MediLeaf
MediLeaf is a Swiss SaaS platform that helps pharmacies run their medical cannabis operations: AI-assisted ordering and stock forecasting, prescription handling, patient follow-up, an integrated webshop, and Swissmedic-ready reporting, with all data hosted in Switzerland.
What is MediLeaf?
MediLeaf is a Swiss software-as-a-service platform built for one job: helping pharmacies in Switzerland run their medical cannabis operations. It is published by Médileaf SNC, a general partnership registered in Lausanne, and it addresses no other market. Every function is shaped by cantonal quotas, Swissmedic reporting duties and Swiss narcotics law.
The platform bundles six modules. Order and catalogue management brings products, suppliers and purchase orders into a single dashboard, with AI forecasting demand and adjusting stock levels. Patient insights track purchases, learn preferences and surface personalised recommendations. Automated reporting produces the filings that healthcare providers and regulators expect, so the pharmacy stays audit-ready without compiling anything by hand. An integrated webshop lets patients order around the clock, with prescriptions verified automatically and deliveries tracked in real time. Prescription management stores and handles orders according to Swiss standards and cantonal rules. Patient engagement adds reminders, progress tracking and adherence guidance.
A separate section details the AI itself: automation that learns the pharmacy's patterns, a Voice Context Capture feature that listens to patient conversations and documents the context automatically, predictive analytics for demand and reordering, correlation analysis between products, dosages and patient responses, and recommendations that improve as outcomes accumulate. All of it is said to run on Swiss servers.
On security and compliance, MediLeaf claims AES-256 encryption, TLS 1.3, exclusively Swiss data storage and compliance with both the Swiss Federal Act on Data Protection and the GDPR. Integration with existing Swiss pharmacy software is offered alongside a standalone mode, and a standard rollout is announced at two to three days.
Two things frame how far the product has come. The website is a single marketing page plus three legal pages, with no pricing, product, contact or documentation page of its own; and the published roadmap runs from 2026 to 2027, targeting twenty pharmacies at the outset and one hundred by mid-2027. The company is young, its domain having been registered in July 2025 and its commercial-register entry published that October, though the site never states a founding date of its own. MediLeaf is therefore an early but unusually transparent offering in a tightly regulated niche.
What it does
- Manage cannabis products, suppliers and orders from a single dashboard
- Let AI forecast demand and keep stock levels adjusted automatically
- Store and handle prescriptions to Swiss standards and cantonal rules
- Generate Swissmedic-required regulatory and clinical reports on demand
- Run an integrated webshop with automatic prescription verification and delivery tracking
- Track patient purchases and surface personalised product recommendations
- Send reminders and follow patient adherence over the course of treatment
When to use MediLeaf / When not to
A quick filter to help you decide if MediLeaf is the right fit.
When to use MediLeaf
- Swiss pharmacies that dispense medical cannabis and must prove traceability to cantonal authorities and Swissmedic
- Pharmacy teams losing hours every week to manual order, stock and prescription paperwork
- Pharmacies planning to open an online cannabis shop with automatic prescription checks and delivery tracking
- Officine managers who need audit-ready regulatory reports without compiling them by hand
- Pharmacies that want a guided rollout, with onboarding, staff training and data migration handled for them
When not to use MediLeaf
- Pharmacies outside Switzerland: the whole product is built around cantonal quotas, Swissmedic reporting and Swiss narcotics law
- Prescribing physicians looking for a clinical tool, since the roadmap states the prescriber link is built without creating a tool for doctors
- Buyers who need a published price, because there is no rate card, no free plan and no documented free trial
- Teams that want to sign up and evaluate on their own: both buttons on the site open a contact form, not a product
- Integrators needing an API today, as partner APIs are a Q4 2026 milestone and a limited write API a Q2 2027 one
How to use MediLeaf
A typical end-to-end flow, from setup to results.
- Click 'Try Demo' or 'Contact Us' on the homepage: both open a form rather than a product
- Fill in first and last name, email, pharmacy name, phone number and preferred contact method
- Alternatively, reach the team directly at hello@medileaf.ch or through the WhatsApp link in the footer
- Discuss scope and pricing, since rates are quoted on request and vary with the features chosen and the volume of use
- Choose between connecting MediLeaf to your existing Swiss pharmacy software or running it standalone
- Go through the onboarding programme, which covers staff training and migration of your existing data
- Expect a standard integration of two to three days, with dedicated support during the transition
- Start managing products, suppliers, orders and prescriptions from the dashboard
- Open the integrated webshop so patients can order at any hour with automatic prescription checks
- Pull regulatory and clinical reports whenever cantonal authorities or prescribers ask for them
Pros & Cons
Pros
- Data stored exclusively in Switzerland, stated on the homepage, in the terms and in the privacy policy
- Swiss regulatory compliance treated as a product feature: cantonal quotas, Swissmedic reports and narcotics-law traceability
- A named subprocessor list, Stripe, Supabase and Plausible Analytics, published in full
- Publisher identity fully disclosed, with legal name, address, UID number, a direct link to the commercial register and three named partners
- Concrete security measures rather than slogans, with AES-256 encryption and TLS 1.3
- Short announced rollout of two to three days, including onboarding, staff training and data migration
- Support offered in French, German and Italian, alongside a public roadmap dated through mid-2027
Cons
- No public pricing at all: the terms send buyers to a quote that varies with features and volume
- No free plan and no documented free trial, and 'Try Demo' merely opens a contact form
- No data retention period is published anywhere, although the platform handles health data
- No Data Processing Agreement is offered; the 'DPA' shown on the site means the Swiss Data Protection Act
- No API is available today, partner APIs being a Q4 2026 milestone and a limited write API a Q2 2027 one
- No named customer, reference or testimonial, and the 2026 roadmap still targets twenty-plus pharmacies
- The terms disclaim liability for outages and data loss, and no service-level commitment is published
Pricing & Plans
MediLeaf publishes no prices. The terms state that access to the platform requires a monthly or annual subscription and that rates are communicated on request, varying with the features chosen and the volume of use. No permanent free plan and no free trial are documented. Stripe appears only as the payment processor for patient purchases in the webshop, not as a means of buying the subscription itself. Either party may terminate with thirty days' notice. A prospective buyer therefore cannot budget from the website and must go through the contact form to obtain a quotation.
Data, GDPR & hosting
A consolidated view of how MediLeaf handles your data.
GDPR overview
MediLeaf claims a double regime, the Swiss Federal Act on Data Protection and the European GDPR, stated on the homepage, in the terms and throughout the privacy policy. The measures are named rather than merely asserted: a data protection officer reachable at privacy@medileaf.ch, six enumerated rights (access, rectification, erasure, portability, objection and withdrawal of consent), Swiss-only storage, AES-256 encryption with TLS 1.3, and a published list of subprocessors. Three elements a GDPR-grade policy would normally carry are absent: no legal basis for processing is cited under Article 6, no supervisory authority or right to lodge a complaint is mentioned, and no Article 27 EU representative is designated, which is notable for a Swiss company processing health data while claiming GDPR coverage. The legal pages carry a last-updated date of 1 September 2026.
Who owns the data?
The published documents never state who owns customer or patient data. The privacy policy commits only that MediLeaf never sells personal data, and limits sharing to Stripe, Supabase, Plausible Analytics, technical subcontractors located in Switzerland or the EU, and public authorities where the law requires it. The intellectual-property clauses in the legal notice and the terms run the other way: they protect MediLeaf's own site content and platform, not the pharmacy's records. What customers do get is a named set of rights under Swiss data-protection law and the GDPR, exercised through privacy@medileaf.ch. Ownership itself is simply not addressed anywhere on the site.
Reuse rights
Nothing in the terms or the privacy policy grants the customer a right to reuse, export or redistribute the data held on the platform, and no export or portability feature is described on the product side. The only reuse channel documented is the portability right under Swiss data-protection law and the GDPR, which a data subject exercises by writing to privacy@medileaf.ch: an individual right, not a commercial licence. MediLeaf, for its part, states seven purposes for the data it holds, namely running the platform and the webshop, handling orders and prescriptions, communicating about accounts and orders, ensuring Swiss regulatory compliance, processing payments through Stripe, preventing fraud, and sending marketing messages only with consent. The terms also forbid customers from sharing their access with unauthorised third parties. Any pharmacy planning to reuse its records beyond that should obtain the position in writing before signing.
Data retention & training
Hosting summary
MediLeaf states three times, on the homepage, in the terms and in the privacy policy, that customer data is stored exclusively on servers located in Switzerland, and the homepage adds that the AI processing itself runs on Swiss servers. Hosting and the database are provided by Supabase, configured for Swiss storage in line with the Swiss Federal Act on Data Protection and the GDPR, and the FAQ describes the datacentres as ISO 27001 certified. Data is protected with AES-256 encryption and TLS 1.3. One nuance qualifies the picture: the privacy policy mentions technical subcontractors located in Switzerland or the EU, the only reference to any location beyond the country, and two named subprocessors are foreign services, Stripe for payments and Plausible Analytics for cookieless audience measurement. Note also that the marketing site itself resolves to a United States content-delivery front; that concerns the public website, not the platform holding pharmacy and patient records. The contract is governed by Swiss law, with the courts of Lausanne named as the sole competent forum.
Where MediLeaf works
Country-level availability.
Available in
Things to keep in mind
Risks and trade-offs to weigh before adopting MediLeaf.
- Two names for one company: the legal pages say 'Médileaf SNC' while the footer, the structured data and the meta tags say 'MediLeaf AG'. The commercial register records a general partnership, not a corporation, so check which entity your contract actually names.
- The ISO 27001 badge is not the publisher's own: the FAQ attributes that certification to the datacentres. No certificate number is published, and 'Swissmedic Ready' is marketing wording rather than an authorisation granted by Swissmedic.
- Structured data on the homepage declares an average rating of 4.9 from 24 reviews, yet not a single review appears anywhere on the site.
- Health data, including prescriptions, consumption history and therapeutic follow-up, is processed without any published retention period, while the terms disclaim liability for data loss.
- Nothing states whether customer or patient data is used to train the AI models, and no opt-out is documented, even though machine learning is central to the product.
- Almost everything ambitious is roadmap rather than delivered: the anonymised Swiss dataset, the partner APIs, the 'MediLeaf Compliance Grade' certification and the national-standard status are all announcements.
- Automation that files regulatory reports and verifies prescriptions can quietly encourage staff to stop checking. The pharmacist remains legally accountable for dispensing, and the terms explicitly place product liability on the partner pharmacies.
Setup & Integrations
Technical difficulty
Low for the pharmacy, but nothing happens self-service. There is no sign-up: every route starts with the contact form, and MediLeaf then runs the deployment. Standard integration is announced at two to three days, with a personalised onboarding programme covering staff training, migration of existing data and dedicated support throughout the transition. The pharmacy chooses between connecting MediLeaf to its existing Swiss pharmacy software or running it standalone. No installation documentation is published and no technical skill is asked of the customer. The roadmap lists fully autonomous pharmacy onboarding as a future milestone, confirming that today's process is a guided one.
Deployment
Integrations
Supported languages
Behind MediLeaf
Social
Resources
All the official URLs gathered for verification and reference.
Frequently asked questions
Who is MediLeaf for?
How much does MediLeaf cost?
Where is the data hosted?
Does MediLeaf offer a public API?
How long does the rollout take?
Does it work with my existing pharmacy software?
How long is my data kept?
Who publishes MediLeaf?
What support is available?
Is MediLeaf certified ISO 27001?
Should you pick MediLeaf?
MediLeaf makes an unusually narrow bet: one product, one country, one type of customer. That focus is its main strength. Swiss regulatory compliance is not a footnote here but the substance of the offer, with cantonal quota management, Swissmedic-required reports and narcotics-law traceability described as concrete functions rather than slogans. The commitment to Swiss-only data storage is repeated across three separate documents, the security measures are named rather than implied, and the publisher discloses far more than most companies its size: legal name, address, UID number, a direct link to the commercial register, three named partners and a full list of subprocessors.
What is missing is just as clear. No price is published, no free plan or trial exists, and no customer is named. No retention period is stated for a platform handling prescriptions and consumption history, no Data Processing Agreement is offered, and no API is available today. Almost every ambitious claim, from the anonymised Swiss dataset to partner APIs and national-standard status, sits in a roadmap running to mid-2027. The company is barely a year old, its footer and structured data call it an AG when the register records a general partnership, and its homepage carries an ISO 27001 badge that belongs to its datacentres rather than to itself.
For a Swiss pharmacy already dispensing medical cannabis and drowning in paperwork, MediLeaf is worth a conversation: the problem is real, the regulatory framing is credible and the announced rollout is short. Everything else has to be settled in that conversation, because the website cannot answer it. Ask for the price, the retention terms, the end-of-contract deletion process and a reference pharmacy before signing.
- Choosing a selection results in a full page refresh.
- Opens in a new window.