Privacy Policy

01Who we are

Medisys-X is operated by [legal entity name] (“Medisys-X”, “we”, “us” or “our”), a company registered in [governing jurisdiction] with its registered office at [registered office address].

We are the controller of the personal data described in this policy. For any question about this policy or your data, email [privacy contact email].

02What this policy covers

This policy applies to personal data we handle when you:

• visit medisys-x.tech, the AI Lab demonstration or the hospital simulator;
• send us a demo request or contact us by email;
• create or use an account in the Medisys-X client portal; or
• communicate with our implementation, support or admin teams.

This policy does not cover a hospital’s own systems or the way a hospital uses Medisys-X. Each hospital is responsible for its own users and for the content it puts into the portal.

03Data we collect

We also store your theme choice and a short-lived session token in your browser. Section 05 explains both.

We do not ask for, and do not want, patient records, health records, government identifiers, payment card numbers or other sensitive information in the portal. If you send such information to us by mistake, contact us so we can delete it.

04How we use data and why

Where we rely on legitimate interests, we balance our interest against your rights and expectations. You can object at any time (see section 10). Where we rely on consent, you can withdraw it at any time; withdrawing does not affect processing that already happened.

We do not use your data for automated decisions that have a legal or similarly significant effect on you.

05Cookies and browser storage

We do not use advertising, analytics or cross-site tracking cookies. The site uses only storage that is needed to work:

The pages also load fonts from Google Fonts. That request sends your IP address and basic request metadata to Google, which is a separate controller for that processing. See Google’s privacy policy.

You can block or clear browser storage in your browser settings. The pages will still work, but your theme choice will not persist and you will need to sign in again.

06Who we share data with

We share personal data only as far as needed to run the service:

• Hosting and infrastructure providers that run the website, portal and database, including Hostinger.
• Email providers that deliver account, security and demo-request messages.
• Professional advisers such as lawyers and accountants, where necessary and under confidentiality duties.
• Authorities and courts where the law requires it, or to establish or defend legal claims.
• A buyer or successor in a merger, acquisition or reorganisation, with equivalent protection and notice where required.

We do not sell personal data, and we do not share it with advertising networks or data brokers. Providers that process data on our behalf are bound by a contract that limits them to our instructions.

07International transfers

Some of our providers may process data in countries other than yours. Where the law requires it, we use appropriate safeguards, such as standard contractual clauses and additional technical or organisational measures. Contact us if you would like more information about the safeguards that apply to your data.

08How long we keep data

• Demo and contact requests: while we follow up, and normally no longer than 24 months after our last contact. We delete it earlier on request.
• Account and portal data: while the account is active, then normally up to 12 months after it closes, unless we must keep it for a legal claim or obligation.
• Requests, comments and files: for the life of the workspace, then the account-retention period above.
• Security and audit logs: kept on a short rotation for security and troubleshooting, and longer only where needed to investigate an incident.
• Backups: rotated out after 14 days, unless a restore or investigation requires a longer hold.

When data is no longer needed, we delete it or anonymise it. If we cannot delete a copy immediately, for example from a backup, we isolate it and delete it when the backup rotates.

09How we protect data

We use TLS for data in transit, bcrypt hashing for passwords, role-based access, rate limits and account lockout, audit logging, and access-controlled backups. Only the people who need access to operate or support the service have it.

No system is perfectly secure. If you believe an account or data has been compromised, email [privacy contact email] straight away. Please do not include passwords, patient data or other sensitive information in an email.

10Your rights

Depending on where you live, you may have some or all of these rights:

• Access a copy of the personal data we hold about you.
• Correct data that is inaccurate or incomplete.
• Delete data we no longer have a lawful reason to keep.
• Restrict or object to processing, including direct marketing.
• Portability receive data you gave us in a structured, commonly used format.
• Withdraw consent where processing is based on consent.

To exercise a right, email [privacy contact email]. We may need to verify your identity first. We answer within the period the law allows, normally one month.

You can also complain to your local data protection authority or to the authority in [governing jurisdiction]. We would appreciate the chance to resolve your concern first.

11Children

Medisys-X is a business service for hospitals and their staff. It is not directed to children, and we do not knowingly collect personal data from anyone under 18. If you believe a child has sent us data, contact us and we will delete it.

12AI and demonstrations

The AI Lab and hospital simulator are demonstrations that use synthetic or illustrative data. They are not connected to a real hospital and must not be given real patient data. Outputs may be incomplete or wrong and are shown for illustration only.

Any AI-assisted feature in the portal is decision support. It does not diagnose or treat anyone, and a qualified clinician must review its output before acting on it.

13Changes to this policy

We may update this policy to reflect changes to the service or the law. The current version is always on this page, with the effective date above. If a change materially affects how we use personal data, we will give notice by email or in the portal before it takes effect.

14Contact us