Privacy
A clear summary of how Mediqa collects, uses, protects, and supports requests about personal data across the website, booking flows, and reserved product areas.
This notice applies to personal data processed through mediqa.it, demo requests, account registration, public booking pages, landing-demo calls, and the reserved SaaS workspace.
SCALEADS di Cristian Chiarelli, a sole proprietorship (VAT IT08833050720, Via Leonardo del Turco 4/E, 70128 Palese, Bari, Italy) trading as Mediqa, acts as controller for its website, demo requests, account setup, platform security, billing, commercial communications, and listening to the call recordings the caller said yes to, in order to improve the product and the service. For patient and workspace operations managed for a healthcare customer, the customer acts as controller and Mediqa acts as processor. That relationship is governed by the Article 28 processing agreement accepted by the healthcare organisation. Privacy requests can be sent to info@mediqa.it.
Depending on the flow, Mediqa may process identification and contact data, organization data, account credentials, requested service, selected appointment slot, message or note content, booking references, call metadata, recordings and transcripts of phone calls, clinical records, reports and documents uploaded by the healthcare organisation, patient-portal activity, per-device sessions and second-factor events, consent markers, billing data, integration status, technical logs, audit events, and workspace configuration.
When a healthcare organisation enables the AI phone assistant, calls handled by the assistant, including callbacks after an online form, are transcribed. At the start of every call the assistant says the call will be recorded and transcribed to improve the service and asks for consent to the recording: recording starts only after a yes, stops when the call is passed to a person at the organisation, and is kept for ninety days; it can be listened to by the organisation's owner and managers and by Mediqa staff — on the organisation's behalf to support it, and as an independent controller to improve the product and the service — and every listen is logged; if the caller says no, or gives no clear answer, the call is not recorded. Recordings are not used to train or improve AI models. A caller normally explains why they need an appointment, so a call can contain data concerning health under Article 9 GDPR. The same applies to clinical records, reports, and documents held inside a customer workspace.
You may have reached this page because a clinic or dental practice you contacted uses Mediqa. In that case your controller is that practice: we hold your data on its behalf and follow its instructions. The one exception is the recording of your call, if you said yes to it: to listen to it in order to improve the product and the service, Mediqa is a controller too. What we may hold about you is what you gave the practice — your contact details, your appointments, the call in which you asked for one, and any clinical documents the practice recorded.
Data is processed to answer demo requests, create and protect accounts, provide the SaaS service, manage public bookings, route calls and follow-ups, send operational notifications, sync authorized calendars, process payments, prevent abuse, keep audit evidence, comply with legal obligations, and manage requested commercial contact.
Personal data is kept for the time needed for the relevant purpose and then deleted, anonymized, or retained only where required for security, accounting, legal claims, audit, or contractual obligations. Customer workspace data follows the retention settings and written instructions agreed with the customer.
Depending on the enabled configuration, data may be processed by providers used for hosting, database and authentication, email delivery, telephony and voice AI, transcription of visit audio and assisted drafting of the clinical note, geocoding of practice addresses, calendar synchronization, payments, rate limiting, security, logging, support, and consent-based public-page measurement. Named here are only the services a visitor's own browser contacts from a public page, because those must be identifiable before they load: Calendly (demo booking, embedded on the public home page) and, only after consent, Google Analytics, Google Tag Manager, and Meta Pixel.
Some providers may process data outside the European Economic Area depending on the chosen account, region, or service. Where this happens, Mediqa relies on applicable adequacy decisions, Standard Contractual Clauses, Data Processing Agreements, and supplementary safeguards where required.
Where applicable, individuals may request access, correction, deletion, restriction, portability, objection, or withdrawal of consent by writing to info@mediqa.it. Requests related to a healthcare organization's workspace may be redirected to that organization when it acts as controller. Individuals may also lodge a complaint with the competent supervisory authority.
Mediqa uses access controls, workspace separation, secure session handling, request guards, webhook signature checks where enforced, rate limiting where configured, audit-oriented logs, least-privilege service keys, and operational safeguards designed to protect platform and customer data.
The application uses technical cookies and equivalent local/session storage for language, authentication, security, booking/demo handoff, and reserved-area usability. Optional support for Google Analytics 4, Google Tag Manager, and Meta Pixel is disabled by default, gated by environment configuration and granular consent, and limited to public marketing pages.
A GDPR certification, where pursued, must be issued by an accredited certification body for a defined processing scope. This notice is one accountability document and must be kept aligned with the technical controls, processor agreements, retention schedule, and certification dossier.
