Privacy notice

Who is responsible

Controller

Prof. Alfredo Conti, Dipartimento di Scienze Biomediche e Neuromotorie (DIBINEM), Università di Bologna, Via Ugo Foscolo 7, 40123 Bologna, Italy

Data protection officer

None. The controller is not a public authority and processes nothing here at a scale that requires one.

Contact

info@neurosurgpredict.com

What is processed, and why

The values you enter

Held in memory on our server for one request to compute the prediction, then discarded. Never written to disk, logged or sent anywhere.

If you upload a spreadsheet for batch predictions

Held in memory for one request and returned with the predictions. Never written to disk, logged or sent anywhere; columns the calculator does not use are dropped as it is read. We count rows and batches, as for single predictions.

If you check predictions against real outcomes

Done in your browser. The file never reaches our server.

If you join the mailing list

Your email address, and the calculator you signed up from, passed to Brevo; we keep no copy. Nothing is sent until you confirm by email. A few emails a year: updates, requests for feedback, invitations to contribute validation data. Each has a link to leave. Your address is deleted when you leave, or two years after our last email to you.

If you submit validation results

The centre, country, study reference, names to credit, a contact email, and the summary results from your browser; never patient data. Kept on our server in Frankfurt. Once reviewed, everything but the email may appear on the calculator page. Unpublished submissions are deleted after six months; published ones keep the names while shown and the email until taken down.

Your IP address

Used to route the request, limit abuse and derive a country, in memory. Never written to disk. Fly.io may hold your address in its own logs for up to seven days, and ships them nowhere else.

Your browser's request headers

Read once, in memory, to tell a browser from an automated request. Never written to disk or logged.

What is kept

Four counts, kept indefinitely, each per day and country: predictions per calculator, single or batch, such as 2026-09-04 | conti-bendor-sbm | IT | 7; batches per calculator; page views per page, such as 2026-09-04 | /about | IT | 12; and, apart, page views that look automated. A row is a date, a calculator or page, and a country, and identifies nobody. Homepage views and their countries are published on the usage page, with countries under 5 views grouped together. Beside them, validation submissions as above. Brevo keeps the mailing list.

What you write to us

An email to info@neurosurgpredict.com, tech@neurosurgpredict.com or security@neurosurgpredict.com is forwarded by Porkbun to a personal mailbox and kept there for as long as it takes to answer.

Legal basis

Legitimate interests (Article 6(1)(f) of the GDPR) for providing the tool, knowing where it is used and keeping it available. Consent (Article 6(1)(a)) for the mailing list and validation submissions, both optional; you can withdraw it at any time.

No cookies, no analytics, nothing from a third-party domain. Your browser keeps two things on your device: the theme you pick, until you change it, and the values you enter, until you close the tab. No special category data (Article 9) and no automated decision (Article 22): the models produce an estimate for a clinician to interpret.

Where

Fly.io, one machine in Frankfurt, inside the EEA. Fly.io is a US company and its staff can reach the machine to keep it running, so access from outside the EEA is possible; their data processing agreement and their EU-US, UK and Swiss Data Privacy Framework certification cover it, the EU-US framework under the European Commission's adequacy decision. The country lookup runs on our own server, against a DB-IP (opens in a new tab) file (CC BY 4.0). No third party is contacted by a page you open. Only the mailing-list sign-up is shared, with Brevo, which also sends the team's own alerts: that a submission arrived or the server failed, and nothing from either.

Brevo (Sendinblue SAS, Paris) holds the mailing list on EU servers. Its sub-processors include US companies (Google Cloud, with servers in Belgium; Cloudflare; Zendesk), covered by the EU-US Data Privacy Framework and standard contractual clauses.

Your rights

Access, rectification, erasure and restriction. For the mailing list or a submission, write to tech@neurosurgpredict.com, or leave the list from any email. Nothing else we keep identifies anyone (Article 11).

You can object to any of this processing at any time: write to tech@neurosurgpredict.com.

You may complain to the Garante per la protezione dei dati personali (opens in a new tab), Italy's data protection authority, or to the authority where you live or work.