Privacy Policy

Stroke InsightZ Mobile ("the app", package name com.genzailabs.perfusion) is a read-only mobile companion to the Stroke InsightZ cerebral perfusion analysis platform operated by Genz AI Labs (https://perfusion.genzailabs.com). The app is intended for use by healthcare professionals — radiologists, neurologists, and stroke clinicians — to view AI-generated perfusion analysis reports for their patient cases.

The app does not perform any AI analysis on your device. All analysis is performed on Genz AI Labs' secure cloud servers; the mobile app is purely a viewer for already-computed results. The app is not a medical device. It does not provide diagnostic decisions and is not a substitute for clinical judgement.

2.1 Information you provide directly

• Account credentials — your username and password, which you enter to log into your existing Stroke InsightZ account. The username may be an email address. These are transmitted over HTTPS to our authentication server (perfusion.genzailabs.com) and are not stored on our servers in plaintext.

2.2 Information stored on your device

• Authentication token — after a successful login, a server-issued opaque token is stored locally in Android's encrypted secure storage (flutter_secure_storage). The token is used only to authenticate further requests to our API, and is deleted when you sign out.
• Remembered username (optional) — if you tick "Remember me" at login, your username is stored locally in SharedPreferences so it can be auto-filled next time.
• Cached PDF reports — when you tap a case, the app downloads the corresponding PDF report into the app's private cache directory. If you tap "Save to Downloads", a copy is also saved to /Downloads/StrokeInsightZ/ on your device for offline access.

2.3 Push notification token (Firebase Cloud Messaging)

To deliver push notifications to your device when a new case is uploaded or a perfusion report becomes ready, the app uses Google's Firebase Cloud Messaging (FCM) service:

• Device push token — when you log in, the app obtains a unique device-specific FCM registration token from Google's servers and transmits it (over HTTPS) to our authentication server (perfusion.genzailabs.com). The token is stored on our backend against your user account so we can route notifications to your device(s) only. Multiple device tokens per account are supported (e.g., your phone + tablet).
• What FCM is NOT used for — we do not use FCM for analytics, advertising, behavioural targeting, location tracking, or sharing data with any third party other than Google's delivery infrastructure as required to send the notification. The notification payload contains only the patient identifier and case status — the same information already visible to you in the app.
• Permission — Android 13 and above requires you to explicitly grant notification permission the first time the app runs. If you decline, the app continues to work normally; you simply won't receive push alerts for new cases.
• Disabling notifications — you can disable notifications at any time via Android Settings → Apps → Stroke InsightZ → Notifications. Logging out also removes the token from our servers.

Google's processing of the FCM token is governed by Google's own privacy policy (policies.google.com/privacy) and Firebase data processing terms (firebase.google.com/support/privacy).

2.4 Information we do NOT collect

The mobile app does not collect, transmit or store:

• Your name, address, phone number, or other contact details
• Your location (GPS, Wi-Fi, or otherwise)
• Android ID, advertising ID (we do not request, read, or use the Android Advertising ID), or hardware identifiers like IMEI
• Crash logs, analytics, telemetry or usage statistics
• Your contacts, calendar, photos, audio or messages
• Any health data about you personally — the patient case data you view in the app belongs to your clinical workspace on the Stroke InsightZ cloud platform; the mobile app fetches and displays it on demand and does not retain it beyond your active session

The only "device identifier" the app handles is the Firebase Cloud Messaging registration token described in section 2.3, used solely to deliver push notifications to your device.

We do not use third-party advertising networks, analytics SDKs, or tracking libraries.

We use the limited information described above only to:

• Authenticate you against your existing Stroke InsightZ account
• Display the cases, metrics, findings and PDF reports that belong to your account
• Allow you to download reports to your device and share them with colleagues via WhatsApp or email (using your device's native sharing — we do not send anything on your behalf)

We do not use your information for advertising, profiling, behavioural targeting, or AI model training.

We do not share, sell or rent your information to any third party for marketing, analytics, advertising, or behavioural-targeting purposes.

The app communicates with two destinations:

1. Genz AI Labs servers at perfusion.genzailabs.com (HTTPS/TLS encrypted) — for authentication, case retrieval, and PDF download. This is our own infrastructure.
2. Google's Firebase Cloud Messaging service — solely to deliver push notifications to your device. Google receives the encrypted notification payload (containing only the patient identifier and case status) and the FCM device token; Google processes this strictly as a transit/delivery service under their Firebase data processing terms.

When you choose to share a PDF via WhatsApp or email, the file is handed to the destination app on your device through Android's standard sharing intent. From that point onwards the destination app's own privacy policy applies — Genz AI Labs has no visibility into or control over what those apps do with the file.

• All network traffic between the app and our servers is encrypted in transit using HTTPS (TLS).
• Authentication tokens are stored on your device using Android's EncryptedSharedPreferences and the Android Keystore.
• Your password is never stored on the device after login.
• Patient case data is fetched on demand from your authenticated session and is not persisted in a local database.

No system can be guaranteed 100% secure. If you suspect unauthorised access to your account, please change your password on perfusion.genzailabs.com and contact us immediately.

• Authentication tokens are retained on your device until you sign out, after which they are deleted.
• Cached PDFs in the app's private cache directory may be cleared by Android when storage is low, or by you via Settings → Apps → Stroke InsightZ → Clear cache.
• PDFs you saved to /Downloads/StrokeInsightZ/ remain on your device until you delete them manually.
• Patient case data viewed in the app is governed by the data retention policies of your Stroke InsightZ cloud platform account and is not retained by the mobile app itself.

You have the right to:

• Access the personal data we hold about you
• Correct any inaccurate data
• Delete your account and all associated data
• Withdraw consent to data processing
• Lodge a complaint with a data protection authority

To exercise any of these rights, email developer.genzailabs@gmail.com with the subject line "Privacy request — Stroke InsightZ Mobile". We will respond within 30 days.

To delete your account and all associated data, please email developer.genzailabs@gmail.com from the address you registered with, or contact your Stroke InsightZ administrator. Account deletion removes your login, your case history and any cloud-stored PDFs from our systems.

Stroke InsightZ Mobile is a clinical tool intended exclusively for adult healthcare professionals. The app is not directed at children under 18, and we do not knowingly collect information from anyone under 18. If you believe a minor has accessed the app, please contact us at developer.genzailabs@gmail.com.

Genz AI Labs' servers are located in India. By using the app, you consent to your information being processed in India under Indian data protection law. Where personal data is transferred from outside India, we apply equivalent safeguards.

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this policy will reflect any change. Material changes will be notified through the app or via email to your registered address. Continued use of the app after a change constitutes acceptance of the updated policy.

For any questions about this Privacy Policy or our data practices: