Privacy Notice

Last updated: November 12, 2026

This notice explains how Puissant, Inc., which operates DTI Reports, collects and uses information through dtireports.com. Patient information submitted to the Service is also governed by the Business Associate Agreement with your organization and is described in the HIPAA Notice.

Information we collect

  • Account information: name, professional credentials, organization, email address and contact details you provide at registration.
  • Patient information you upload: exam files and the case details you enter, and the reports generated from them.
  • Security and usage records: sign-in times, IP addresses, the actions you take on records, and similar audit data.
  • Messages you send us through the contact or report forms.
  • Order and payment records: what was ordered, amounts, promotion codes and Stripe payment references. Card details are entered on Stripe’s payment page and are not received by us.
  • Notes you add to reports, changes you make to case details (with the earlier values), and the email addresses of people you share reports with.

How we use information

We use account information to run your account, verify eligibility, provide support and send service and security messages. We use patient information only to provide the reports you request and as your organization’s BAA permits; we do not use it for advertising or sell it. We use security records to protect accounts, investigate incidents and meet audit obligations. As our BAA permits, we create de-identified statistics (with names, identifiers and exact dates removed and small groups suppressed) to monitor quality and identify trends; these cannot be used to identify a patient.

Service providers

We share information only with providers that help us run the Service, under contracts that protect it, including business associate agreements where patient information is involved: cloud hosting (Google Cloud), AI processing used to draft reports (Anthropic), email delivery, and payment processing (Stripe, which receives order and payment information but no patient information). We may also disclose information when required by law.

Cookies and browser storage

We use one strictly necessary, secure session cookie to keep you signed in (and, for people opening a shared report, a short-lived cookie after they confirm their email address), and store your display name and last activity time in your browser to support automatic sign-out. We do not use advertising or third-party tracking cookies.

Security

Information is encrypted in transit and at rest. Every account uses two-factor sign-in, sessions end after 15 minutes of inactivity, and access to records is logged in a tamper-evident audit trail. No system is perfectly secure; please report concerns through Report an Issue.

Retention

Exam files, reports, notes and case changes are kept for the retention period selected for each case (7, 10 or 15 years) unless a legal hold applies, and are then securely destroyed. They are not deleted when your 30-day online access ends; they remain in our archive, which only authorized administrators can open. Archive copies may be kept on encrypted external media under our control. Encrypted backups are kept for a limited period and then deleted. Account information is kept while your account is active and afterwards as needed for legal, audit and security purposes.

Your choices and rights

You may ask to access, correct or delete your account information, subject to legal and record-retention requirements. Requests about a patient’s records should go to the healthcare organization that submitted them, which controls those records; we will assist that organization as our BAA requires.

Children

The site is intended for professionals and is not directed to children. Studies of minors may be submitted only by authorized healthcare organizations.

Changes and contact

We will post changes to this notice here with a new date. Privacy questions and requests: tech@dtireports.com.