Melatech

GDPR overview

GDPR implementation is documented in concrete terms rather than asserted. Melatech ApS names itself controller, gives Trekronergade 126G, 2500 Valby as its address and support@melatech.io as the contact point. The policy, effective 1 January 2026, enumerates the legal bases used, including Article 9(2)(h) for health data, and the full set of data subject rights: access, rectification, erasure, objection and restriction, portability and withdrawal of consent, with a stated 30-day response time and a right to complain to the Danish authority Datatilsynet. Processing of patient data is framed under Article 28 with a Data Processing Agreement. Transfers outside the EEA rely on Standard Contractual Clauses, and Seranote is stated to process exclusively within the EU/EEA. No Data Protection Officer is named, and no Article 27 representative applies since the publisher is EU-established.

Who owns the data?

Ownership is split along GDPR lines. Melatech ApS is the data controller for the data it collects about its own users and website visitors. For patient data submitted through the platform, Melatech acts only as a data processor under Article 28 GDPR, and the terms state plainly that the customer organisation remains the controller. A Data Processing Agreement governs that relationship. Melatech retains intellectual property over the software, algorithms, designs and branding, which customers may not copy, modify, distribute or reverse-engineer without written permission. Clinical content submitted by clinicians therefore stays theirs; the platform around it does not.

Reuse rights

Melatech lists its purposes explicitly: operating and improving the platform, facilitating clinical workflows between primary care and specialists, producing AI documentation through speech-to-text and text-to-note, account communication, legal compliance, and statistical analysis on anonymised or aggregated data. The legal bases cited are contract performance, legitimate interests, legal obligation, consent, and Article 9(2)(h) for health data. Two commitments stand out. Consultations are never used to train AI models, the models being trained on synthetic and internally generated data instead. Audio is not kept at all: each segment is deleted immediately after transcription, and patient names and CPR numbers are pseudonymised before anything reaches the model. Customers reuse their own clinical output freely within their record systems; they acquire no rights over the software itself.

Data retention & training

Hosting summary

Melatech states that its primary data infrastructure is hosted in the European Union. Where data does move outside the EU or EEA, the privacy policy says appropriate safeguards apply, naming Standard Contractual Clauses or equivalent. US enterprise customers are explicitly served from EU-hosted infrastructure under contractual data processing agreements rather than by moving data to the United States. For Seranote the wording is stricter still: all processing happens exclusively within the EU/EEA, with no transfers to third countries. No individual country is named, and no hosting provider is identified, so the commitment is regional rather than specific. The corporate website itself resolves to a server in Paris, France, but that concerns the marketing site and should not be read as the location of clinical data.