Privacy Policy

1Who We Are

Provider: Rivux EOOD, registered in Bulgaria
Contact: admin@medrag.eu
Service: MedRAG — Medical Knowledge Retrieval Service

2Roles

MedRAG acts as a Processor for health data uploaded by customers (hospitals, clinics). The customer is the Controller under GDPR. For account and billing data, MedRAG acts as a Controller.

3Data We Collect

Category	Data	Purpose
Account data	Name, email, organisation	Service access & billing
Customer data	Documents uploaded by you	Semantic search (your instructions)
Usage data	Query counts, storage used	Billing & service operation
Server logs	IP addresses, request metadata	Security monitoring

We do not collect or store query text beyond the request lifecycle.

4Legal Basis

Contract (Art. 6(1)(b))Account management, service delivery

Legal obligation (Art. 6(1)(c))Tax record retention (invoices)

Legitimate interest (Art. 6(1)(f))Security logging (7-day retention)

Health data (Art. 9(2)(h))Processing authorised by customer DPA

5Where Your Data Lives

All infrastructure is hosted exclusively within Germany by Hetzner Online GmbH. No data leaves the European Economic Area. No US-based cloud providers or sub-processors are used.

6Security Measures

LUKS full-disk encryption on all data volumes
TLS 1.3 for all connections
WireGuard VPN between servers (no public database port)
Tenant isolation via PostgreSQL Row-Level Security
Self-hosted AI models (no external API calls for embeddings)

7Data Sharing

We share minimal data with the following parties:

Party	Purpose	Data	Role
Hetzner Online GmbH	Infrastructure hosting	All stored data (encrypted)	Sub-processor
Mollie B.V.	Payment processing	Name, email, payment details	Independent controller

See our Sub-Processor List for details.

8Data Retention

Data	Retention
Account data	Duration of account + 30 days
Customer documents & embeddings	Until deleted or contract ends + 30 days
Server access logs	7 days
Performance metrics (anonymised)	30 days
Billing records	10 years (tax law)

9Your Rights

Under GDPR, you have the right to:

AccessRequest a copy of data we hold about you

RectificationCorrect inaccurate account data

ErasureDelete your account and all associated data

PortabilityExport your data in machine-readable format

RestrictionRestrict processing in certain circumstances

ObjectObject to processing based on legitimate interest

To exercise your rights, contact us at admin@medrag.eu. We will respond within one calendar month.

10Supervisory Authority

If you are unsatisfied with how we handle your data, you may lodge a complaint with:

Commission for Personal Data Protection (CPDP)
2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria
www.cpdp.bg

11Contact

Questions about this policy: admin@medrag.eu