Privacy
Privacy
The short version: your images never leave your machine, and we do not want them.
Last updated 20 October 2026 · Trial check-in days and checkout visits counted
Medical images
OmniDICOM opens, decodes, renders and processes studies entirely on the computer in front of you. No image, file name, study description or patient detail is ever transmitted to us, under any setting, including while using Denoise or other processing. There is no upload step and no cloud processing.
The application does make outbound connections to the PACS and DICOMweb nodes you configure. Those are your servers, and what travels there is governed by your own arrangements, not by us.
What licensing sends
To keep a licence valid the application contacts our licence service. Apart from the update check below, that is the only connection it makes to us, and it carries:
- your licence key — once, when you first activate;
- afterwards, a signed licence token and a salted hash of a machine identifier. The underlying hardware identifier never leaves your computer;
- when your trial starts — which happens by itself the first time you open the application — a device hash, device label and application version, so reinstalling does not restart the trial;
- a device label you can recognise (for example "MacBook Pro"), so we can help when you ask us which machine holds a licence;
- the application version.
This normally happens about once a day while you are online. It happens more often for a while in two cases: after you ask for a longer trial, the application checks in at every start and every hour while it is open, for up to a week, so the extension arrives without reinstalling; and after you open an upgrade checkout, it checks every few minutes until the upgrade arrives. It carries no image data and no patient information.
Emails you send from the application
Help › Request a Feature… and Help › Ask for a Longer Trial… prepare an email that you send from your own mail app, so you see everything in it before it leaves your computer. It ends with the application version, your operating system and your licence status. Ask for a Longer Trial… also adds this computer’s Computer ID: the same salted one-way hash the application sends when it checks in, and the only thing our licence service keeps a trial against, so we can find this computer’s trial and extend it. It contains no name, serial number or patient data. These emails never include your licence key, file paths, studies or file names.
Update checks
The application also looks for a newer version by reading a small public file,
omnidicom.com/updates/latest.json, shortly after it starts and about once
a day while it runs. That request carries nothing about you, your computer or
your licence: the only thing it tells us is the application version, in its
User-Agent (OmniDICOM/ and the version number). Like any request to this
website it passes through our hosting provider, as described under
Website, but we keep no record of individual update checks.
You can switch the automatic check off in the application's Settings
(Check for updates automatically); it then checks only when you choose
Help › Check for Updates…
Nothing is downloaded or installed until you choose Update now. The update is then downloaded from OmniDICOM's public release page on GitHub, which receives that request as it would any download from your browser; GitHub's privacy statement covers what it keeps.
Purchase
Payment is handled by Paddle as merchant of record. Paddle collects your email address and billing details and passes us the email address so we can send your licence key and support you. Licence emails are delivered through our transactional email provider, Resend, which receives the destination address and message content needed to deliver them. Cloudflare hosts our website and licensing service. We do not receive or store card numbers. Paddle's privacy notice covers what they hold.
Diagnostics
The application does not automatically upload crash reports to us. If you send a report to support, remove patient information, image data and private file paths first. We use the technical information you choose to provide to investigate the problem.
Denoise on Windows
Denoise is computed on your computer with Microsoft’s ONNX Runtime, and OmniDICOM sends nothing about it. ONNX Runtime does record a few technical events in Windows’ own event log: its version, whether it prepared the processor or the graphics card, and the graphics driver’s name and version. These records contain no images, patient data or file names. They stay on your computer unless you have turned on optional diagnostic data in Windows (Settings › Privacy & security › Diagnostics & feedback); in that case Windows may include them in the diagnostic data it sends to Microsoft.
On a Mac, Denoise runs on Apple’s Core ML, and ONNX Runtime is not included.
Website
Our pages use externally hosted web fonts. When you open a checkout, Paddle processes the connection and payment information needed to complete your purchase and may use cookies or similar technologies under its privacy notice. We do not add advertising trackers. Our pages load Cloudflare Web Analytics, which counts visits and measures how fast pages load without cookies or other storage in your browser; it sees the page address, the referring site, your browser, operating system and device type, and the country the request came from, and it does not identify individual visitors. Our hosting and licensing services process technical request information for security, rate limiting and service operation.
When you open one of our pages, checkout included, our server
records the time, the page's address without anything after a question mark, a source
label, the country the request came from, the website that linked to it (its domain
name, and only for search engines and the sites on our short list, such as YouTube,
Reddit and the software directories that list us; any other site is recorded only as
“other”), the operating-system family of your browser, and whether your
browser only fetched the page in advance, so we can compare the number of page visits
with the number of downloads and checkout visits. From the rest of the checkout page's
address we keep only which plan it opened with (Basic, Professional or an upgrade) and
the source label described below, never anything else in the link. Requests that look automated (a search-engine crawler,
a link preview or a program rather than a web browser) are not recorded. The source
label is a tag on the link from our own short list (such as ?src=youtube),
or else the name of a listed site that linked to the page (such as reddit), or else
“direct”. This is counted on our server as the page is sent: it adds no
script, cookie or storage to your browser. When you download the installer from our
site, or choose Get it from Microsoft Store on it, we record the time, the platform
and version you chose, the country the request came from, the website (domain name
only) that linked to it, a tag on the link if it had one, the operating-system family
of your browser, and whether the request looked automated, so we can count downloads.
We do not store your IP address or your full browser identification with these
records, and we delete them after 24 months.
When you pay for an upgrade from Basic to Professional on our
checkout page, your browser keeps a list named
omnidicom.upgrade-tickets-paid in its local storage. It holds the
signature part of each upgrade link paid for in that browser, the last 20 at most,
which says nothing about who you are or which licence it was. The checkout page
reads it so that reopening a link already paid for cannot take a second payment.
The list stays in your browser: it is never sent to us or to Paddle, and clearing
this site's data in your browser removes it.
Retention and your rights
We keep the licence and activation records needed to provide your subscription while it remains active. After it ends, we retain only records needed for support, fraud prevention or a legal obligation, and delete or anonymise the rest. Where Korean transaction-record retention rules apply to records we hold, contract, cancellation, payment and supply records are retained for five years, and complaint or dispute records for three years. Paddle maintains its own payment records under its privacy notice. Device hashes and trial dates are retained to prevent repeated free trials. With each trial we also keep the first and last day the application checked in, the number of days it checked in, and the application version it last reported, so we can see whether people keep using OmniDICOM during and after the trial; these check-in details are deleted 24 months after the last check-in. These trial records contain no medical images, device label or IP address. You can ask us for a copy of what we hold, or ask us to delete it, at contact@omnidicom.com — deleting your licence records ends the licence.
Data controller: 옴니다이콤 (OmniDICOM), business registration number 104-43-02097, contact@omnidicom.com.