No server-side report archive
Draft report text lives in your browser, and account export excludes report drafts by design. Bounded records described below can hold short report fragments for safety auditing.
What we claim, and what we do not.
Revelar is a reporting workspace for licensed radiologists. You stay the author of every report. This page states the boundary in plain language.
Intended use
Reporting assistance
Wording changes
You approve them
Report drafts
No server archive
Processing
EU-first
Scope
The boundary
Revelar transforms what the radiologist provides. It never creates clinical content.
Revelar does
- Transcribe your live dictation
- Place your dictated words into your own templates
- Suggest formatting, spelling, and wording corrections
- Show every suggestion for your approval
- Keep your templates, study types, and preferences
Revelar does not
- Detect, identify, or reduce missed findings
- Diagnose, stage, triage, or prioritise
- Recommend follow-up, treatment, or imaging protocols
- Read, interpret, or analyse medical images
- Claim CE marking, MDR, or EU AI Act compliance
- Claim ISO 27001 or SOC 2 certification
Safeguards
Controls running in production today
These are product behaviours in code, not intentions. Each one is covered by tests in the repository.
You approve every wording change
Review-class suggestions stay pending until you accept them. Nothing rewrites your report behind your back.
Stale suggestions cannot apply
Every edit carries a fresh report hash. A suggestion computed against older text is rejected.
No tool-selection surface
The report assistant cannot choose its own tools. Each check runs as a fixed, non-agentic phase, so there is no path to a clinical reasoning tool.
Row-level security on account data
Database policies, auth checks, and organisation membership checks guard account and organisation data.
Nothing cached offline
The service worker never caches report text or API responses, so report content stays off offline storage.
Bounded records, with published retention
Safety-audit snippets are capped at 600 characters and deleted after 180 days. Developer diagnostics are deleted after 30 days. Learned preferences stay yours to view, edit, and remove.
Data
Where your data goes
Providers that may process data when their feature is in use. Full DPAs, regional evidence, and retention terms are still being collected; ask us for the current state.
ProviderPurposeRegion
SupabaseAuth, database, account and organisation dataEU (Frankfurt)
VercelHosting and serverless runtimeEU-first
Vercel AI GatewayAI request routing under zero data retentionRoute-dependent
AI model providers (OpenAI, Google, Anthropic)AI generation, routed through the gatewayRoute-dependent
SonioxRealtime dictationEU-first where documented
StripePayments and billingEU / Global
ResendAuth and support emailEU / Global
Documents
Read the detail, or ask us
Privacy notice
Account data, workspace text, AI processing, dictation, retention, your rights, and cookies.
Legal noticeCompany identity, registered address, enterprise and VAT number, and terms boundary.
Privacy mailboxprivacy@revelar.xyz for rights, deletion, DPA, and processor questions. support@revelar.xyz for product support.