1. Check the organization and purpose
The identified healthcare organization determines why it sends an examination or requests files, what information is necessary and who may use it. Check its name and expected contact before opening or uploading. Confirm unexpected messages through a known organization contact. MediSend supplies the technical service; it is not medical advice, a diagnosis or an emergency channel.
The organization normally controls clinical information and Karizo EOOD, company number 207562809, processes on its instructions. A receiving professional may separately control their medical work. Karizo independently controls necessary platform-security and operational information described in the Privacy Notice. The sender supplied your contact for the notice.
2. A named-recipient link and separate PIN
No account is needed to open authorized files. Open the sender’s latest protected link. Named-recipient SMS requires a PIN supplied separately: the SMS itself contains the link and expiry without the PIN. Email or an in-person link/QR may also have a sender-selected PIN. The QR and printout for this link do not contain the PIN.
Enter the supplied PIN or other explicitly requested code accurately. Attempts and use are limited; follow any retry time shown. A PIN extends no deadline and gives no access to another organization. Keep the link and PIN from others and exclude them from support cases. Support cannot reveal a lost PIN.
3. Patient Key and request code
A Patient Key is a separate issued grant with its own code, PIN, expiry and use limits. Use Open with code; its QR or individual link may supply the code, while a PIN remains required. Keys have separate SMS and printing rules: a selected key SMS may contain its code and PIN. This is distinct from named-recipient SMS and its credentials must not be mixed with another access type.
For a file request, use its link or Open request with code and the stated protection. A request code is not a Patient Key. Check the clinic, expiry, permitted files and size limits. A code or contact gives no access to other examinations.
4. What you may do
You see only the issued handover and permitted actions: viewing, downloading, acknowledgement, messaging or returning files where enabled. Not every format has a preview; diagnostic DICOM viewing uses suitable medical software after authorized download. A file still being checked, restricted or prepared from archive may remain unavailable.
Use content only within the lawful authority granted. Do not forward access, use another person’s PIN or try to view other patients. Acknowledgement records that action, not a clinical conclusion. Clinical deadlines and urgent contact must be arranged through a separate reliable organization channel.
5. Uploads, replies and safety
Upload or return only necessary files to the correct organization and handover where you have authority to supply them. The form acknowledgement confirms authority and awareness of instructions; it is not blanket consent to all clinical purposes. Supplied name, contact, message, files and technical information serve the request and authorized reply.
Wait for upload confirmation and the displayed safety-check state. Recovery after interruption may require the same file; a different selection does not restore prior bytes. Submitted, checked and delivered are different states. When retry is offered, inspect the earlier result to avoid unnecessary copies. Exclude passwords, PINs and clinical information from technical support requests.
6. Expiry, revocation and new access
Expiry and limits belong to the particular grant. A link or key expiring does not prove erasure of the medical file. Where renewal requests are available, the sender decides whether to approve; registration or professional verification cannot bypass that decision. Ask the sender for fresh protected access if the PIN is lost.
Resending may rotate the link; use the latest because the earlier one may be invalid. Revocation blocks new access under service checks but does not erase a copy already downloaded by an authorized recipient. Retention, archive preparation and deletion follow separate controller rules and instructions; deleted content is not promised to be recoverable.
7. Optional receiving with an account
A doctor may use a free personal workspace without creating a clinic or paid subscription. Where adding an examination is offered, the issued access is proved first and the action is confirmed. Registration alone adds no unrelated examination and bypasses no expiry, PIN, revocation or permission. Linking accounts does not merge medical rights.
Private notes and saved-for-later markers are separate from a clinical reply to the sender. They do not extend access or make the service a permanent medical archive. Read the Privacy Notice and professional terms before activating the relevant functions.
8. Information, rights and help
Contact the identified organization about accuracy, clinical basis, medical retention, export or erasure. Applicable rights include access, rectification, erasure, restriction, portability and objection, assessed for the activity. For Karizo’s own processing, an unfamiliar sender or a technical personal-data question, contact [email protected]. Exclude clinical attachments and access secrets from the initial message.
Technical help is available at +359 895 88 66 45 using a safe support code, time and screen description. Clinic conversations require authorized membership; a public support request confers no organization access. Rights requests may require proportionate identity evidence. You may complain to Bulgaria’s CPDP or another competent authority; cpdp.bg publishes the current procedure. Separate privacy, retention and subprocessor documents explain further deadlines and suppliers.
Product scope for review · 20 October 2026
The sender may have created access while the notification is still processing or its outcome remains unconfirmed. The recipient uses the latest supplied link and the separate PIN when required. Registration is not required merely for authorized anonymous access; a personal inbox is a separate choice.
For expired, revoked or denied access, the recipient contacts the sender. A repeated notice or previously received message does not itself restore permission. Do not supply the protected link, PIN, sign-in code or medical file when contacting support.
Decisions before approval
The clauses above are complete proposed text. These decisions must be resolved before publication or a request for acceptance.
Bulgarian counsel and customer controllers
Approve patient/representative upload information, minors, professional secrecy and actual clinical grounds. The clinic must supply its own purpose, basis, recipient and medical-retention information; a platform checkbox does not replace it.
Counsel, security owner and operator
Review the Patient Key policy allowing its code/PIN in a key SMS separately from named-recipient links with a separate PIN. Confirm templates, supplier, limits, short-lived download URLs and renewal operation in a real environment without conflating the models.
Legal counsel and communications owner
Review the actual email, SMS, QR and printed instructions and the contact available to people without accounts. A local mockup alone does not approve a notification.
