Privacy & security
Where data is processed, how long it stays, DPA, TOMs and evidence.
10 articles
Data processing
- Where MediSync processes dataThe MediSync Cloud stores all data in data centres in Germany. Patient data is not transferred to third countries.
- What MediSync stores and for how longMediSync deletes appointments with their recording and attached documents automatically after a period you set. The default is 14 days.
- Sub-processorsWhich service providers MediSync uses, which of them process patient data and where to get the binding list.
- Your data does not train AI modelsMediSync does not use its customers' recordings, transcripts or documentation to train AI models. The data processing agreement sets this out.
Contracts and evidence
- Conclude the data processing agreement (AVV)The data processing agreement under Art. 28 GDPR is concluded with the service contract. You get the full text with its annexes from datenschutz@medisync.me.
- Technical and organisational measures (TOM)The TOM under Art. 32 GDPR are an annex to the data processing agreement. These are the main measures of the MediSync Cloud.
- Certificates of our hosting providerThe MediSync Cloud runs on Amazon Web Services. AWS is audited against ISO/IEC 27001 and BSI C5, among others. MediSync GmbH itself is not ISO/IEC 27001 certified.
Patients and responsibility
- Inform patients about the recordingMediSync does not ask patients for permission itself. Your practice decides how to inform them and whether consent is needed. These are the points to cover.
- Who is responsible for the documentationYour practice is responsible for the patient data, and MediSync processes it on your behalf. Whoever releases the documentation is responsible for its content.
- Security and reporting a vulnerabilityHow MediSync protects your account and your data, what you can do yourself and how to report a vulnerability to security@medisync.me.