Privacy Policy

1. Introduction and Scope

MediTalk s.r.o. ("MediTalk", "we", "us", or "our") is committed to protecting the privacy and security of personal data in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and applicable Slovak and European Union data protection laws.

This Privacy Policy describes how we collect, use, disclose, and safeguard personal data when you use our medical documentation platform (the "Service"). By using MediTalk, you acknowledge that you have read and understood this Privacy Policy.

2. Data Controller

For the purposes of GDPR Article 4(7), MediTalk s.r.o. is the data controller responsible for your personal data:

3. What Personal Data We Collect

We collect and process the following categories of personal data:

4. Legal Basis for Processing

We process personal data only when we have a valid legal basis under GDPR Article 6(1):

• Contract Performance (Article 6(1)(b)): Processing necessary to provide the Service and fulfill our contractual obligations to healthcare providers.
• Legal Obligation (Article 6(1)(c)): Compliance with healthcare record retention requirements and applicable medical regulations.
• Legitimate Interests (Article 6(1)(f)): Service improvement, security, and fraud prevention, where such interests are not overridden by data subject rights.

5. How We Use Your Data

• Transcription of medical consultations using AI speech-to-text technology
• Generation of clinical documentation and structured medical notes
• Secure storage and retrieval of medical records
• Service improvement and quality assurance (anonymized data only)
• Communication regarding service updates, security notices, and administrative matters

6. AI Processing and Third-Party Services

MediTalk utilizes artificial intelligence services from third-party processors to provide transcription and documentation generation. These processors act as data processors under GDPR Article 28:

Important: These AI services do not use your data to train their models. Audio recordings and transcripts are processed transiently and are not retained by the AI providers beyond the time necessary for processing.

7. Data Sharing and Disclosure

We do not sell personal data to third parties. We share data only in the following limited circumstances:

• With AI service providers (Anthropic, OpenAI) as data processors under strict contractual safeguards
• With cloud infrastructure providers (Supabase, Vercel) for secure data storage and application hosting
• When required by law, court order, or regulatory authority, or to protect the rights, property, or safety of MediTalk, our users, or others

8. Data Retention

Clinical records (consultations, transcripts, notes) are retained for a minimum period required by Slovak healthcare regulations (typically 10 years from the date of the last medical intervention). After this period, data may be archived or deleted in accordance with legal requirements.

Account and user data is retained for the duration of your account plus an additional period as required for legal compliance, dispute resolution, and enforcement of agreements.

9. Data Security

We implement technical and organizational measures to protect personal data against unauthorized access, alteration, disclosure, or destruction:

• End-to-end encryption for data in transit (TLS 1.3)
• Encryption at rest for all database storage (AES-256)
• Access controls and authentication mechanisms (multi-factor authentication available)
• Regular security audits and vulnerability assessments

10. Your Rights Under GDPR

As a data subject, you have the following rights under GDPR:

• Right of Access (Article 15): You may request a copy of the personal data we hold about you.
• Right to Rectification (Article 16): You may request correction of inaccurate or incomplete personal data.
• Right to Erasure (Article 17): You may request deletion of your personal data, subject to legal retention obligations.
• Right to Restriction (Article 18): You may request that we limit processing of your personal data in certain circumstances.
• Right to Data Portability (Article 20): You may request transfer of your data to another controller in a structured, machine-readable format.
• Right to Object (Article 21): You may object to processing based on legitimate interests or for direct marketing purposes.

To exercise any of these rights, please contact us at privacy@meditalk.ai. We will respond to your request within one month as required by GDPR Article 12(3).

11. International Data Transfers

Your data may be transferred to and processed in countries outside the European Economic Area (EEA), including the United States, where our AI service providers operate. Such transfers are conducted in accordance with GDPR Chapter V:

We ensure appropriate safeguards through Standard Contractual Clauses (SCCs) approved by the European Commission, supplemented by additional technical and organizational measures to ensure GDPR-level protection.

12. Cookies and Tracking

We use cookies and similar tracking technologies only with your consent. Analytics cookies (Vercel Analytics) are used to understand service usage patterns and improve user experience. You may withdraw consent at any time through our cookie banner or browser settings.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. Material changes will be communicated via email or prominent notice on the Service at least 30 days before taking effect.