Privacy Policy

Last updated: November 1, 2026

MEDCopilotAI ("we", "us", or "our") is committed to protecting your personal information and your patients' data. This Privacy Policy explains how we collect, use, disclose, and safeguard information when you use our Service.

1. Data Controller

MEDCopilotAI acts as a data processor on behalf of healthcare professionals (data controllers) who use the Service to manage patient information. You, as the healthcare professional, are responsible for ensuring a lawful basis for processing patient data under GDPR and applicable local regulations.

2. Information We Collect

We collect information that you provide directly to us, including:

• Account data: name, email address, password, medical license number, specialty, practice address, and phone number.
• Patient data: health records, diagnoses, medications, and clinical observations entered by you.
• Usage data: log data, IP addresses, browser type, pages visited, and timestamps.
• Payment data: billing information processed securely by our payment provider.

3. Legal Basis for Processing

We process your personal data on the following legal bases under the GDPR:

• Contract performance: to provide the Service you have subscribed to.
• Legitimate interests: to improve the Service, ensure security, and prevent fraud.
• Legal obligation: to comply with applicable laws and regulations.
• Consent: where you have explicitly consented to specific processing activities.

4. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Service.
• Process transactions and send related information.
• Send technical notices, updates, security alerts, and support messages.
• Respond to your comments and questions.
• Monitor and analyse usage patterns to improve the Service.
• Detect, investigate, and prevent fraudulent or illegal activities.

Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris.

5. Patient Data

Patient health data entered into the Service is treated as special category data under Article 9 of the GDPR. We process this data solely on your instructions as data controller. We do not use patient data for any purpose other than providing the Service to you.

Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum.

6. Data Retention

We retain your account data for as long as your account is active or as needed to provide the Service. Patient data is retained according to your instructions and applicable healthcare record-keeping obligations. You may request deletion of your data at any time, subject to legal retention requirements.

7. Data Sharing and Disclosure

We do not sell, trade, or rent your personal information to third parties. We may share information with:

• Service providers: trusted third parties who assist in operating the Service (hosting, payment processing, email delivery) under strict confidentiality agreements.
• Legal authorities: when required by law, court order, or governmental authority.
• Business transfers: in connection with a merger, acquisition, or sale of assets, with prior notice to users.

8. Data Security

We implement industry-standard technical and organisational measures to protect your data against unauthorised access, alteration, disclosure, or destruction. These include encryption in transit (TLS), encryption at rest, access controls, and regular security assessments.

Pellentesque habitant morbi tristique senectus et netus et malesuada fames ac turpis egestas. Vestibulum tortor quam, feugiat vitae, ultricies eget, tempor sit amet, ante.

9. International Data Transfers

Your data is stored and processed within the European Economic Area (EEA). Where data is transferred outside the EEA, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission.

10. Your Rights Under GDPR

As a data subject, you have the following rights:

• Right of access: to obtain a copy of your personal data.
• Right to rectification: to correct inaccurate or incomplete data.
• Right to erasure: to request deletion of your data ("right to be forgotten").
• Right to restriction: to limit how we process your data.
• Right to data portability: to receive your data in a structured, machine-readable format.
• Right to object: to object to processing based on legitimate interests.
• Right to withdraw consent: at any time, without affecting prior processing.

To exercise any of these rights, contact us at privacy@medicai.app. We will respond within 30 days.

11. Cookies

We use essential cookies to maintain your session and language preference. We do not use third-party advertising or tracking cookies. You may configure your browser to refuse cookies, though this may affect certain features of the Service.

12. Children's Privacy

The Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from minors. If you believe a minor has provided us with personal data, please contact us so we can delete it.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or by posting a prominent notice on our website. Continued use of the Service after changes constitutes your acceptance of the updated policy.

14. Contact

For privacy-related questions or to exercise your rights, contact our Data Protection Officer at privacy@medicai.app.