Privacy Policy

YSOTOPE Theranostics S.L. ("the Company," "we," "us," or "our") (Avinguda Diagonal 640, Planta 6, 08028 Barcelona, Spain) is the data controller for personal data processed through getysotope.com. You can contact us at [email protected] for any data-protection matter, including to exercise the rights described below.

YSOTOPE builds AI-assisted radiopharmaceutical dosimetry software for nuclear oncology departments. Our core platform reads molecular imaging data from PET and SPECT scans submitted by oncology centres, constructs patient-specific pharmacokinetic models, and generates personalised absorbed-dose recommendations for targeted radionuclide therapy. This policy explains what personal data we collect through this website and, where applicable, through our clinical dosimetry platform, and how we process it.

1. Data Controller

YSOTOPE Theranostics S.L. (Avinguda Diagonal 640, Planta 6, 08028 Barcelona, Spain) is the data controller for personal data processed through getysotope.com. For enquiries about this policy or your data-protection rights, contact us at [email protected].

Where oncology centres upload patient scan data to our clinical platform, the Company acts as a data processor on behalf of those centres, which are the data controllers for their patients' health records. That relationship is governed by the data-processing agreement we enter into with each partner institution.

2. Personal Data We Process

Through this website and our clinical access programme, the Company processes the following categories of personal data:

• Identity and contact data you provide when requesting early access, scheduling a clinical demo, or submitting a contact form (name, email address, phone number, job title, institution name);
• Communications content (messages, questions, and correspondence you send us);
• Account credentials for clinicians and physicists who hold platform access (hashed passwords; we do not store plain-text credentials);
• Technical data collected automatically when you visit the site (IP address, browser type and version, operating system, pages visited, referral source, session duration);
• Analytics data, where you have given prior consent through our cookie banner.

Regarding clinical imaging data: when an oncology centre uploads PET or SPECT scan files to our dosimetry platform, those files may contain patient health data (a special category under GDPR Article 9, specifically data concerning health). The Company processes such data solely to generate the dose calculation requested by the treating institution and does not use clinical imaging data to train machine-learning models without the explicit written consent of the responsible data controller. We do not link imaging data to identifiable individuals in our own systems; the institution retains responsibility for maintaining the linkage between a scan and a named patient.

3. Purposes and Legal Bases (Article 6 GDPR)

The table below sets out each processing purpose and its legal basis under Article 6 GDPR. Where health data (Article 9 GDPR) is involved, the basis is additionally Article 9(2)(h) (processing necessary for the provision of health care under contract with a health professional) or Article 9(2)(j) (scientific research) as applicable, and always subject to the data-processing agreement with the relevant institution.

Purpose	Legal basis
Responding to early-access requests and clinical enquiries	Pre-contractual steps / legitimate interest (Art. 6(1)(b)/(f))
Operating and securing the platform and website	Legitimate interest (Art. 6(1)(f))
Processing clinical scan data to generate dose reports on behalf of partner institutions	Performance of contract with the institution (Art. 6(1)(b)); Art. 9(2)(h) for health data
Legal compliance and regulatory record-keeping	Legal obligation (Art. 6(1)(c))
Analytics cookies (website usage measurement)	Consent (ePrivacy Directive + Art. 6(1)(a))

4. Recipients and International Transfers

Personal data is shared only with processors acting under Article 28 GDPR data-processing agreements. These include our hosting provider (infrastructure within the EU/EEA), email-delivery services, and, where consent is given, analytics software. We do not sell personal data to third parties.

Where a processor operates outside the EU/EEA, we rely on Standard Contractual Clauses approved under Article 46 GDPR and, where relevant, conduct transfer-impact assessments in line with the guidance following the Schrems II ruling. Clinical imaging data is processed exclusively on infrastructure located within the EU.

5. Retention

We retain personal data only for as long as necessary for the purposes described. Specifically:

• Early-access and contact enquiries: 24 months after last contact or until the commercial relationship begins, whichever is longer;
• Platform account data: for the duration of the partner agreement, plus 5 years for regulatory and audit purposes consistent with obligations applicable to medical software providers operating in the EU;
• Clinical scan data processed on behalf of partner institutions: in accordance with the retention schedule agreed in the data-processing agreement, typically returning or securely deleting data within 90 days of report delivery unless a longer period is contractually required;
• Server access and security logs: 90 days.

6. Your GDPR Rights

As a data subject under the EU General Data Protection Regulation, you have the following rights with respect to personal data the Company holds about you:

• Right of access (Art. 15): you may confirm whether we process your data and request a copy;
• Right to rectification (Art. 16): you may ask us to correct inaccurate data;
• Right to erasure / right to be forgotten (Art. 17), subject to limited exceptions (for example, where retention is required by law);
• Right to restriction of processing (Art. 18);
• Right to data portability (Art. 20), where processing is based on consent or contract;
• Right to object (Art. 21), including to direct marketing at any time without further conditions;
• Right not to be subject to solely automated decision-making with legal or similarly significant effects (Art. 22). The Company does not engage in automated decision-making of this kind.

To exercise any of these rights, email [email protected]. We will respond within one calendar month; for complex or multiple requests that period may be extended by two further months, and we will notify you of the extension within the first month.

If you are a patient at an institution that uses our platform, please direct data-subject requests to that institution in the first instance, as it is the controller for your health records.

7. Right to Lodge a Complaint

You have the right to lodge a complaint with the competent supervisory authority. In Spain, that authority is the Agencia Espanola de Proteccion de Datos (AEPD), reachable at www.aepd.es. You also retain the right to complain to the supervisory authority of your country of habitual residence or place of work if it is within the EU/EEA. A complete list of EU/EEA authorities is available at edpb.europa.eu.

8. Cookies

See our Cookie Policy for full details on the cookies we use and how to manage your preferences. Non-essential cookies (analytics) are not set until you give your prior consent through our cookie banner on first visit.

9. Security

The Company implements technical and organisational measures appropriate to the risk presented by processing clinical and contact data. These include TLS encryption in transit for all data exchanged with getysotope.com and our platform API, encrypted storage for clinical scan data at rest, role-based access controls limiting who can access uploaded scan files, and regular review of access logs. Our security practices are designed with the requirements of EU medical device software guidance in mind, though we make no certification claims beyond what is stated here.

10. Changes to This Policy

Material changes to this Privacy Policy will be reflected by an updated "Last updated" date at the top of this page. Where a change affects how we process data in a way that requires your consent, we will request renewed consent before the change takes effect.

11. Contact

YSOTOPE Theranostics S.L.
Avinguda Diagonal 640, Planta 6
08028 Barcelona, Spain
Email: [email protected]
Phone: +34 93 550 4200