Privacy Policy
1. Data controller
The controller of your personal data is: [TO BE COMPLETED BY COUNSEL — placeholder only, not legal advice] [LEGAL NAME], [REGISTERED ADDRESS], [KRS/NIP if applicable], contact: [EMAIL], [PHONE].
Data Protection Officer (if appointed): [TO BE COMPLETED BY COUNSEL — placeholder only, not legal advice] [NAME / CONTACT], or state that no DPO has been appointed.
2. What this service processes
Badax is an information assistant for personal medical records. It may process ordinary personal data and special-category health data that you choose to provide.
- Account data (e.g. identifiers from the authentication provider — currently Clerk)
- Health profile (e.g. date of birth, conditions, medications, allergies, lifestyle notes)
- Medical documents and examination results you upload or paste
- Chat messages with the AI assistant and related history
- Technical/session data needed to operate the service (e.g. authentication cookies)
3. Purposes and legal bases
[TO BE COMPLETED BY COUNSEL — placeholder only, not legal advice] Confirm and adapt the bases below for your jurisdiction (GDPR / RODO).
Typical purposes for this product include: providing the account and storage features; indexing your materials so the assistant can retrieve relevant context; generating AI responses; security and abuse prevention; and responding to legal requests.
Product intent (draft): we do not sell your health data and do not use it to build advertising profiles or scores for insurers, employers, or marketers. Counsel should confirm this as a binding commitment and list any exceptions.
Processing of health data generally requires an explicit consent (GDPR Art. 9(2)(a)) and/or another applicable exception — counsel must confirm the correct bases and wording.
4. AI processing and subprocessors
To provide chat and document understanding, content you submit (including health-related content) may be sent to subprocessors that host models and infrastructure.
- Authentication: Clerk
- Cloud storage: Microsoft Azure (Blob Storage)
- Document OCR / parsing: Azure AI Document Intelligence (for PDF pipelines)
- Embeddings / vector search: Pinecone
- Large language model inference: Azure OpenAI / Microsoft Foundry
- [TO BE COMPLETED BY COUNSEL — placeholder only, not legal advice] Add full legal names, locations, DPA status, and transfer mechanisms (e.g. SCCs).
5. International transfers
[TO BE COMPLETED BY COUNSEL — placeholder only, not legal advice] Describe whether data leaves the EEA/UK, which transfer tools apply, and where users can obtain a copy of safeguards.
6. Retention
[TO BE COMPLETED BY COUNSEL — placeholder only, not legal advice] Define retention periods for account data, documents, chat history, logs, and backups. Example placeholder: “We keep your data until you delete it or close your account, then remove it within [X] days, subject to legal retention duties.”
7. Your rights
Subject to applicable law, you may have rights to access, rectify, erase, restrict, port, and object to processing, and to withdraw consent without affecting prior lawful processing.
To exercise rights, contact: [TO BE COMPLETED BY COUNSEL — placeholder only, not legal advice] [PRIVACY EMAIL]. You may also lodge a complaint with a supervisory authority (in Poland: UODO — https://uodo.gov.pl).
In-product controls (export / account deletion) may be incomplete in early versions — see Settings → Privacy for the current status.
8. Security
[TO BE COMPLETED BY COUNSEL — placeholder only, not legal advice] Summarize technical and organizational measures (encryption in transit/at rest, access control, tenant isolation by user id, etc.). No measure is perfect; describe residual risk honestly.
9. Children
[TO BE COMPLETED BY COUNSEL — placeholder only, not legal advice] State the minimum age and whether the service is offered to minors / via a parent or guardian.
10. Changes to this policy
We may update this policy. Material changes should be communicated in-product or by email. The “Last updated” date will change when the policy is revised.