-processor with access to health data is our AI sub-processor, used solely for AI features (dictation, writing assistance) and processing within the European Union; the list of sub-processors is available from the DPO on request. Legal archiving and secure storage remain the sole responsibility of the institution's RIS/PACS system.

📝 Anonymized application logs

To ensure software stability, PISUM generates local technical error logs. These files are strictly programmed to capture no business data:

  • No patient names, dates of birth, or identification numbers (ID).
  • No medical terms, report content, or voice transcriptions.
  • Only system error codes, loading times, and click events.

04 Patient rights (Art. 15 to 22)

The GDPR guarantees patients the right of access, rectification, erasure, and portability of their data. Given that PISUM retains no data after the application is closed, it is technically impossible to query or delete a patient file within it.

Exercising patient rights. The exercise of these rights must be directed to the Data Controller (the DPO of the clinic or hospital) who will intervene directly on the RIS/PACS or hospital information system (HIS) where the final reports are archived.

05 Contact & DPO

For any questions regarding data protection or to exercise your rights as a user of the PISUM service:

  • Email: support@pisum.app
  • Recommended subject: [GDPR] — your request
  • Response time: 30 days maximum (GDPR Art. 12)

Created by radiologists, for radiologists. 👨‍⚕️