Privacy Policy

Effective: November 5, 2026 · Last updated: November 5, 2026

RT Image Matching Trainer is the name of an educational software product, not a separate business or legal entity. This Privacy Policy explains how Craig Utter, the individual provider and operator ("we", "us", or "our"), handles personal information when you use the website, trainer, account, and related services (the "Service"). It also explains your choices and rights.

1. Personal information we collect

Daily Classroom Challenges: optional daily registration practice within an active class. Challenges may become available automatically when a class has no existing challenge settings. Existing pause and board-visibility choices are preserved. The class owner or an authorized co-instructor can pause challenges or hide the leaderboard. Each day has one class case and a fixed starting setup and timer for each difficulty. Starting an attempt creates a private classroom record; these attempts do not count toward required coursework or grades. A separate, unchecked choice for each day lets a learner share their best accepted match overall and at each difficulty with current classmates and authorized class staff on a private class leaderboard. Challenge availability does not itself authorize that sharing. The board shows a random daily alias, rank, difficulty, points, maximum translation error in millimetres and maximum rotation error in degrees. Your own row is marked for you. It does not show names, account identifiers, speed, attempts, adjustments or detailed work. Higher points rank first. Accuracy breaks a points tie, and equal points and accuracy share a rank. A previous choice to share accuracy alone does not enable sharing difficulty or points. Rankings can change while eligible work remains open.

We store the day's sharing choice, random alias, disclosure version, choice revision and update time in Neon. Withdrawal immediately removes the result from subsequent board reads; it does not delete the learner's private attempt record. Leaving, roster removal or class archiving clears the sharing choice, and re-enrollment requires a new choice. An instructor can hide the board. Class or account deletion removes associated sharing records and mutation receipts, subject to provider backup cycles. This daily choice is separate from independent public leaderboards and from required legal acceptance. Do not include student or patient information in free-text fields.

Former-student history boundary. When a student leaves or is removed, or when a class is archived, we freeze the learner-visible class name, term, description, instructor, and teaching-staff list. The read-only view contains only modules first published before that boundary, plus any module on which the student already has an attempt. Later class activity and announcements are not disclosed through that past-class view.

Where this information comes from. We receive information directly from you or your class instructor, from the verified account email maintained by Clerk when you request instructor access, automatically from your browser and use of the Service, and from providers that operate the account, security, payment, hosting, classroom, leaderboard, legacy billing, and support-email functions described below. We infer only limited information needed for those functions, such as approximate region from network data and matching patterns from your private scored-history summaries. We do not buy student profiles from data brokers.

What is required and what is optional. An email address, a password handled by Clerk, necessary session and security data, agreement to the current Terms and acknowledgement of this Privacy Policy, and confirmation that you are at least 18 are required to create an account and use authenticated trainer features. If you do not provide them, you can still read the public website and guides but cannot use authenticated features. Joining or staffing a class, joining a particular Live Lab, requesting instructor access, and labelling a class with a school are optional. An instructor request requires the school, educational role, intended use, application acknowledgement, and a verified account email; the program name and expected student count are optional. If you join or staff a class, the display-name snapshot and classroom records described above are shared with the class owner and authorized staff according to their roles. A live-lab station label is optional. Your name, public leaderboard name display, daily class-board sharing, project-update emails, microphone access, support messages, and any one-time support payment are otherwise optional. Public challenge sharing is optional and requires a separate affirmative choice in Account settings.

Optional email updates

The optional signup and Account settings checkbox uses your verified primary account email; you do not need to enter it again or confirm a separate mailing-list email. We store your choice, the identifier of that verified email, the consent wording version, the time of the choice, and whether it was made at signup or in Account settings in server-controlled private Clerk account metadata. This record does not contain training or classroom activity. A signup choice waits only in the existing tab-scoped acceptance marker until the account is created, for no more than 30 minutes.

If you opt in, we send your verified email address and a random contact-binding value to Resend to maintain the project updates mailing list. We do not include your training or classroom activity. Upstash retains the private account-to-contact link, email address, consent revision and synchronization state so we can update or remove the delivery contact even after the account is deleted. Synchronization is attempted when you save and through signed account and email-provider events; temporary failures are retried.

Uncheck the box in Account settings or use an update email's unsubscribe link to withdraw your choice. Creating an account, accepting required terms, or leaving the signup box unchecked never subscribes you automatically. Changing your primary email or losing verification removes the old delivery contact; a new primary address requires a new opt-in. Account deletion removes the preference, our contact binding and the Resend contact created for this list. If a contact already existed for another purpose, we remove only its membership in our updates list. Past delivery and suppression records may remain under the provider's retention policies. Each update includes an unsubscribe link. We do not enable open or click tracking for project updates.

2. How and why we use personal information

• Provide the Service: create and secure accounts, authenticate users, deliver protected case files, save progress and preferences, and provide account support.
• Provide training and engagement features: save progress, course learning records and private study workspaces, show achievements and replay summaries, review instructor access applications, administer server-side instructor roles and optional school labels, administer private curricula, classes, ordered modules, announcements, scoped teaching-staff access, explicitly joined supervised live-lab coordination, server-graded registration assignments, simulator-reported Full Treatment assignments, instructor observation rubrics, additive student access adjustments, and targeted follow-up, provide optional Daily Classroom Challenges with a separate daily class-board sharing choice, show authorized class staff only the roster and teaching records their role permits, publish eligible challenge results only after an explicit sharing choice, honor withdrawals, display a public name only after a separate choice, enable browser voice coaching only after microphone permission, and enforce challenge-attempt and abuse-prevention limits.
• Provide on-device review and simulator controls: personalize Match review feedback for Practice reviews and scored 2D/2D, CBCT, and Full Treatment results, compare recent patterns with lifetime history, use compact replay summaries, compare session-only suggestion outcomes, and interpret approved Machine Room commands. Review responses, fixed-rule case ranking, and Machine Room command interpretation run entirely in your browser and make no model-provider or tutor API request. We do not send prompts, commands, replies, or scored training histories to an AI provider, and we do not use student activity to train a shared, foundation, or general-purpose AI model. Match review also does not train a personal model: it applies fixed rules without fitted weights. CT Simulation notes, measurements, simulator-rendered views, and report generation likewise remain local to the current page unless you choose to download a report to your device. Exact simulator rules control correction directions, tolerances, grades, Full Treatment outcomes, and safety statements; recommendations cannot change them. Existing Machine Room controller rules, not Room command help, control movement limits, collision feedback, and interlocks. Room command help cannot start Beam On or VMAT.
• Administer payments: record and reconcile optional one-time support payments, respond to payment questions, handle disputes or refunds, maintain any legacy subscription controls and records, and keep required financial records.
• Operate and protect the Service: troubleshoot failures, prevent abuse and bulk scraping, enforce access controls, investigate security events, and maintain performance.
• Communicate: answer support requests and send service, account, legal, privacy, or billing notices. If you separately opt in during signup or in Account settings, we may also send occasional project updates about new cases, features, and teaching resources to your verified primary account email. This choice is optional, starts off, and does not affect access.
• Comply with law: meet legal, tax, accounting, fraud-prevention, and enforcement obligations and protect rights, safety, and the integrity of the Service.

3. Legal bases where GDPR or UK GDPR applies

• Contract: account creation, authentication, protected-content delivery, synced progress, optional instructor access requests and school affiliation, private classroom participation and assignment administration where necessary to provide features you request under our contract with you, local coaching and simulator controls, account support, an optional support payment you choose to make, and any applicable legacy billing administration.
• Consent: optional project-update emails, optional public challenge leaderboard participation, optional publication of a result on a Daily Classroom Challenge leaderboard, optional public leaderboard name display, and optional microphone capture and third-party speech recognition. These choices are separate from agreeing to the Terms and acknowledging this Privacy Policy. You can stop project updates in Account settings or through an update email's unsubscribe link, withdraw daily class-board sharing through that day's sharing control, and withdraw public challenge participation or name display in Account > Trainer preferences. Removing public results remains available even when renewed training-policy acknowledgement or a training-profile load is pending. Releasing or cancelling push-to-talk stops further microphone capture; you can also revoke microphone permission in your browser. Audio already transmitted may already have been processed. Withdrawal does not affect earlier lawful processing. Withdrawing class-board sharing removes the result from subsequent board reads but does not delete the underlying private attempt record.
• Legitimate interests: securing, debugging, maintaining, and improving the Service; preventing abuse; responding to non-account inquiries; and protecting legal rights. You can object to this processing using the contact details below.
• Legal obligation: tax, accounting, payment, lawful-request, and similar records or disclosures.

An institution's use of classroom records requires its own appropriate authority and lawful basis. Where we process records on an institution's behalf, the applicable agreement must define the parties' roles, permitted purposes, and instructions. Accepting these Terms or this Privacy Policy does not itself create that agreement or authorize unrelated uses of student records.

4. Service providers, subprocessors, and disclosures

This is our published service-provider inventory. A provider’s role depends on the processing and the applicable agreement; payment providers may act independently for their own payment and legal obligations. For an institutional DPA, the parties must agree which providers act as subprocessors, their processing locations and transfer safeguards, and any change-notice or objection procedure. We disclose only what is reasonably needed for the purposes above:

• Clerk provides account creation, authentication, session security, account storage including your leaderboard participation and name-display choices, and any legacy billing controls.
• PayPal independently operates the hosted one-time support checkout and processes payment credentials, payment methods, fraud checks, receipts, transaction records, disputes, and refunds under its own Privacy Statement. Our site links to, but does not embed, that checkout.
• Stripe may retain or process historical transaction information and any applicable cancellation, dispute, or refund activity for a legacy supporter subscription previously handled through Clerk Billing.
• Vercel hosts the site, server functions, private Blob case files and normalized school logos, content delivery, and operational/security logs.
• Upstash stores the separate public-sharing receipt and leaderboard records for accounts that explicitly opted in, along with short-lived ranked-run setup and start records, and provides short-lived IP- or user-based rate limiting. It stores the pseudonymous voice reservation and usage counters described in Sections 1 and 7, without audio or transcripts. It also stores a one-bit marker under a SHA-256 hash of your internal account ID so a one-time sign-in announcement is not repeated across devices. The marker contains no name, email, session, timestamp, or training activity; it remains until account deletion. For optional project updates it separately stores the private account/contact binding and synchronization state described above, removed after delivery-contact cleanup.
• Neon provides the private Postgres database used for your synced training profile (stored under your internal Clerk user ID, readable only through your own authenticated session, and deleted with your account), personal course learning records and private registry study preferences, bookmarks and notes, assigned course work, instructor access applications and role grants, school identities, affiliations and verified-email snapshots, curricula, class identity and revision state, memberships and scoped staff roles, ordered modules and deployed-course snapshots, announcements, linked live-lab sessions and check-ins, latest presence and help-acknowledgement state, server-graded registration attempts and replay check points, Daily Classroom Challenge settings, daily cases, private attempts, sharing choices, random aliases, disclosure versions and mutation receipts, simulator-reported Full Treatment summaries, observation rubrics and student-release choices, additive access adjustments and their instructor-entered reasons, targeted follow-up links, instructor feedback, retry grants, historical revoked consent records from the retired personal training-summary sharing feature, without training content, and private presentation drafts and school publication history including logo-permission statements.
• Apple iCloud Mail hosts the support@rtimagematch.com mailbox and processes support correspondence and email metadata.
• Resend, when automatic instructor email is enabled, processes the verified applicant email address, school name, educational role, submission time, approval confirmation when applicable, and email delivery metadata. It sends new-request notifications to the site owner at support@rtimagematch.com and an instructor acceptance notification to the applicant after approval. For separately opted-in project updates, Resend stores the verified email address, a random contact-binding value, list membership and subscription status, and processes update messages, delivery results and unsubscribe requests. The Service sends no institution invitation email. These notifications do not include classroom rosters, student results, or sign-in credentials.
• Cloudflare provides authoritative DNS and the Turnstile security challenges Clerk may use during account authentication. Turnstile processes connection, browser, and anti-bot signals to decide whether a challenge is needed; it does not host the support mailbox.
• Deepgram: processes short push-to-talk clips sent through our authenticated server. We request model-improvement opt-out; see Section 6 for retention and use.

We may also disclose information when reasonably necessary to comply with law or valid legal process; protect a person, rights, or the Service; investigate fraud or security incidents; or complete a merger, financing, reorganization, asset sale, or similar transaction. In a transaction, the recipient must handle personal information consistently with applicable law and any notice we provide.

Public disclosure: after you explicitly enable leaderboard participation, the alias or separately selected display name, best challenge time, maximum residuals, rank, challenge period, tier, and case sequence are publicly available. Regular-case personal bests are not published. Public sharing starts off. Withdraw it in Account settings if you no longer want challenge results posted, and do not enable name display if you do not want that name connected with your results.

Shared Live Labs. When you open a shared lab, the class follows the instructor’s simulated case, including Full Treatment. Checked-in students and the class facilitators can see the current simulator images, slices and adjustments. The instructor can give one student control of the image and take it back. Upstash temporarily holds the latest simulation image views, the current control grant, a tab identifier and pending image adjustment. These expire when the presenter stops updating the room. Shared images and adjustments are not saved in class reports. Attendance, help requests and exit answers follow the class retention rules.

Patient triangulation Live Labs. If your instructor assigns you to a two-student pair, you and your partner share accepted simulated patient and couch positions, readiness, fixed coordination cues and setup-check feedback. You can access only your assigned pair. Authorized teaching staff see the roster, attendance, readiness and checked progress, not the pose, hidden initial error or alignment residuals. Neon stores pair assignments, roles and private retry records with the lab. Deleting either participant’s membership, attendance record or account removes the pair; deleting an actor’s account also removes their private retry records. Retry records can be used for up to 24 hours while the lab and access remain valid, and are pruned on later pair changes; inactive labs can retain expired records until lab or actor-account deletion. Upstash privately holds the canonical simulated pose, internal account, attendance and tab identifiers, readiness and bounded retry state. These records expire at the earlier of lab expiry or 24 hours, including inaccessible state temporarily left after pair or account deletion. New requests cannot read or control a removed pair. This activity does not enter assignments, grades, leaderboards, XP or your training profile.

Earlier Full Treatment Live Labs. Joining an individual treatment lab created before shared rooms became available allowed the simulator to save each run’s start and end times, completion or early-exit status, and simulator-reported imaging, delivery, treatment-field, monitor-unit, collision, residual, scan, hold, and re-image summary. Repeats are retained separately. These ungraded records are visible only to you and authorized teaching staff for that class, follow the existing Live Lab retention and deletion rules, and may be included in a private instructor report. A disconnect without a saved outcome is not recorded as a failed treatment. Shared class displays do not show individual treatment outcomes.

Class disclosure: class rosters, curricula, modules, announcements, live-lab check-ins, rubrics, adjustments, replays, and assignment results are not public. Students can see only their own assigned records, effective adjustment, and personal history, not the instructor-entered reason or another student's detailed activity; the separately opted-in Daily Classroom Challenge board shares only the limited result fields described in Section 1; an observation rubric or replay is shown to the student only after authorized staff separately releases it. A student who leaves or is removed, or whose class is archived, retains a read-only view of the frozen class context and work first published before the relationship ended, plus modules with their own attempt, while those records are retained. Later class activity and announcements are excluded. The class owner and authorized co-instructors, graders, or observers can see or manage only the class information permitted by their role. One-time staff codes must be shared only with the intended authorized educator.

Personal training history: your own training profile remains private to your account and is not shared with Classroom. The optional personal-summary sharing feature has been removed. Previously copied summaries have been deleted from the active database and cannot be refreshed or restored by an older app tab. Assigned-module results and authorized Live Lab attendance remain separate classroom records.

Instructor application disclosure: instructor access applications are not public. Application details and verified account emails are available only to the applicant and the site owner, except that the applicant view does not repeat the stored email address.

School disclosure: school affiliations are not public. Only the site owner can see which instructors are affiliated with a school and their verified-email snapshots, record or change a school, or globally revoke an instructor; a durable denial prevents a later application or school change from undoing that decision until a later site-owner approval. An instructor sees their own school, not other instructors' affiliations or any email list. A class's school label is visible to that class's members as part of the class information they already see; it names no person. School affiliation alone reveals no student, roster, class, assignment, or attempt information and grants no class-level access.

5. Cookies, local storage, and tracking choices

On our site, we use Clerk cookies and similar storage that are necessary for sign-in, sessions, fraud prevention, and security. The trainer uses local storage for progress and preferences, a short-lived tab marker for pending legal acceptance, and a service worker that may cache public app files for faster or offline-tolerant loading. Course working copies can use account-scoped local storage and sync through the authenticated APIs described above. CT Simulation's fictional documentation workspace remains in page memory rather than being synced or uploaded. Files you choose to download are controlled through your device and chosen applications, not browser site-data controls. You can remove browser-held data through site-data controls, but blocking essential cookies can prevent sign-in or protected cases from working.

Clerk's session cookies are first-party or same-site, strictly necessary, and are not used by Clerk for cross-site tracking. Clerk may process authentication events and browser, device, IP-address, and security signals to operate and protect accounts, and may summarize production sign-in, sign-up, and retention activity in its authentication dashboard. PayPal may process cookies, device data, IP addresses, transaction activity, and payment details on its hosted checkout for payment administration, fraud prevention, and legal compliance. Stripe may do the same for legacy billing controls. We do not embed PayPal advertising code or ask these providers to target advertising to you.

We do not currently use an advertising network, behavioral-advertising pixel, or a general audience-analytics product, and we do not set advertising cookies. We do not respond differently to browser "Do Not Track" signals because we do not engage in cross-site behavioral tracking. See Section 9 for Global Privacy Control. Optional Clerk SDK product telemetry is disabled. Because we do not currently use optional advertising or audience-analytics cookies, there is no optional-cookie consent banner. If we introduce consent-based optional tracking, it will remain off until you choose it, with an equally accessible way to reject optional tracking and withdraw consent.

6. Push-to-talk microphone coaching

Standalone DIBH, partial-breast Full Treatment, CT Simulation DIBH, and microphone tests use push-to-talk only. Hold the talk button or its keyboard key to capture one short instruction; release ends microphone capture. Opening an exercise or enabling voice does not start listening. Losing focus or leaving the exercise cancels capture and pending recognition.

While push-to-talk is held, the browser streams audio through our authenticated server to Deepgram Nova-3 for speech recognition. Releasing stops microphone capture immediately; the completed instruction is applied only after the remaining audio has been processed. Cancelling stops further transmission and discards pending instructions; audio already streamed has already been processed by the provider. Audio and recognized text are processed transiently and are not saved or logged by the trainer. We request exclusion from Deepgram's model improvement program on every transcription request. Deepgram states that opted-out audio and transcripts are not retained after processing; request metadata and usage logs remain subject to Deepgram's data practices. The local microphone level meter does not transmit its samples. We do not create voiceprints or use voice for identification.

Recognized text appears only in the current page and controls the fictional patient's breathing through a fixed coaching vocabulary. A case record may retain matched command identifiers, but not the transcript or audio. Voice cannot start irradiation or acquisition. Microphone-dependent exercises require a successful spoken-command test or recognized coaching; if you decline microphone access or third-party processing, choose another exercise. You can revoke microphone permission in browser settings.

7. Data retention

• Account and synced training profile: while the account is active, then deleted or de-identified when the account is deleted, subject to provider backup cycles and records we must keep by law. The synced training profile is stored in Neon and is removed by the same verified account-deletion event that removes classroom records; the hash-only deletion guard described below then prevents a delayed save from recreating it. Up to three compact Full Treatment replay timelines remain with the profile until you reset progress or delete the account.
• Local progress, preferences, and cached files: until you clear site data, uninstall the app, or the browser evicts them.
• Course learning records: personal course progress remains until you reset it or delete the account. Private registry study preferences, bookmarks, and notes have a separate workspace reset; resetting personal progress does not erase those records or assigned course submissions. Assigned course work follows the Classroom retention rules below. Account deletion removes associated course records from the active database, subject to provider backup cycles; deleted-account guards reject later writes. Browser working copies can remain until the relevant reset, a detected sign-out or account change, site-data clearing, or browser eviction. Copies you download remain on your device until you delete them.
• Match review page memory: review questions and answers remain only in the current page until a new result replaces them or the page reloads. Fixed-rule ranking results and suggestion-to-next-result outcome comparisons remain only until reload. None of this page-memory data is synced to your account.
• Room command help commands and replies: only for the current in-page Machine Room session; they are discarded when you leave the room or reload the page and are not added to your account or training profile.
• CT Simulation local workspace and downloaded files: fictional notes, measurements, comments, simulator-rendered views, and report state remain in page memory until the exercise is reset, replaced by a new exam, or the page reloads; closing the completed exam or leaving CT Simulation can retain it for later review in that page. It is not synced to your account or received by us. A report, progress export, classroom calendar file, personal classroom-history CSV file, or instructor cohort-progress CSV that you download remains on your device until you delete it.
• Leaderboard data and sharing receipt: until you turn participation off, delete the account, or the leaderboard is discontinued. Turning it off removes the sharing receipt, stored rows and active ranked runs when the server confirms the request. Earlier default-on standings are no longer served; their storage cleanup is tracked separately and can also be requested through the same removal control. A verified account-deletion event also removes independently stored leaderboard rows.
• Ranked-run, attempt-limit, and rate-limit data: ranked-run setup and start records expire within four hours and are removed sooner after submission or opt-out. Per-account ranked-attempt counts expire automatically eight days after the applicable challenge period resets and may remain until that scheduled expiry after leaderboard opt-out or account deletion. Ordinary rate-limit counters generally expire around their enforcement window—currently about 60 seconds and up to about 10 minutes for class-join protection. An opaque privacy-write guard keyed by a SHA-256 hash of the internal account ID prevents delayed leaderboard writes from restoring removed data. It contains no name, email, or activity and expires 24 hours after the last guarded request or cleanup. These safeguards may be kept longer when needed to investigate active abuse or a security event.
• Voice protection records: an active reservation expires within 60 seconds and is normally removed earlier when processing settles. The per-account request counter expires within 120 seconds after its last update. Per-account and site-wide daily usage counters expire approximately 60 seconds after the applicable UTC day ends. These short-lived records can remain until their scheduled expiry after account deletion. Deepgram's separate request metadata and usage records follow the provider practices described in Section 6.
• Classroom records: while the class and account records remain active and the records are needed to provide the classroom feature, respond to a request, or protect the Service. This includes private Daily Classroom Challenge attempts and their separate sharing records. Leaving, roster removal, or class archiving blocks new activity but preserves the bounded read-only history described above using context frozen at that boundary; deleting the archived class or relevant account is the normal removal boundary. The class owner may choose automatic deletion 90, 180, 365, or 730 days after archive, after confirming the class name, export options and the school’s retention policy. Manual retention remains the default. A scheduled deletion date is shown in the instructor workspace at least 30 days before deletion; the owner can cancel it or restore the class. Scheduled deletion removes the class and its associated grades, attempts, roster and attendance, subject to provider backup cycles. All copies from the retired personal training-summary sharing feature have been deleted from the active database, subject to provider backup cycles. Only revoked consent records without training content remain until membership, class, or account deletion. Account deletion removes that student's memberships, targeted assignments, access adjustments, attempts and replay points, release choices, live-lab check-ins, historical personal training-share consent records, and staff access where applicable. Deleting a class-owner account removes owned curricula and classes with their staff, announcements, live sessions, rubrics, release choices, personal training-share records, and associated records, subject to provider backup cycles and records we must keep by law. Neon retains a SHA-256 hash of the deleted account's internal Clerk user ID as long as needed to prevent a racing or later classroom request from recreating deleted records; this deletion guard does not contain the account's email, name, or classroom activity.
• Instructor access applications: while the account or instructor role remains active and while pending, declined, revoked, or approved application history is reasonably needed to administer access, handle a resubmission, respond to a request, or protect the Service. Account deletion removes the application and role grant from the active database, subject to provider backup cycles and records we must keep by law.
• School affiliations: while the school, affiliation, related instructor access, or site-owner denial record is active and while the record is reasonably needed to administer affiliation, enforce a revocation, respond to a request, or protect the Service. The site owner may end an affiliation or global instructor access for an instructor. Account deletion removes that account's affiliation, role grant, and active denial record, removes its verified-email affiliation snapshot, and neutralizes its identity in retained school-creation records, subject to provider backup cycles and records we must keep by law. A school may remain for other instructors. Records from the retired institution invitation feature keep no email address and remain only as neutralized administrative history.
• Storage monitoring: we retain up to 90 days of daily aggregate database size, class and cleanup counts, and provider restore-history usage. These measurements contain no student names, account identifiers or classroom content.
• Operational and CSP logs: for the short period made available under our hosting plan, generally no more than 30 days, unless a specific entry is needed longer to investigate an incident, enforce rights, or comply with law.
• School presentation drafts and history: private drafts are recoverable for 30 days. Expired draft content is cleared on the next draft access or by the daily cleanup job; scheduling delays mean erasure may occur after day 30. A revision marker remains to reject stale browser saves. Discarding a draft clears its content, and loss of the relevant editor access or account deletion removes the draft. The latest 20 school publication snapshots retain their content and any logo-permission statement; account deletion removes the publisher’s account reference and replaces the publisher name with “Deleted account.” Logo bytes remain while a current profile or retained history references them, then become eligible for cleanup. A retained permission statement records the earlier publication; it does not establish continuing permission or ownership.
• Payment and tax records: for the period required by payment, tax, accounting, chargeback, and anti-fraud rules. PayPal and Stripe may retain information under their own legal obligations.
• Support messages: while needed to respond, maintain reasonable business records, resolve disputes, protect the Service, or meet legal obligations, then deleted or de-identified when no longer needed.

8. Your choices and privacy rights

You can correct account information, export training progress, export your personal classroom-attempt history, reset progress, control leaderboard participation and name display, manage browser permissions, and delete the account through the account page and Classroom workspace where those controls are available. The personal classroom export is generated in your browser from your own history; historical personal training-share consent records and other classroom, school-affiliation, and instructor-application records are not part of the local training-progress export, so contact us for a verified access, correction, portability, or deletion request involving those records.

For accounts with course-preview access, the account progress export also includes personal course progress, the private registry study workspace, and available assigned course submissions. The registry workspace has its own export and reset controls. Personal progress reset keeps private registry notes and assigned submissions; use the separate workspace reset or contact us about those records. If a control is unavailable, request access, correction, or deletion through the verified request route below.

Account security, account deletion controls, and withdrawal from project-update emails remain available to a signed-in user on the account page without accepting revised trainer terms or successfully loading saved progress. Progress export and reset require your own saved profile to load; use the verified request route below for broader account data or unavailable records.

Depending on where you live, you may have rights to know or access personal information; correct it; delete it; obtain a portable copy; restrict or object to processing; withdraw consent; and appeal a denied privacy request. You may also use an authorized agent where law permits. We may ask for information reasonably needed to verify identity, authority, and account ownership. We will respond within the time required by applicable law and will not discriminate against you for exercising a right.

If you are in the EEA, United Kingdom, or Switzerland, you may complain to your local data-protection authority. You may also object to legitimate-interest processing and request information about transfer safeguards.

9. Sales, targeted advertising, and Global Privacy Control

We do not sell personal information for money. We also do not "sell" or "share" it for cross-context behavioral advertising, use it for targeted advertising, or knowingly sell or share personal information of users under 18 as those terms are used in applicable U.S. state laws. Because we do not conduct that processing, there is currently no sale/share opt-out for a Global Privacy Control signal to activate. If our practices change, we will update this policy and honor applicable opt-out signals.

10. International data transfers

We operate from the United States, and providers may process information in the United States and other countries whose laws may differ from yours. Where required, transfers rely on a lawful mechanism such as an adequacy decision, approved contractual clauses, a provider's recognized certification framework, or another safeguard. Contact us to request more information about safeguards relevant to your information.

11. Children's privacy

The Service is intended only for adults age 18 and older and is not directed to children or minors. We do not knowingly allow anyone under 18 to create or maintain an account or use a leaderboard, and we do not knowingly collect personal information from anyone under 18. We ask only for confirmation that an account holder is at least 18; we do not collect a date of birth. If you believe someone under 18 provided personal information, contact us so we can investigate and delete it.

12. Security

We use reasonable safeguards designed for the nature of the Service, including HTTPS/HSTS in transit, provider-managed authentication, private case-file storage, access controls, rate limiting, restrictive browser security headers, limited logging, and removal of session credentials and query strings from the diagnostic URLs we control. No system is completely secure. Protect your account, use a unique password, and notify us promptly about suspected unauthorized access.

We do not claim a SOC 2 audit report or certification for RT Image Matching Trainer. A service provider’s certifications do not certify this application. Institutions can contact us to review available evidence and the data-processing requirements for their intended use.

13. Automated scoring

The trainer automatically calculates educational scores, class-assignment results, pass/fail feedback, progress, achievements, and leaderboard rank from simulated activity. The instructor dashboard also applies simple rules to label whether a stored class attempt was within tolerance, timed out, or ended with translation or rotation outside tolerance, and presents the server-recorded check sequence as a replay. Instructor rubric ratings, notes, presence labels, and feedback are human-entered teaching observations; they do not change the recorded correction, residual, result, tolerance, or grading version. Match review uses fixed rules to rank suggestions from lifetime and recent-weighted scored summaries and compact Full Treatment replay summaries; its session-only outcome comparison does not train a model or change its rules, and it does not change scores, access, leaderboard validity, outcomes, or safety controls. These outputs do not make decisions that produce legal or similarly significant effects and must not be used as evidence of clinical competency, employment qualification, certification, or licensure.

14. Changes to this policy

We may update this policy as the Service or law changes. We will post the new effective date. For a material change, we will provide reasonable advance notice by email, an in-product message, a site notice, or another appropriate method, except when an immediate change is needed for law, security, or abuse prevention. If consent is legally required for a new use, we will request it.

15. Contact

The controller responsible for this policy is Craig Utter. For privacy questions, requests, complaints, or appeals, email support@rtimagematch.com. Please use the subject "Privacy request" and do not include patient information or unnecessary sensitive data.