Privacy Policy

This Privacy Policy describes how your personal information is collected, used, and shared when you visit docdemic.com (the "Site") or use our services. Docdemic is the operating name of Avidemic AB, a Swedish company.

You Own Your Data

We do not own your data, your data belongs to you. Data here refers to everything you place on the Docdemic platform including transcriptions, notes, audio files, documents, and any other form of data you upload. The act of creating, editing or sharing content to Docdemic does not change that content's ownership nor does it change its copyright status. If the data belonged to you to begin with, it remains as yours after you put it in Docdemic.

Your Data is Private

All of the data that you put into Docdemic is private by default. Furthermore, everything you store on Docdemic is stored in encrypted EU datacenters with GDPR-aligned safeguards. Because your data is private, we do not try to make money from your content. We do not sell your content to any third party for advertising purposes. There are no ads on the Docdemic platform.

Your Data Can Be Retrieved

There is no data lock-in with Docdemic which means that you can, at any time, choose to retrieve and download the data that you have stored to your own devices. You can export your transcriptions and documents in standard formats including PDF, Word, and plain text.

Your Data is Never Used to Train AI

If you use any of our AI functionalities, the data that you input is never used to train the AI. Like other forms of data, the AI related data stays private and is not shared without your consent. Your transcriptions are processed by our AI systems but are not used to improve our models.

Personal Information We Collect

Essential cookies maintain your secure account session and privacy preferences. To operate the service securely and reliably we record the technical information needed to provide it, such as sign-ins, usage against your plan’s allowance, which features are used, errors, and what was happening when a problem occurred. This service data is linked to your account (name and email address) so that we can meter your plan, keep the service secure and help you when something goes wrong. It is kept on our own servers in the EU and is not shared with anyone else. It never includes patient names, document content, transcripts, audio, passwords, or authentication tokens.

We collect Device Information using the following technologies:

• "Cookies" are data files that are placed on your device or computer and often include an anonymous unique identifier. For more information about cookies, and how to disable cookies, visit allaboutcookies.org.
• "Log files" track actions occurring on the Site, and collect data including your IP address, browser type, Internet service provider, referring/exit pages, and date/time stamps.
• "Web beacons," "tags," and "pixels" are electronic files used to record information about how you browse the Site.

Information We May Receive From:

• Information that you have provided directly: This includes the information you provide when registering for an account (like name and email) as well as any information regarding your profession or industry. We use this information to enable you access to Docdemic or to fulfil the request that you have made.
• Information that we have collected from your use of Docdemic: We may collect information about your use of Docdemic. This information includes your IP address, browser type and any referring website addresses. We may use this information in combination with other information that we have collected about you in order to keep a record of our interaction and to enable us to provide support, personalisation and improve our services.
• Information that we collect from our other interactions or business dealings: This includes, if you have contacted us via our social media profiles or otherwise interacted with our business, we will make a record of those dealings, which may contain personal data.
• Information that has been provided to us by other Docdemic users: We may receive personal data, such as your email address, from other users of Docdemic, for example, if a user has tried to share something with your email or attempted to refer Docdemic to you.

When we talk about "Personal Information" in this Privacy Policy, we are talking both about Device Information and Account Information.

How Do We Use Your Personal Information?

Service data is recorded with OpenPanel, running on our own servers in the EU. Events use a limited set of feature names and counts, linked to your account so that we can meter your plan, keep the service secure and help you with support. We never send patient information, recordings, transcripts, document text or record URLs. On the public website, before you sign in, page statistics are only recorded if you allow them under Privacy choices.

Sharing Personal Information

Finally, we may also share your Personal Information to comply with applicable laws and regulations, to respond to a subpoena by a court, search warrant or other lawful request for information we receive, or to otherwise protect our rights.

GDPR & Your Data Related Rights

Docdemic is committed to complying with GDPR regulation regarding data privacy. You have the right to access personal information we hold about you and to ask that your personal information be corrected, updated, or deleted. If you would like to exercise this right, please contact us through the contact information below.

The transcriptions and data that you upload to Docdemic are stored in EU datacenters. Our primary server provider is Hostup in Sweden, with secondary datacenter capacity through Hetzner in Germany.

Data Protection Outside of EU

We offer the same high level of data protection to our non-EU based users. This is done in order to comply with other national data regulations, including the CCPA, HIPAA, and the Australian Privacy Act. If your organization requires a custom DPA agreement to be signed between us and you, please contact us through our contact form. If no such custom DPA agreement is signed, the data policy on this page stands as the default agreement for all users. The data policy on this page governs all users and does not make a distinction between free and paid users. Both groups of users enjoy the same data related rights, as described on this page, including the right of data privacy.

HIPAA Compliance

US healthcare organisations must confirm a suitable Business Associate Agreement and the permitted processing configuration before submitting protected health information. Availability of technical features alone does not establish HIPAA compliance. Contact us at compliance@docdemic.com for BAA requests.

Data Retention

When you create a subscription through the Site, we will maintain your Subscription Information for our records unless and until you ask us to delete this information. Upon account deletion request, we will permanently remove your data within 30 days in compliance with GDPR's right to erasure. Service data (sign-ins, feature usage, errors) is kept for 24 months and is removed together with the account.

Security Measures

We implement industry-standard security measures to protect your data:

• Restricted access to stored data and encrypted authentication secrets
• HTTPS encryption for data in transit
• Multi-factor authentication (MFA) support
• Technical diagnostics to investigate service errors and security events
• Deployment and processor settings reviewed for the organisation’s requirements

Changes

We may update this privacy policy from time to time in order to reflect, for example, changes to our practices or for other operational, legal or regulatory reasons. We will notify users of material changes via email or through a notice on our website.

Contact Us

For more information about our privacy practices, if you have questions, or if you would like to make a complaint, please contact us by email at privacy@docdemic.com or by mail using the details provided below:

Docdemic is developed and operated from Sweden.

AI and service providers

Text generation uses TensorX and Berget. Transcription uses Berget, with Lemonfox's EU service as a fallback when needed. The input needed for your requested task is sent to the relevant provider. Lettermint delivers account and service emails, and Stripe manages billing. Your organisation should confirm its processing agreement and permitted data types before uploading clinical information.