UK/EU GDPR Compliance Policy

Version 1, Effective: 1st October 2026

1. Introduction

This policy applies to all employees, contractors, and vendors of ACE Ltd. (“MedicDesk.ai”, “we”, “us”, “our”), and to anyone else who has access to personal data of individuals in the United Kingdom (UK) or European Union/European Economic Area (EU/EEA) in connection with MedicDesk.ai’s operating activities.

This policy should be read alongside our wider Privacy Policy. In the event of any contradiction or inconsistency between the Privacy Policy and this policy, this policy governs for individuals covered by the UK General Data Protection Regulation (together with the Data Protection Act 2018, “UK GDPR”) and/or Regulation (EU) 2016/679 (“EU GDPR”), together referred to in this policy as “GDPR” except where the UK/EU distinction specifically matters — see §6.

As part of our service, we provide the MedicDesk.ai platform — the Ambient Scriber and AI Receptionist (together, the “Services”) — to qualified healthcare professionals and the clinics that employ them (“Providers”, “Customers”). In this policy:

• “MedicDesk.ai”, we, our, or us — we mean ACE Ltd and any related bodies corporate.
• “our Services” — we mean the provision of the Ambient Scriber and/or AI Receptionist to you, and related services we provide.
• “you” — we mean you, the reader of this policy.
• “your information” — we mean your personal data.
• “privacy laws” — we mean all privacy and data protection laws that apply to us when we handle your information, including UK GDPR and EU GDPR.

You can get in touch with us at any time about how we handle and safeguard your information — to ask questions, update your information, update or delete your MedicDesk.ai Account, change your preferences, register a concern, opt out of marketing, or anything else. Contact us at connect@medicdesk.ai, or, for registered users, through the Services’ built-in Help/Feedback flow.

2. Background

MedicDesk.ai is committed to protecting the security, confidentiality, and privacy of the personal data it handles — including UK, EU, and EEA personal data — in accordance with UK GDPR and EU GDPR. Personal data is only processed where there is a lawful basis to do so, is managed to maintain its security, confidentiality, and integrity, and is used only for authorized purposes. Everyone at MedicDesk.ai who has access to personal data shares responsibility for safeguarding it.

This policy, and the practices adopted under it, are intended to:

• ensure compliance with UK GDPR, EU GDPR, and MedicDesk.ai’s other regulatory obligations;
• set out the technical, physical, and administrative safeguards we maintain to protect the security, confidentiality, and privacy of personal data; and
• set out the roles and responsibilities necessary for MedicDesk.ai to meet its obligations regarding the processing of personal data under GDPR.

3. What Information Do We Collect?

When you access and use our website, the Services, or otherwise interact with us, we collect and hold categories of personal data as described in our Privacy Policy. The personal data we handle is provided directly by you, for reasons such as:

• you have submitted an enquiry to us;
• you have started or completed a business transaction with us (for example, registering a MedicDesk.ai Account);
• we are delivering the Services to you, or to the clinic you represent;
• you have applied for a position with us;
• you are employed by or collaborate with us;
• you visit our website and agree to our use of cookies; or
• you have filed a complaint with us.

We also obtain personal data indirectly, in these instances:

• when providing the Services to the clinic you work for or represent, and it shares your information with us (for example, when a clinic Admin registers an Account for a Provider or Assistant);
• when your contact details are publicly available on your organization’s website, and we use them to contact you and your organization; or
• when your contact information is accessible via social media platforms, and we use it to contact you and your organization.

4. Why Do We Process Your Information?

Our Privacy Policy sets out the personal data we collect and the lawful basis for processing it in detail. In summary, when we rely on legitimate interests, we apply the following test:

• Purpose — is the purpose of processing the personal data legitimate?
• Necessity — is the processing necessary to achieve that purpose?
• Balance — do the individual’s interests, rights, or freedoms override our legitimate interest?

The collection of personal data via our website serves the following purposes:

• where we provide information about the Services you requested (for example, by email subscription), the lawful basis is consent;
• where we provide related information about an identified area of interest, the lawful basis is legitimate interests; and
• where we enable you to exercise your rights over your personal data, the lawful basis is compliance with a legal obligation.

Where a clinic uses the Services to process a Patient’s health data, we process that data as processor, on the clinic’s documented instructions, under the DPA. Depending on the clinic’s own jurisdiction, this typically relies on:

• Article 6(1)(b)/(f) GDPR — processing necessary for the contract between the clinic and its Patient, or the clinic’s legitimate interest in operating its practice;
• Article 9(2)(h) GDPR — processing necessary for the provision of health or social care, subject to the professional-secrecy safeguards in Article 9(3); and
• Article 9(2)(a) GDPR — the Patient’s explicit consent, where the clinic relies on consent for a particular purpose (for example, recording a consultation).

The clinic, as controller, is responsible for identifying and documenting the correct lawful basis for its own processing of Patient data — see the DPA and §6 (Patient and Caller Data) of our Privacy Policy.

4.1 No Training on Your Data

We may de-identify and/or aggregate personal data to provide certain functionality and improve the Services. We do not use Customer Data to train AI models made available to other customers, except with express, separate consent — see the Terms of Use and Privacy Policy.

4.2 No Automated Decision-Making

MedicDesk.ai does not make a decision about a Patient based solely on automated processing, including profiling, that produces a legal effect or similarly significantly affects them, within the meaning of Article 22 GDPR. Where the AI Receptionist proposes an appointment change, or the Ambient Scriber drafts a clinical note, a human at the clinic reviews and approves it before it takes effect — see the Usage Policy’s “Draft, Not Final” principle.

5. How Long Do We Keep Your Information?

We retain personal data in line with the retention periods described in our Privacy Policy — in summary: raw audio recordings are retained for up to 14 days and then automatically deleted; the resulting clinical note/transcript is retained for up to 7 years, consistent with standard medical-record retention practice; website/demo and MedicDesk.ai Account data are retained as described in the Privacy Policy’s §4, §5, and §8. Patient/caller data processed on a clinic’s behalf is retained as defined in the DPA, which may reflect the clinic’s own, potentially longer, jurisdiction-specific record-keeping obligations.

6. Do We Store or Share Your Information Outside the UK/EU?

We do not disclose your information to third parties for their own direct marketing purposes.

We engage third-party service providers (“sub-processors”) to perform services on our behalf. These sub-processors are bound by data processing terms that restrict them from using your personal data for any purpose other than the ones we specify, and from sharing it with other organizations unless we explicitly instruct them to. They are required to securely store personal data and retain it only for the duration we specify.

6.1 Transfers Outside the UK

Where we transfer personal data outside the UK, we ensure this is done in compliance with UK GDPR and the Data Protection Act 2018, using an appropriate transfer mechanism — such as the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses — and we document our decision-making.

6.2 Transfers Outside the EU/EEA

Where we transfer personal data outside the EU/EEA, we rely on an appropriate transfer mechanism under EU GDPR — such as the European Commission’s Standard Contractual Clauses (SCCs), or an adequacy decision where one applies to the destination — together with any additional technical and organizational measures needed to bring the transfer up to essentially equivalent protection.

6.3 UK GDPR and EU GDPR, Side by Side

7. Roles and Responsibilities

7.1 Policy Adoption

MedicDesk.ai shall, in cooperation with relevant stakeholders, develop and adopt necessary and appropriate GDPR policies and procedures, including the technical, physical, and administrative safeguards required to protect the confidentiality, integrity, and privacy of personal data against reasonably anticipated threats and unauthorized use or disclosure. This policy is one component of that broader set of policies.

7.2 Responsible Person / Data Protection Officer

MedicDesk.ai has designated the following individual as responsible for data protection matters:

Dana Nacheva, Data Protection Officer, dana.nacheva@medicdesk.ai

7.3 Enforcement

The CEO & founder is responsible for enforcement of this policy. Employees with questions about this policy should contact them.

Failure to comply with this policy may result in disciplinary action. All suspected or potential violations, however small, should be reported promptly to the contact in §7.2 or by emailing connect@medicdesk.ai. A report made honestly and in good faith will not result in adverse action against the person who made it.

8. Implementation

8.1 Breach Notification

Where a personal data breach is reasonably likely to result in a risk to the rights and freedoms of individuals, we will notify the relevant supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it, as required by Article 33 GDPR. Where a breach is likely to result in a high risk to individuals, we will also notify the affected individuals without undue delay, as required by Article 34 GDPR — for a breach affecting Patient/caller data processed on a clinic’s behalf, this is coordinated with the clinic as controller, consistent with the DPA.

8.2 Data Subject Access Requests (DSAR)

Subject to the exemptions in §8.6, we will action a request concerning the following rights of the data subject:

• access — a copy of the personal data undergoing processing;
• rectification — correction of inaccurate or incomplete data;
• erasure (“right to be forgotten”);
• restriction of processing;
• notification of any rectification or erasure to others we’ve shared the data with, where feasible;
• data portability — export in a structured, commonly used, machine-readable format; and
• objection to processing, including withdrawal of consent where processing is consent-based.

8.3 Making a Request — Where MedicDesk.ai Is the Controller

For data we control directly — website, demo, and MedicDesk.ai Account data, see §§3–5 of our Privacy Policy — a request can be made by emailing connect@medicdesk.ai, or, for registered users, through the Services’ built-in Help/Feedback flow. Where required, we may ask you to verify your identity (for example, by email verification) before actioning a request. If a request is submitted by an agent on someone else’s behalf, it must identify the data subject.

8.4 Making a Request — Where MedicDesk.ai Is the Processor

For Patient/caller data processed through a clinic’s use of the Services, the request should be made to the clinic, as controller. Where a Patient or caller contacts us directly about their data, we will direct them to the relevant clinic and, where appropriate, assist that clinic in responding — see the DPA.

8.5 Response Timeline

We will acknowledge a request promptly and respond within one calendar month of receipt, as required by Article 12(3) GDPR. Where a request is complex or we have received a number of requests from the same individual, this period may be extended by a further two months; where we do so, we will tell the individual within the first month, together with the reasons for the delay. We keep a record of each request, including the date received, identity verification, the right(s) exercised, and the date of our response.

8.6 Exemptions

We may withhold information requested under a DSAR in accordance with Article 23 GDPR, or an equivalent exemption under the Data Protection Act 2018, where applicable. Any such exemption should be reviewed and approved by the contact in §7.2 before it is applied.

8.7 Fees

We do not charge a fee for a first copy of personal data requested under Article 15 GDPR. Where permitted — for example, for further copies, or a manifestly unfounded or excessive request — we may charge a reasonable fee based on our administrative cost, or, in the case of a manifestly unfounded or excessive request, may refuse to act on it (Article 12(5)).

8.8 Compelled Disclosure

We may receive valid third-party legal demands for personal data — for example, a court order, search warrant, subpoena, or regulatory investigation. On receipt of such a demand, we will notify the contact in §7.2 and assess its validity before responding. We will disclose only the information specifically and validly demanded, not more, and will not act on an overly broad or vague demand. Where the demand concerns Patient/caller data for which a clinic is controller, we will, where legally permitted, involve the clinic before responding — consistent with the DPA. We may notify an affected Customer of a compelled disclosure concerning their data where we are legally permitted to do so, but are not obliged to, and in some cases may be legally prohibited from doing so.

9. Questions or Complaints

If you have a question or complaint about how MedicDesk.ai handles your personal data, contact us at connect@medicdesk.ai. You also have the right to lodge a complaint with a supervisory authority — in the UK, the Information Commissioner’s Office (ico.org.uk); in the EU, the authority in your own member state, or, for MedicDesk.ai’s own lead authority, Bulgaria’s Commission for Personal Data Protection (cpdp.bg).