Privacy Policy

Effective date: 11 July 2026

Introduction

Welcome to AI DiagMe! Smart Medical Care SAS (“we”, “our”, “us”) is committed to protecting the privacy and security of the personal data of its users (“you”, “your”). AI DiagMe is a trade name of Smart Medical Care SAS. This Privacy Policy explains how we collect, use, share, retain and protect your personal data when you use our website aidiagme.com (the “Site”) and our AI-powered services that help you understand and interpret your laboratory test results (the “Services”). It also informs you of your data protection rights and available remedies. By using our Services, you acknowledge that you have read this policy. The processing of your health data is based on your explicit consent, collected separately.

A strictly informational service. AI DiagMe is an informational and educational service designed to help you understand your test results. It is a complement to — not a substitute for — professional medical care, and it does not provide a diagnosis. AI DiagMe is not a medical device: this has been confirmed by the French National Agency for the Safety of Medicines and Health Products (ANSM — reference GIO 23593272, file 2500297).

1. Data controller and privacy contact

The controller of your personal data is:

  • Company: Smart Medical Care SAS (a simplified joint-stock company / société par actions simplifiée incorporated in France)
  • Registered office: 37 Avenue Maréchal Foch, 06000 Nice, France
  • Trade & Companies Register: RCS Nice 932 924 194
  • Contact email: contact@aidiagme.com

Your privacy contact. For any question about this policy, your personal data or to exercise your rights, contact our privacy officer, Julien P., at contact@aidiagme.com.

Data Protection Officer (DPO). At this stage, Smart Medical Care SAS has not appointed a DPO within the meaning of Articles 37 to 39 of the GDPR, as its activities do not trigger a mandatory appointment. Julien P. acts as the main point of contact for any data protection matter.

Health data hosted in France. Regardless of your location, all health data processed through AI DiagMe is hosted exclusively on Google Cloud servers located in France, certified for Health Data Hosting (Hébergement de Données de Santé — HDS). Your account health data and your reports are not hosted outside the European Union. In accordance with Article L1111-8 of the French Public Health Code, this hosting takes place after you have been informed and unless you object on legitimate grounds; this right can be exercised at contact@aidiagme.com (its exercise may, however, prevent us from providing the service). The only exception, for quality-control purposes: pseudonymised interpretations (no direct identifier on the board; our doctors have no access to our databases and cannot re-identify you) may be reviewed by the doctors of our Scientific & Ethics Committee via Trello (Atlassian), hosted in the United States and covered by a data processing agreement (Standard Contractual Clauses and Data Privacy Framework).

2. Personal data we collect

  • Identification and contact data: name, surname, email address. Your name and surname are used to pseudonymise (de-identify) your report before AI processing; your email is used to send you the generated AI report.
  • Health and context data (special categories): the laboratory test report (blood, urine, stool) you upload as a PDF, and the context information you provide (age, sex, height, weight, personal and family medical history, allergies, lifestyle) to generate a more relevant explanation.
  • Transaction data: information relating to your purchase, processed directly by our payment provider Stripe (we do not store your full card details); your transaction history with us.
  • Technical usage data: how you interact with the Site, collected via Google Analytics subject to your consent (IP address, anonymised where possible, browser type, pages visited, time spent, navigation path).
  • Communication data: any information you provide when contacting our support or giving feedback.

3. How we use your data (purposes and legal bases)

We only process your data where we have an appropriate legal basis under the UK GDPR (and EU GDPR):

  • To provide the AI DiagMe service (analyse your report and generate the AI explanation): your explicit consent for health data (Art. 9(2)(a)), collected via a mandatory checkbox before any processing, and performance of the contract for non-sensitive data (Art. 6(1)(b)).
  • To pseudonymise your report (removing your direct identifiers before AI analysis): performance of the contract (Art. 6(1)(b)), within the processing based on your explicit consent (Art. 9(2)(a)).
  • To send you the generated AI report: performance of the contract (Art. 6(1)(b)).
  • To manage the customer relationship and process payments (via Stripe): performance of the contract (Art. 6(1)(b)).
  • To analyse Site usage and keep it secure (via Google Analytics): your consent for non-essential cookies (Art. 6(1)(a)); our legitimate interest for security (Art. 6(1)(f)).
  • To respond to your requests: performance of the contract (Art. 6(1)(b)) or legitimate interest (Art. 6(1)(f)).
  • To send marketing communications (where applicable): solely on the basis of your specific opt-in consent, requested separately and never presumed (Art. 6(1)(a)).
  • To comply with our legal and regulatory obligations: legal obligation (Art. 6(1)(c)).

Pseudonymisation and AI improvement

Our in-house tool removes your direct identifiers (name and surname) from your PDF report before any AI analysis. This constitutes pseudonymisation within the meaning of Article 4(5) of the UK GDPR: your health data is no longer directly identifying, but remains personal data as long as it can be linked back to you via your email address, which is stored separately. We do not create purportedly anonymous datasets retained indefinitely.

We do not train AI models on your data. We improve the quality of our explanations through a proprietary knowledge base, informed by the review of pseudonymised interpretation reports by the doctors of our Scientific & Ethics Committee, who have no access to our databases and cannot re-identify you. As these reports remain health data, you can object (opt out) to this review at any time by writing to contact@aidiagme.com.

No automated decision-making

The AI interpretation of your results is not a decision based solely on automated processing producing legal effects concerning you or similarly significantly affecting you, within the meaning of Article 22 of the GDPR. The AI DiagMe report is an informational and educational document: it provides no diagnosis and makes no medical decision, and it is intended to be discussed with a healthcare professional. The interpretation is generated by a large language model (Claude, by Anthropic) from your report and context data; you may at any time ask us for clarification, express your point of view and contest the output by writing to contact@aidiagme.com.

Necessity of providing your data

Providing your test report, your context data and your explicit consent is necessary to use the service: without them, we cannot generate your AI report. This is not a statutory or contractual obligation but results solely from your decision; you remain free not to provide them, in which case the service cannot be delivered.

4. Sharing your personal data

We do not sell your personal data. We share it only with the processors strictly necessary to provide the Services, with appropriate safeguards:

  • Hosting: Google Cloud — your health data is hosted on HDS-certified servers located in France.
  • AI infrastructure: OpenRouter, Inc. (United States), which securely interfaces with the AI model (Claude, by Anthropic) to generate your report. Only rigorously pseudonymised data (stripped of your direct identifiers) is transmitted; these providers never have access to your identity and are not permitted to reuse your data, including to train their models.
  • Payment processing: Stripe, Inc. (United States), which securely processes your payments.
  • Transactional email: SendGrid (Twilio Inc.), which temporarily processes your email address and the content of your report strictly for routing and delivery of the AI report.
  • Audience analytics: Google LLC (Google Analytics), subject to your cookie consent.
  • Quality control (Scientific & Ethics Committee): Atlassian, Inc. (Trello, United States) — hosting the board where our committee’s doctors review pseudonymised AI interpretations (no direct identifier) to verify their accuracy. No identifying data, and no laboratory report, is shared with them.

We may also disclose your data to the competent authorities where required by law, or transfer it to an acquiring entity in the event of a merger, acquisition or sale of assets, subject to equivalent confidentiality commitments.

5. International data transfers

Your health data is hosted in France and is not transferred outside the European Economic Area (EEA) for storage. Some of our processors (OpenRouter, Stripe, Google, Twilio, Atlassian) are established or operate in the United States. Where a transfer outside the EEA/UK takes place, we ensure an adequate level of protection through one of the following:

  • The EU–US Data Privacy Framework and its UK extension, for certified companies (Stripe, Google, Twilio, Atlassian).
  • The Standard Contractual Clauses approved by the European Commission (and the UK International Data Transfer Addendum for UK transfers), together with a transfer impact assessment where necessary.
  • Prior pseudonymisation of the data sent to the AI provider, your direct identifiers being removed before any transfer.

6. Data security

We implement appropriate technical and organisational measures to prevent loss, unauthorised access, alteration or disclosure of your data, including:

  • Hosting on HDS-certified servers in France (Google Cloud, certified ISO/IEC 27001 and SOC 2).
  • Pseudonymisation of reports (removal of your direct identifiers) before AI processing.
  • Encryption of data in transit (TLS) and at rest (AES-256).
  • Strict access controls on the principle of least privilege; multi-factor authentication (MFA) is currently being deployed, and access rights are reviewed monthly.
  • Personal data breach management and notification procedures, in accordance with Articles 33 and 34 of the GDPR.

7. Data retention

We keep your data only for as long as necessary for the purposes for which it was collected, including to meet our legal, accounting and reporting obligations:

  • Original test report (PDF): up to 90 days after the AI report is generated and delivered, then securely deleted (data minimisation, Art. 5(1)(c)).
  • Account, contact and context data, and generated AI reports: for the life of the active account, then up to 3 years after deactivation or last interaction, before permanent deletion. Pending the launch of the secure patient portal, this data is linked to your email address and kept for up to 3 years after your last use.
  • Transaction data: kept for 6 years, and up to 10 years for invoices and accounting records from their date of issue, in accordance with the French Commercial Code (Art. L123-22) and applicable tax law.
  • Analytics cookies (Google Analytics): up to 14 months (CNIL recommendation).
  • Consent cookie: up to 6 months (CNIL recommendation).
  • Server logs (IP addresses): up to 90 days (legitimate interest — security).

A request for permanent deletion results in the erasure of all such data, except where we are legally required to retain it (in particular transaction data).

8. Your data protection rights

Under the GDPR (and UK GDPR), you have the following rights: access; rectification; erasure (“right to be forgotten”), subject to our legal obligations; restriction of processing; objection (including to the review of your pseudonymised interpretations by our Scientific & Ethics Committee, via opt-out, and to direct marketing); data portability; and the right to withdraw your consent at any time, without affecting the lawfulness of prior processing.

We respond to your requests within one month, extendable by two months for complex requests, free of charge unless the request is manifestly unfounded or excessive.

Users in the United States. Depending on your state of residence (for example California, under the CCPA/CPRA), you may have the right to know, access, correct and delete your personal data, and to opt out of the “sale” or “sharing” of personal data. We do not sell your personal data. To exercise these rights, contact us at the address below; we will not discriminate against you for exercising them.

How to exercise your rights. Write to contact@aidiagme.com. Once the patient portal (under development) is live, deactivation and permanent deletion options will also be available directly from your online settings.

9. Children and minors

Our Services are not intended for persons under 18. An age confirmation (being at least 18) is required before payment. We do not knowingly collect personal data from minors; where this occurs, we delete it promptly.

10. Cookies

We use strictly necessary cookies (for the Site to function) and analytics cookies (Google Analytics), the latter only with your consent collected via the banner. We do not use advertising cookies. For more information and to manage your preferences, see our Cookie Policy.

11. Changes to this policy

We may update this policy from time to time. The date of the latest update is shown at the top of this page. In the event of a material change, we will inform you by appropriate means.

12. Right to lodge a complaint

If you have concerns about how we handle your data, we encourage you to first contact our privacy officer at contact@aidiagme.com. You also have the right to lodge a complaint with a supervisory authority:

  • France (lead authority): Commission Nationale de l’Informatique et des Libertés (CNIL) — www.cnil.fr
  • United Kingdom: Information Commissioner’s Office (ICO) — www.ico.org.uk
  • Other EEA countries: the data protection authority of your country of residence.