Privacy Policy

DeepEcho Training Privacy Policy

Version 1.0 | Effective date: 23rd October 2026 

DeepEcho, Inc. (“DeepEcho,” “we,” “us,” or “our”) provides DeepEcho Training for learning and practicing obstetric ultrasound. This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information through the DeepEcho Training application made available in connection with Butterfly hardware, its associated web and mobile interfaces, and related support and communications that link to this policy (collectively, “DeepEcho Training”).

DeepEcho Training is provided for educational use. It is not offered under this policy for diagnosis, treatment, or clinical decision-making. This policy does not cover separate clinical editions or other DeepEcho products unless they expressly link to it.

In this policy, “you” means a person using DeepEcho Training. Your “Organization” is the institution or other organization that authorizes your access. “Examined persons” means individuals scanned during training or whose personal information is entered or uploaded for an authorized educational activity, including volunteers and individuals represented in teaching cases.

This policy provides information about our practices. It does not itself obtain consent to scan an individual, process health information, or use information to train AI models.

1. Responsibility for your data

Information we process for our own purposes

DeepEcho acts as a controller when it determines the purposes and means of processing personal information. This includes information we use to manage our business relationships, respond to inquiries, administer voluntary surveys, protect our systems, and meet our own legal obligations.

Whether particular account, support, or security information falls within this category depends on the purpose for which it is processed. Information about a user is not automatically processed by DeepEcho as a controller simply because it relates to their account.

Information we process for an Organization

Your Organization generally determines which individuals may use DeepEcho Training, which educational activities are authorized, and what information about examined persons may be recorded and used.

When we process information on an Organization’s behalf, we act as its processor or service provider, or as a subprocessor where access is arranged through Butterfly or another provider. We process that information under the applicable contractual arrangements and documented instructions. This may include examined persons’ information, user accounts administered for the Organization, training records, and associated activity and audit records.

The responsible Organization must establish the lawful basis for its processing and provide required notices and obtain consent where required. An individual user’s acceptance of app terms does not replace those requirements.

If your Organization creates your account, we receive your account details from it. We may also receive information from Butterfly to provision access, verify your Organization’s entitlement, and administer the deployment.

Butterfly

Butterfly arranges subscriptions and bills Organizations for this offering. Butterfly’s processing of information for its own billing, account, hardware, and other independently determined purposes is described in its applicable privacy notices. This policy describes DeepEcho’s processing and does not replace those notices.

If you are an examined person, please contact the Organization responsible for the training activity with questions or requests about your information. If you contact us, we will handle or route your request according to our role and applicable obligations.

2. Your data

Account and professional information

We receive and use your name, email address, phone number, role, profession or specialty, Organization, facility, professional identifiers, and account preferences where provided. We use this information to provision access, assign permissions, communicate with you, and support your use of DeepEcho Training.

We also process license, subscription, and device-enrollment status. Your Organization’s payments are handled through Butterfly. We do not collect payment card details through this offering.

Sign-in and security information

We process information needed to authenticate you and protect access, including password hashes, authentication settings, login and session records, and security events. App PINs are stored in hashed form on the device. We do not receive fingerprint images or Face ID templates from your device.

Where enabled, we use email or WhatsApp to send activation, authentication, or password-reset messages. If you use Google sign-in or your Organization’s single sign-on service, we receive the account identifiers and profile information needed to authenticate you.

Device and activity information

We collect device and installation identifiers, device model, operating system and version, app version, IP address, enrollment and license status, and connection or last-active information.

We record activity such as sign-ins, access to records, changes, exports, and administrative actions, together with the relevant user and time. These records support access management, accountability, troubleshooting, and investigation of misuse.

The apps may request camera, local-network, location, or other device permissions needed for supported functions, such as scanning enrollment codes or connecting to a probe. A location permission may be required by the operating system to identify the probe’s Wi-Fi network. We do not collect precise geographic coordinates through that permission.

Training content, support, and surveys

We process information you enter or create, including annotations, measurements, corrections to AI results, training reports, and other content associated with educational activities.

Error reports and diagnostic logs may include technical details, recent app activity, and your name, email address, role, or account identifier. We use them to investigate problems and maintain the app.

When you contact support or report a problem, we receive your description and any information you submit, which may include the screen or exam involved and whether you believe anyone’s safety was affected. Please use approved reporting channels and include only information needed to address the issue.

If you complete a survey, we receive your answers and comments.

Cookies and similar technologies

The training interfaces use cookies and local storage needed for authentication, security, and preferences. We do not use advertising cookies, advertising identifiers, or cross-app tracking through DeepEcho Training. We do not sell personal information or share it for cross-context behavioral advertising.

3. Examined persons’ data

Depending on the educational activity and enabled functions, your Organization and its users may enter, capture, or upload:

• Identity and contact information: names, national identity or other identification numbers, dates of birth or ages, contact details, record identifiers, insurance information, and emergency contacts.

• Personal and family information: education, occupation, family circumstances, spouse or partner information, and relevant family history.

• Health and pregnancy information: medical histories, pregnancy dates and history, prior deliveries, risk factors, medications, lifestyle information, blood group, height, weight, and other information included in an authorized training record.

• Imaging information: ultrasound images, video recordings, DICOM files, and associated metadata.

• Training results and reports: annotations, AI-suggested views and measurements, estimates, findings, corrections, and reports generated during training.

• Scheduling and communications information: contact details, training appointments, reminders, and links to records where those functions are enabled.

Records may also include information about spouses, emergency contacts, or newborns. Images and recordings may contain identifying information in their metadata or within the image itself.

Health information remains sensitive personal information when used for education. Labeling a record as a teaching case, or removing a name, does not necessarily make it anonymous.

We process identifiable information about examined persons on the responsible Organization’s behalf for its authorized educational activities, subject to the applicable agreements and law. Only information necessary and lawfully available for the activity should be entered. Synthetic or genuinely anonymous teaching material that cannot reasonably identify an individual is not personal information.

4. Legal basis

Where European data protection law applies and DeepEcho acts as controller, we rely on the following legal bases, according to the processing involved:

When relying on legitimate interests, we consider the impact on individuals and do not rely on that basis where their interests or fundamental rights override those interests.

For information we process as a processor or subprocessor, the responsible controller determines the lawful basis. For identifiable health information, this includes both a general lawful basis and an applicable condition permitting special-category processing under European law. An educational activity does not automatically qualify for the legal conditions applicable to medical treatment.

If DeepEcho processes health information for a purpose for which it acts as controller, it must also have an applicable special-category condition, such as explicit consent or a relevant legal exception. Neither an Organization’s subscription nor a user’s acceptance of app terms supplies that condition by itself.

Where consent is required, it must be obtained through an appropriate consent process. Information about withdrawing consent or exercising other rights appears in Section 9.

5. Artificial intelligence

DeepEcho Training uses AI to support ultrasound education, including recognizing anatomical views and structures and suggesting measurements. Its results are intended for review during training. They are not provided for diagnosis, treatment, or clinical decision-making.

On-device analysis and synchronization

In the training mobile apps, ultrasound image analysis runs on the device. Images do not need to be transmitted to an external AI provider for that analysis.

Records, images, results, and annotations may nevertheless be stored on our hosting infrastructure and synchronized between authorized devices and associated web interfaces. On-device analysis does not mean that information remains exclusively on the device.

Model training and improvement

We do not use identifiable information about examined persons, their images, or their training records to train or improve our AI models. We do not permit providers processing that information on our behalf to use it to train their generally available models.

We use technical performance information, error reports, and voluntary feedback to troubleshoot and improve DeepEcho Training, subject to the purposes and legal bases described in this policy. Patient-specific annotations and corrections remain subject to the restrictions applicable to examined persons’ information.

Human review

AI results may be incomplete or inaccurate and must be reviewed by the user or instructor. DeepEcho does not use DeepEcho Training to make decisions based solely on automated processing that produce legal or similarly significant effects on an individual.

6. Sharing

We disclose personal information for the purposes described below. Disclosures of information processed on an Organization’s behalf remain subject to the applicable instructions, agreements, and law.

Your Organization and authorized recipients

Your Organization’s administrators manage accounts, permissions, and enrolled devices. Authorized users and instructors may access records and activity information within the permissions assigned to them.

When an authorized user shares a training record or sends a reminder or record-access link, we process and deliver the information to the designated recipient on the Organization’s instructions.

DeepEcho personnel and service providers

Access by DeepEcho personnel is limited to those who need the information for authorized support, maintenance, security, administration, or other permitted responsibilities. Personnel with access are subject to confidentiality obligations.

Depending on the deployment and enabled features, our providers include:

Providers engaged to process personal information on our behalf are subject to written obligations concerning permitted processing, confidentiality, and security. Providers that independently determine purposes for particular processing are responsible for that processing under their own applicable notices and legal obligations.

Butterfly

We exchange account, Organization, entitlement, license, and device information with Butterfly as necessary to provision and administer the integrated offering. Relevant support information may also be exchanged to investigate integration or hardware issues.

These arrangements do not authorize DeepEcho to provide protected health information to Butterfly. Users must not include that information in reports sent to Butterfly. Butterfly’s independently operated accounts, hardware services, and software may process information under Butterfly’s applicable privacy notices.

Professional advisers and legal disclosures

We may disclose information to advisers, auditors, insurers, and other professional service providers where reasonably necessary for their services and subject to appropriate confidentiality obligations.

We may disclose information where required by applicable law or valid legal process, or where otherwise lawfully necessary to address fraud, security threats, or risks to individuals. For information processed on an Organization’s behalf, we refer requests to the responsible Organization or contracting party where legally permitted and follow the applicable contractual and legal requirements.

Business transactions

Personal information may be disclosed in connection with a proposed or completed financing, merger, acquisition, reorganization, insolvency, or transfer of the relevant business or assets. Disclosures are limited to what is appropriate for the transaction and subject to applicable confidentiality and data-protection requirements.

A transaction does not remove the restrictions applicable to information processed on an Organization’s behalf. Any successor remains subject to the applicable obligations.

International transfers

Hosting, support, maintenance, and provider operations may involve processing in the European Union, the United States, Morocco, and other countries where authorized providers operate. Hosting arrangements vary by deployment. Access from another country may constitute an international transfer even where the information remains stored in its original hosting region.

Where European data protection law restricts a transfer, we use an applicable adequacy decision or appropriate safeguards, such as the European Commission’s Standard Contractual Clauses, together with assessments and supplementary measures where required. An Organization’s instructions or a user’s acceptance of app terms do not, by themselves, replace a required transfer mechanism.

You may contact us using the details in Section 12 for information about relevant transfer safeguards or a copy of them, subject to appropriate redaction of confidential information.

7. Retention

We retain personal information only for as long as necessary for the relevant purposes, applicable contractual requirements, and legal obligations. Retention periods depend on the category of information, the deployment, and our role.

When setting retention periods for information we control, we consider its sensitivity, the purpose of processing, whether the purpose can be achieved with less information, and applicable legal or limitation periods.

Deletion and backups

Removing a record from the app’s ordinary display may initially mark it as deleted rather than immediately erase every copy. Subsequent erasure is handled under the applicable deletion process, retention schedule, and legal requirements.

Backup copies are removed through the applicable backup-rotation process. Information awaiting deletion from backups is protected against ordinary use and remains subject to the applicable safeguards.

Where information must be retained for a legal obligation or valid legal hold, we limit its use to the relevant purpose and protect it for the remainder of the retention period.

Information on devices

Offline records may remain on an enrolled device until removed through the applicable synchronization, unenrollment, or deletion process. Signing out or removing a user account does not necessarily erase all locally stored records.

Organizations must follow approved procedures for device reassignment and disposal. We support return and deletion obligations for information under our control in accordance with the applicable agreements and law.

8. Security

We maintain technical and organizational measures designed to protect personal information against unauthorized access, disclosure, alteration, loss, and destruction. We assess those measures in light of the sensitivity of the information and the risks involved.

Our safeguards include:

• encryption for communications between supported applications and our servers;
• encryption and access protections for stored information, including information held on enrolled devices;
• separation of Organization environments and access restrictions based on roles and facility permissions;
• authentication controls, session protections, and available multifactor authentication;
• device enrollment and the ability to revoke access for lost or compromised devices;
• activity logging, monitoring, and investigation of suspected misuse;
• controls designed to limit personal information in diagnostic reports;
• security testing and vulnerability management; and
• confidentiality obligations and access controls for personnel and providers.

The measures and user-configurable options available may vary by platform and deployment. No system is completely secure, and we cannot guarantee that a security incident will never occur.

Your Organization manages its users, permissions, devices, and networks. Users should protect their credentials, lock shared devices when unattended, install required updates, and promptly report suspected unauthorized access or lost devices. These responsibilities do not replace DeepEcho’s own security obligations.

If an incident affects information we process on another party’s behalf, we notify the responsible contracting party without undue delay and provide assistance as required by the applicable agreement and law. We notify authorities and affected individuals where required by applicable law.

9. Your rights and choices

Your rights depend on the law applicable to your information and DeepEcho’s role in processing it. They may include the right to:

• obtain confirmation of whether your personal information is processed, receive information about that processing, and access a copy;
• correct inaccurate or incomplete personal information;
• request deletion of personal information, subject to applicable exceptions;
• restrict certain processing;
• object to processing based on legitimate interests;
• receive information you provided in a structured, commonly used, machine-readable format and, where technically feasible, have it transmitted to another controller, where the applicable portability requirements are met;
• withdraw consent where processing is based on consent, without affecting the lawfulness of processing before withdrawal; and
• exercise applicable protections concerning decisions based solely on automated processing that produce legal or similarly significant effects.

These rights are not absolute. Information may need to be retained or processed to meet legal obligations, protect other individuals’ rights, or establish, exercise, or defend legal claims.

Making a request

To exercise rights concerning information for which DeepEcho acts as controller, contact us using the details in Section 12. Please identify the information or processing concerned and the action you are requesting. We may request information reasonably necessary to verify your identity and authority to act.

We will respond within the period required by applicable law. Under the GDPR, this is ordinarily one month after receipt. We may extend that period by up to two additional months where permitted because of the complexity or number of requests, and will notify you of the extension and reasons within the initial month. Under applicable US state privacy laws, the response period is generally forty-five days, subject to any permitted extension and notice requirements.

Requests are ordinarily free of charge. We will impose a fee or decline to act only where applicable law permits and will explain the basis for doing so. If we decline a request, we will explain the available means of challenging our decision.

Information controlled by your Organization

Your Organization administers your account and may control associated training and activity records. Account closure does not necessarily require deletion of records your Organization must lawfully retain.

If your request concerns information we process on an Organization’s behalf, please contact that Organization. Examined persons should contact the Organization responsible for the relevant training activity. If we receive such a request directly, we will route it to the responsible party and provide assistance in accordance with our legal and contractual obligations.

Withdrawing consent for an educational activity or the use of identifiable teaching material should also be directed to the Organization responsible for obtaining that consent.

European privacy rights

If European data protection law applies, you may object to processing based on legitimate interests on grounds relating to your particular situation. We will stop that processing unless we demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or the processing is necessary for legal claims.

You may complain to the competent data protection authority, including the authority in the EU Member State where you habitually reside, work, or believe an infringement occurred. You may also seek a judicial remedy. You do not need to contact DeepEcho before exercising those rights.

US state privacy rights

Where applicable US state privacy laws cover the processing, you may have rights to know, access, correct, delete, and obtain a portable copy of your personal information, and to opt out of specified processing, including sale, targeted advertising, or certain forms of profiling.

We do not sell personal information, share it for cross-context behavioral advertising, or use it for targeted advertising through DeepEcho Training. We do not use DeepEcho Training to engage in profiling that produces legal or similarly significant effects. Where applicable law provides a right to limit the use or disclosure of sensitive personal information, you may contact us to exercise it.

You may use an authorized agent where permitted by law. We may require evidence of the agent’s authority and verify your identity as applicable law allows.

If your request is denied and applicable law provides an appeal right, you may appeal by replying to our decision or contacting us using the details in Section 12. We will respond within the applicable statutory period and explain any available right to complain to a regulator. We will not unlawfully discriminate or retaliate against you for exercising privacy rights.

Communications and device settings

You may withdraw consent to a voluntary survey by contacting us. You may opt out of non-essential promotional communications using the unsubscribe method provided. Necessary account, security, and service communications may continue.

Device permissions can be managed through your device settings. Disabling a permission may prevent functions such as probe connection or enrollment-code scanning. Restricting device permissions does not itself delete information already processed.

10. Minors

DeepEcho Training is intended for authorized adult users aged eighteen or older. It is not directed to children, and we do not knowingly provide user accounts to children.

Information about an examined person may concern a pregnant minor, a newborn, or another minor represented in an authorized teaching case. Such information is distinct from a minor holding a user account. We process it only within the applicable lawful educational arrangements and instructions, including any required parental permission, individual consent, or other safeguards.

If you believe a person under eighteen has obtained a user account, contact us using the details in Section 12. We will investigate and take appropriate steps to restrict or close unauthorized access and address the associated information in accordance with applicable law. Closing an unauthorized account does not automatically require deletion of otherwise lawfully maintained Organization records.

11. Changes

We may update this policy to reflect changes in DeepEcho Training, our processing practices, or applicable law. We will publish the revised policy at https://deepecho.io/provacy-policy and update the effective date and last-updated date.

For material changes, we will provide appropriate notice through the app, by email, or through your Organization before the changes take effect, unless applicable law permits or requires a different approach.

An update to this policy does not itself authorize a new use of information where additional consent, contractual authorization, or another legal requirement must first be satisfied. Where consent is required, we will obtain it through an appropriate process rather than treating continued use as consent.

12. Contact

For questions about this policy or to exercise privacy rights, contact:

DeepEcho, Inc.

555 East Loockerman Street; 

Dover, DE USA

Privacy email: privacy@deepecho.io

Data protection officer, where applicable:
dpo@deepecho.io

If your inquiry concerns an examined person’s information or records controlled by your Organization, please identify the responsible Organization so that we can direct the inquiry appropriately. Do not send ultrasound images, medical histories, identification documents, or other sensitive information through ordinary email unless we have arranged an appropriate secure method.

© DeepEcho | DeepEcho Training Privacy Policy