Privacy Policy

Version 1, Effective: 1st October 2026

We are ACE Ltd, a company registered in Bulgaria (“MedicDesk.ai”, “we”, “us”, “our”).

This Privacy Policy describes how we collect, use, share, and protect personal data when you visit our website, interact with our online demo tools, or register for and use a MedicDesk.ai Account.

If you are a Patient, or a caller whose data is processed through a clinic’s use of our platform, that processing is carried out by us on that clinic’s instructions, under our Data Processing Addendum (“DPA”), available at /legal/dpa — not under this Policy. See §6 below for the full explanation of this distinction.

1. Scope of this Policy

This Policy applies to:

visitors to our website (medicdesk.ai);
users who engage with our online AI Receptionist demo widget;
individuals who submit contact forms or enquiries, or who communicate with us by email or phone;
individuals who register for, and use, a MedicDesk.ai Account — Providers, Assistants, and Admins at a customer clinic; and
individuals we otherwise correspond with in the course of running MedicDesk.ai (for example, a prospective customer during a sales conversation).

This Policy does not extend to Patient or caller data processed on behalf of our customers through the MedicDesk.ai platform — that is, the audio, transcripts, clinical notes, and Personal Data of Patients and callers that a clinic’s own Providers and staff submit to or generate through the Services in the course of delivering healthcare. That processing is governed by the DPA — see §6.

2. Personal Data We Collect

We collect the following categories of data, depending on how you interact with us.

2.1 Information You Provide Directly

first name and last name;
email address;
business or contact details;
any information submitted via a form on our website;
audio recorded during the website AI demo, and the AI-generated transcript of that demo session (see §4); and
information provided when registering a MedicDesk.ai Account — see §5.

2.2 Automatically Collected Data (“Usage Data”)

IP address;
browser and device type;
pages visited and time spent on them;
technical and diagnostic information; and
cookies and similar tracking technologies (see §7).

3. How and Why We Use Your Data

We process personal data for the purposes below, each supported by a lawful basis under the GDPR.

Purpose	Description	Lawful Basis
Deliver our website and services	To operate, maintain, and make available the website and its online features.	Legitimate interests (running and improving our services)
Respond to enquiries or requests	To reply to incoming messages and manage contact submissions.	Legitimate interests (communicating with users)
Provide the website AI Receptionist demo	To facilitate audio interactions and return responses within the demo environment.	Legitimate interests (offering and evaluating interest in our services)
Enhance the performance and quality of the demo	To diagnose issues, review interactions, and improve the overall demo experience.	Legitimate interests (service improvement)
Create and operate your Account	To register, authenticate, and let you use the Services as a Provider, Assistant, or Admin.	Performance of a contract (the Terms of Use)
Bill and collect payment for a subscription	To process and manage subscription fees for the Services.	Performance of a contract; legal obligation (accounting/tax)
Provide customer support	To respond to Help/Feedback submissions and other support requests from registered users.	Legitimate interests (supporting our customers)
Uphold security and prevent fraudulent activity	To protect the website and Services and identify abusive or harmful behaviour.	Legitimate interests (ensuring platform integrity)
Meet our legal obligations	To satisfy regulatory, tax, or record-keeping requirements as required by law.	Legal obligation

4. AI Demo / Website Widget Call Processing

4.1 What We Collect

When you use our AI demo widget, we process:

your voice/audio;
the AI-generated transcript;
call/session metadata; and
any information you verbally provide.

4.2 How We Use Demo Call Data

We use this data to:

deliver the AI demo functionality;
diagnose performance issues;
improve demo accuracy and responsiveness;
follow up if you request further contact; and
maintain system integrity and prevent misuse.

4.3 AI Output Behaviour

Our AI Receptionist is powered by machine-learning models that may:

misinterpret speech;
generate inaccurate or fabricated responses (“hallucinations”);
incorrectly infer personal information; or
produce synthetic or approximate language outputs.

AI outputs must not be treated as factual.

An AI hallucination alone does not constitute a Personal Data Breach unless it results from a security incident.

4.4 Lawful Basis for Demo Processing

legitimate interests — providing and improving the demo; and
consent — only where you explicitly request follow-up communication or marketing.

4.5 Third-Party Processors Used for the Demo

Demo interactions may be handled by:

AWS (EU — London) — hosting and infrastructure;
Sentry (EU) — error monitoring;
OpenAI Whisper – speech-to-text provider;
Anthropic Claude – clinical reasoning provider;
Resend – email-delivery provider;
Datadog (EU) — performance monitoring; and
ElevenLabs (US) — speech processing and audio storage.

All third-party processors act solely under our instructions and are not permitted to use demo data for their own purposes.

4.6 International Transfers

Where demo data is transferred outside the UK/EU, we apply appropriate safeguards, including:

Standard Contractual Clauses (SCCs);
the UK International Data Transfer Addendum (IDTA); and
additional technical and organisational measures.

4.7 Demo Data Retention

Demo audio and transcripts are retained for 30 days, after which they are permanently deleted. This retention period applies solely to the website demo widget — registered-Account data is retained as described in §5.5, and customer platform data (Patient/caller data) is retained as defined in the DPA.

4.8 Your Rights Regarding Demo Data

You may request:

access to your demo call audio or transcript;
deletion of your data;
correction of transcript inaccuracies;
restriction of, or objection to, processing; and
data portability, where applicable.

To exercise any of these rights, contact us at connect@medicdesk.ai — see also §9.

5. Your MedicDesk.ai Account

If you register for a MedicDesk.ai Account as a Provider, Assistant, or Admin at a customer clinic, we process personal data about you directly, as controller — separately from any Patient or caller data you submit to or generate through the Services while using your Account, which is governed by the DPA (§6).

5.1 What We Collect

your name, email address, and role (Admin, Provider, or Assistant);
your employer/clinic details;
your login credentials and authentication data;
your language and theme preferences;
billing contact details and subscription/plan information, and payment metadata processed by our payment processor (we do not ourselves store full card numbers); and
support and feedback messages you submit through the Services’ Help/Feedback flow.

5.2 How We Use Account Data

We use this data to:

create, authenticate, and operate your Account;
bill and collect payment for your clinic’s subscription;
provide support in response to Help/Feedback submissions;
send Account-related notices (for example, password-reset and setup-link emails);
maintain security, including detecting unauthorized access; and
meet our own legal, accounting, and tax obligations.

5.3 Lawful Basis

performance of a contract — operating your Account and the Services under the Terms of Use;
legal obligation — accounting, tax, and regulatory record-keeping; and
legitimate interests — security, fraud prevention, and responding to support requests.

5.4 Sub-Processors Used for Account Operation

Operating Accounts and billing may involve the following categories of sub-processor, acting solely under our instructions:

AWS (EU — London) — hosting and infrastructure;
Sentry (EU) — error monitoring;
Datadog (EU) — performance monitoring
Stripe – a payment processor to process subscription billing;
Resend – email-delivery provider for Account and transactional email.

5.5 Retention

We retain your Account data for as long as your Account is active. Following termination of the Agreement, we retain it for up to 30 days to allow for data export, after which it is deleted or anonymized, consistent with the Terms of Use — except where a longer period is required by law (for example, billing records for tax purposes).

5.6 Your Rights Regarding Account Data

The rights described in §9 apply equally to your Account data. To exercise them, contact us at info@medicdesk.ai, or, for many of them, directly from your Account’s own Settings page.

6. Patient and Caller Data — Governed by the DPA, Not This Policy

When a clinic uses the Ambient Scriber to record and document a clinical encounter, or the AI Receptionist to answer or place calls, the Personal Data of the Patient or caller involved — including audio, transcripts, clinical notes, and call recordings — is processed by us on that clinic’s behalf and instructions. As between MedicDesk.ai and the clinic, the clinic is the data controller of that Patient/caller data and we are the processor.

Our processing of that data — including retention, security measures, sub-processors, and international transfers — is governed by the DPA, available at /legal/dpa, not by this Privacy Policy. A Patient or caller with a question about how their data is handled should contact the clinic that provided their care, who can in turn contact us.

7. Cookies and Tracking Technologies

We use cookies and similar technologies to:

ensure essential website functions operate correctly;
maintain platform security; and
understand how visitors use our website (subject to your consent for analytics cookies).

Where required by law, we display a cookie consent banner enabling you to accept or decline non-essential cookies. For full details, please refer to our Cookie Policy.

8. Data Retention

How long we retain your data depends on its type:

website form submissions: 12–24 months;
AI demo call data: 30days (§4.7);
MedicDesk.ai Account data: for as long as the Account is active, then up to 30 days for export (§5.5);
technical logs: 30–180 days;
email correspondence: as long as necessary to address your query; and
Patient/caller data processed through the Services: as defined in the DPA (§6), not this Policy.

We will only hold data beyond these periods where required by law or necessary to establish or defend legal claims.

9. Your GDPR Rights

Under the GDPR, you have the right to:

access your personal data;
correct inaccurate or incomplete information;
request erasure of your data (“right to be forgotten”);
restrict or object to processing;
request data portability;
withdraw consent at any time, where processing is consent-based; and
lodge a complaint with a supervisory authority.

We will respond to all rights requests within the timeframes prescribed by the GDPR.

10. International Transfers

Where personal data covered by this Policy is transferred outside the UK/EU — for example, to a sub-processor described in §4.5 or §5.4 — we apply appropriate safeguards, including Standard Contractual Clauses, the UK International Data Transfer Addendum, and additional technical and organisational measures, consistent with §4.6.

11. Security

We implement appropriate technical and organisational measures to safeguard personal data, including:

encryption in transit (TLS);
role-based access controls and multi-factor authentication (MFA);
secure cloud hosting;
logging and monitoring;
vulnerability scanning and dependency monitoring; and
abuse and rate-limit protections.

For detailed security information relating to Patient/caller (customer platform) data, please refer to our DPA.

12. Children’s Data

Our website, demo widget, and Accounts are directed at healthcare professionals and clinic staff, not at children, and we do not knowingly collect personal data about children through them. Personal Data about a Patient who is a child may of course be processed through a clinic’s use of the Services as part of that Patient’s care — that processing is governed by the DPA (§6), under the clinic’s own instructions and legal basis, not by this section.

13. Updates to This Policy

We may revise this Privacy Policy periodically. Where material changes are made, we will update the “Last updated” date and may provide additional notice where appropriate.

14. Contact Us

If you have questions about this Privacy Policy or the way we handle your personal data, please get in touch:

Email: connect@medicdesk.ai