Legal

Privacy Policy

Aimedis is committed to protecting your personal data in accordance with GDPR and applicable privacy laws worldwide.

Effective date: 7 October 2026

01Controller

The controller responsible for data processing described in this Privacy Policy is:

Aimedis LLC

16192 Coastal Highway

Lewes, Delaware 19958

USA

contact@aimedis.com

Data protection officer: [TO BE COMPLETED: data protection officer]
Representative in the European Union (Art. 27 GDPR): [TO BE COMPLETED: EU representative under Art. 27 GDPR]

02Scope of this Privacy Policy

This Privacy Policy applies to personal data collected through:

our websites and related domains
contact requests and customer support communications
account registration and use of our services
newsletters and marketing communications
online forms, uploads, and customer interactions
online meetings, consultations, and related communications

03Personal Data We Collect

Depending on how you interact with us, we may collect the following categories of personal data:

a. Identity and contact data

first and last name
title, role, or organization
postal address
email address

b. Account and profile data

login details
account preferences
communication history
customer number or account identifier

c. Usage and device data

IP address
browser type and version
operating system
language settings
date and time of access
pages visited
referring website
device identifiers
log files

d. Content you provide

messages submitted through forms
emails and support requests
uploaded files
survey or form responses
chat communications

e. Payment and transaction data

billing address
transaction amount
payment status
limited payment-related information required for payment processing

f. Health-related or special category data

Where you use healthcare or consultation features, we may process health-related information you submit, such as:

symptoms and medical descriptions
photographs or image uploads
date of birth
sex or gender information
insurance information where relevant
treatment-related communications

We process this data only where permitted by law and, where required, based on your explicit consent or another valid legal basis.

04How We Collect Personal Data

We collect personal data:

directly from you, when you contact us, register, make a payment, subscribe, upload content, or use our services
automatically, through cookies, server logs, analytics tools, and similar technologies
from service providers and partners involved in delivering our services
from healthcare professionals engaged through our platform where relevant to the service provided

05Purposes of Processing

We may process personal data for the following purposes:

to provide and operate our website and services
to create and manage user accounts
to respond to inquiries and provide customer support
to process payments and manage contracts
to provide consultation or related healthcare services
to send service-related communications
to send newsletters and marketing communications where permitted
to improve website functionality, performance, and security
to analyze usage trends and optimize our offerings
to comply with legal, regulatory, and contractual obligations
to establish, exercise, or defend legal claims
to prevent fraud, abuse, and unauthorized access

06Legal Bases for Processing

Where GDPR applies, we process personal data on one or more of the following legal bases:

Consent under Art. 6(1)(a) GDPR, including explicit consent where required for special category data under Art. 9(2)(a) GDPR
Performance of a contract or steps prior to entering into a contract under Art. 6(1)(b) GDPR
Compliance with legal obligations under Art. 6(1)(c) GDPR
Legitimate interests under Art. 6(1)(f) GDPR, such as operating, securing, and improving our services, provided those interests are not overridden by your rights
other lawful bases applicable to healthcare-related processing where relevant under Art. 9 GDPR and applicable local law

Where U.S. privacy laws apply, we process personal data in accordance with applicable notice, transparency, and consumer rights requirements.

07Cookies and Similar Technologies

We use cookies and similar technologies to:

ensure website functionality
remember preferences
analyze traffic and user behavior
measure campaign performance
improve security and user experience

Where required by applicable law, we ask for your consent before placing non-essential cookies or using similar technologies. You can change your cookie preferences at any time through our consent tools or browser settings.

These are the cookies and browser storage entries in use:

aimedis.com

aim-cookie-consent (browser storage): your cookie choices; kept until you clear your browser data
aim-locale (browser storage): the language you chose; kept until you clear your browser data
aim-ava-autospeak (browser storage): whether AVA reads its answers aloud; kept until you clear your browser data
_ga and _ga_<ID> (Google Analytics cookies): set only after you allow analytics; they distinguish visitors and sessions and last up to two years

Aimedis Connect (connect.aimedis.com)

sb-…-auth-token (cookie for .aimedis.com): keeps you signed in and is shared with Aimedis Care Pro and Aimedis Onboarding; 400 days, renewed while you use the service
connect-tz (cookie): your device's time zone, so dates and times show in your zone; 1 year
NEXT_LOCALE (cookie): the language you chose; until you close the browser
connect-theme and aimedis-connect-push-owner (browser storage): your light or dark display, and which account receives notifications on this device; kept until you clear your browser data or turn notifications off
Secure messaging (browser storage and database): the messaging sign-in for this device, encryption keys, a technical sync setting and messages waiting to be sent; kept on your device until you remove the device
Offline support (browser cache): the offline page and app files, without personal content; deleted when you sign out

Aimedis Pro (pro.aimedis.com)

aim_pro_session (cookie): keeps you signed in; ends after 12 hours or when you sign out
aim_pro_pending (cookie): holds an unfinished sign-in, registration or password reset that needs a second step; 30 minutes
aim_pro_tz (cookie): your device's time zone, so dates and times show in your zone; 1 year
NEXT_LOCALE (cookie): the language you chose; until you close the browser
aim-pro-theme (browser storage): your light or dark display; kept until you clear your browser data

08Hosting and Technical Infrastructure

We use third-party providers to host, maintain, secure, and support our website and systems. These providers may process technical and usage data such as IP addresses, server logs, device information, and similar metadata on our behalf for hosting, security, and operational purposes.

On the homepage, devices that display the animated background load an animation script from the jsDelivr content delivery network, which receives your IP address in order to deliver it.

Where required by law, we enter into appropriate data processing agreements with such providers.

09Contact Requests

If you contact us by email, contact form, chat, or other communication channels, we process the information you provide to respond to your request and manage the communication.

This may include:

name
email address
message contents
any additional information you choose to provide

We retain this information for as long as necessary to handle your request and comply with legal obligations.

10AVA, the Website Assistant

AVA answers questions about this website and our products. AVA is an AI system, not a person, and gives no medical advice. Please do not enter health information.

When you use AVA, we process:

your messages and AVA's answers;
your voice recording, only if you use the microphone;
your IP address, which our server keeps only in its working memory to limit requests and prevent abuse; it is not written to storage or passed on.

External services process your messages and AVA's answers on our behalf: Anthropic PBC (USA) writes the answers; Voyage AI (USA) receives a search query based on your messages and finds the matching website content; ElevenLabs (USA) reads answers aloud with an AI-generated voice and, if you use the microphone, turns your speech into text. Read-aloud is switched on by default, and you can turn it off in AVA. These services do not receive your IP address.

We do not store the conversation on our servers. It stays in your open browser tab and is gone when you reload or close the tab. Your browser only remembers whether read-aloud is switched on.

Legal basis: Art. 6(1)(f) GDPR (answering your question). For transfers to the USA, see International Data Transfers.

11Accounts and Registration

If you create an account, we process the data necessary to register and maintain your account, authenticate you, provide requested features, and communicate important service updates.

Required registration fields must be completed in order to create and maintain an account.

13Healthcare and Consultation Services

Where you use healthcare-related or consultation services through our platform, we may process additional data necessary to provide those services.

This may include:

identity and contact data
demographic information
health information you submit
image uploads
payment and billing data
records needed to facilitate communication with participating healthcare professionals

Where applicable, Aimedis and the healthcare professional involved may act as independent controllers or joint controllers depending on the service configuration and applicable law.

Special category data, including health data, will only be processed where a valid legal basis applies, including explicit consent where required.

14Payments

If you purchase services or pay fees, payment processing may be handled by third-party payment providers.

Payment-related data may include:

name
billing address
email address
payment method details
transaction amount
transaction time and status

We do not store full payment card details unless necessary and legally permitted. Payment providers process payment data under their own privacy terms and applicable legal obligations.

15Forms, Upload Tools, and File Submissions

We may provide online forms, upload features, or document submission tools. Data submitted through such tools may be processed to manage requests, support service delivery, or receive documents and other information from users.

16Customer Support and Communication Tools

We may use internal or third-party systems to manage inquiries, support communications, appointments, and customer records.

These systems may process:

contact details
conversation content
account identifiers
technical metadata
support history

We use these systems to provide efficient support, improve service quality, and maintain service records where appropriate.

17Analytics and Advertising

We may use analytics and marketing technologies to understand website usage, measure campaign performance, improve our services, and deliver more relevant communications.

Where required by law, such technologies are used only with your consent. Information collected may include:

IP address
device and browser data
pages visited
interactions on the website
referral information
conversion and campaign data

19Online Meetings and Communications

We may use online communication tools to conduct meetings, consultations, support sessions, or other communications.

When you participate in such interactions, relevant data may include:

name and contact details
meeting metadata
device and connection data
audio, video, chat, and shared files
recordings where enabled and lawfully disclosed

20Aimedis Connect and Aimedis Pro

Aimedis Connect (connect.aimedis.com) and Aimedis Pro (pro.aimedis.com) use this Privacy Policy. Besides the recipients under Data Sharing and Recipients, they use these service providers:

Supabase (Connect, Pro): database, sign-in and file storage; [TO BE COMPLETED: Supabase hosting region]
Stripe (Connect, Pro): payments, subscriptions and payouts to professionals; card details are entered only on Stripe's own pages; USA
Resend (Connect, Pro): transactional emails such as confirmations and notifications; USA
Anthropic (Connect): AVA's answers and, when you ask for it, the translation of messages; USA
OpenAI (Pro): AVA in Aimedis Pro; USA
ElevenLabs (Connect, Pro): AVA's voice, turning speech into text and reading answers aloud; USA
Voyage AI (Connect): searching the knowledge base for AVA; USA
NCBI / PubMed (Connect, Pro): literature search for AVA; only search terms are sent, never personal data; USA
Zoom (Connect): video consultations and calls, including Zoom accounts for professionals with a video plan; Zoom processes the audio and video of each call; USA
Browser push services (Connect): delivering notifications with general text, through your browser's provider (for example Google, Apple, Mozilla or Microsoft)
Your browser's speech recognition (Pro, only where your organisation has enabled it): dictation for AVA, processed by your browser's provider
Terminology service (Pro, only where configured): looking up medical codes; [TO BE COMPLETED: terminology service provider]

Secure messaging in Aimedis Connect runs on our own private Matrix server. Aimedis Care Pro and the Aimedis Wiki are Aimedis services: Care Pro provides the health records that a patient shares with a professional by PIN, and the Wiki provides reference excerpts for AVA.

22International Data Transfers

Because we operate internationally and may use global service providers, personal data may be transferred to and processed in countries outside your country of residence, including outside the European Economic Area.

Where required, we use appropriate safeguards for international transfers, including:

adequacy decisions
Standard Contractual Clauses
supplementary contractual, technical, and organizational measures
other lawful transfer mechanisms recognized under applicable law

23Retention

We retain personal data only for as long as necessary for the purposes described in this Privacy Policy, including to:

provide services
maintain business records
comply with legal, tax, accounting, and regulatory requirements
resolve disputes
enforce agreements

Retention periods may vary depending on the nature of the data and applicable legal requirements.

24Data Security

We use appropriate technical and organizational measures designed to protect personal data against unauthorized access, loss, misuse, alteration, or disclosure.

These measures may include:

encryption in transit
access controls
authentication procedures
logging and monitoring
secure hosting environments
internal confidentiality and security procedures

No method of internet transmission or electronic storage is completely secure, but we take reasonable steps to protect personal data.

Your Rights

25Your Privacy Rights

Depending on your location and applicable law, you may have the right to:

access your personal data
request correction of inaccurate data
request deletion of your data
restrict or object to certain processing
withdraw consent at any time where processing is based on consent
receive data portability where applicable
opt out of direct marketing communications
opt out of certain profiling or targeted advertising practices where applicable under U.S. law
lodge a complaint with a supervisory authority or regulator

To exercise your rights, contact us at contact@aimedis.com.

We may need to verify your identity before responding to your request.

26Children's Privacy

Our services are intended for adults. You must be at least 18 years old to create an account on an Aimedis platform, and we do not knowingly collect personal data from anyone under 18. If we learn that we have, we delete it. If you believe a person under 18 has given us personal data, please contact contact@aimedis.com.

27Automated Decision-Making

We do not make solely automated decisions that produce legal or similarly significant effects on individuals unless expressly disclosed and permitted by law. If this changes, we will provide the notices and rights required by applicable law.

28U.S. State Privacy Rights

If you are a resident of a U.S. state with specific privacy rights, you may have additional rights regarding access, deletion, correction, and opting out of certain uses of personal data. We will honor such rights where applicable.

29Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect legal, technical, or business developments. The updated version will be posted on this page with a revised effective date.

30Contact

If you have questions about this Privacy Policy or our privacy practices, contact: