Privacy Policy & Health Data Governance

1. Identity of Data Controller & DPO

The Data Controller responsible for your personal information under the General Data Protection Regulation (GDPR) and California Consumer Privacy Act (CCPA) is:

2. Strict Data Minimization & Categories Collected

In accordance with GDPR Article 5(1)(c) ("data minimization"), CARELYNX collects and processes only the information strictly necessary to provide discharge instructions:

• Uploaded Clinical Documents: Discharge summaries, handwritten or digital prescriptions, and post-operative instruction sheets submitted directly by the patient or authorized caregiver.
• Derived Medical Facts: Extracted appointment dates, medication names, dosages, wound care instructions, and emergency warning symptoms.
• Technical Telemetry: Anonymized server logs (IP address hashed with SHA-256, HTTP status codes, browser client user-agent) retained solely for security defense and rate-limiting.

3. Lawful Basis for Processing (GDPR Articles 6 & 9)

Because healthcare paperwork contains special category health data, we process your information under:

• Explicit Consent (GDPR Art. 6(1)(a) & Art. 9(2)(a)): You provide voluntary, informed consent prior to document upload.
• Provision of Health Care Services (GDPR Art. 9(2)(h)): Assisting the navigation and comprehension of legitimate hospital discharge directions.

4. Security Safeguards & Zero-Leakage Architecture

CARELYNX implements defense-in-depth technical and organizational measures aligned with HIPAA Security Rule (45 CFR § 164.312) and ISO/IEC 27001:

• Encryption in Transit & At Rest: All communications enforce TLS 1.3 encryption. Uploaded documents are assigned randomized UUIDv4 storage keys outside public web roots.
• Zero Commercial AI Training: Your clinical paperwork is never stored, scraped, or ingested to train public machine-learning models.
• Audit Logging: All document accesses and clinical review adjudications create tamper-evident audit logs.

5. Your Legal Rights (Access, Deletion, Portability)

Depending on your jurisdiction, you possess the following enforceable data subject rights:

You can exercise your deletion or export rights instantly through our dedicated Data Deletion & Rights Portal.

6. Protection of Minors (COPPA & GDPR Article 8)

CARELYNX does not knowingly allow unsupervised access by children under 18 years of age. If a child's pediatric discharge paperwork is processed, it must be submitted exclusively by a parent or legally recognized guardian. We provide immediate deletion mechanisms upon verification of unauthorized submission.