Trust & Security
Privacy
Product-architecture view of data categories for procurement conversations. This page does not replace a counsel-approved privacy policy and does not invent retention periods.
MedicalBot communicates security and governance capabilities based on documented architecture, implementation scope, and verified agreements. Certification or regulatory status is presented only when formally established.
Data classes
Data categories
Do not submit protected health information (PHI) on this website. Categories below describe architecture intent across public and secured planes.
Public marketing content
Feature copy, educational materials, and publicly available product information. No patient data.
B2B contact / lead data
Work email, organisation name, role, and inquiry details submitted for demos or contact — deliberately non-PHI.
Website telemetry
Aggregate usage and conversion events when analytics are configured, subject to cookie and consent settings.
Demo / illustrative data
Synthetic staff, sample scripts, and labeled metrics used only for product education. Not real patient records.
Staff identity & access data (secure app)
Accounts, roles, and session metadata for organisational users when a secured product environment is deployed.
Workflow oversight metadata (secure app)
Approvals, escalations, and configuration changes designed to support auditability under customer policy.
Sensitive clinical / PHI content (secure app only)
Processed only under configured contractual, technical, consent, and governance controls — never as intentional input on the public website or public demo.
Retention
Retention policy matrix
Retention durations are not published as fixed numbers here. Status for each category remains to be defined by contract and configuration.
| Data category | Typical context | Retention status | Notes |
|---|---|---|---|
| Marketing website analytics events | Aggregate page and CTA measurement on the public site | To be contractually/configurationally defined | Subject to cookie/consent configuration when analytics are enabled. |
| B2B lead / demo inquiry records | Work email, organisation, role, and inquiry notes | To be contractually/configurationally defined | Must not include PHI. Retention follows CRM and contractual settings when implemented. |
| Transactional communications metadata | Demo confirmation and non-PHI business messages | To be contractually/configurationally defined | Depends on selected communications providers and customer preferences. |
| Product authentication / session logs (secure app) | Staff and admin access events in a secured product environment | To be contractually/configurationally defined | Applies when the secure application is deployed; not collected on the public marketing site. |
| Workflow audit / oversight records (secure app) | Who approved, escalated, or edited assistive outputs under policy | To be contractually/configurationally defined | Governance artefact for secured environments — contract and configuration dependent. |
| Sensitive clinical / PHI content (secure app only) | Patient-related content processed only under controls | To be contractually/configurationally defined | Not intentional on public website or public demo. Retention, residency, and deletion are customer-contractual. |
For the legal privacy placeholder on this marketing site, see /privacy. For processing boundaries, see data handling.
Counsel-approved privacy policy, DPA language, and jurisdiction-specific notices will be published here following legal review. Contact us for current information.
See MedicalBot in a guided demo
Book a product walkthrough with our team. We discuss architecture, governance patterns, and fit for your organization — without collecting PHI.
Do not submit protected health information (PHI) on this website.