Privacy Policy

The data controller responsible for processing your personal data is Professional Development Services Wojciech Nabiałkowski, correspondence address: ul. Jesionowa 7, 55-010 Święta Katarzyna, Poland, NIP 8961658532, REGON 543018382.

For any inquiries regarding the processing of your personal data, please contact us at: office@doccare.pl.

We collect the following categories of personal data:

• Account data: first name, last name, email address, date of birth, medical specialty, professional license number, phone number, and password (stored in hashed form).
• Billing data: full name, address, company name, tax identification number (NIP), provided for invoicing purposes.
• Visit data: audio recordings of patient visits, AI-generated transcriptions, and medical notes created through the Service. This data may contain health-related information.
• Technical data: IP address, browser type, device information, and usage logs collected automatically during your use of the Service.
• Payment data: payment card details are processed directly by our payment provider Stripe and are never stored on our servers.

We process your personal data for the following purposes:

• Provision of the Service – processing audio recordings, generating transcriptions and medical notes (legal basis: Art. 6(1)(b) GDPR – performance of a contract).
• Account management – creating and maintaining your user account (legal basis: Art. 6(1)(b) GDPR – performance of a contract).
• Billing and payments – processing subscription payments and issuing invoices (legal basis: Art. 6(1)(b) GDPR – performance of a contract).
• Service improvement – analyzing usage patterns to improve our Service (legal basis: Art. 6(1)(f) GDPR – legitimate interest).
• Communication – sending you service-related notifications and updates (legal basis: Art. 6(1)(f) GDPR – legitimate interest).
• Legal compliance – fulfilling our legal obligations, including tax and accounting requirements (legal basis: Art. 6(1)(c) GDPR – legal obligation).

DocCare does not keep medical records – the medical record is kept by the User, or by the healthcare provider they work for, in their own system. We process patient data contained in recordings, transcriptions, and notes, including health data, as a processor – on behalf of and on the instructions of the User, who is the controller of that data (Terms of Service, § 8). The User processes this data under Art. 9(2)(h) GDPR – processing necessary for medical diagnosis, the provision of health care or treatment, by or under the responsibility of a healthcare professional subject to professional secrecy.

We retain your personal data for as long as your account is active and as necessary to provide the Service.

• Account and profile data are retained until you delete your account.
• Audio recordings are deleted automatically 24 hours after upload. Transcriptions and notes are retained until you delete them or close your account. Working copies created during processing are deleted automatically within 24 hours.
• Invoices are issued in KSeF, the Polish National e-Invoice System, where they are stored. We keep other tax records for the period required by tax law.
• Technical logs are retained for up to 12 months.

Upon account deletion, your personal data will be permanently erased within 30 days, except where retention is required by law.

Under the GDPR, you have the following rights regarding your personal data:

• Right of access – you may request a copy of your personal data.
• Right to rectification – you may request correction of inaccurate data.
• Right to erasure – you may request deletion of your data ("right to be forgotten").
• Right to restriction of processing – you may request that we limit how we use your data.
• Right to data portability – you may request to receive your data in a structured, machine-readable format.
• Right to object – you may object to processing based on legitimate interest.
• Right to withdraw consent – where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, please contact us at office@doccare.pl. We will respond to your request within 30 days.

You also have the right to lodge a complaint with the Polish supervisory authority – the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO), ul. Stawki 2, 00-193 Warsaw.

We implement appropriate technical and organizational measures to protect your personal data, including:

• Encryption of data in transit.
• Automatic deletion of audio recordings 24 hours after upload.
• Access controls limiting data access to authorized personnel only.
• Logging of account security events.
• Secure infrastructure hosted within the European Economic Area (EEA).
• Limiting the data shared with processors to the minimum necessary.

Despite these measures, no method of electronic transmission or storage is 100% secure. In the event of a data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and inform you without undue delay.

We use the following third-party sub-processors to operate the Service. Where personal data – including special-category health data processed under Art. 9(2)(h) GDPR (healthcare provision) and your consent – is transferred outside the European Economic Area (EEA), we rely on the European Commission's Standard Contractual Clauses (SCCs) as the safeguard under Art. 46 GDPR. A copy of these safeguards can be obtained by writing to office@doccare.pl.

• Stripe Payments Europe, Ltd. (Ireland) – payment processing. Data may be transferred to the USA (Stripe, Inc.); the transfer is covered by SCCs. Privacy policy: https://stripe.com/privacy.
• RunPod, Inc. (USA) – provider of the cloud infrastructure used to process data as part of the Service. Processing takes place in the EU; because RunPod is a US company, the transfer of data is covered by SCCs. Privacy policy: https://www.runpod.io/legal/privacy-policy.
• Anthropic Ireland, Limited (Ireland) – provider of AI services used to process text as part of the Service. Processing takes place in the USA; the transfer of data is covered by SCCs. Privacy policy: https://www.anthropic.com/legal/privacy.
• OpenAI Ireland Ltd. (Ireland) – provider of AI services used to process text as part of the Service. Data may be transferred to the USA; the transfer is covered by SCCs. Privacy policy: https://openai.com/policies/privacy-policy.
• Mailgun Technologies, Inc. (USA) – handling of email related to your account and the Service. Processing takes place in the EU; the transfer of data is covered by SCCs. Privacy policy: https://www.mailgun.com/legal/privacy-policy/.
• Sentry (Functional Software, Inc., USA) – application error monitoring. Processing takes place in the EU; the transfer of data is covered by SCCs. Privacy policy: https://sentry.io/privacy/.
• Expo (650 Industries, Inc., USA) – delivery of push notifications to the mobile app (through Apple's or Google's notification services). Transfers to the USA are covered by SCCs. Privacy policy: https://expo.dev/privacy.
• Hosting provider – the servers that run the Service and store its data are located in the European Union.

All sub-processors are bound by Data Processing Agreements (DPAs) ensuring GDPR-compliant handling of your data.

We issue invoices for the Service in the National e-Invoicing System (KSeF), operated by the Head of the National Revenue Administration (Polish Ministry of Finance). An invoice contains the buyer's details: full name or company name, address and, for a company, its tax identification number (NIP). We are required to send this data under the Polish VAT Act (Art. 6(1)(c) GDPR – legal obligation). The Head of the National Revenue Administration receives it as a public authority, not as our processor.

We use only mechanisms that are strictly necessary for the Service and that store information on your device:

• Browser storage – to keep you logged in and remember your selected language.
• Language preference cookie – to remember your selected interface language.

These do not require your consent, as they are essential for providing the Service. We do not use advertising or tracking cookies.

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable laws. We will notify you of any material changes by posting the updated policy on our website and, where appropriate, by sending you an email notification.

The "Last updated" date at the top of this page indicates when the policy was last revised. We encourage you to review this policy periodically.

If you have any questions about this Privacy Policy or our data processing practices, please contact us at:

Professional Development Services Wojciech Nabiałkowski Correspondence address: ul. Jesionowa 7, 55-010 Święta Katarzyna, Poland NIP: 8961658532 REGON: 543018382 Email: office@doccare.pl