Privacy Policy

1. Who is responsible?

The controller under the GDPR is: Aimedis LLC 16192 Coastal Highway Lewes, Delaware 19958 USA Email: contact@aimedis.com Contact for privacy enquiries: datenschutz@aimedis.app

2. What data do we process?

We only process data you provide yourself or that is necessary to deliver the medical service: • Account: name, email, password hash, role • Profile: date of birth, gender, address, phone, medical data (blood type, height, weight, insurance), emergency contact, avatar • Consultation: symptoms, vitals, uploaded attachments, clinician notes, the physician's triage decision with its earlier versions, non-binding medication recommendations • Course of a request: when a physician releases your request to the practice, hands it over to a colleague or closes it without a decision, the reason and the note are part of your consultation record • AI suggestions: the AI triage suggestions shown to the treating physician are stored with your consultation record as provenance, marked as non-binding; your physician decides. They are not shown on your screens; your data export contains them in a separate, labelled section • Messages and check-ins: messages between you and your physician about a consultation and, where your practice offers it, your answers to a check-in after care at home are part of your consultation record. No AI reads them, and notices never contain their text • Notifications: if you switch them on, the language and time zone your notices use, and a delivery log that holds only references and times (deleted after 400 days) so that a notice is not sent twice • AI assistant AVA: patients' conversations (questions, answers, sources) in their own account; for physicians only metadata in the audit log (source, model, time), never the text • Audit log: access to sensitive actions with actor and target

3. On what legal basis?

Processing medical data is based on your explicit consent under Art. 9(2)(a) GDPR. For contract performance (e.g. consultation) also Art. 6(1)(b). Audit log on the basis of legitimate interests (Art. 6(1)(f)) to ensure platform security.

4. Where is the data stored?

Database and storage buckets run on Supabase in the EU region (Stockholm, Sweden); a standby copy is kept in the EU region (Ireland). Encryption in transit (TLS 1.3) and at-rest (AES). Service-role access is server-only; the browser only sees the anonymous public key. Video consultations run by default on Aimedis' own video server (LiveKit, hosted in the EU), not at a third party. They are end-to-end encrypted: sound and picture are encrypted on your device with a key that only you and your physician receive, so the server forwards them without being able to see or hear them. Aimedis does not record video consultations. The video server processes only connection data such as IP addresses and times, never names or case numbers.

5. Who has access?

Strict row-level security (RLS) on every table: • Patients see only their own data. • Before a physician takes on a request, the physicians of the Aimedis telehealth practice see only a short card: the main complaint, the number of warning signs, the waiting time and the case number, never your name or contact details. After that, only the physician who took on your request, or the physician you booked in Aimedis Booking, sees your consultation. • If you allow it on a request, the physician who takes it on also sees your earlier Decision consultations with the same practice. The setting is off unless you switch it on, and you can switch it off while the request is open. • Decision administrators (platform administrators of Aimedis Pro) see no patient data: no consultation, no care plan, no file and no name. They see totals only (numbers below 5 are shown as "<5"), the content library, the settings and the audit log, which records actions with their time and shortened, pseudonymous references, never health data, names or email addresses. • Every sensitive action is recorded in an audit log whose hash chain makes later changes detectable. • No third parties have access apart from the processors named in section 7.

6. How long is the data kept?

Records of a consultation are kept for 10 years after it ends (§ 630f Abs. 3 BGB, § 10 Abs. 3 MBO-Ä), longer only where the law requires it, and then deleted. Data not under this duty is deleted with your account. Push subscriptions are deleted immediately upon opt-out.

7. Subprocessors

We share data with the processors below only as needed to deliver the service. Before production use with real data a Data Processing Agreement must be in place with each of them.

Most providers process data in the USA; these third-country transfers are safeguarded by EU Standard Contractual Clauses (Art. 46 GDPR). Supabase runs in the EU region (Stockholm, Sweden). AVA reads its answers aloud with ElevenLabs and turns dictation (your spoken audio) into text with ElevenLabs. Until an Enterprise agreement with Zero-Retention mode is in place, the text and audio sent there may be logged server-side. For medical literature and health topics AVA sends only a short English search topic, never your message, your name or other personal data, to the U.S. National Library of Medicine (PubMed, MedlinePlus).

8. Your rights

You have at any time the right to: • Information (Art. 15): download of your Decision data in your profile (one ZIP file with your requests, the physicians' decisions and care plans, your files, your AVA conversations and your settings) • Rectification (Art. 16): correct wrong data directly in the profile • Erasure (Art. 17): deletion of your account and of all data not under a retention duty; records under the 10-year duty are kept without the link to your account and deleted when it ends • Data portability (Art. 20) • Withdrawal of consent (Art. 7) • Complaint to a supervisory authority

9. Cookies and tracking

The platform sets only functional cookies (session, language preference, your device's time zone, auth token). No third-party tracking, no advertising pixel, no analytics tool without explicit consent. Web push and email notifications are explicitly opt-in.