How we handle your Medicus account data

This notice covers your Medicus account only: the sign-in you use for Medicus products. What a product does with your health information is in that product's own privacy notice (for HealthSpan: healthspan.medicus.ai/privacy).

Who is responsible. Medicus AI FlexCo, Wehleweg 9 / Top 53, 1030 Vienna, Austria, FN 458726y. Contact for anything about your data: [email protected].

What we keep, and why.

• Your email address, your name, and your password, which we store only in scrambled (hashed) form. We need these to run your account (Art. 6(1)(b) GDPR).
• When you agreed to which terms and notices, and which version. We keep this to show what you agreed to (Art. 6(1)(c) and (f) GDPR).
• Sign-in records: time, IP address, and browser or device type. We use them to keep your account safe and to detect misuse (Art. 6(1)(f) GDPR, our interest in security).

Who else sees it. Amazon Web Services (AWS) runs the account service and its database in the EU, and sends our sign-up, verification and password-reset emails (Amazon SES). We have a data processing agreement with AWS. No one else processes your account data for us. We do not sell your data and do not use it for advertising.

Outside the EU. Your account data is stored and processed in the EU. AWS is a US company, so its data processing agreement includes the EU Standard Contractual Clauses, and AWS is certified under the EU-US Data Privacy Framework.

How long. Account data until you delete your account. Sign-in records for 90 days. Backups are overwritten within 30 days after you delete your account.

Your rights. You can ask for a copy of your data, correct it, delete it, restrict or object to its use, and take it with you, by writing to [email protected]. You can also complain to the Austrian Data Protection Authority (Datenschutzbehörde, www.dsb.gv.at) or the authority where you live.

Version 1.2, 17 October 2026.