Privacy Notice

1. Who we are, and which data is whose

Medicypher is operated by Veltrano Tech Ltd, established in United Kingdom.

There are two different relationships here, and they carry different obligations.

For patient records, the clinic is the controller and we are its processor. The clinic decides what is collected and why; we hold and process it on the clinic's instructions and do not use it for anything of our own. A patient asking about their record should ask their clinic, which can answer with our help.

For the account of the person who signs up — name, email, sign-in activity, billing — we are the controller, and this notice describes what we do with it.

2. What we hold, and why

As controller of clinic-user accounts, we hold what is needed to run the service and no more:

• Account details: name, email address, and a hashed password. We never store a password we can read.
• Sign-in records: times, devices and addresses, kept so an account takeover can be seen and investigated.
• Clinic and subscription details: clinic name, country, plan, payment status. We do not store card numbers.
• Diagnostic logs: errors and performance data, used to keep the service working.

3. Patient data

Patient records are processed only to provide the service to the clinic that entered them. We do not sell them, do not use them for advertising, and do not use them to train models of our own.

Every record carries the identifier of the clinic it belongs to, and every query is filtered by it, so one clinic cannot reach another's data. This is enforced in code and covered by an automated test that runs on every change.

Where a clinic uses the AI documentation features, the clinical text it submits is sent to the AI provider listed below to produce the draft, and is subject to that provider's terms. A clinic that would rather this did not happen can simply not use those features.

4. Where it is kept

Patient records are stored in Frankfurt, Germany. Some of the services below operate outside that region; where they do, transfers rest on the standard contractual clauses in our agreement with the clinic.

5. Who else touches it

We use these providers to run the service:

• Neon Inc. — Database hosting (Germany (eu-central-1, Frankfurt))
• Amazon Web Services — Underlying infrastructure for the database platform (Germany (eu-central-1, Frankfurt))
• Vercel Inc. — Application hosting (United States, with edge processing in the region of the request)
• ImageKit — Storage and delivery of uploaded documents and images (See provider terms)
• Brevo — Transactional email (France)
• OneSignal — Push notifications (United States)
• DeepSeek — AI assistance with clinical documentation (See provider terms)
• Sentry — Error monitoring (United States)
• Whish Money — Payment processing (Lebanon) (Lebanon)

6. How long

Account data is kept while the account is open, and deleted within 90 days of closure except where we must keep it longer — billing records, for instance.

Patient records are kept for as long as the clinic instructs, which is at least the period its own law requires it to retain medical records. A patient's request to erase a record cannot override that obligation while the period is running; the clinic will say which parts it can delete and which it cannot.

Diagnostic logs are kept for 90 days.

7. Your rights

You can ask for a copy of the personal data we hold about you, ask us to correct it, ask us to delete it, object to how we use it, or ask us to restrict it. You can also complain to your national data protection authority.

If you are a patient, ask your clinic first: it is the controller, it holds the record, and it can act faster than we can. If your clinic cannot resolve it, write to us and we will help.

To exercise any of these, write to hello@medicypher.com. We answer within 30 days.

8. Security

Data is encrypted in transit and at rest. Access requires authentication and is scoped to a single clinic. Administrative actions are written to an audit log the clinic can read. Passwords are hashed, never stored in a readable form, and repeated failed sign-ins lock an account temporarily.

No system is beyond compromise. If a breach affects your data we will tell you and the relevant authority within the time the law allows.

9. Changes

If we change this notice materially we will tell account holders by email before the change takes effect. The date above always shows the current version.