Privacy Policy

At MedPix, protecting your personal data is our absolute priority. This privacy policy explains how we collect, use, store and protect your information in connection with your use of our medical image management platform.

MedPix complies with the General Data Protection Regulation (GDPR) and the specific requirements applicable to health data in France.

1. Data controller and MedPix's role

The healthcare practitioner remains the data controller for their patients' data, in accordance with the GDPR. As a healthcare professional, you determine the purposes and means of processing your patients' health data.

MedPix acts as a technical data processor (Article 28 GDPR) for hosting, storage, and platform provision. For certain automated features (voice dictation, OCR, template analysis, report generation), MedPix defines the technical means of processing (choice of AI model, parameters, retention period) and therefore acts as a processor with documented instructions, with the practitioner retaining the role of data controller. We do not hold, exploit, or commercialise your patients' medical data.

As a practitioner, you retain full ownership and control of your data. You may at any time:

• Export all your data locally
• Close your account
• Manage access rights and patient consents

For any questions regarding your personal data, you may contact us at: contact@medpix.app

2. Infrastructure and hosting

2.1 Technical architecture

MedPix is available on the web and as mobile applications. The apps communicate with services operated by MedPix on Google Cloud for authentication, synchronisation, storage and selected features.

MedPix uses Firebase, Cloud Functions, Cloud Storage and Vertex AI. MedPix remains responsible for their configuration, security and contractual governance.

2.2 HDS v2.0 certified hosting

Health data is stored on Google Cloud services configured in the European Economic Area, mainly in Paris where supported. Google Cloud's HDS v2.0 certification covers a defined list of services and locations; MedPix compliance also depends on the services actually used, their configuration and the applicable contracts.

HDS v2.0 certification (the most recent version) strengthens requirements in the areas of:

• Data sovereignty
• Access traceability
• Process transparency
• Infrastructure security

2.3 Data sovereignty

Persistent medical content is configured for storage in the European Economic Area, mainly in Paris. Some technical and AI processing may use another European region or the "eu" multi-region. Technical telemetry, audience measurement and commercial data, which must not contain medical content, may be processed outside the European Union with applicable GDPR safeguards.

Each practitioner has their own isolated storage area within the Google Cloud bucket managed by MedPix. You do not need to create a Google Cloud account: MedPix manages the storage billing with Google and includes it in your subscription.

3. Data collected

We collect the following types of data:

3.1 Practitioner data

• Last name, first name
• Professional email address
• Account information (credentials, encrypted password)
• Billing and subscription information
• Login and platform usage data

3.2 Patient data

• Identification data: last name, first name, date of birth
• Contact details: email, phone number (if provided)
• Medical photos and clinical images
• Medical notes and annotations
• Treatment and injection history
• Electronically signed consents

3.3 Technical data

• IP address
• Browser and device type
• Navigation data (pages visited, duration)
• Cookies and similar technologies
• File metadata (date, time, camera)

4. Purposes of processing

Your data is collected and processed for the following purposes:

• Service provision: Patient record management, secure image storage, before/after comparisons
• Medical follow-up: Treatment history, injection mapping, progress tracking
• Communication: Sending notifications, secure sharing with patients via dedicated portal
• Administrative management: Billing, customer support, subscription management
• Service improvement: Usage analysis, bug fixes, development of new features
• Legal compliance: Fulfilment of legal and regulatory obligations

5. Legal basis for processing

The processing of your data is based on:

• Performance of a contract: Processing necessary for the provision of the service
• Consent: For optional processing and non-essential cookies
• Legitimate interests: For security, fraud prevention and service improvement
• Legal obligations: Retention of data for the applicable legal periods

Health data: The processing of patients' health data is carried out under the responsibility of the healthcare practitioner, in accordance with Articles 6 and 9 of the GDPR. The practitioner remains the data controller for their patients' data.

6. Recipients of data

Your data may be shared with:

• Hosting providers: Google Cloud Platform (Firebase), mainly the Paris region, infrastructure certified HDS v2.0 for a defined scope of services and locations
• Artificial intelligence: Google Vertex AI (Gemini), requested in a European region or the "eu" multi-region depending on the model
• Subscriptions and payments: RevenueCat and, depending on the subscription channel, Apple, Google Play or the web payment provider
• Infrastructure services: Analytics and monitoring services (anonymised)
• Technical support: In the event of a support request, with your agreement

MedPix manages the Google Cloud bucket, but you remain the full owner of your data. Each practitioner has an isolated storage area.

No health data is shared with third parties for commercial or advertising purposes.

6bis. Artificial intelligence and automated processing

6bis.1 Provider and infrastructure

Some features use Google Vertex AI (Gemini). Depending on the model, processing is requested in Paris (europe-west9) or the European "eu" multi-region. MedPix therefore does not guarantee processing exclusively in France. HDS eligibility must be checked for the service, location, configuration and contractual scope actually used.

6bis.2 Features using AI

The following features use artificial intelligence processing:

• Medical dictation (MedPix Voice): Audio recordings sent for transcription and automatic formatting of medical letters
• Operative report (MedPix Report): Audio recordings and patient information (name, operated side, anaesthesia type, date of procedure) sent to generate structured reports
• Template analysis: PDF and DOCX operative template documents sent for structural analysis and variable detection
• Patient label scan: Images of patient identification documents (hospital labels, ID cards, medical documents) sent for automatic data extraction

6bis.3 Data transmitted to AI

The following types of data may be transmitted to the AI service:

• Audio recordings (voice dictations)
• Medical documents (PDF/DOCX templates)
• Images of patient identification documents
• Patient information (last name, first name, date of birth, procedure dates)

6bis.4 Security guarantees

• Requested location: Paris or the European "eu" multi-region depending on the configured model
• HDS scope: Google Cloud is HDS v2.0 certified for a defined scope; MedPix must keep the services, location, configuration and contractual terms aligned with that scope
• No training: Your data is not used to train or improve Google's AI models
• Encryption: All communications are encrypted in transit (HTTPS/TLS) and data at rest (AES-256)
• Provider retention: Google may temporarily retain certain data in documented scenarios, including abuse monitoring. The duration depends on the service and settings; MedPix does not promise a universal 55-day period.
• Authentication required: Access to AI features requires prior authentication by the practitioner

6bis.5 Acceptance of AI terms

The AI processing described above is part of the MedPix service in its current configuration. On first sign-in, the healthcare professional accepts the data-processing addendum and acknowledges this processing information. Without acceptance, access to the application is not permitted and no additional data is transmitted.

7. Data location and transfers

Persistent medical content is configured for storage in the European Economic Area, mainly in Paris. Audio, documents or images voluntarily sent to an AI feature may be processed in Paris or the European "eu" multi-region depending on the model.

Certain ancillary technical data (WebAuthn authentication, automatic image resizing and export/deletion tools) may transit through other data centres located within the European Union (Frankfurt, Netherlands and Belgium). Technical telemetry and audience-measurement data, which contain no medical content, may be processed outside the European Union with appropriate safeguards, including Standard Contractual Clauses approved by the European Commission.

Non-sensitive technical data (anonymised logs, application telemetry) may transit through GDPR-compliant services with appropriate safeguards (European Commission Standard Contractual Clauses).

Contractual safeguards: Google Cloud's data processing terms include applicable transfer mechanisms. Health-data use also requires verification that each service and location is within the HDS scope, is properly configured and is covered by the required HDS terms. Provider certification does not automatically make every workload compliant.

8. Retention periods

Your data is retained for the following periods:

• Patient data: During use of the Service, according to the retention period selected by the practitioner as controller. MedPix does not automatically retain it for 20 years after account deletion
• Practitioner account data: For the duration of your subscription, then 3 years after termination
• Billing data: 10 years in accordance with accounting obligations
• Connection data: Maximum 1 year
• Trash: 30 days before permanent deletion

At the end of these periods, your data is deleted in a secure and irreversible manner.

9. Data security

We implement robust technical and organisational security measures:

• Encryption: Encryption in transit (HTTPS/TLS) and at rest (AES-256)
• Authentication: Firebase Authentication manages credentials and MedPix does not access plaintext passwords. Stronger verification may be required for sensitive actions
• Restricted access: Strict access control, principle of least privilege
• HDS v2.0 certified hosting: Google Cloud infrastructure, mainly the Paris region, certified Health Data Host v2.0 for a defined scope of services and locations
• Monitoring: Continuous monitoring, anomaly detection, secure logs
• Resilience: Provider redundancy and restoration mechanisms, supplemented by MedPix operational procedures
• Maintenance: Security updates and controls proportionate to risk

10. Your rights

In accordance with the GDPR, you have the following rights:

• Right of access: Obtain a copy of your personal data
• Right to rectification: Correct your inaccurate or incomplete data
• Right to erasure: Delete your data under certain conditions
• Right to restriction: Restrict the processing of your data
• Right to portability: Receive your data in a structured format
• Right to object: Object to the processing of your data
• Right to withdraw consent: At any time for processing based on consent

To exercise these rights, contact us at: contact@medpix.app

You also have the right to lodge a complaint with the CNIL (Commission Nationale de l'Informatique et des Libertés): www.cnil.fr

11. Regulatory status of the application

MedPix is not presented as a medical device under European MDR Regulation 2017/745 and must not be used to establish a diagnosis or recommend treatment.

MedPix is an administrative and documentary tool designed for the capture, comparison and management of clinical photos in the context of your medical practice.

The application has no claimed diagnostic or therapeutic purpose. You remain responsible for medical decisions and must review automatically generated content. Regulatory qualification depends on the claimed purpose and actual functionality and must be reassessed before adding analysis or decision-support features.

12. MedPix Chrome Extension

The MedPix Chrome extension enables patient import from Doctolib and photo transfer from Canon WiFi devices. This section describes the data collected and processed by the extension.

12.1 Data collected by the extension

• Doctolib patient data: Last name, first name, date of birth, phone number and email extracted from patient files on Doctolib Pro
• Authentication token: Stored locally in the browser to maintain your MedPix session
• Canon photos: Images transferred from your Canon camera via WiFi

12.2 Extension permissions

• storage: Local storage of the Firebase authentication token
• tabs: Detection of Doctolib pages and communication with the MedPix tab for session retrieval
• scripting: Injection of patient data extraction script into Doctolib pages
• activeTab: Access to the active tab to extract data from the displayed patient file
• Host access: doctolib.fr (patient extraction), medpix.app (authentication), local network (Canon WiFi)

12.3 Data processing

No data is stored on third-party servers. Patient data extracted from Doctolib is sent directly to your MedPix account on the Google Cloud infrastructure in the European Economic Area, mainly the Paris region (certified HDS v2.0 for a defined scope). The authentication token is stored only in your browser's encrypted local storage.

The extension does not use remote code. All code runs locally in your browser.

Data is never sold, shared with third parties, or used for advertising or creditworthiness assessment purposes.

13. Cookies and similar technologies

We use cookies for:

• Essential cookies: Necessary for the operation of the service (authentication, security)
• Performance cookies: Usage analysis to improve the service (with your consent)
• Preference cookies: Remembering your choices and settings

You can accept, refuse or withdraw your consent at any time in MedPix's privacy preferences, without limiting the service's core features.

13.1 Google Analytics for Firebase audience measurement

With your consent, MedPix uses Google Analytics for Firebase to measure application journey steps pseudonymously (for example creating a first patient, adding photos, making a comparison or using a feature). Transmitted data may include device type, application version, feature category and subscription type. No name, email address, patient identifier, photo, dictation, report or other medical content is sent to this service. User-associated event data is retained for 2 months and user data for up to 14 months, subject to the service settings.

14. Data concerning minors

MedPix is intended for healthcare professionals. Data of minor patients may only be collected by authorised practitioners, under their professional responsibility, and in accordance with the rules applicable to medical confidentiality and parental authority.

15. Changes to the policy

We reserve the right to modify this privacy policy. Any significant changes will be notified to you by email or via the application. The date of last update is indicated at the bottom of this page.

16. Data protection contact

For any questions regarding this privacy policy or the exercise of your rights:

MedPix does not display a formally appointed Data Protection Officer. Use this contact for questions and requests relating to personal data.