Below we provide you (“you” or “User”) with an overview of what data we process in the Medicus AI App ("App") and how we ensure the protection of your data.
The controller is the Medicus Group (" we/us/our" or " Medicus") consisting of:
Medicus AI GmbH
Lehargasse 11/1/8,
1060 Vienna, Austria
Registration number:
FN 458726y
Medicus AI Middle East Ltd.
2480, 24, Al Sila Tower
Abu Dhabi Global Market Square
Al Maryah Island, Abu Dhabi
United Arab Emirates
Registration number:
000002499
Your data will be used by us to provide the service of the App.
Personal data are any information relating to an identified or identifiable natural person; an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity. Personal data includes e.g. name, email address or telephone number. Personal data also includes information about health, lifestyle or behaviors.
We will only collect, use and/or pass on personal data if this is permitted by law or if the User consents to the data processing. Consent means any freely given, specific, informed and unambiguous indication of the User's (data subject) wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.
Applicable legal provisions are in particular those of the regulation (EU) 2016/679 of the European Parliament and Council of 27 April 2016, repealing the directive 95/46/EC, on the protection of individuals with regard to the processing of personal data, on the free movement of such data ("General Data Protection Regulation", GDPR).
When using our services and App, your data may be transferred to outside the EU to the controllers of the Medicus Group as set forth above, and also to our affiliated processors, Cloud Appers, Building no 16A, 2nd Floor Freezone Damascus, Jamarek Damascus, Syria, registration number 1953, and EOS Health SARL, Bshara El Khoury Street, Berytech Building, BDD 1294, Beirut, Mount Lebanon, 1100, registration number 1026304. All companies belonging to the Medicus Group as well as Cloud Appers and EOS Health SARL comply with data protection standards applicable in the EU via EU standard contractual clauses. Data can also be transported to outside the EU to the parties listed in “Data we share with 3rd parties” section of this Data Privacy Policy, details are listed there.
When contacting us via email, your details are stored for the purpose of processing the enquiry and, if applicable, follow-up questions based on Art. 6 (1) b. GDPR.
We process your data for the purpose of providing the services of the App. Such data may also include health data. The purpose of the App is to provide you with lab test result insights, calculated health risks, wellbeing tips, catered content and a calendar to guide you through a smoother, healthier and more informed life. The App is also supposed to help you collect, access and store all relevant data around your health in one place. To that end, we collect detailed personal and medical data in the App:
The personal and health data you provide when using the App is processed based on your consent according to Art. 6 (1) a. and Art. 9 (2) a. GDPR. You can revoke your consent at any time; if you choose to do so, we’ll stop processing your data from that point forward.
You provide data just if this is necessary for the aforementioned purposes. In the event you refrain from providing such data you may face legal disadvantages, for example, limited or no possibility of using our App.
To provide the services of the App, we have to share parts of your data with the following 3rd parties:
Google Firebase and Google Crashlytics: We use the services “Google Firebase” for push notifications, generation of universal links, gathering of analytical data and statistical testing, and “Google Firebase Crashlytics” to report malfunctions in the App. Both services are offered by Google LLC, Mountain View, CA, USA (“Google”). Data collected are send to servers located in the USA. If the data are not anonymized the processing of data is based on our legitimate interests of a statistical analysis of the User relationship quality assurance purposes according to Art. 6 (1) f. GDPR. Google is certified according to the EU-US agreement "privacy shield", which guarantees the level of data protection applicable in the EU.
In the event you choose to use our scanning service (“Scanning Service”) and upload a medical report via the App, your data will be transferred to our research team with your explicit consent for the purpose of the Scanning Service only, based on Art. 6 (1) a. GDPR or Art. 9 (2) a. GDPR. The use of the Scanning Service is optional for each User. For convenience purposes, you may choose the option to upload your medical report(s) and/or related data (“Report Data”) instead of typing these data in the App yourself. After you have clicked the button ‘Continue' within the App the Report Data provided for scanning within the App will be uploaded and transferred to our server in Belgium. Cloud Appers and EOS Health SARL (see Data Transfer outside the EU), as well as our research team, also located outside the European Union (EU) and/or the European Economic Area (EEA), will be able to access those Report Data there, and extract, verify and store those Report Data on our server. This way, you may access those Report Data through the App without having to type in the Report Data yourself. After having provided the Scanning Service, we will immediately delete the Report Data from our server in Belgium.
The use of this Scanning Service is optional. You may also type in the data by yourself. You may receive information about such data and withdraw your consent for sharing such data anytime, for example, via email to: [email protected]. We will delete such data in case of account deletion, request for data deletion by the User within the App, and, of course, in case of consent withdrawal.
You have the right to be informed at any time and free of charge about the personal data stored about you. For further information, you can contact e.g. [email protected].
This right of access includes confirmation as to whether or not personal data is processed on you and, if so, the detailed information about such processing.
The right to information does not exist if the data are only stored because they may not be deleted due to legal or statutory storage regulations, or only serve the purpose of data protection or data protection control and the provision of information would require a disproportionate effort and processing for other purposes is excluded by appropriate technical and organizational measures.
You have the right to withdraw your consent regarding the use, processing or transmission of your data at any time with effect for the future when such data processing is based in your consent. For this purpose, the User can contact
In the event of withdrawing the consent, we will no longer process and immediately delete your stored data. This does not apply if we can prove compelling grounds for processing that are worthy of protection and which outweigh the interests, rights, and freedoms of the respective User or in case the processing serves to assert, exercise or defend legal claims. For example, we will continue to use data if it is still necessary for the implementation of the contractual relationship.
You have the right to demand that we immediately correct any incorrect personal data concerning you. For this purpose, you can contact [email protected] at any time.
You have the right to have us delete any personal data concerning you that we store. For this purpose, you can delete all data yourself or contact [email protected].
Immediate deletion shall be effected in the following cases:
In the event of termination of the User relationship, your data will be regularly deleted from the internal database. Data shall be excluded from deletion if, for example, processing of data is necessary for asserting, exercising or defending legal claims; e.g., performance of the contract with us or if there are legal retention periods that prevent deletion.
In the case of non-automated data processing, deletion is also not necessary if this would not be possible due to the special type of storage or would only be possible at disproportionately high expense and the interest of the User in the deletion is to be regarded as minimal. The deletion is then replaced by the restriction of processing.
Furthermore, we carry out a restriction of the processing and no deletion of the data, as long as and insofar as we have the reason to assume that a deletion would impair your interests worthy of protection or those of the person affected. In so doing, we will inform you or the affected person of the restriction on processing, provided that such information does not prove to be impossible or would require a disproportionate effort.
You also have the right to demand that the processing be restricted. For this purpose, you can contact [email protected]. You can only successfully enforce the right to restrict processing if one of the following prerequisites is met:
You have the right to receive any personal data you have provided to us in a structured, current and machine-readable format. For this purpose, you can contact [email protected].
You also have the right to data portability vis-à-vis another controller, provided that the processing is based on a consent or on a contract to which the data subject is a party and that the processing is carried out by means of automated procedures.
When exercising your right to data portability, you have the right to obtain the personal data to be transmitted directly by one person in charge to another person in charge, as far as this is technically feasible. This right shall not apply where the rights and freedoms of other persons are adversely affected or where processing is necessary for the performance of a task in the public interest or in the exercise of official authority delegated to the person responsible.
You have the right to lodge a complaint vis-á-vis a supervisory authority of your choice. An overview of the European National Data Protection Authorities may be found here: http://ec.europa.eu/newsroom/article29/item-detail.cfm?item_id=612080 .
The App is operated through a safe SSL-connection. If an SSL-connection is activated, third parties are prevented from reading any data that are transferred by you to us. Your data are only stored on servers within the EU except as set forth in this privacy policy.
System logins to our servers by our research team and any 3rd parties involved, also located outside the EU/EEA, include a 2-factor authentication to ensure that only verified persons may gain access.
For any inquiries and additional questions about processing personal data please contact [email protected]. We have appointed a data protection officer who may be reached via [email protected].