Separate organization and roles
Permissions are checked against the current organization and resource. There is no global patient-file search by national identifier, name or phone.
Trust Center
Clear access boundaries. Verifiable security information.
How MediSend protects medical file handovers, what remains under the clinic’s control and which infrastructure facts require separate confirmation.
Every handover has its own access scope
The clinic manages its own team, files and invitations. Recipients receive permission for a specific handover with expiry and revocation. Professional verification and clinic-group membership do not grant access to other clinics’ medical files.
Protected sign-in and scoped invitations
Supported controls include multifactor authentication, session expiry and revocation, and one-time codes or PINs according to the selected workflow. Sensitive administrative actions require recent identity confirmation.
Checks before download
The system checks allowed file types, sizes and scan outcomes. Pending, failed or quarantined scans block download eligibility.
History of material actions
Sending, access, permission changes and privileged decisions create an audit trail with limited metadata. Support uses safe operational references.
Cryptographic protection with a defined scope
Production deployment requires HTTPS/TLS. Passwords and public tokens are stored as one-way hashes. File delivery is subject to authorization checks, and SHA-256 checksums support integrity verification.
Private object storage, storage-side encryption, key management, database encryption and protected recovery copies are deployment-specific settings. Their actual configuration requires operator confirmation. These controls do not establish end-to-end encryption.
Processing locations require infrastructure evidence
Production facts awaiting confirmation
The application server, PostgreSQL, cache, object storage and recovery-copy locations cannot be established from source code. This page makes no unverified promise that all processing remains in the EU. Request the current inventory and contractual annexes for your organization.
The published register describes supported roles for AWS, Netlify, Cloudflare, Brevo, SMSAPI, Stripe and Sentry and identifies unconfirmed settings. A supported integration does not establish an active provider, a particular region or an executed agreement.
Access expiry and data retention are different
An expired link ends that access. Archiving, cold-storage preparation and final deletion are separate processes. Organization policies, legal holds and existing access workflows are checked before destructive operations.
The organization workspace and applicable order define the relevant periods. The clinic retains responsibility for medical recordkeeping obligations and exported copies. Recovery-copy schedules and disaster-recovery evidence require separate production validation.
Monitoring, response and reliability
Operational monitoring evaluates recorded delivery and processing outcomes, correlates signals and opens incidents for the responsible team. Missing or insufficient data is not presented as confirmed normal operation. The public page shows only authorized summaries with freshness checks.
Use the contact below to report a suspected incident. Keep clinical contents out of the report. The contractual process defines customer communications and applicable notifications. No independent certification or external audit result is asserted here.
Effective documents and separate review drafts
The editions below correspond to existing acceptance records. The effective texts are Bulgarian. English reading adaptations appear in separately labelled legal review drafts and do not replace accepted editions. Reading this page does not create new contractual acceptance.
The accepted editions are Bulgarian. Review drafts offer separate Bulgarian and English reading versions.
8 documents
- Terms of servicev2026-09-02.2 · Effective · Bulgarian
- Privacy noticev2026-09-02.2 · Effective · Bulgarian
- Data processing agreementv2026-09-02.2 · Effective · Bulgarian
- Subprocessors and providersv2026-09-02.2 · Effective · Bulgarian
- Retention, archiving and deletionv2026-09-02.2 · Effective · Bulgarian
- Technical and organizational measuresv2026-09-02.2 · Effective · Bulgarian
- Cookies and local storagev2026-09-02.2 · Effective · Bulgarian
- Recipient privacy noticev2026-09-02.2 · Effective · Bulgarian
Accessibility and reading preferences
Workspaces provide text-size, high-contrast and reduced-motion preferences. Choices persist in the browser; system preferences apply when no explicit choice exists. Core workflows support keyboard navigation and labelled controls.
Automated checks do not establish accessibility certification. When reporting a barrier, include the page, browser, assistive technology and intended action. The team will review it through the support process.
Security and data-protection contact
For suspected vulnerabilities, incidents, processing questions or accessibility barriers: [email protected].
Describe the affected function and include a safe operational reference. Exclude patient names, medical files, access codes, PINs and passwords. If further evidence is needed, the team will arrange an appropriate protected channel.