EU & UK General Data Protection Regulation

Scope

This statement covers all personal data Desha.ai processes through MedNote, DocNote, the Health Responsibility Score and the HeartBeat platform, including identity data, contact details, prescription and medication data, adherence events, and conversation content captured with consent.

Lawful basis & consent

Every processing activity is mapped to a lawful basis. Patient-facing health processing relies on explicit, granular, plain-language consent captured at onboarding; clinician and operational processing relies on contract and legitimate interests assessed via an LIA.

• Consent is granular (per channel and per purpose), logged, and revocable at any time without affecting care.
• Special-category (health) data is processed under Article 9 conditions with explicit consent and, where relevant, the provision-of-healthcare condition.
• No selling of personal data; no use of identifiable patient data to train third-party foundation models.

Data subject rights

We support all GDPR data subject rights end-to-end, with a target response well inside the statutory one-month window.

Governance

• Records of Processing Activities (Article 30) maintained.
• Data Protection Impact Assessment (DPIA) completed for high-risk processing and kept current.
• A named data protection contact / DPO function and an incident response process with a 72-hour breach-notification path.
• Article 28 processor terms (DPA), including sub-processor flow-down and Standard Contractual Clauses for any international transfer.

International transfers

Primary processing and storage use UK / EU regions. Where a transfer outside the UK/EEA is unavoidable, it is covered by the UK IDTA or EU Standard Contractual Clauses together with a transfer risk assessment.