Privacy policy

Orcaton is operated by Kanghoun Lee (dlrkdgns1324@gmail.com), who is the data controller for the information described here.

What we collect

This is the complete list. Nothing else about you is stored.

We do not collect date of birth, phone number, postal address, government identifiers or payment details. We do not buy or receive personal data from third parties.

Clinical data you upload

Cases and dose files are treated as de-identified research and teaching data, not as patient records. You must not upload data containing patient identifiers. Every upload is scanned automatically and a case carrying direct identifiers is blocked from publication — see the security overview for what is checked.

The automated scan is a safety net, not a substitute for de-identifying at the source. You remain responsible for having the right to share what you upload.

What is public

• Your display name and affiliation appear next to your entries on leaderboards.
• Score cards for published cases are public, including your per-metric results.
• Your email address is never shown publicly.

Legal basis

• Contract: holding your account and running the challenge you chose to enter.
• Legitimate interest: showing attribution on leaderboards, which is intrinsic to a public competition.

Sharing

Data is not sold, rented or shared for advertising. It is processed only by our hosting provider (AWS Lightsail, ap-northeast-2 (Seoul), Zone A) and our identity provider (Google, for sign-in). Aggregate statistics — participant counts, score distributions — may be published or shared with challenge sponsors, never with identifying detail beyond what is already public on the leaderboard.

Hosting requests and customer quotes are private to the requester and platform operator. If email delivery is configured, the selected SMTP provider processes the account email and transactional receipt or approved quote. The operator receives the hosting conditions. Request forms must not contain patient information, institutional secrets or credentials. A Confidential label is a business notice; it does not prevent forwarding.

Optional surgical reference videos load from Wikimedia only after you choose to load them. Your browser then connects to that provider, which can receive connection information such as your IP address and the site origin. These videos are separate from your account data and competition submissions.

Retention

• Retained until the account is deleted by the user or on request.
• Scored dose, plan and imaging prediction artifacts are retained while the task is published so score cards stay reproducible. Deleted with the account.
• Published cases are retained indefinitely as a community resource; the contributor's name can be anonymised on request.
• Application, job and access logs are retained for 30 days.
• Page feedback is retained with the account and deleted when the account is deleted.
• Hosting requests, approved quotes and mail queue records are retained with the account and deleted when the account is deleted. Copies already delivered to email inboxes are handled separately on request.
• Competition registration and consent receipts are retained until account deletion or a completed deletion request; account deletion removes them together.

Your rights

You can access and correct your profile at any time, and delete your account from your profile page. Deleting removes your account, your submissions and the dose files you uploaded. Cases you contributed remain published as a community resource; email us to have your name removed from them. For any other request — export, objection, restriction — write to dlrkdgns1324@gmail.com and we will respond within 30 days.

Cookies

One strictly necessary session cookie, set when you sign in. No analytics, no advertising, no third-party trackers.

Changes

Material changes will be announced on the site before they take effect. This policy was last reviewed on 2026-10-23.