Data Processing Agreement

Introduction

This page sets out the standard terms that apply when an organisation (a clinic, a hospital or a software vendor) gives its staff access to MedyDive or places the MedyDive widget in its own website or system. The organisation is the controller of the personal data it sends to MedyDive, and MedyDive processes that data on its behalf as a processor. MedyDive is operated by its founding team (MedyDive SRL in registration; registration planned for November 2026).

These terms follow Law no. 195/2024 of the Republic of Moldova on personal data protection and, where it applies, the EU General Data Protection Regulation (GDPR). A signed agreement between the organisation and MedyDive takes precedence over this page.

Details of Processing

Subject Matter and Purpose

Answering clinical and pharmaceutical questions asked by the organisation's staff, with the sources behind each answer, and keeping the conversation history.

Duration

For as long as the organisation uses MedyDive, and afterwards until the data is deleted as described below.

Categories of Data Subjects

• The organisation's staff who use MedyDive
• Patients, if staff type patient information into a question or if the page information sent by the organisation's site contains it

Categories of Personal Data

• User identifiers that the organisation's site passes to the widget, or the email address of a web app account
• Questions, answers and conversation titles
• Information about the page on screen that the organisation's site chooses to send with a question
• Files attached to a conversation and the text extracted from them
• Feedback on answers, with a copy of the conversation it refers to

How the Data Is Handled

• Questions and answers are saved under the user identifier the organisation provides
• Page information sent with a question is used to produce the answer and part of it is passed to the language model; it is not stored in the conversation history
• Search terms derived from a question are sent to public medical databases such as PubMed and the World Health Organization
• The widget has no delete button; conversations are deleted on the organisation's request

MedyDive's Obligations

As processor, MedyDive will:

• Process the data only to provide the service and on the organisation's documented instructions
• Keep the data confidential and limit access to authorised personnel
• Apply the security measures listed below
• Help the organisation answer requests from data subjects, such as access or deletion
• Tell the organisation without undue delay if it becomes aware of a personal data breach affecting the organisation's data
• Delete or return the data when the organisation stops using MedyDive
• Give the organisation the information it reasonably needs to check that these terms are respected

The Organisation's Responsibilities

• Have a legal basis for the personal data it sends to MedyDive, in particular for any patient data
• Send only the page information that is needed to answer the question
• Keep the list of approved site addresses for its widget key up to date
• Inform its staff about the use of MedyDive

Security Measures

• Connections to MedyDive use HTTPS
• Passwords are stored as hashes
• Conversation history is kept separately for each user account or widget user identifier
• Each widget has its own access key and can be restricted to a list of approved site addresses

Sub-processors

The organisation gives MedyDive a general authorisation to use sub-processors. The current sub-processors are:

We will tell organisations with a signed agreement before we add or replace a sub-processor, so that they can object.

Transfers Outside Moldova

All sub-processors above process data outside the Republic of Moldova. The application and the Chrome extension sign-in run in the European Union (Poland and Germany); the language model runs in the United States.

Data Return and Deletion

When the organisation stops using MedyDive, or earlier at its request, we delete or return its data, unless the law requires us to keep it.

Contact Information

For a signed agreement or questions about data processing: