Trust / GDPR
We treat health information as special-category personal data under the GDPR and ship strong defaults for lawful, minimized, and transparent processing.
EU-region storage by default
Regional residency options for Hospital and Enterprise plans.
Data Processing Agreement
Standard DPA with Standard Contractual Clauses available on request.
Data subject rights
Access, rectification, erasure, restriction, portability, and objection.
Records of Processing
Maintained per Article 30, available under NDA to enterprise customers.
We process only what a clinical workflow needs. Patient-provided content is used to deliver care, operational logs support security and reliability, nothing is used to train foundational models.
Patient data is never included in foundational model training. Model quality improvements happen on synthetic and consented, de-identified evaluation sets only.
Contact info@medi-prompt.com to exercise data subject rights. We aim to acknowledge within 72 hours and fulfil verified requests within 30 days.
Related
