Privacy Policy — EliaMed
1. Who We Are
EliaMed is currently operated by Farhan Ali as an individual, and is not yet formally registered as a business entity. Contact: info@eliamed.de
2. What This Policy Covers
This Privacy Policy explains how EliaMed ("we," "us," "our") collects, uses, stores, and protects personal data when you visit www.eliamed.de, create an account, or use our AI-powered medical document platform ("the Service").
3. Account & Contact Data
We collect: Name; Email address; Password (stored encrypted/hashed); Language preference.
4. Medical Document Data
When you upload medical documents to EliaMed, we process: the content of uploaded documents, which may include health data, diagnoses, treatment history, or other medical information (documents are stored as files in our storage provider, Supabase, and are also processed into vector embeddings to enable search and AI chat functionality); metadata associated with uploads, such as file names, upload dates, and document types; your messages within the AI chat interface, which are used transiently to generate responses and are not stored or retained by us after the session ends.
5. Technical Data
We collect IP address, browser type and device information, and log data and usage analytics. Signing in sets a first-party session cookie that keeps you signed in between visits; this cookie is strictly necessary for the Service to function and is not used for tracking or advertising. See our Cookie Notice for full details.
6. Legal Basis for Processing
Account data is processed to provide the Service to you under our agreement with you. By choosing to upload a medical document to EliaMed, you consent to our processing of its content as described in this policy; you may withdraw this consent at any time by deleting the document or your account, or by contacting us at info@eliamed.de. Technical data is processed based on our legitimate interest in securing and improving the Service.
7. How We Use Your Data
We use your data to: create and manage your account; process uploaded medical documents into a searchable knowledge base; power the AI chat interface that answers questions about your documents; maintain the security and integrity of the Service; communicate with you about your account or the Service; comply with legal obligations. We do not sell your personal data. We do not use medical document content for advertising purposes.
8. Subprocessors
To provide the Service, we work with: Supabase (server hosting, file storage, and vector embeddings) — Germany (Frankfurt); Google Gemini (AI chat processing) — United States. Transactional emails are currently sent directly by us from Germany.
9. International Data Transfers
Google Gemini, our AI processing subprocessor, is based in the United States. When your document content is processed for the AI chat feature, it is transferred outside the EU/EEA. We rely on Google's Standard Contractual Clauses (SCCs), as provided under their data processing terms, to safeguard this transfer. Our other subprocessors currently store and process data within Germany/the EU.
10. Your Rights
You have the right to: access the personal data we hold about you; rectify inaccurate data; erase your data; restrict processing in certain circumstances; receive your data in a machine-readable format (data portability); object to processing based on our legitimate interest; withdraw consent at any time, including for medical document processing; lodge a complaint with a supervisory authority (in Germany, your regional Datenschutzbehörde, or the authority in your EU country of residence). To exercise any of these rights, including requesting deletion of your account and all associated data, contact us at info@eliamed.de.
11. Data Retention
Medical documents are retained until you delete them. If you request deletion of your account, all data associated with that account — including uploaded documents — is permanently deleted. We do not separately retain technical or log data beyond what is contained within your account and documents.
12. Data Security
We rely on our infrastructure provider, Supabase, for encryption at rest and in transit: data is encrypted at rest in Supabase's storage and database, and connections to our Service use TLS encryption in transit. Access to documents is restricted at the database level using Row Level Security, so that users can only access their own data.
13. Data Protection Officer
We have not appointed a Data Protection Officer at this time.
14. Children's Data
EliaMed is not intended for individuals under 18. We do not knowingly collect data from minors.
15. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes via email or a notice on the Service.
16. Contact Us
Questions about this policy or your data: info@eliamed.de