Privacy notice

This notice explains how personal data is processed by the Yggdrasil service that this website links to (“the service”) and by this website, under the EU General Data Protection Regulation (GDPR). The service’s terms of use say who is responsible for the data uploaded to it.

Who processes your data

Operator of the service: Università degli Studi di Modena e Reggio Emilia, Via Università 4, 41121 Modena (MO), Italy, contact yggdrasil@unimore.it. The operator runs the service for its own research projects; other institutions run their own installations, which hold none of its data.
Data protection officer: the Data Protection Officer of the Università degli Studi di Modena e Reggio Emilia, Via Università 4, 41121 Modena, dpo@unimore.it (PEC: dpo@pec.unimore.it).
Project data. For the data uploaded to a project (images, annotations, clinical forms and their metadata), the operator is the controller: it decides why and how its projects’ data is processed. Data a partner institution contributes is covered by an agreement between that institution and the operator.
Account, sign-in and request data. For the data of the people who use the service (accounts, sign-ins, project requests) and for this website, the operator is the controller.

What is processed

Encrypted project content the operator cannot read. Files, pseudonyms, clinical values, descriptions, annotation content, processor parameters and logs, and free-text reasons are encrypted in the members’ browsers with keys only they hold. The operator stores them but cannot read them. Before upload, the browser removes identifying metadata from the files; identifiers burned into the pixels are the uploader’s responsibility.

Readable metadata. To route data, enforce permissions and report usage, the service keeps some metadata readable. The privacy and security model and the platform specification (section 4) list it in full. In short:

Your account: email address, your given and family name, affiliation type and institution, which versions of the research-use terms you accepted and when, status, whether you created the account yourself through the demo sign-up, sign-in times, your public keys, your sessions (browser user agent, a coarse network address such as an IPv4 /24, times, the passkey used), your passkeys’ public keys and whether they support key unlocking, and which in-page guides you have been offered (page names and roles such as “project, admin”, and the last “what’s new” note you saw), so they are not offered again on another device. Your private keys are stored only encrypted, in a bundle that a known device or your passkey opens; while a new device of yours is being approved, the server also holds a short code, public values and your bundle key encrypted to that device, for at most 10 minutes. When your keys are replaced, the server records when.
Projects and memberships: your role and permissions in each project, invitations (with the invitee’s email address), and a signed log of membership changes.
Requests to join a demo project: which demo project you asked to join and when. The project’s admins see your email address, name, affiliation type and institution with the request, and are emailed about it; it ends when they invite or dismiss you.
Project structure: IDs, sizes, counts, times, modality types, the de-identification receipt and annotation progress. No names, dates of birth or other direct identifiers are part of it.
The audit log: who did what and when (actor, action, object, time).
Project requests: the request form’s fields: your name, institution and verified email address, the project’s title and summary, modalities, estimated data volume, number of annotators, ethics approval status, expected duration and kind of support; then the decision, who took it and the messages emailed to you.
Export archives, when a project’s admins ask the service to package an export (how exports work): the archive is a plain, unencrypted zip of the data and annotations the admins chose, stored on the server until its link expires or is revoked, then deleted; it is never copied into backups. When a project uses the service’s own export worker, the worker decrypts that data on the service’s machines, so the operator can see exported data while it is packaged; projects whose institution runs its own worker are not exposed this way.
Export downloads: the time and a coarse network address (for example an IPv4 /24) of each request for an export link, never the full address; a refused link code is recorded at most once per network and hour, never the code itself.
Server logs: the API’s request logs (time, client IP address, method, path, status) and error logs, used to run and secure the service.

Why, and on what legal basis

Purpose	Data	Legal basis
Running the operator’s research projects	Project data and its metadata	[PLACEHOLDER: the legal basis, for example Art. 6(1)(e) and 9(2)(j), scientific research in the public interest]
Running your account: sign-in, sessions, keys, invitations	Account data	[PLACEHOLDER: the legal basis, for example Art. 6(1)(b), performance of the terms of use]
Handling project requests	Request data	[PLACEHOLDER: the legal basis, for example Art. 6(1)(b), steps taken at your request before an agreement]
Security: rate limits, audit log, investigating abuse	Account data, audit log, server logs	[PLACEHOLDER: the legal basis, for example Art. 6(1)(f) legitimate interest, or 6(1)(e) for a public body]

No decision about you is made by automated means. The operator does not sell data, and does not use project data for its own purposes.

How long it is kept

Data	Kept
Project data	Until the project’s admins delete it, or the project ends and the operator deletes it. Deleting a project destroys its keys on the server, so its data cannot be read again.
Deleted items (patients, studies, series, files, annotations)	Their encrypted rows stay as markers for 90 days after the deletion, so members’ apps learn of it, then are removed.
Your account	While you are a member of a project or have a pending invitation, then [PLACEHOLDER: how long an unused account is kept, and how to ask for its deletion].
A demo account (created through the demo sign-up)	As for any account (above).
Sessions	A session ends after 14 days without use, or when you sign out or revoke it; ended sessions are removed 30 days later.
Sign-in codes	10 minutes, or until used.
Project requests	While pending; approved and declined requests are removed 365 days after the decision.
Audit log	For the life of the project (it is a hash chain that members verify), or of the service for instance-wide events.
Export archives	Until the link expires (1 to 30 days after the archive is ready, chosen by the admin) or is revoked; never in backups.
Export download records	With the export’s record, for the life of the project.
Server logs	[PLACEHOLDER: log retention, for example 30 days]
Backups	Encrypted database dumps and storage copies, kept for [PLACEHOLDER: backup retention, for example 90 days]. Deleted data leaves the backups when the oldest backup holding it is removed.

Who receives it

Hosting: the service runs on the University of Modena and Reggio Emilia’s own servers (Department of Engineering “Enzo Ferrari”), in the European Union.
Email: sign-in codes, invitations and replies to requests are sent through Google (Google Workspace for the University of Modena and Reggio Emilia), which sees the recipient’s address and the message.
AI models: the service may use AI models to help with some tasks, such as setting up a project or translating its texts. What you type to its assistant and the text it works on go to the model’s provider (Anthropic), never images, annotations or keys.
Processors a project chooses: a project’s admins may register processing services, which receive the keys of only the data each job needs. They act for the operator.
Whoever holds an export link: a project’s admins decide whom they give an export’s link (and its code, if they protect it with one); anyone holding it can download the archive until it expires.
Authorities, when the law requires it.

Data stays in the European Union.

Your rights

You have the right to access your data, to have it corrected or deleted, to restrict or object to its processing, and to data portability, within the limits the GDPR sets. Where processing is based on consent, you may withdraw it at any time.

For project data, write to the operator or the DPO. The operator answers, but cannot read the encrypted content: the project’s members can.
For account, sign-in and request data, write to yggdrasil@unimore.it or the DPO.

You also have the right to lodge a complaint with a supervisory authority: the one where you live or work, or where the operator is established.

Cookies

The web app uses only strictly necessary cookies: the session cookies that keep you signed in (HttpOnly, Secure, SameSite=Strict). It sets no tracking or analytics cookies and loads nothing from third parties. It keeps a few preferences in your browser’s storage (for example the brush size), which are never sent anywhere. It also keeps, encrypted, what lets a browser you trust unlock your keys, the project histories it has verified, and work in progress that has not reached the server yet (autosaved drafts), none of which leaves the device unencrypted.

This website

No cookies and no tracking. This website (the landing page and the documentation) sets no cookies, runs no analytics and loads nothing from third parties: fonts, scripts and search are served from this site.
Your browser keeps two preferences. The documentation stores the colour theme you pick in your browser’s local storage (starlight-theme) and the state of the side menu in its session storage (sl-sidebar-state). Neither is sent anywhere.
Search runs in your browser. The search box downloads an index of these pages and searches it locally; what you type is not sent.
Server logs. Like any web server, the one delivering this site receives your IP address, the page you ask for and your browser’s user agent. They are kept for [PLACEHOLDER: log retention, for example 30 days].

How the platform itself protects data, and what its operator can see, is described in the privacy and security model.

Changes

The operator announces changes to this notice on this page. Version 1.0, draft.