Security and privacy
Medical data deserves care.So security is built in from the start.
Medbook has not launched yet. The platform is being designed so that data protection, access control and traceability are part of its foundation, not added afterwards.
- Hosting in the EU/EEA
- Access only with the patient's permission
- Data is not used to train AI models
Data protection
Core protection principles
These principles are commitments we are building the platform on. The specific technical measures will be described in detail before launch.
Hosting in the EU/EEA
Medical data will be stored and processed on infrastructure in the European Union and the European Economic Area.
Encryption in transit and at rest
Data will be encrypted both when exchanged between your device and the platform and when stored.
Strong authentication for professionals
Doctor accounts will require UIN and specialty verification and two-factor authentication (2FA).
Logging of sensitive actions
Actions such as sharing, opening, correcting and deleting data will be recorded in an audit log.
Controlled support access
The support team has no automatic access to medical content. When access is needed, it is temporary, limited and logged.
Access control
The patient decides who sees the record, and for which visit
A doctor sees a medical record only when the patient has shared it with them for a specific visit. Sharing is designed so that the scope is clear and access follows the rules of that visit.
Professional functions are available to verified doctors only.
- Shared for a specific visit, not forever
- The patient chooses what to share
- Invitations and notifications contain no medical information
Traceability and control
The original remains the source of truth
The original document is never altered
Every extracted fact points to the document and page it came from. Corrections affect only the structured layer and are logged.
No training of AI models
Users' data will never be used to train internal or external AI models.
Notifications without medical content
Text messages and emails will contain only an invitation or reminder and lead to the secure environment.
Deletion includes derived data
When you delete a document, the extracted text, structured facts and results that depend only on it will be deleted too – unless the law requires otherwise.
GDPR
Your rights over your data
As a Medbook user you will be able to exercise your rights under the General Data Protection Regulation (GDPR).
Access
See what data about you is stored.
Correction
Ask for inaccurate data to be corrected.
Deletion
Delete documents or your entire record.
Regulatory framework
How we approach the EU Medical Device Regulation (MDR)
Medbook separates the core record functions – storage, structuring, sharing and traceability – from the professional Clinical AI that supports clinical preparation for a specific specialty.
Specialty Clinical AI is being developed within a quality management and regulatory framework under Regulation (EU) 2017/745. It will not be available until the applicable requirements are met.
- Clinical AI for verified medical specialists only
- Released specialty by specialty after validation
- Controlled, traceable changes to everything that affects the output
- The doctor always reviews the output and makes the decision
- Patient-facing AI only explains information in plain language and does not diagnose
- The pilot follows a pre-reviewed regulatory scope
Regulatory note
Medbook does not currently carry a CE mark and does not offer Clinical AI for routine clinical use. The functions and measures described here are in development.
Have a question about security or data?
Write to us – we will give you a specific answer.