Log in Start for free

Privacy Policy

Last updated: 14 September 2026.

This is a translation provided for convenience. In case of any discrepancy, the Serbian version prevails.

This Privacy Policy describes how the company RUBISCO DOO (Tax ID (PIB): 113190109, Company ID no.: 21820300, hereinafter: "Rubisco", "we") processes personal data in connection with the MedHistory platform (hereinafter: the "Platform") and this website.

We process personal data in accordance with the Law on Personal Data Protection of the Republic of Serbia ("Official Gazette of the RS", No. 87/2018, hereinafter: the "LPDP").

1. Our roles in data processing

Depending on the type of data, Rubisco acts in one of two different roles:

  • Controller — for the data of visitors to this website and for the user account data of healthcare institutions and doctors who use the Platform (e.g. name, email address, specialty and the staff member's role in the clinic).
  • Processor — for medical records and patient data uploaded to the Platform by a healthcare institution (a clinic or practice) or by a doctor who uses the Platform independently. In that case, the controller of the data is that institution or doctor, and Rubisco processes the data solely on their instructions and on the basis of a data processing agreement, or the Terms of Service.

Patients exercise their rights regarding their medical records primarily with the healthcare institution where they are treated, and we provide the institution with all the support it needs to handle such requests.

2. What data we process

Website visitor data

  • data you provide when you contact us or book a demo (name, email address, name of institution, content of your message);
  • basic technical data necessary for the website to function (IP address, browser type, time of access).

Platform user data

  • account data (first and last name, email address, role in the institution);
  • logs of access and activity on the Platform (for security and access control).

Patient data (processed by us as a processor)

  • medical records uploaded by the institution (discharge summaries, laboratory results, specialist reports and the like);
  • data derived from those records (diagnoses, therapies, results, treatment timeline).

Health data constitutes a special category of personal data within the meaning of Article 17 of the LPDP and is processed with the enhanced safeguards described in this policy.

3. Purposes and legal basis of processing

  • Providing the Platform service — organizing uploaded medical records into a structured medical history for the needs of the healthcare institution. Legal basis: the contract with the institution and the controller's instructions; special categories of data are processed for the purposes of healthcare within the meaning of Article 17, paragraph 2 of the LPDP.
  • Communication — responding to inquiries and scheduling demonstrations. Legal basis: taking steps at the request of the data subject prior to entering into a contract, or legitimate interest.
  • Security — access control, access logging and prevention of misuse. Legal basis: legitimate interest and compliance with legal obligations.

We do not use data for marketing profiling, and we do not sell it or disclose it to third parties for commercial purposes.

4. Automated processing and artificial intelligence

The Platform uses artificial intelligence to organize, link and summarize uploaded medical records. This processing serves solely to support the doctor's work:

  • no automated decisions producing legal effects for the patient are made — medical assessments and decisions are made exclusively by the doctor;
  • every extracted piece of data remains linked to the original document in which it appears, so it can be verified;
  • we do not use patients' medical records to train our own or anyone else's artificial intelligence models.

5. Data recipients and sub-processors

Data may be processed by trusted service providers that we engage as sub-processors (e.g. hosting and infrastructure services, or document processing services), solely on the basis of contracts that bind them to confidentiality and data protection in accordance with the LPDP. A list of sub-processors is available to healthcare institutions on request.

If data is transferred out of the Republic of Serbia, the transfer is made only to countries or under conditions for which the LPDP provides an adequate level of protection, or subject to appropriate safeguards (Article 63 et seq. of the LPDP).

6. Data retention

  • we retain patients' medical records for as long as required by the contract with the healthcare institution; upon termination of the contract, the data is returned to the institution or irreversibly deleted;
  • we retain user account data for the duration of the contractual relationship with the institution;
  • we retain data from inquiries and communications for no longer than one year from the last contact, unless regulations require longer retention.

7. Data security

We apply technical and organizational safeguards, including:

  • encryption of data in transit and at rest;
  • controlled access to records based on user roles and permissions;
  • logging of access to data;
  • isolation of data between healthcare institutions;
  • defined rules for the retention and deletion of records.

In the event of a personal data breach, we act in accordance with Articles 52 and 53 of the LPDP, including notifying the competent authorities and the controller without undue delay.

8. Your rights

In accordance with the LPDP, you have the right to:

  • request access to your personal data;
  • request the correction of inaccurate data and the completion of incomplete data;
  • request the erasure of data;
  • request the restriction of processing;
  • object to processing;
  • request the transfer of your data (data portability);
  • withdraw your consent, where processing is based on consent, without affecting the lawfulness of processing carried out before the withdrawal.

You may submit a request using the contact details at the bottom of this page. If your request concerns medical records, we will refer you to the healthcare institution that is the controller of that data and support it in handling your request.

You also have the right to lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection (Bulevar kralja Aleksandra 15, 11120 Belgrade, www.poverenik.rs).

9. Cookies

This website uses only strictly necessary cookies that enable its basic functionality (e.g. a session cookie). We do not use tracking cookies or third-party marketing cookies.

10. Changes to this policy

We may amend this Privacy Policy from time to time. The current version is always published on this page, with the date of the last update indicated. We will notify Platform users of material changes in a timely manner.

11. Contact

RUBISCO DOO
Tax ID (PIB): 113190109 · Company ID no.: 21820300
Email: [email protected]