Clinomic

GDPR overview

GDPR implementation is documented and concrete, at least for the website. The privacy policy, effective 19 August 2022, is written under the GDPR and the German BDSG and spells out the rights of access (Art. 15), rectification, erasure (Art. 17), restriction (Art. 18), portability (Art. 20) and objection (Art. 21), naming LDI Nordrhein-Westfalen in Düsseldorf as the competent supervisory authority. A data protection officer is appointed. On the product side, Elaine is presented as GDPR-compliant, ISO 27001-certified and aligned with the EU AI Act, and mona TeleICU as fully GDPR-compliant through encrypted peer-to-peer connections over VPN; the company also holds ISO 13485 and a BSI C5 certificate for its cloud. As an EU-established publisher, Clinomic needs no Article 27 representative. No published policy covers patient data handled in Mona, and no processing agreement is offered publicly.

Who owns the data?

The privacy policy names Clinomic Medical GmbH, Forckenbeckstraße 66 in Aachen, as the controller, while the imprint identifies the publisher as Clinomic Group GmbH. A data protection officer is reachable at dpo@clinomic.ai, and at datenschutzbeauftragter@clinomic.ai on the business-partner notice. For clinical data, mona OS claims customer sovereignty: an open, documented HL7 FHIR interface to the Clinical Data Repository gives the hospital access to its own data in structured form at no additional cost, and with Elaine the institution decides which sources the AI may read. Note the scope: the published policy covers the website and social media pages only, not patient data processed inside Mona.

Reuse rights

No terms of use are published, so the site sets out no rules on how customers may reuse data. What is documented is website processing. Browser type and version, operating system, referring URL, host name, request time and IP address are collected automatically to deliver content, keep systems secure, fend off attacks and support legal action, on the legitimate interest basis of Article 6(1)(f) GDPR. Contact forms collect a name, email address, subject and timestamp; the Elaine demonstration form adds first name, last name, clinic name and telephone number; job applications arrive by email or through GoHire. Only strictly necessary cookies are set, without consent, under Section 25(2)(2) TTDSG. Clinomic states that it uses no automated decision-making or profiling, and that transfers to third countries, including the United States, rely on standard contractual clauses under Article 46(2)(c) GDPR.

Data retention & training

Hosting summary

Hosting differs by component. Elaine runs, according to the site, on a secured infrastructure hosted in Germany, with data that never leaves that protected environment. The corporate website is hosted by RAIDBOXES GmbH, Friedrich-Ebert-Straße 7, 48153 Münster, engaged as a processor under Article 28 GDPR, and the privacy policy states that processing takes place only within the European Union — while also mentioning transfers to third countries, including the United States, covered by standard contractual clauses. mona HealthCloud is Clinomic's own private cloud for medical devices and patient data, holding a BSI C5 certificate, but the site does not say in which country its data centres sit. Because the HealthCloud is presented as an alternative to on-premise deployment, hosting on the hospital's own infrastructure remains possible. One detail should not be confused with the rest: the web server answering clinomic.ai sits on a Belgian IP address (AS34762, Combell), which describes the website only and says nothing about where clinical data is stored.