Compliance and protection of your data

Compliance frameworks

The frameworks we comply with

Our compliance approach is progressive and documented. اللائحة العامة لحماية البيانات (GDPR), ، ال قانون الذكاء الاصطناعي للاتحاد الأوروبي, HDS hosting و U.S. consumer privacy are fully documented, and our سياسة الخصوصية is published online. This page will grow as further frameworks are formalized.

Documented

اللائحة العامة لحماية البيانات (GDPR)

Regulation (EU) 2016/679. A complete set of records, policies and procedures covering data collection, consent, security and individuals’ rights.

See the 19 documents

Compliant

قانون الذكاء الاصطناعي للاتحاد الأوروبي

Regulation (EU) 2024/1689 on artificial intelligence. Transparency, AI literacy, human oversight and risk management : 12 documents covering the applicable obligations.

See the 12 documents

Compliant

HDS Hosting

Health data hosted by a certified HDS host (Health Data Host), on servers يقع في فرنسا. 6 documents in place.

See the 6 documents

Confirmed

Regulatory status (ANSM)

In 2025 the ANSM confirmed that AI DiagMe is not a medical device within the meaning of Regulations (EU) 2017/745 and 2017/746.

Learn more

Compliant

U.S. Consumer Privacy (B2C)

U.S. consumer privacy (direct-to-consumer) : FTC, CCPA/CPRA, MHMDA, HBNR. 10 documents in place. HIPAA compliance will only apply to sales to U.S. laboratories.

See the 10 documents

Published

سياسة الخصوصية

How we collect, use and protect your data, and how to exercise your rights. A public document, available at any time on the site.

Read the policy

اللائحة العامة لحماية البيانات (GDPR)

Our GDPR compliance

The lab results and health information we process are special categories of data (Article 9 GDPR). We apply the strictest requirements regarding legal basis, consent, security and respect for individuals’ rights.

Documentation reviewed in July 2026

19Documents kept up to date

6Areas covered

Art. 5 → 49of the GDPR referenced

Documents available on request

These documents describe our processing activities and security measures in detail. Because they contain sensitive information, we share them on a case-by-case basis. Click a document : your email app opens with a pre-filled request addressed to contact@aidiagme.com.

Request the full package

Records & impact assessments 3 documents

Record of Processing Activities Art. 30 Available Request Data Protection Impact Assessment (DPIA) — AI processing of health data Art. 35 Available Request Legal-basis analysis per processing activity Art. 6 & 9 Available Request

Individual information & consent 4 documents

Privacy notices at collection points Art. 13 & 14 Available Request Explicit consent collection & proof (health data) Art. 7 & 9(2)(a) Available Request External privacy policy (website, FR/EN) Art. 12–14 Available Request Cookie policy + consent proof (CMP) Art. 82 (ePrivacy) Available Request

Data-subject rights & incidents 3 documents

Rights-request procedure + request log Art. 12–22 Available Request Data-breach management procedure + log Art. 33 & 34 Available Request Incident response plan Art. 32-33-34 Available Request

Internal data governance 3 documents

Internal data-protection policy Art. 24 Available Request Data retention & deletion policy Art. 5(1)(e) Available Request DPO designation & duties (where applicable) Art. 37–39 Available Request

Processors & transfers 3 documents

Processor-management policy + register Art. 28 Available Request Data Processing Agreements (DPAs) — signed Art. 28 Available Request Non-EU transfer safeguards + TIA Art. 44–49 Available Request

Processing security 3 documents

Processing-security policy Art. 32 Available Request Access-control procedure Art. 32 Available Request Security awareness & training policy Art. 32 Available Request

قانون الذكاء الاصطناعي للاتحاد الأوروبي

Our EU AI Act compliance

ال Regulation (EU) 2024/1689 governs artificial-intelligence systems. AI DiagMe applies the obligations that fall to it — transparency, user information, AI literacy, human oversight and risk management — and keeps the documentation up to date.

Documentation reviewed in July 2026

12Documents in place

4Areas covered

EU 2024/1689Reference regulation

Documents available on request

As with GDPR, these documents describe our AI design and governance choices. Click a document : your email app opens with a pre-filled request addressed to contact@aidiagme.com.

Request the full package

System mapping & risk classification 3 documents

AI-system mapping & register Art. 6 · Annex III Available Request Risk-classification note (not “high-risk”) Art. 6 · Annex III · Art. 5 Available Request Prohibited-practices screening Art. 5 Available Request

Transparency & user information 3 documents

Transparency measures & user information Art. 50(1) Available Request AI-generated content marking Art. 50(2) Available Request AI-literacy plan & register Art. 4 Available Request

Human oversight & technical documentation 3 documents

Human oversight & instructions for use Best practice (Art. 13-14) Available Request AI-system technical sheet Best practice (Art. 11) Available Request Data governance & quality Best practice (Art. 10) Available Request

Value chain & compliance monitoring 3 documents

GPAI value chain — provider documentation Art. 25 · 53 · Annex XII Available Request Monitoring & incident reporting Art. 72-73 (if high-risk) Available Request Compliance timeline & monitoring (Digital Omnibus) Art. 113 + Omnibus 2026 Available Request

HDS Hosting

Our health-data hosting

The health data we process is hosted by a certified HDS host (Health Data Host, Art. L.1111-8 of the French Public Health Code), on servers يقع في فرنسا. We document the split of responsibilities, the contractual clauses and the precise location of the data.

Documentation reviewed in July 2026

6Documents in place

فرنساServer location

Art. L.1111-8 CSPReference framework

Documents available on request

These documents evidence our compliant hosting and the split of roles with the host. Click a document : your email app opens with a pre-filled request addressed to contact@aidiagme.com.

Request the full package

Certified host & contract 3 documents

HDS positioning note (SMC = client of a certified host) Art. L.1111-8 CSP Available Request Certified-host verification statement Art. L.1111-8 · R.1111-9 Available Request Contractual-clauses verification Art. R.1111-11 CSP Available Request

Responsibilities, data & individuals 3 documents

Responsibility-allocation matrix (host / SMC) HDS framework Available Request Hosted health-data mapping & location Art. L.1111-8 · HDS v2.0 Available Request Individual information (HDS hosting + right to object) Art. L.1111-8 Available Request

U.S. Consumer Privacy (B2C)

Our U.S. consumer-privacy compliance

For our individual users in the United States (direct-to-consumer sales), we apply the federal and state privacy framework — FTC, CCPA/CPRA, ، ال My Health My Data Act (MHMDA) و HBNR. HIPAA compliance will only apply to sales to U.S. laboratories — a step not yet undertaken.

Documentation reviewed in July 2026

10Documents in place

3Areas covered

FTC · CCPA/CPRAReference frameworks

Documents available on request

These documents describe our privacy commitments for the U.S. B2C market. Click a document : your email app opens with a pre-filled request addressed to contact@aidiagme.com.

Request the full package

Framework & consumer notices 3 documents

U.S. Privacy Compliance Overview & Applicability (outside HIPAA) FTC · state laws Available Request U.S. Consumer Privacy Notice (CCPA/CPRA) CCPA/CPRA · state laws Available Request Consumer Health Data Privacy Policy (MHMDA) WA My Health My Data Act Available Request

Consumer consent & rights 3 documents

Consent & Authorization Framework (consumer health data) MHMDA · state laws Available Request Consumer Rights Request Procedure CCPA/CPRA · state laws Available Request Health Breach Notification Procedure (FTC HBNR) 16 CFR Part 318 Available Request

Data, vendors & security 4 documents

Data Inventory & Data Protection Assessment State laws (assessments) Available Request Service Provider / Vendor Management CCPA/CPRA · state laws Available Request Data Retention & Deletion Schedule (U.S.) State laws Available Request Reasonable Security Program (U.S.) FTC · state laws · CMIA Available Request

الأسئلة الشائعة

Your data, your rights : frequently asked questions

Do you sell or share my health data?

No. We do not sell your health data and do not share it for any commercial purpose. Under French law, any sale of identifiable health data is prohibited (Art. L.1111-8 of the Public Health Code). Your data is used solely to provide the explanation of your results.

Where is my health data hosted?

In France, by a certified HDS host (Health Data Host), in accordance with Article L.1111-8 of the French Public Health Code. See the HDS Hosting section.

Is AI DiagMe a medical device?

No. In 2025 the ANSM confirmed that AI DiagMe is not a medical device. AI DiagMe provides educational insight and does not replace your doctor’s advice. Learn more.

How do I exercise my rights (access, rectification, erasure)?

Email us at contact@aidiagme.com. We respond as soon as possible, within one month at the latest. You may also contact the CNIL.

Do you use artificial intelligence, and how is it governed?

Yes. Our AI processing complies with Regulation (EU) 2024/1689 (the EU AI Act) : transparency, user information, human oversight and risk management. See the قانون الذكاء الاصطناعي section.

Can I review your compliance documents?

Yes. Our records and policies are available on request, on a case-by-case basis : click a document in the sections above, or email contact@aidiagme.com.

تواصل معنا

A question about your personal data?

You can exercise your rights or ask us about our compliance practices at any time.

Exercise your rights

Access, rectification, erasure, objection, portability : email us at contact@aidiagme.com. We respond as soon as possible, within one month at the latest.

Privacy contact

For any question about the protection of your data or our practices : contact@aidiagme.com.

You may also lodge a complaint with the CNIL.

Publisher & hosting

سمارت ميديكال كير إس إيه إس
37 Avenue Maréchal Foch
06000 Nice, France

Health data hosted in France by a certified HDS host.

Compliance governance. AI DiagMe’s compliance is led by the management of Smart Medical Care SAS. Each framework undergoes a documented gap analysis and regular review ; this page is updated as that work progresses.