GDPR Compliance

Our GDPR Commitments

Data Subject Rights

Under GDPR, data subjects (patients and users) have the following rights, which IdeaDunes fully supports:

• Right to Access (Art. 15): Request a copy of all personal data we process
• Right to Rectification (Art. 16): Correct inaccurate or incomplete data
• Right to Erasure (Art. 17): Request deletion of personal data (subject to legal retention requirements for medical records)
• Right to Data Portability (Art. 20): Export data in machine-readable format (JSON, CSV)
• Right to Object (Art. 21): Object to processing based on legitimate interests
• Right to Restrict Processing (Art. 18): Limit how we process your data

Lawful Basis for Processing

• Contract Performance: Processing necessary to provide the IdeaDunes platform
• Legal Obligation: Healthcare record retention, tax compliance
• Consent: Marketing communications, optional analytics
• Vital Interest: Emergency health situations (Art. 9(2)(c))

Technical & Organizational Measures

• AES-256 encryption at rest, TLS 1.3 in transit
• Role-based access control with principle of least privilege
• Complete audit trail of data access and modifications
• Data pseudonymization and anonymization for analytics
• Regular security assessments and penetration testing
• Employee data protection training
• Documented incident response and breach notification procedures (72-hour notification)

International Data Transfers

For EU/EEA data subjects, we offer EU data residency. When data must be transferred outside the EU (e.g., to our India headquarters for support), we rely on Standard Contractual Clauses (SCCs) as approved by the European Commission.

Data Protection Officer

Sub-Processors

We use the following sub-processors, all of which have been assessed for GDPR adequacy:

We notify customers 30 days before adding a new sub-processor. You may object if the new sub-processor does not meet your data protection requirements.

Data Processing Agreement (DPA)

Related Policies