Where your patient's scan goes
This page answers the questions surgeons ask before they upload. It is a plain description of the actual setup. The legal terms are in the Privacy Notice and the Data Processing Agreement referenced in the Terms of Service.
Upload
Files go from your browser straight to encrypted object storage over HTTPS. They do not pass through an email inbox or a shared drive. Each order gets its own upload link, and the link expires.
Who can see the files
At MedForm3D, only our staff accounts can open your files, and staff sign in with a password. You sign in with a link or a six-digit code that we email to you. Nobody outside the workshop gets the scan unless you add a colleague to the project, or ask us to.
What we keep, and for how long
The scans you upload are deleted 90 days after the project is shipped or cancelled. Want them gone sooner, or kept for a later revision? Send us a message on your project page or write to info@medform3d.com. The other retention periods are in section 8 of the Privacy Notice.
Which services are involved
- Hosting and file storage: Vercel
- Order database: Upstash (Redis)
- Transactional email: Resend. Order confirmations carry the fields you entered, not the scan.
- Payments: Stripe. Card data never touches our systems.
What we do not do
- We do not use patient scans to train anything or to build products for other customers.
- We do not send patient data to a third party for segmentation.
Questions
Write to info@medform3d.com. We answer privacy requests, such as a request to see or delete your data, within 30 days. The details are in the Privacy Notice.