Last updated: 14 April 2026
This privacy policy explains how Lakeside Health AG (MedicalDocu) processes personal data in connection with operating the medicaldocu.com platform. It is based on the revised Swiss Federal Act on Data Protection (revFADP) and, where applicable, the EU General Data Protection Regulation (GDPR).
The entity responsible for processing your personal data is:
Lakeside Health AG
Hauptstrasse 39, CH-8280 Kreuzlingen
Data Protection Officer: Jonas Frangenheim
Contact: info@medicaldocu.com
This policy applies to all processing of personal data in connection with the use of the MedicalDocu platform, the medicaldocu.com website and associated services.
Linked third-party offerings are governed by their own privacy statements.
We process personal data to provide the following services:
• Operation of the platform, in particular the creation of medical letters, reports and other medical documents.
• Speech-to-text transcription of audio recordings to support your documentation workflow.
• Account and practice administration, authentication, billing and support.
• Protection of the platform (abuse and attack detection) and compliance with legal obligations.
• Account and master data: name, email, title, role, practice affiliation.
• Usage data: log data, IP address, timestamps, device information, features accessed.
• Content data: text, templates, notes and audio recordings you enter or upload.
• Patient-related content: health data contained in documents that you, as a medical professional, enter while observing your professional duty of confidentiality.
• Billing data: address, company details and payment information as required for contract performance.
We process data based on contract performance (Art. 31 para. 2 lit. a revFADP and Art. 6(1)(b) GDPR), our legitimate interests in secure and efficient operation (Art. 31 para. 1 revFADP and Art. 6(1)(f) GDPR) and, where required, your explicit consent (Art. 6 para. 7 revFADP and Art. 6(1)(a) GDPR).
Processing of particularly sensitive personal data (in particular health data) takes place to the extent necessary for the fulfilment of your professional documentation obligations.
Responsibility for obtaining any patient consents remains with the medical professional using the platform.
The content data you provide, including patient-related documents and audio recordings, is stored on servers located in Switzerland (Zurich region).
Database, authentication and file storage are provided by Supabase Inc., with the storage location restricted to Switzerland.
Data is encrypted in transit (TLS) and at rest.
We use carefully selected sub-processors who are contractually bound to data protection and confidentiality:
• Supabase Inc. (USA/Switzerland): database, authentication and storage infrastructure; content data is hosted in the Zurich region.
• Vercel Inc. (USA/EU): hosting of the application frontends and edge functions in EU regions.
• Google Cloud (EU): Vertex AI for text generation and Cloud Speech-to-Text for transcription of audio recordings, operated in European data centres.
Where data is disclosed to countries outside Switzerland or the EEA, we rely on the European Commission's Standard Contractual Clauses together with the Swiss supplements recognised by the FDPIC, as well as further appropriate safeguards.
Detailed information on the specific safeguards can be requested from us.
Account and master data are retained for the duration of the contractual relationship and beyond for as long as required by law (e.g. commercial and tax retention obligations).
Content data (documents, transcripts, audio recordings) is retained according to the settings you choose within the application and deleted upon request.
Log data is generally deleted or anonymised within 90 days.
You have the right to access, rectification, erasure, restriction of processing and – within the scope of the GDPR – data portability and objection.
You may withdraw any consent you have given at any time with effect for the future.
To exercise your rights, an informal message to info@medicaldocu.com is sufficient.
You also have the right to lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC) or the EU supervisory authority responsible for you.
We take appropriate technical and organisational measures to protect personal data against unauthorised access, loss and misuse.
These include encryption in transit and at rest, multi-factor authentication for administrative access, row-level security at the database layer and a strict least-privilege principle.
Access is logged and reviewed regularly.
We use only strictly necessary cookies, in particular for managing the login session and securing the platform.
We do not use analytics or advertising cookies.
For aggregate, privacy-friendly usage statistics on our public website we use Vercel Web Analytics, a cookieless service that stores no information on your device and does not collect personal data.
We may amend this privacy policy where necessary, in particular to reflect changes in legal requirements or our services.
The current version is always available on this page; the last-updated date above is authoritative.
For any questions regarding data protection, please contact: info@medicaldocu.com