Privacy Policy

Version: v1.13 · Last updated: 2026-10-21 · Effective: from the date of public launch

The "we" in this document is Medelix, operated by Melih Ekrem Yaz, Seitenstettengasse 5/37, 1010 Vienna, Austria (see the Impressum).

Medelix is a medical-evidence retrieval tool. We help doctors and medical students search peer-reviewed and open-access medical literature with citations on every claim. We are not a medical device and we do not provide clinical advice. Medelix is an AI-generated tool; outputs are clearly labelled as AI-generated, per EU AI Act §50 transparency obligations. This page explains what data we process, why, for how long, and what control you have.

1 · Who we are

Service: Medelix (medelix.ai) Controller: Melih Ekrem Yaz, Seitenstettengasse 5/37, 1010 Vienna, Austria, operating the service "Medelix". References to "we", "us", or "Medelix" in this Policy include any future legal entity established to operate the service. On such a transition, signed-in users will be notified by email at least 30 days in advance and may withdraw consent or delete their data before it takes effect. Contact: Contact us Sub-processors: see §5.

A Data Protection Officer has not been appointed; given the scale of processing, GDPR Art. 37 does not require one. If that changes, contact details will be added here.

2 · What data we collect

When you use the service anonymously (no account)

• Question and answer text — used in real time to retrieve evidence and generate an answer, and stored on our servers against a salted hash rather than your identity. We keep it to investigate abuse and to find and fix wrong or unsafe answers, which is the main way this product is made safer. It is not linked to a name, an email, or an account. Your browser also keeps a local copy of anonymous chats so you can scroll back through them; that copy never leaves your device, and you can erase it under Settings → "Clear local copies on this device".
• A rate-limit cookie (medelix_anon) — when you first ask a question without signing in, we set a small random identifier in a cookie scoped to .medelix.ai (HttpOnly, SameSite=Lax, 30-day max-age). We use it solely to enforce the anonymous quota of 2 questions per browser per 24 hours. The value is not linked to your identity, is never shared, and you can delete it from your browser at any time.
• Hashed IP address (secondary backstop) — as a defence against scripted cookie rotation, we hash your IP with a secret we hold and cap any single network to ~200 anonymous questions per 24 hours. The original IP is never stored on the anonymous path; only the hash. Be aware that a hash of an IP address is not anonymous in the strict sense: we hold the secret, and the address space is small enough that the hash is reversible by anyone who has it. We therefore treat these rows as personal data, and so should you when you read the retention section below.
• Country code, request ID, user agent — for security monitoring and incident response.
• Where you came from (first question only) — with the first question of a visit, your browser tells us the domain of the page that linked to Medelix (for example google.com — never the full address) and any campaign tag in the link you followed (for example utm_source=newsletter). Nothing is stored on your device for this. We use it only in aggregate, to understand which channels bring people to Medelix.

When you subscribe to the newsletter without an account

• Email address and language — if you enter your email in the newsletter prompt, we ask our email provider to send you a confirmation email. Your address is added to the newsletter list only after you click the confirmation link (double opt-in); the provider keeps the record of when you confirmed. Without confirmation you receive nothing further from us.
• What the newsletter contains — news about Medelix and the Medelix app, occasional practical tips for study and clinical work, and occasionally offers from selected partners. We send every email ourselves; we do not pass your address to any partner.
• Unsubscribing — every email contains an unsubscribe link, or write to contact@medelix.ai. Your address is then removed from the list.
• To stop abuse of the form, we count sign-ups per network using the same salted IP hash described above (at most 5 per day); the original IP is not stored.

When you create an account

• Email address, hashed password (or Google / Apple OAuth identifier) — used to authenticate you.
• Display name and language preference, if you set them.
• Phone number, if and when phone-OTP authentication is added.
• Consent flags — whether you accepted the Terms of Service and this Privacy Policy, and whether you opted in to product emails.

When you ask questions while signed in

• Question + answer + citations — stored in your conversation history so you can return to past chats and so we can support data export. Stored only because you consented at sign-up; if you withdraw consent, we delete this data.
• Per-query metadata — language, latency, model used, abstention flags, IP, country, user agent.
• Images and PDFs you attach — signed-in users can attach one image (JPEG, PNG, WebP) or a short PDF (up to 10 pages) to a question. Two kinds of file are accepted: published material (a medicine package or insert, a guideline table, a figure from a paper) and anonymised patient documents such as lab reports, findings reports, doctors' letters, discharge summaries or medication plans. On ECGs, X-rays and other clinical images only the printed text is read; the picture itself is never interpreted, and an image without printed text is refused. Before anything else happens, an automated check looks for anything that identifies a person — a name, date of birth, address, ID or record number, or a face. If it finds one, or if it is unsure, the file is refused and deleted immediately and we ask you to crop or black out those details; a second, rule-based check then runs on the text read from the file. A file that passes is read into text, and that text is screened and has direct identifiers removed exactly like a typed question before it is used. Location and camera metadata (EXIF) are removed from images on arrival. Attached files are not stored. A file is held only until it has been read — at most 15 minutes — and is then deleted, whether it was refused, unreadable or answered from. The text read from published material is kept for at most the same 15 minutes so that a retry does not need the file again. The text read from an anonymised patient document is used only for that one answer: it is not kept for a retry, it is removed from the question we store and from your conversation history, and it is kept out of our logs. Answers based on such a document explain general meaning and reference ranges with sources; they never give an individual diagnosis or treatment recommendation, and they end with a note that they are for learning purposes only. What we keep is a technical record that an attachment was used: a fingerprint of the file (a SHA-256 hash, from which the file cannot be rebuilt), what kind of document the check took it for, and how much text it contained — so we can investigate abuse and errors. Files are never used for training. Because the file is gone, your conversation history does not show it. Attaching files is not available without an account.
• Reminder notifications (mobile app, optional) — if you are signed in and allow notifications, the app registers your phone's push token (a random address issued by Apple or Google), the platform (iOS or Android), the app language, and the time the app was last opened. We use this only to send an occasional reminder when you have not used Medelix for more than a day: at most one per week, and none once you have been away for more than 30 days. The reminder is one fixed, generic sentence in your language; it never contains a question, an answer, a topic or your name. You can turn reminders off in the app's Settings or in your phone's notification settings at any time.
• Where you came from (first question only) — with the first question of a visit, your browser tells us the domain of the page that linked to Medelix (for example google.com — never the full address) and any campaign tag in the link you followed (for example utm_source=newsletter). Nothing is stored on your device for this. We use it only in aggregate, to understand which channels bring people to Medelix.
• Within-conversation context — while a chat is open, earlier turns in that same conversation are used so follow-ups make sense ("and in renal impairment?"). Nothing is carried across separate conversations.

Things we do not collect

• We do not collect cookies for advertising or analytics.
• We do not embed third-party trackers (no Google Analytics, no Facebook pixel).
• We do not buy data from data brokers.
• We do not require patient-identifying input — and our Terms prohibit you from entering it.

3 · Why we process this data (lawful bases)

3a · Health data and special categories

Summary: We don't want patient data in the system, and we actively filter for it. To the extent your own queries touch on health topics, you give explicit consent at sign-up.

Medelix is designed not to process health data of identifiable patients. Our Terms prohibit input of patient-identifying data (§5 of the Terms), and we apply automated pattern-matching filters at the input layer that detect and redact common direct identifiers — including names, addresses, and phone numbers — before queries are passed to model and embedding providers. These filters are a defence-in-depth measure, not a guarantee of perfect detection; the user-level prohibition in the Terms remains the primary safeguard.

The same applies to attached images and PDFs. Every attachment is first checked automatically for anything that identifies a person; a file that does — or that the check cannot confidently clear — is refused and deleted at once. Anonymised patient documents are accepted, but their text is used only for the one answer and is not stored, and Medelix explains their general meaning without giving an individual diagnosis or treatment. The check works on probabilities and can be wrong in either direction, so it supplements the prohibition in the Terms rather than replacing it.

To the extent your queries contain health-related context that constitutes special-category data within the meaning of GDPR Art. 9, we process that data on the basis of your explicit consent (Art. 9(2)(a) GDPR), which you give at sign-up. You may withdraw this consent at any time by deleting your account; without it, we cannot lawfully provide the service.

3b · Automated decision-making

Summary: Medelix gives you AI-generated information; it does not make decisions about you.

Medelix does not make decisions about you using solely automated processing that produce legal effects or similarly significantly affect you within the meaning of GDPR Art. 22. The service generates AI-summarised answers to your medical questions; these are informational outputs, not decisions about you. Any clinical, diagnostic, or treatment decision remains entirely with you and the qualified professionals involved.

4 · How long we keep your data

We do not currently run scheduled deletion. Being straight about this: an earlier version of this page set out a retention schedule — 90 days for anonymous metadata, 12 months for conversation history — that no automated job enforced. The periods were an intention, not a practice, and the oldest rows we hold date to 6 May 2026, when the service began collecting them. Publishing a schedule we did not keep was wrong, and we would rather correct it than quietly leave it there.

What is true today:

What we are changing. Scheduled deletion is being implemented, after which this table will state enforced periods rather than intentions, and this paragraph will be replaced by them. Until it ships, you can have anything about you erased on request — see Section 6 — and we act on that within 30 days.

When you ask us to delete your account, we delete or irreversibly anonymise the data within 30 days, except where retention is legally required (e.g. tax / accounting where applicable). Note that backups are kept on a 14-day rotation, so a deleted record can persist in a backup for up to two weeks after it is removed from the live database.

5 · Where your data is processed

Your account data, your conversation history, and the core processing that powers Medelix are handled within the European Union / EEA.

Our servers are in Helsinki, Finland. The database, the authentication service and the backups all run there on hardware we administer ourselves — not on a managed cloud database. In August 2026 we moved this stack off a US-incorporated managed provider precisely so that no third party outside our control holds your questions.

These are the processors that handle your account data, your questions and the answers:

One note we would rather state plainly than bury:

• The model providers do not train on your data. The contractual terms of every AI model provider we use exclude submitted content from model training. We do not train any model of our own on your questions or attachments.
• The model providers keep no copy. The providers that write answers, check and read attachments, and transcribe dictation process your content under zero data retention: inputs and outputs are held only while the response is generated and are not stored or logged afterwards. They keep usage metadata such as token counts for billing, not the content.

If we add, remove or replace a processor, we will update this table and notify signed-in users by email. The names of the individual providers in each category are available on request at contact@medelix.ai.

International transfers. Beyond the processors listed above, a small number of infrastructure providers are incorporated in the United States even though the data they handle stays within the EU/EEA — specifically our content-delivery / DNS / security-edge provider, our website host, and the optional federated sign-in providers (Google / Apple), which are involved only if you choose to use them. For these, transfers rely on the Standard Contractual Clauses (SCCs) as the primary safeguard, supplemented by the EU–US Data Privacy Framework where the provider is certified, and supported by an internal Transfer Impact Assessment available to supervisory authorities on request.

We also send your anonymised question text (no account identifier, no IP address) to public medical-literature search APIs to retrieve evidence — currently Europe PMC, OpenAlex, CORE, Semantic Scholar and Unpaywall, plus the guideline registers of the issuing bodies themselves. These receive no personal data about you and are not processors of yours. We may add or change these sources over time; this Policy will be updated accordingly.

6 · Your rights under GDPR

You have the right to:

• Access the data we hold about you (Art. 15).
• Correct inaccurate data (Art. 16).
• Delete your data (Art. 17 — "right to be forgotten").
• Restrict processing in certain circumstances (Art. 18).
• Data portability — receive your data in a machine-readable format (Art. 20).
• Object to processing based on legitimate interest (Art. 21).
• Withdraw consent at any time, where consent is the lawful basis (Art. 7(3)).

To exercise these rights:

• By email: contact@medelix.ai. Write to us from the address on your account and tell us what you want — a copy of your data, correction, or deletion of your account. We will respond within 30 days (one extension of two months is possible for complex requests, with notice). There is no form to fill in and no reason you need to give.

We handle these by hand rather than with a button in Settings. Account deletion is irreversible and takes your conversation history with it, and a single mis-click — or anyone who reaches an unlocked laptop — should not be able to destroy your account. Asking costs you one email and costs us the check that you meant it.

If you believe we have mishandled your data, you can lodge a complaint with the supervisory authority in your EU member state. Our lead authority is Austria's Datenschutzbehörde (DSB): https://www.dsb.gv.at · Barichgasse 40-42, 1030 Wien · dsb@dsb.gv.at. EU users may also complain to their national DPA.

7 · Children

Medelix is intended for adults — primarily medical professionals and medical students. The minimum age to create an account is 18. We do not knowingly collect data from anyone under 18. If you believe we have, contact contact@medelix.ai and we will delete it.

8 · Security

Practical measures include encryption in transit (TLS 1.2+), per-tenant access controls (Row-Level Security on every table holding personal data, plus app-layer enforcement), admin endpoints gated behind a separate secret token, input-layer pattern-matching to detect and redact direct patient identifiers (names, addresses, phone numbers) before queries reach model and embedding providers, prompt-injection scanning before model calls, and error reports scrubbed of personal data before they leave the process. Database backups run every six hours, with an automated restore test that compares the restored copy against the live database.

Three things this section used to claim that were not true, corrected here rather than left standing: question and answer text is not encrypted at rest at the column level — it is stored as ordinary text in an encrypted-disk database; admin access is not protected by multi-factor authentication today, only by a separate secret token; and backups are six-hourly rather than nightly and are not themselves encrypted at rest. Column-level encryption, MFA on the admin surface, and encrypted off-site backups are all planned; none of them is in place as you read this.

We work to GDPR Art. 32 standards. No security is absolute; if a breach occurs we will notify the supervisory authority within 72 hours where required and notify affected users without undue delay where there is a high risk to their rights.

9 · Cookies

Medelix uses only strictly necessary cookies — no advertising cookies, no analytics cookies and no third-party analytics. The only usage information we keep is the referring domain described in section 2. There is no cookie banner because none is required when only strictly-necessary cookies are used.

We also use your browser's local storage for things that never reach us. Like cookies, it is listed here for transparency; you can clear all of it from Settings, or through your browser.

10 · Changes to this policy

If we materially change how we process your data, we will:

1. Update this page with a new "Last updated" date.
2. Email signed-in users in advance.
3. Where the change requires renewed consent (e.g. introducing a new lawful-basis category or sub-processor that requires consent), we will request that consent before applying the change to your data.

11 · Contact

Contact: Contact us

Postal address: Melih Ekrem Yaz, Seitenstettengasse 5/37, 1010 Vienna, Austria (Impressum)

This is a clinical-evidence research tool. We are not a substitute for medical advice. If you are facing a medical emergency, contact your local emergency services (in the EU: 112). For mental-health crisis support: Telefonseelsorge Österreich 142, Rat auf Draht 147 (Austria); Telefonseelsorge 0800 111 0 111 (Germany).