Privacy Policy

1. Controller and contact

We have not appointed a data protection officer; please use the e-mail above for any data protection matters.

2. What data we process and why

Depending on how you use Evidiq, we process the following categories of data:

• Visiting evidiq.cz — technical data about your device and browser, IP address (in server logs) and, with your consent, anonymised traffic statistics (Google Analytics 4). Legal basis: legitimate interest in securing and operating the website (Art. 6(1)(f)); consent for analytics (Art. 6(1)(a)).
• Contact form — name, e-mail and the content of your message. Legal basis: steps prior to entering into a contract or legitimate interest in handling your enquiry (Art. 6(1)(b) and (f)).
• User account in the application — name, e-mail, password (stored as a hash), profession, billing details, account settings, login records and audit log. Legal basis: performance of a contract (Art. 6(1)(b)), compliance with legal obligations such as accounting and tax (Art. 6(1)(c)).
• Payments — payment details are processed directly by Stripe; we only keep the payment identifier, amount and status. Legal basis: performance of a contract and legal obligations.
• Client and patient data entered by users into the application, including health data (special category under Art. 9 GDPR) — processed solely as a processor on the instructions of the user-controller and only to the extent necessary to provide the service.

3. Artificial intelligence in the application

The application offers voice dictation and AI-drafted records. Speech transcription and summarisation are performed by the contracted processors listed in section 4. These features run only when the user actively triggers them; every AI output is reviewed and approved by the user before it is saved.

Data sent for AI processing is not used by the providers to train their models (contractually ensured under their API terms). The user is responsible for having an appropriate legal basis to use AI features on their clients' data.

4. Recipients and processors

Only authorised staff of the controller and the following contracted processors have access to the data:

Data may be disclosed to public authorities where required by law.

5. Transfers outside the EU/EEA

The application and database are operated in the EU. When AI features are used (speech transcription, summarisation), data is transferred to Anthropic and OpenAI in the USA. Transfers are safeguarded by the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR) and, for providers certified under the EU-U.S. Data Privacy Framework, by the adequacy decision. A copy of the safeguards is available on request.

Google Analytics may transfer data to the USA; it is used only with consent and with Consent Mode active, which blocks identifier storage without consent.

6. Retention

• Contact form messages: 12 months after the enquiry is handled.
• User account data: for the lifetime of the account; within 30 days after cancellation, except data we must retain by law (accounting and tax records for 10 years).
• Client and patient data: for the period determined by the user-controller; after account cancellation the user may export it, after which it is deleted within 30 days.
• Audit and security logs: 12 months.
• Analytics data: per Google Analytics settings, at most 14 months.

7. Security

• Encryption in transit (TLS 1.3) and at rest (AES-256).
• Client data is accessible only to the user who entered it; access by the controller's staff is limited to operational interventions and logged.
• Audit trail of access and changes, regular backups within the EU, access control and security reviews before each release.

8. Cookies and analytics

evidiq.cz uses strictly necessary cookies (language preference and your cookie decision) and, only with your consent, Google Analytics 4 analytics cookies. You can withdraw consent at any time by deleting cookies in your browser or reopening the cookie banner. Declining is as easy as accepting.

The application at app.evidiq.cz uses only technical cookies required for sign-in, and analytics only if the user enables it in account settings.

9. Your rights

• the right of access (Art. 15),
• the right to rectification (Art. 16) and erasure (Art. 17),
• the right to restriction of processing (Art. 18),
• the right to data portability — export in a common machine-readable format (Art. 20),
• the right to object to processing based on legitimate interest (Art. 21),
• the right to withdraw consent at any time without affecting the lawfulness of prior processing,
• the right to lodge a complaint with the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, www.uoou.cz, or with your local supervisory authority.

We respond to requests within 30 days. For client and patient data entered into the application, please contact your care provider (the Evidiq user) first, as they are the controller of that data; we will gladly assist them.

10. Changes to this policy

We may update this policy when the service or applicable law changes. The current version is always available on this page; application users are notified of material changes by e-mail.