Privacy policy
Last updated: 1 November 2026.
DocTwin.pl processes health data, so we treat privacy as a legal requirement, not a marketing claim. Below we explain who controls your data, why we process it and how long we keep it.
Data controller
The controller of your data is DocTwin.pl, developed by D2 Heart & Health / MGWP Group.
How we process data
A PDF you upload is sent to the DocTwin server, where the AI model (Bielik/Ollama) reads it and the extracted results are stored in a PostgreSQL database. Processing happens server-side, not on your device. We do not sell your data or share it with third parties for marketing purposes.
Purposes and scope
We process account data (name, email), uploaded PDF reports and the extracted lab results to maintain your result history, compute deviations and generate educational AI commentary. We do not use your data to diagnose or treat any condition.
Legal basis
Art. 6(1)(a) GDPR (consent) and Art. 9(2)(a) GDPR (explicit consent to process health data) for lab results and AI commentary; Art. 6(1)(b) GDPR (contract) for running your account. You can withdraw consent at any time.
Retention
We keep your data until you delete your account or ask us to erase it. When the account is deleted, the data is permanently removed from the database.
Your rights
You have the right to access, rectify, erase, restrict or port your data and to object to processing. You can also lodge a complaint with the Polish Data Protection Authority (UODO). Data export (FHIR) and account deletion are available in the app.
Contact
Privacy questions and requests: [email protected] (working address — to be confirmed before production launch).