Privacy policy

Important: This text is a template and must be reviewed and approved by a lawyer before publication. Details in square brackets must be filled in.

1. Scope of this policy

This policy explains how we process the personal data of visitors to the Medbook website and of people who fill in its forms. It applies only to the website.

The Medbook platform is in development and is not yet available. We do not collect health data through the website.

2. Data controller

• Controller: [Legal name]
• Company number (UIC): [company number]
• Address: [address]
• Email for data protection queries: [data protection email]

3. What data we collect

We collect only the data you give us through the website's forms:

• Early-access list: name, email, role (patient or caregiver) and, optionally, town.
• Design Partner application: name, specialty, practice or healthcare facility, town, email, phone, optionally your UIN (doctor's registration number), the medical software you use, and a message.
• Contact form: name, email, topic and message.

Please don't include any medical information – about yourself or anyone else – in free-text fields. If we receive such information anyway, we will delete it and will not use it.

The website also uses cookies. See the Cookie policy for details.

4. Why we use the data and on what legal basis

Purpose	Legal basis
To let you know when early access opens in your region	Your consent (Art. 6(1)(a) GDPR)
To review your Design Partner application and contact you	Steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR)
To reply to your message	Your request and our legitimate interest in replying (Art. 6(1)(f) GDPR)
To protect the website and forms from abuse and spam	Our legitimate interest in security (Art. 6(1)(f) GDPR)

You can withdraw your consent at any time – using the unsubscribe link in any email or by writing to us. Withdrawal does not affect the lawfulness of processing before it.

We do not use your data for automated decision-making or profiling.

5. Spam protection

To limit automated abuse of the forms, we calculate a short-lived hash of your IP address combined with a secret value (a "salt"). The hash is held in memory only for a short time, is not written to any database, and cannot be used to recover your IP address.

6. Who receives the data

Your data is available only to the Medbook team, to the extent necessary. We use the following processors, who act on our instructions and under contract:

• Website hosting: [provider]
• Email delivery: [provider]

We do not sell your data or share it with third parties for marketing. [If any provider processes data outside the EU/EEA, state the safeguard used, e.g. standard contractual clauses.]

7. How long we keep the data

We keep form data for up to [24 months] from our last contact with you, after which we delete it. If you ask, we will delete it sooner. If you withdraw your consent for the early-access list, we will remove you from it.

8. Your rights

You have the right to:

• request access to your data and a copy of it;
• request correction of inaccurate data;
• request deletion of your data;
• request restriction of processing;
• object to processing based on legitimate interest;
• receive your data in a structured, machine-readable format (portability);
• withdraw your consent at any time.

To exercise your rights, write to us at [data protection email]. We will reply within one month.

You have the right to lodge a complaint with the Bulgarian Commission for Personal Data Protection (CPDP), 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, www.cpdp.bg.

9. The future Medbook platform

When the Medbook platform becomes available, it will process health data – a special category of personal data under Art. 9 GDPR. Before launch we will publish a separate privacy notice for the platform, setting out the legal bases, retention periods, security measures and your rights in relation to health data.

10. Changes to this policy

We may update this policy. The date of the last change is shown at the top of the page. If we make significant changes, we will let people on the early-access list know by email.