GDPR & HIPAA Compliance Overview
How PixelShift's client-side architecture supports your compliance obligations.
This page describes PixelShift's technical architecture. It is not legal advice and is not a substitute for your own GDPR/HIPAA compliance assessment.
For organizations operating in regulated sectors, including healthcare, legal, and financial services, data governance is paramount. PixelShift.cc is designed so image and file content never leave the browser, which removes several compliance burdens by removing the data-handling risk itself. Because conversion files never cross the network boundary, PixelShift does not receive that content as a data processor would.
General Data Protection Regulation (GDPR)
Under Article 4 of the European Union General Data Protection Regulation (GDPR), personal data is defined as any information relating to an identified or identifiable natural person. Images, document graphics, and embedded metadata qualify as personal data.
Why PixelShift Does Not Act as a "Data Processor"
A "Data Processor" (Article 4(8)) is an entity that processes personal data on behalf of a controller. Because the PixelShift application runs purely client-side inside the user's browser sandbox:
- We do not receive, store, transmit, or have access to any image or document content.
- No data transfer (Chapter V) occurs, as files are not uploaded to our infrastructure.
- No Data Processing Agreement (DPA) is required for file content, because we never receive customer image or document data.
Website Analytics (Opt-In Only)
Separately from file conversion, PixelShift uses Google Analytics 4 to collect anonymous usage metadata (such as page views and session duration). This analytics data does not include image files, document content, filenames, or other personally identifiable information from your conversions.
- Analytics cookies are blocked by default until you explicitly accept via our cookie consent banner.
- You can reject analytics at any time or reopen your choice from Cookie Preferences in the site footer.
- Rejecting analytics has no effect on the local file conversion pipeline — your files still never leave your browser.
Health Insurance Portability and Accountability Act (HIPAA)
HIPAA regulates the protection of Protected Health Information (PHI) in the United States. Medical scans, patient charts, and treatment photographs are strictly classified under HIPAA security rules.
Why a Business Associate Agreement (BAA) Typically Isn't Needed
Usually, healthcare providers must sign a BAA with online conversion websites to process patient documents. PixelShift is different because conversion happens locally:
- Files are processed in the browser, so PixelShift never receives the file content.
- Because PixelShift never receives or stores file content, it does not act as a Business Associate under HIPAA in the way an upload-based converter would.
- You keep custody of your files on your device throughout conversion and download.
This page describes PixelShift's architecture, not legal advice. Whether a BAA is required for your specific workflow depends on your organization's own HIPAA risk assessment — consult your compliance officer or counsel.
Enterprise Compliance Matrix
| Regulatory Framework | Requirement | How PixelShift's Architecture Addresses It |
|---|---|---|
| GDPR Article 28 | Formal DPA execution | No DPA for file content — PixelShift never receives image or document data |
| GDPR Article 32 | Secure transport & processing encryption | Not applicable — files are never transported; processing happens locally in the browser sandbox |
| HIPAA Security Rule | PHI protection and BAA compliance | No PHI is received, stored, or transmitted by PixelShift, so no BAA is created between you and PixelShift |
| CCPA / CPRA | Prevention of personal info sales/sharing | No telemetry on source files; only opt-in, anonymized page/session analytics |
| GDPR Article 7 | Freely given consent for non-essential cookies | Google Consent Mode v2 + cookie banner, denied by default |
Need technical details of the client-side sandbox? You can verify the architecture yourself.