Privacy Policy

1. Legal Basis for Processing

We process your personal data in accordance with Article 6 of the GDPR. The legal bases for processing include:

Health data falls under special categories of personal data (Article 9 GDPR). Additional safeguards apply, and processing is only permitted under specific exceptions provided by law.

• Consent: Where you have given explicit consent for specific processing activities
• Performance of Contract: To provide you with our services as agreed
• Legal Obligation: To comply with applicable laws and regulations
• Legitimate Interests: For purposes necessary to our legitimate business interests, provided these do not override your rights

2. Information We Collect

We may collect and process the following types of information:

3. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain our services
• Manage your account and authenticate your identity
• Facilitate medical appointments and bookings
• Store and manage medical records at your request
• Communicate with you about updates, promotions, or service-related notices
• Improve user experience and develop new features
• Ensure compliance with legal obligations
• Respond to your inquiries and provide support

4. Data Minimization and Purpose Limitation

We only collect personal data to the extent necessary to achieve the specific purposes for which it is collected. We do not collect personal data just in case without a clear, documented purpose. All processing activities are tied to specific, legitimate purposes that are communicated to you.

5. Consent Management

Where we rely on consent as a legal basis for processing:

• Consent must be freely given, specific, informed, and unambiguous
• We use clear, plain language when requesting consent
• You have the right to withdraw consent at any time by contacting us or through your account settings
• Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal

6. Sharing Your Information

We do not sell or rent your personal data. We may share your data with:

All third-party processors are bound by data protection agreements that meet the requirements of Article 28 GDPR.

• Trusted third-party service providers: Assisting in operations such as hosting, payment processing, email delivery, and analytics
• Healthcare providers: Only with your explicit consent when you book appointments or share medical records
• Legal authorities: If required by law or in response to valid legal requests
• Affiliates and subsidiaries: For operational purposes

7. Cross-Border Data Transfers

When transferring personal data outside the European Union or European Economic Area:

• We ensure the receiving country provides an adequate level of data protection
• We use appropriate safeguards such as standard contractual clauses approved by the European Commission
• We may transfer data with your explicit consent or for the performance of a contract

8. Your Data Subject Rights

Under the GDPR, you have the following rights:

To exercise these rights, please contact us at hi@mymedex.com. We will respond to valid requests within one month.

• Right of Access: Request copies of your personal data
• Right to Rectification: Request correction of inaccurate or incomplete data
• Right to Erasure (Right to be Forgotten): Request deletion of your data under certain conditions
• Right to Restriction of Processing: Request that we restrict processing under certain conditions
• Right to Data Portability: Request transfer of your data to another organization or directly to you
• Right to Object: Object to processing of your data under certain conditions
• Right to Withdraw Consent: Withdraw consent at any time where consent was relied upon
• Right to Lodge a Complaint: Complain to a data protection authority about our processing activities

9. Data Protection Impact Assessments (DPIA)

We conduct Data Protection Impact Assessments for processing operations that are likely to result in high risk to your rights and freedoms, particularly when using new technologies or processing sensitive health data on a large scale.

10. AI System Usage

If we deploy AI systems that process health data or interact with users about health topics:

Systems using only rule-based if-then logic without machine learning or inferential capabilities are not considered AI systems and do not fall under additional AI-specific requirements.

• We ensure transparency about AI system usage and capabilities
• We maintain appropriate human oversight for AI-assisted decisions
• We document AI system operations and decisions
• We ensure data governance and quality for AI training data
• We implement accuracy and robustness testing
• We maintain quality management systems

11. Data Security

We implement industry-standard security measures including encryption, access controls, regular security audits, and staff training to protect your information from unauthorized access, disclosure, or destruction. However, no method of electronic transmission or storage is 100% secure.

12. Data Retention

We only retain your personal data for as long as necessary to fulfill the purposes for which it was collected, including for legal, accounting, or reporting requirements. When data is no longer needed, it will be securely deleted or anonymized.

13. Children's Privacy

Our services are not directed to individuals under the age of 16. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us immediately.

14. Cookies and Tracking Technologies

We use cookies to personalize your experience and analyze traffic. You can adjust your browser settings to refuse cookies or alert you when cookies are being sent. For more information, please see our Cookie Policy.

15. Policy Updates

We may update this Privacy Policy from time to time. Changes will be posted on this page, and where appropriate, you may be notified by email or through the website. Your continued use of the service after changes constitutes acceptance of the updated policy.

16. Contact Us

If you have any questions about this Privacy Policy or how we handle your data, please contact us at:

You also have the right to lodge a complaint with your local data protection authority if you are dissatisfied with our response.

Email: hi@mymedex.com