GestAI

GDPR overview

Implementation is detailed rather than declarative. The privacy notice (version 2.3, updated 1 July 2026) is drafted under Articles 13-14 GDPR and names 4Mee S.r.l., Via Carrate 42, Solara di Bomporto (MO), VAT 04262930367, Modena Companies Register, REA MO-456230. No DPO is appointed: the company documented an Article 37 assessment and designates an internal privacy officer reachable at privacy@gestai.it. A DPIA under Article 35 covers special-category health data and the use of AI, with an executive summary available to professional users on written request. An Article 28 DPA applies automatically on acceptance of the terms, and a named subprocessor list is published with 30 days' notice before any change. Rights under Articles 15-22 are answered within 30 days, complaints going to the Garante. Article 50 of the EU AI Act is addressed separately.

Who owns the data?

Two roles run in parallel. For the practitioner's own data — identity, billing, technical logs — 4Mee S.r.l. acts as data controller. For patient data the practitioner is the sole controller and 4Mee is a processor under Article 28 GDPR, acting only on instruction and never deciding purposes or means. The terms state that uploaded data remain the property of the user or of the rightful holders, the vendor receiving only a limited licence to run the service. Intellectual property in the platform itself stays with 4Mee. One clause deserves attention: feedback, suggestions and ideas submitted by users are assigned to the vendor free of charge and without limitation.

Reuse rights

Patient data are processed only to deliver the functions the practitioner asks for. Four separate documents — the privacy notice, the terms, the DPA and the subprocessor list — state that these data are never used to train, fine-tune or improve any AI model, whether the vendor's or a third party's, and are never sold, profiled or used for marketing. AI processing runs on Amazon Bedrock and Bedrock Data Automation for transcription, diarisation, summarisation and contextual retrieval. Under Article 22 GDPR no fully automated decision producing legal effects is taken: every AI output is support material that the clinician must review before use. Service improvement relies on aggregated or anonymous data only. Analytics and advertising tools run on the public marketing site alone and never inside the application, and Google Calendar data are excluded from all AI features. The applicable privacy notice is version 2.3, in force since 1 July 2026.

Data retention & training

Hosting summary

Clinical components are hosted inside the EU/EEA. Supabase provides the database, authentication, storage and edge functions from the West Europe (Frankfurt) region, with its legal seat in Singapore and extra-EU transfers covered by the EU Standard Contractual Clauses 2021/914. AWS handles infrastructure and AI processing — Bedrock and Bedrock Data Automation — in configured EU regions such as eu-central-1 Frankfurt, contracted through Amazon Web Services EMEA SARL in Luxembourg. Stripe keeps the EU as primary with a United States operational backup under the EU-US Data Privacy Framework and SCCs. Resend, used for transactional email, hosts in the United States with an EU region described as under evaluation, and handles no health data. Hotjar stays entirely within the EU. Google, Meta and LinkedIn operate on the public marketing site only. The vendor states that no patient health data is transferred outside the EU. Cloud servers carry ISO 27001, 27017 and 27018 certification — the providers' certifications, not 4Mee's. Data are encrypted in transit and at rest, databases are logically isolated per user, backups run daily and security logs are kept for at least twelve months.