Provider: CEE-MED d.o.o., Zaima Šarca 34, 71000 Sarajevo, BiH, JIB 4210007440005
Data protection contact: privacy@aimed.ba | Support: support@aimed.ba
1. WHAT THIS POLICY IS ABOUT
AiMED is an auxiliary tool for healthcare professionals that speeds up the preparation of documentation through voice recognition and the output of text in real time. The User is responsible for the content that it enters into the Service and is obliged to take care not to enter identification data of patients. To the extent that personal data are nevertheless processed, CEE-MED acts exclusively as a processor on the instructions of the User.
This Policy explains which data CEE-MED d.o.o. (hereinafter: CEE-MED) processes when the User (a doctor or a healthcare institution) uses the AiMED Dictate service (hereinafter: the Service), on what basis, how long it retains them and how rights are exercised. The Policy is based on the Law on Personal Data Protection (Zakon o zaštiti ličnih podataka, "Official Gazette of BiH", No. 12/25, hereinafter: the ZZLP).
2. ROLES
2.1. For the content that the User speaks or enters (dictation, transcript, output of the Service), the controller is the User, and CEE-MED is the processor within the meaning of Art. 30 of the ZZLP and acts exclusively on the documented instructions of the User. The processing is governed by the Data Processing Agreement (Annex 2).
2.2. For data on the User Account, sign-in, billing and the security logs of the account, the controller is CEE-MED.
2.3. The User is responsible for the lawfulness of the input, the legal basis for the processing, informing its patients and, in the Conversation mode, for the prior consent of the patient to the recording of the conversation (section 6).
2.4. A User Account is intended for one user (a healthcare professional). Exceptionally, on the basis of an individual offer, one account may be assigned to one workstation of an institution that is used by several staff members (e.g. in shifts). Any other sharing of an account is not permitted. The account data are the name of the user or, in the case of an individual offer, the designation of the workstation (the institution then keeps a record of the persons who use the account).
3. PROCESSING OF CONTENT
Speech and text entered by the User are processed in an automated manner, exclusively for the purpose of producing a text record of the documentation, which the User then verifies and signs. In doing so, CEE-MED uses providers of technical services necessary for the operation of the Service (section 8), under a contractual obligation of data protection; they are not permitted to use the data of the User for training models.
The output of the Service is not stored permanently on the servers of CEE-MED: it remains in the browser of the User and is exported by the User. The exceptions are temporary retention for the purpose of quality control and technical logs of the execution of processing, for no longer than 30 days, described in section 4. The output is automatically generated, may contain errors, omissions and fabricated (hallucinated) content, and the User must verify, correct and sign it before use. The Service does not make diagnoses and does not recommend therapy.
4. WHAT WE RETAIN AND FOR HOW LONG
| Data | Purpose | Retention period |
|---|---|---|
| Speech and text entered by the User | Production of the text record | They are not stored permanently on the systems of CEE-MED, except for the temporary retention in the next row and the technical logs in the last row of the table. |
| Transcript, output of the Service and final text | Quality control and elimination of errors in the operation of the Service, including checking the quality of the output, on the instruction of the User (CEE-MED as processor) | No longer than 30 (thirty) days from creation, after which they are automatically deleted. Only two authorised members of the CEE-MED team have access. Not used for training models, marketing or other purposes. |
| Account data: first and last name (or the designation of the workstation in the case of an individual offer), e-mail, specialty, name of the practice, account settings, own templates, writing style settings, usage counters | Provision of the Service, sign-in, support | For as long as the agreement lasts, and they are deleted no later than 30 days after its end, except for access records, records of completed deletion and data that CEE-MED is obliged to retain by law. |
| Invoicing data (name, address, identification and tax number, invoices and payments) | Issuing invoices, accounting | In accordance with accounting regulations. |
| Technical and security logs (IP address, time of access, browser type, error logs, data on visits to public pages and usage events linked to the account (without dictation content), record of security-relevant actions on the account) | Security, troubleshooting, prevention of misuse | Logs of the hosting platform and of the execution of processing up to 30 days. Record of actions on the account: 2 years from the creation of the record. |
| E-mail about the Service and, with consent, notifications about news | Communication with the User | Until the end of the agreement, or until unsubscription or withdrawal of consent. |
If the User nevertheless enters personal data of patients, including health data, CEE-MED processes them exclusively as a processor and, if they are captured by quality control, deletes them within 30 days.
5. PURPOSES AND LEGAL BASIS
| Processing | Role of CEE-MED | Legal basis |
|---|---|---|
| Dictation content and output of the Service (including quality control) | Processor on the instruction of the User | The basis is determined by the User as controller: Art. 8 para. (1) and Art. 11 para. (2) item h) in conjunction with para. (3) of the ZZLP (provision of healthcare and management of healthcare services, processing under the responsibility of a professional bound by professional secrecy). CEE-MED does not rely on the consent of the patient as a basis for the Service. |
| User Account, sign-in, provision of the Service, support | Controller | Performance of the agreement, Art. 8 para. (1) item b) of the ZZLP |
| Billing and accounting | Controller | Performance of the agreement (item b) and compliance with legal obligations (item c) under Art. 8 para. (1) of the ZZLP |
| Security, technical logs, measurement of visits and usage, prevention of misuse | Controller | Legitimate interest, Art. 8 para. (1) item f) of the ZZLP |
| Notifications about news and marketing communication | Controller | Consent, Art. 8 para. (1) item a) of the ZZLP; it may be withdrawn at any time (Art. 9 para. (3)), by unsubscribing through the link in the message or at privacy@aimed.ba |
Account data are collected from the User and are necessary for the conclusion and performance of the agreement; without them the Service cannot be provided. CEE-MED does not make decisions about the User solely by automated processing that produce legal or similar effects (Art. 24 of the ZZLP). Writing style settings derived from the corrections of the User are kept as a setting of the account of the User until the account is deleted and are used only for its account. Style settings contain rules on the form of writing, not patient data; at the request of the User they are deleted without delay.
6. CONVERSATION MODE
In the Conversation mode, the conversation between the doctor and the patient is recorded. Before using that mode, the User is obliged to inform the patient and to obtain the patient's consent to the recording of the conversation, and to keep proof of the consent. CEE-MED has no contact with the patient, does not obtain the consent and cannot verify that it has been given.
7. RIGHTS AND HOW TO EXERCISE THEM
7.1. In relation to the data for which CEE-MED is the controller (account, billing, logs), you have the right of access (Art. 17), rectification (Art. 18), erasure (Art. 19), restriction of processing (Art. 20), portability (Art. 22) and objection (Art. 23 of the ZZLP). The request is sent to privacy@aimed.ba. We respond without undue delay, and no later than within 30 days of receipt of the request (Art. 14 para. (3)). In order to protect the data, we may request verification of identity.
7.2. If you are a patient and the request concerns dictation content, the controller is the practice or the doctor treating you, so the request is submitted to them. CEE-MED must not act outside the instructions of the controller. The patient addresses requests (access, erasure) to the User, and CEE-MED acts on the instruction of the User without delay. If a request reaches us, we will forward it to the User and assist the User in handling it, including deletion on the instruction of the User. Because of the way the Service works, we cannot independently determine which record belongs to which patient.
7.3. You have the right to lodge a complaint with the Personal Data Protection Agency in Bosnia and Herzegovina (AZLP, azlp.ba), Art. 108 of the ZZLP, without prejudice to other legal remedies.
8. SUB-PROCESSORS
To provide the Service, CEE-MED engages providers of technical services necessary for the operation of the Service (sub-processors), under a contractual obligation to apply appropriate technical and organisational protection measures. The list of sub-processors, with the purpose and location of processing, is an integral part of the Appendix on Sub-processors and Security Measures to the Data Processing Agreement and is not published publicly; it is delivered to the User with that agreement and on request at privacy@aimed.ba. We notify the User of a planned change to the list at least 30 days in advance, with the right to object.
9. DATA TRANSFER
Data are transferred from BiH to other countries only on the written instruction of the User and with appropriate protection measures: for suppliers certified under the EU-US Data Privacy Framework, on the basis of the adequacy of the level of protection established by the European Union (Art. 47 para. (2) of the ZZLP), and in other cases with the safeguards under Art. 48 of the ZZLP, including standard contractual clauses. If the User is established in the EU/EEA, Regulation (EU) 2016/679 applies in addition, and an addendum with the EU standard contractual clauses is concluded alongside the Data Processing Agreement. Sub-processors, locations of processing and transfer mechanisms are listed in the Appendix on Sub-processors and Security Measures, and the list of countries is part of the Data Processing Agreement.
10. SECURITY
We apply technical and organisational measures appropriate to the risk (Art. 34 of the ZZLP), including encryption, access control, a record of actions on the User Account, separation of data by account and a procedure for the event of a data breach. We notify the User of a breach concerning the data of the User without undue delay, and no later than within 48 hours of becoming aware of it; the User as controller notifies the AZLP within 72 hours (Art. 35 of the ZZLP). No system is completely secure; we commit to measures appropriate to the risk, not to invulnerability.
11. COOKIES AND VISIT MEASUREMENT
The signed-in part of the Service uses only cookies necessary for sign-in and the session, for which consent is not required. Display settings and the working version of the report are remembered by your browser locally, on your device. On public pages we use visit measurement without cookies (Google Analytics, PostHog and Vercel Analytics), and in the Service we record usage events linked to the account (e.g. that a dictation was sent, without the dictation content) in order to measure the usage and performance of the Service. We do not use marketing or profiling cookies. If we introduce cookies that require consent, we will update this Policy and request consent before using them.
12. CHILDREN
The Service is intended for healthcare professionals and we do not knowingly collect data of persons under 18 years of age as users. If data of children are found in dictation content, the controller is the User.
13. CHANGES
We notify Users of material changes to the Policy by e-mail or by a notice in the Service at least 30 days in advance. The date and version are stated at the beginning of the document.
14. CONTACT
CEE-MED d.o.o., Zaima Šarca 34, 71000 Sarajevo, Bosnia and Herzegovina. Data protection: privacy@aimed.ba.