Privacy Policy

Who We Are

MedyDive is operated by its founding team (MedyDive SRL in registration; registration planned for November 2026). MedyDive ("we", "us") is the controller of the personal data described in this policy, except where we act on behalf of an organisation as described in our Data Processing Agreement. Contact: [email protected].

This policy covers the website medydive.com, the web app at app.medydive.com, the MedyDive website widget and the MedyDive Chrome extension.

We process personal data under Law no. 195/2024 of the Republic of Moldova on personal data protection and, where it applies, the EU General Data Protection Regulation (GDPR).

Data We Process

Your Account

• Email address and, if you provide it, your name
• Your password, stored only as a hash
• For each sign-in session: the date and time, IP address and browser type

Your Conversations

• The questions you type and the answers of the assistant, including the search steps and sources
• Files you attach to a conversation and the text extracted from them
• Feedback you send on an answer, together with a copy of the conversation it refers to

Website Widget

When you use MedyDive inside the website or system of one of our partners, that site sends us a user identifier and may send information about the page on your screen. We use the page information to produce the answer; it is not stored in the conversation history. The questions and answers are saved under the identifier the partner provides.

Chrome Extension

When you ask a question in the Chrome extension, the extension sends the content of the page open in that browser tab to our servers together with your question, and part of it is passed to the language model. The page content is used to produce the answer; it is not stored in the conversation history. Sign-in for the extension is handled by Supabase, which receives the email address and password you enter there.

Website Forms

• Contact, support and integration forms: your name, email address, phone number, organisation and message. They reach our team by email and are not stored in a database

Technical Data

• Server logs with timestamps, account and conversation identifiers and short excerpts of search queries
• For service emails: whether a message was delivered, opened or clicked
• Cookies and browser storage, described in our Cookie Policy

Why We Use It

• To provide the service: create your account, answer your questions and keep your conversation history. Legal basis: the contract with you (our Terms of Service)
• To keep the service secure: sign-in sessions and server logs. Legal basis: our legitimate interest in protecting the service
• To find and fix problems: we review the feedback you send and error reports. Legal basis: our legitimate interest in the quality of the answers
• To write to you: account emails such as confirmation and password reset, and occasional service announcements, which you can unsubscribe from
• To answer your enquiry: messages sent through the website forms

We do not sell personal data and we do not use it for advertising.

Who Receives Your Data

We use the following providers to run MedyDive:

• Microsoft Azure: hosts the application and provides the language model (Azure OpenAI). The model receives your question, the earlier messages of the conversation, text from attached files and, for the widget and the extension, part of the page information
• Brevo: delivers our emails
• Supabase: sign-in for the Chrome extension
• Google Fonts: the website loads its font from Google, which receives your IP address when the page loads

When the assistant searches the medical literature, it sends search terms to public databases such as PubMed (U.S. National Library of Medicine) and the World Health Organization. Your account details are not sent with them.

If you share a conversation by link, anyone who has the link can read that conversation without signing in, including messages added after you shared it, until you cancel the sharing in the web app.

We also disclose data when the law requires it.

Transfers Outside Moldova

Some of the providers above process data outside the Republic of Moldova:

• Microsoft Azure: the MedyDive application runs in the Poland Central region (Poland, European Union). The language model (Azure OpenAI) runs in the East US region (United States)
• Supabase: Germany (European Union)
• Brevo: European Union
• Google Fonts: United States

How Long We Keep It

• Account: until you ask us to delete it
• Conversations: you can delete them in the web app. The widget and the Chrome extension have no delete button; conversations started there are deleted on request
• Sign-in sessions: expire after 30 days without use
• Messages from website forms: kept in our mailbox for as long as needed to handle your request

Your Rights

You can ask us to:

• Give you a copy of your personal data
• Correct data that is inaccurate
• Delete your account, conversations, files and feedback
• Restrict or stop a particular use of your data
• Provide your data in a portable format

Write to us at the address below and we will answer within the time limit set by law. You can unsubscribe from service announcements with the link in each email.

You also have the right to lodge a complaint with the National Center for Personal Data Protection of the Republic of Moldova (datepersonale.md).

Security

• Connections to MedyDive use HTTPS
• Passwords are stored as hashes, never in readable form
• Your conversation history is behind your account sign-in. A conversation you share by link can be read by anyone who has the link
• The widget can be restricted to the site addresses approved for a partner

Contact Us

For questions about this policy or to exercise your rights:

Policy Updates

When we change this policy we publish the new version on this page and change the date at the top. We tell account holders about material changes by email.