Privacy policy
e-anamneza is a platform where patients keep their medical record and talk to their doctors. We process health data, so we handle it with the care required by the General Data Protection Regulation (GDPR, EU Regulation 2016/679) and Romanian law. Below you’ll find what data we hold, why, who sees it, how long we keep it and how to exercise your rights.
1. Who is responsible for your data
The data controller is [to fill in: name of the clinic or company, registration number, address]. The data protection officer (DPO) can be reached at [to fill in: DPO e-mail].
Your account is created by the platform’s administrator (your clinic). The doctors who care for you use the platform to keep your record and to talk to you.
2. What data we process
| Category | Examples |
|---|---|
| Identity and contact | first and last name, e-mail, phone, date of birth, your EA-… patient code, your personal numeric code (CNP — optional, only if you add it) |
| Your account | username, chosen language, two-step sign-in devices, the consents you gave |
| Health data | clinical history, allergies, medication, medical documents (lab results, letters, images), questionnaire answers, AI summaries and analyses of documents, referrals and clinical cases, your communication profile (for example, whether you use sign language) |
| Communication | messages with your doctor or the AI assistant, files sent in a conversation, video call recordings (only when you and the doctor both agreed) |
| Images | your profile photo (saved without metadata such as location) |
| Appointments and notifications | appointments, reminders, in-app notifications |
| Technical data | the record access log, your phone’s push-notification identifier, your IP address (used for security and rate limiting) |
We don’t keep: dictation audio (it is transcribed, then discarded), the video used for sign-language recognition (it stays on your phone) or the text of your searches.
3. Why, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Keeping your medical record, appointments, talking to your doctors, notifications | healthcare (Art. 9(2)(h) GDPR) and providing the service you asked for (Art. 6(1)(b)) |
| The AI assistant reading your documents and answers | your separate, explicit consent (Art. 9(2)(a)), which you can withdraw at any time in your profile |
| Using data for research | your separate, explicit consent; today we only record it and do no research on data |
| Recording a video call | the agreement of both parties, given in the app for each call |
| Your CNP | you add it, optionally [legal check: consent or legitimate interest, Art. 4 of Romanian Law 190/2018] |
| Keeping the record after the account is closed | legal obligations on medical records [legal check: basis and period] |
| Access logs, platform security | our legitimate interest in protecting your data and the security obligation (Art. 32 GDPR) |
We don’t use your data for advertising, we don’t sell it and we don’t do marketing profiling.
4. Who sees your data
- You — your whole record.
- The doctors who care for you — only those you have a non-cancelled appointment or an accepted referral with. You can revoke any doctor’s access under “Who can see your record”, and restore it.
- Administrators and supervisors — have no access to records. Only in exceptional cases (support, an incident, a legal request) can they open a record, read-only, for 30 minutes, with a written reason. You are told at once, and the access and its reason appear in your log.
- The sign-language interpreter — joins only the video call they were called to, with no access to your record.
Every time someone else opens your record, it appears in your access log, which you can see in the app.
5. The AI assistant
- The virtual assistant gives general information, doesn’t diagnose and doesn’t replace a medical consultation. A doctor checks its answers before they reach you.
- The assistant reads your documents and questionnaire answers only if you gave that consent in your profile. A file you send in a conversation is read only for that question.
- AI summaries and analyses of documents, asked for by you or your doctor, aren’t checked by a doctor and are labelled as such.
- The AI model runs at [to fill in: the production AI provider and country]. We don’t use it to train other models.
6. Who we share data with
We work with providers that process data only on our behalf, under contract:
| Provider | What they receive |
|---|---|
| Server hosting [to fill in: provider, country] | all data, stored encrypted |
| AI provider [to fill in] | messages to the assistant and, with your consent, extracts from documents |
| Google Firebase Cloud Messaging | push notifications on your phone: the caller’s or doctor’s name and the appointment time — nothing medical |
| E-mail service [to fill in] | your e-mail address and the text of the notifications your clinic chose |
| SMS (our own gateway and the mobile operator) | your phone number and the text of important notifications, with no medical data; you can turn them off in your profile, except the security ones |
Fonts, icons, the video-call servers and the assistant’s voice are hosted by us: your browser doesn’t contact Google or other third parties for them. Data may be disclosed to authorities only when the law requires it.
7. How long we keep it
| Data | Period |
|---|---|
| Medical record, while you have an account | as long as the account is open |
| Medical record, after the account is closed | 10 years, locked and seen by no one, then deleted automatically [legal check] |
| Deleted documents (the recycle bin) | 30 days, then deleted for good |
| Video call recordings | 90 days |
| Notifications | 30 days |
| AI replies checked by doctors (drafts) | 1 year |
| Phone upload sessions | 90 days |
| Data outside the record (conversations, recordings, questionnaire answers, photo, push devices) | deleted at once when the account is closed |
| Backups | about 35 days; once your keys are deleted, older copies become unreadable when they expire |
8. How we protect it
- Your medical files, the text extracted from them, AI summaries, questionnaire answers and your photo are encrypted with a key of each patient’s own. The master key is kept in a separate vault (OpenBao) it never leaves.
- Traffic is encrypted (HTTPS). Doctors, administrators and supervisors must use two-step sign-in; for patients it is optional.
- Access to the record is decided on every request, based on the care relationship, and the access log can’t be altered.
- Not encrypted, but protected by access control: message contents, document titles, names, identification data and the structured clinical history.
- If a security breach happens, we notify the authority within 72 hours, and you when there is a high risk to you.
9. Your rights
You have the right of access, rectification, erasure, restriction, portability and objection, and the right to withdraw a consent at any time. You exercise most of them directly in the app:
- Access and portability — Profile → My data → “Download my data”: a ZIP archive with everything we keep about you.
- Rectification — your personal data in your Profile; a wrong medical entry is corrected by the doctor who wrote it.
- Consents — Profile → Consents, switched on or off at any time.
- Who can see your record — revoke or restore a doctor’s access.
- Access log — see who opened your record.
For any other request, write to [to fill in: contact e-mail]. We answer within one month.
10. Deleting your account
In the app: Profile → My data → Delete my account, then confirm by typing DELETE. You can also ask for deletion by e-mail, at [to fill in: contact e-mail], from your account’s address.
- The account is closed at once and you can no longer sign in.
- Data outside the medical record is deleted at once: conversations, call recordings, notifications, questionnaire answers, your profile photo, notification devices and upload sessions.
- The medical record stays locked, seen by no one, for the period the law requires (section 7), then is deleted automatically, together with its encryption keys.
- Before deleting, you can download all your data.
11. The mobile app
- It keeps no medical data on your phone. Only your sign-in session stays there, in the system’s secure storage.
- It asks for the camera (video calls, photographing documents, your profile photo, sign language), the microphone (calls, dictation) and the photo library (documents, your photo) — only when you use that feature.
- The app’s screen is hidden when you send it to the background.
- It has no ads and uses no third-party tracking or analytics tools.
12. Contact and complaints
Questions about your data: [to fill in: e-mail] or the DPO [to fill in].
You can lodge a complaint with the Romanian data protection authority (ANSPDCP), www.dataprotection.ro.
If we change this policy, we tell you in the app before the change applies.