Privacy notice

Karizo EOOD, Bulgarian company number 207562809, provides MediSend. Its declared contractual address is 150 Sveti Knyaz Boris Street, entrance B, floor 4, Stara Zagora 6000; contact: [email protected], +359 895 88 66 45. This is a privacy contact, not an assertion that a data protection officer has been appointed. Company details require registry confirmation before this draft is approved.

For medical files, patient uploads, returned results and clinical messages, the sending organization normally acts as controller: it determines the purpose, necessary data, recipient and retention. Karizo processes on its documented instructions. A customer that is itself a processor must have authority to appoint us as a subprocessor. A receiving doctor or their healthcare organization may separately control their own medical work. Roles follow the actual activity, not merely the account type.

Karizo independently controls its account administration, contracts, billing, security, abuse prevention, professional and organization verification, opt-in discovery and its own support records. Assistance involving particular customer clinical content remains processor activity for that operation. This notice does not transfer clinical responsibility to the platform.

Information comes from your registration, settings, verification, billing or support request; an organization inviting you, sending an examination or requesting uploads; an authorized uploader or respondent; and authenticated payment or communication events. Technical information arises when the service is used. Public registers and supplied evidence may support authorized verification; there is no global patient search.

If you receive a notice without an account, the sender supplied the contact. Ask the identified organization about the reason, contact accuracy and clinical basis. Registration is not required to exercise applicable rights. For an unfamiliar sender, do not send clinical attachments or access secrets to support.

When Karizo obtains personal data from another source for its own controller activity, it supplies the applicable Article 14 GDPR information within a reasonable period and at the latest within one month, at the first communication with the individual or before the first disclosure, whichever occurs earlier. This includes the source and whether it was publicly accessible. Any applicable legal exception is assessed and documented for the activity; a public register does not automatically remove the duty. For customer clinical data, the controller determines and supplies the required patient information and Karizo assists on instruction.

Required fields are identified for the particular requested service. Name, email, password, express Terms acceptance and privacy-notice acknowledgement are needed to create an account; without them it cannot be created. Legal and billing details are needed for the relevant review, order or invoice, with statutory necessity determined for the particular document. A recipient email or phone is required only for the selected delivery channel; without the correct contact that notice cannot be sent. Additional profile information, professional verification and discovery are separate choices. Declining discovery or professional verification does not revoke existing particular authorized access, but the corresponding additional function is unavailable. Required clinical information and its lawful basis are determined by the healthcare organization, not a universal platform requirement.

Account information includes name, email, supplied phone, preferences, protected password representations, MFA settings, devices and sessions. Clinic information includes business and legal details, memberships and roles, a public upload address, plan, usage, contractual evidence and accounting references. Clinical content may include patient names or references, images, examinations, documents, filenames, purpose, clinical context, permitted replies and access history.

Personal receiving processes the doctor’s specific grants, authorized examination list, chosen filters, saved-for-later markers and private notes. Notes are separate from replies to the clinic and are not included in its conversation; their stored content is encrypted. Saving for later does not extend medical access. An account, directory listing or linked login grants no medical-file permission.

A requested account and contractual service rely on contract performance or pre-contract steps. For staff acting for an organization, the business relationship may rely on legitimate interests in administering the service. Accounting and tax records serve applicable legal obligations. Security, fraud prevention and accountability rely on assessed legitimate interests and applicable security duties. The assessment considers necessity, minimization, sensitivity and the right to object.

Professional verification supports reliable professional routing and protection against false profiles; it does not assess clinical quality. Discovery is a separate voluntary choice that can be turned off. Contract acceptance, privacy-notice acknowledgement and permission for a service SMS are not blanket consent to health-data processing. Counsel must approve the separate directory basis and notice before publication.

For customer clinical content, the controller determines the Article 6 GDPR basis, applicable Article 9(2) condition, professional secrecy and medical-record rules. A general registration or upload checkbox does not replace that assessment. The customer must minimize disclosure, check the recipient and inform affected individuals, including through its own notice.

We do not use clinical content for advertising, model training or an independent new clinical purpose. MediSend does not diagnose or make automated clinical decisions. Abuse, quota and eligibility controls may restrict an action or require human review; professional and organization verification are separate reviews. The sender checks applicable authority when someone acts for a patient or minor.

One login may have a personal workspace and separate clinic memberships. Two existing logins are linked only after independent authentication and an explicit choice. The accounts, time and authorization evidence are recorded. Passwords, MFA, medical permissions, subscriptions, invoices and history do not merge. Unlinking revokes switching and affected sessions without deleting either independent account.

Professional discovery requires opt-in visibility and current verification. It may show name, professional role, specialty, city and supplied address; email and phone have separate sharing choices. Material identity changes require fresh review and may stop discovery. Turning discovery off stops future searching but does not revoke lawful existing grants or information already received.

A named-recipient SMS contains a protected link and expiry; the sender shares its required PIN separately and it is excluded from that SMS. Email sends the link and any enabled PIN is also shared separately. In-person link/QR delivery sends no notice. A separate Patient Key has its own code, PIN and rules; its selected SMS may contain that key’s code and PIN. Communication suppliers process the contact, minimal message and delivery information. Provider acceptance does not mean delivery, opening or clinical review.

Clinical replies stay within the authorized handover. Support cases use safe descriptions, categories, times and permitted technical references; clinic conversations remain within its scope. Ordinary support does not request files, patient names, protected links, PINs, OTPs or passwords. Clinic-selected API keys and webhooks have specific permissions, endpoints and history; the customer is responsible for its receiving software and must not place clinical secrets in URLs or general diagnostic logs.

Information is disclosed to authorized persons within scope, explicitly selected medical recipients and suppliers needed for the activity. A payment provider may independently control its own regulated and security purposes. Disclosure to competent authorities requires an applicable legal ground and verified scope. A directory contact or badge provides no access to other patients.

The subprocessor document describes supported integrations and what must be confirmed for actual suppliers. Code does not establish the contracting entity, country, onward access or provider retention. Processing outside the EEA requires an applicable mechanism, assessment and supplementary measures where needed. Exclusively EU processing is not promised. Information about applicable safeguards may be requested through the privacy contact.

Access, active work, archive and final deletion have separate deadlines. Product defaults are 60 active days and 365 total days from creation; the specific plan, recorded policy and lawful instructions matter. File-byte deletion is a separate conditional operation disabled by default. It does not automatically remove filenames, clinical context, descriptive records or audit. Their minimization schedule and backups require separate approval.

Raw professional-verification evidence is removed through a process after 90 days from submission, following confirmed deletion; decisions and history remain separate. Private notes are readable in the service only until the earlier of grant expiry and 90 days from saving; expired notes are withheld before periodic physical cleanup. This does not establish simultaneous removal from every backup. Contracts, invoices, support, delivery and security history follow applicable legal and approved operational periods. Session records may contain an IP hash, masked network summary and technical browser representation; these records are not described as anonymous.

Depending on the applicable basis, you may request information and access, rectification, erasure, restriction or portability, or object. Where consent is the actual basis, it can be withdrawn for future processing. Legal limitations, medical duties, other people’s rights and claims are assessed for the particular request; refusals are explained. Contact [email protected] for our own activities. For clinical data, contact the identified organization first; we assist its verified instruction.

Where identity or representation is reasonably in doubt, we may request proportionate evidence. We respond without undue delay and normally within one month; a permitted extension of up to two further months for complex or numerous requests is explained within the first month. No one-click function automatically erases all account data. Offboarding first addresses clinic ownership, permissions, export and lawful holds. You may complain to Bulgaria’s CPDP or another competent supervisory authority; cpdp.bg publishes its current procedure.

Article 20 GDPR portability applies under its conditions to data supplied by the individual and processed automatically on consent or contract; it is not a general right to export other people’s medical records. Objection to legitimate-interest processing is assessed against the particular situation and applicable legal conditions. Withdrawal of actual consent does not affect the lawfulness of earlier processing. A paid or new account is not required to make a rights request. Requests are normally free; the controller must justify any permitted reasonable fee or refusal for a manifestly unfounded or excessive request under applicable law. Judicial remedies are also available under applicable rules. In an initial request, identify the activity and a safe contact; do not send a national identifier, identity-document copy, medical files or access secrets without a specifically justified secure procedure.

The applicable version and earlier editions are preserved. Material changes to purposes, grounds, recipients or retention require review and appropriate advance information where law requires it. Reading a draft, changing language, signing in or continuing a session is not fresh consent. A new contractual edition may require separate acceptance; the privacy notice remains information about processing.