Privacy Policy
Last updated: July 2026
Introduction
Eva Medical AI is committed to protecting your privacy and personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our medical AI analysis platform. Please read this policy carefully to understand our practices regarding your personal data.
Information We Collect
Personal Information
- Full name and professional credentials
- Email address for account management and communications
- Phone number for account verification and support
- Practice address and billing information
- Professional license numbers and certifications
Medical Information
- medical X-rays, photographs, and other diagnostic images
- Medical reports, treatment plans, and clinical notes
- AI analysis results and diagnostic recommendations
- Treatment history and patient care records
Technical Information
- Device information and operating system details
- Browser type, version, and settings
- IP address and location data
- Usage patterns, feature interactions, and performance data
How We Use Your Information
- Provide and maintain our AI-powered medical analysis services
- Improve our algorithms and develop new features
- Communicate with you about your account and our services
- Comply with legal obligations and regulatory requirements
- Ensure the security and integrity of our platform
Data Security
We implement industry-standard security measures to protect your personal and medical information. Our security practices include:
- End-to-end encryption for all data transmission and storage
- Role-based access controls and multi-factor authentication
- Continuous security monitoring and threat detection
- HDS compliance and regular security audits
Data Sharing and Disclosure
We do not sell, trade, or rent your personal information to third parties. We may share your information only in the following circumstances:
- With trusted service providers who assist in platform operations
- When required by law or to protect our legal rights
- With your explicit consent for specific purposes
- In connection with a business transfer or acquisition
Your Rights
- To exercise your rights (access, correction, deletion, portability, objection), contact us at support@evamedical.ai or use the "Download my data" option in your account settings. We will respond within one month.
Access
You have the right to access and review your personal information held by us.
Correction
You can request corrections to any inaccurate or incomplete personal information.
Deletion
You may request deletion of your personal information, subject to legal and operational requirements.
Data Portability
You can request a copy of your data in a structured, machine-readable format.
Data controller
The data controller for your personal data is Eva Medical AI (5 rue Ellenhard, 67000 Strasbourg, France). You are not required to publish a named individual: GDPR requires identifying the controller and a contact point. Data-related requests are handled via our support address.
- Contact
Data Protection Officer
For any question regarding the protection of your personal data or to exercise your rights, you may contact our team at the support address below. A Data Protection Officer (DPO) may be designated as a legal entity (law firm); contact details will be updated on this page accordingly.
- Contact (support and data-related requests)
Data retention periods
Your data is retained for the following periods:
- Technical logs (errors, actions, login attempts, tokens): 3 years, then automatic deletion.
- Account and practice data (patients, reports): until your account is deleted. When you close your account, all such data is permanently deleted.
Subprocessors
We use the following subprocessors to operate the service. The personal data we share with them is limited to what is strictly necessary. We do not send sensitive identifying data (patient name, patient identifier, etc.) to AI service providers.
- Google Cloud Platform (GCP): application hosting and data storage — Paris region (France), HDS-certified host (primary deployment).
- Amazon Web Services (AWS): hosting and storage — France / EU as configured, HDS-certified host (compatible alternate deployment).
- Microsoft Azure: hosting and storage — Paris region (France), HDS-certified host (compatible alternate deployment).
- Stripe: payment and subscription processing (United States).
- Google (Gemini API): AI inference services (no sensitive identifying data sent).
- AWS Bedrock: AI inference services (no sensitive identifying data sent).
- Microsoft Azure (AI services): AI inference services (no sensitive identifying data sent).
- OpenAI: AI inference services (no sensitive identifying data sent).
Contact Us
If you have any questions about this Privacy Policy or our data practices, please contact us:
- Address
- Eva Medical AI, 5 rue Ellenhard, 67000 Strasbourg, France
- for any request regarding your rights (access, correction, deletion, portability)
Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the 'Last Updated' date. Your continued use of our services after any modifications constitutes acceptance of the updated policy.