GDPR Compliance

Our GDPR Commitment

SHOMA AI Health is designed to support customers in meeting their data protection obligations under applicable privacy laws, including the EU GDPR. This page summarises how we support data-subject rights and data-protection principles.

Zero Retention of Patient Data

SHOMA AI Health does not retain patient or clinical data. Information submitted for report generation is processed temporarily to provide the requested service and is permanently deleted after the report is generated. Patient or clinical data is not stored in our databases or retained for future use.

Important: SHOMA AI Health does not retain patient or clinical data. Clinical information is processed temporarily for report generation and permanently deleted after processing is complete. Account and service-related information, where applicable, may be retained separately as described in our Privacy Policy.

Data-Subject Rights

• Access (Art. 15)

  You can request a copy of the account information we hold about you: your profile details, organisation information, invoices and plan history. Patient and clinical data is not included, as it is permanently deleted after the report is generated and is not stored by us. To make a request, contact support@shoma-ai.com.

• Rectification (Art. 16)

  Some profile details can be edited directly in your account settings. For fields that cannot be edited there, contact us at support@shoma-ai.com and we will correct inaccurate or incomplete data.

• Erasure (Art. 17)

  Delete your account and associated personal data from Settings → Account, subject to legal retention limits.

• Portability (Art. 20)

  Contact us at support@shoma-ai.com to receive a copy of your account data in a structured, commonly used, machine-readable format. This covers account and billing information; patient and clinical data is not included, as it is not stored by us.

• Restriction & Objection (Art. 18/21)

  Restrict or object to certain processing by contacting us.

Roles

For documents you submit for processing, you are typically the data controller and we act as your data processor under a Data Processing Agreement (DPA). Hospitals and clinics remain the data controllers for any data they choose to save locally after receiving the temporary report. For account and billing data, we act as controller as described in our Privacy Policy.

Exercising Your Rights

Use the in-app controls in Settings → Account where available, or contact us via the Contact page. We respond to verified requests within the timeframes required by law.