GDPR & EU privacy
Privacy notice
Last updated: 2026-10-02
This notice explains how MediEasy (web and mobile app) processes your personal data, as required by Article 13 GDPR. It does not cover the clinical guideline content.
In short: MediEasy stores your account, your favorites, bookmarks and history, and a small activity log. We use them only to run, secure and improve the service — never for advertising, and we do not sell them. You can delete your account at any time in Settings → Account.
Operator status: MediEasy is run by its founders as an unincorporated project; no legal entity has been formed yet. The founders named in section 1 therefore act jointly as controllers (joint controllers within the meaning of Art. 26 GDPR). You can exercise your rights towards each of them, and requests sent to contact@medieasy.be reach all of them. When a legal entity takes over the service, this notice will be updated and registered users informed.
1. Who is responsible (controller)
Controller: Haykel Karoui, Nabil Douss, Mohamed Ali Belaiba. Postal address: 93 rue de bonne, 1080 Molenbeek-Saint-Jean, Belgique. Full details are in the legal notice.
Contact for any privacy question or request: contact@medieasy.be, or the contact form (topic “Data protection request”). We have not appointed a Data Protection Officer (none is required for us).
2. What we process, why, and for how long
| Data | Why, and legal basis | Kept for |
|---|---|---|
| Account — first name, last name, email, password (salted hash only), registration date, email-verification and approval status, and the date and version of the Terms of Use you accepted | Why, and legal basisCreate and manage your account, sign you in, send the verification email, restrict access to approved users and keep proof that you accepted the terms. Art. 6(1)(b); Art. 6(1)(f) for access control and proof (our legitimate interest: keeping the platform limited to its intended audience and secure). | Kept forAs long as your account exists; deleted with it (Settings → Account, or on request). The verification link expires after 24 hours. Accounts never verified or approved are not deleted automatically: an administrator removes them manually when judged necessary. |
| Favorites, bookmarks and history — guidelines you star, outcome cards you bookmark, guidelines you recently viewed (with a view counter) | Why, and legal basisProvide these features to you. Art. 6(1)(b). | Kept forAs long as your account exists. |
| Sign-in — web session cookie; on the mobile app an access token and a refresh token (only a hash of the refresh token is stored on our server) | Why, and legal basisKeep you signed in securely. Art. 6(1)(b). | Kept forWeb cookie up to 30 days; mobile access token 30 minutes, refresh token 30 days. Signing out ends the session; deleting your account removes your tokens. |
| Activity events — your user id, the event type (sign-in and sign-out, guideline or score opened and outcome reached, search length, errors, request timing, page load), the route or screen, a timestamp and coarse technical context (browser or OS family, device type, language, app version). Never the text you type, patient data or precise location; no advertising or third-party analytics. | Why, and legal basisKeep the tool reliable and understand how it is used so that we can improve it. Art. 6(1)(b) for core events (sign-in, guideline access, errors); Art. 6(1)(f) for the rest (same legitimate interest). | Kept for180 days, then deleted. When an account is deleted, remaining events are detached from you (the user reference is cleared). |
| Contact messages — the name, email, topic and message you enter, the page language and, if you are signed in, your account name, email and id | Why, and legal basisAnswer your enquiry. Art. 6(1)(f) (our legitimate interest in answering enquiries) and, where it concerns your account, Art. 6(1)(b). Your IP address is held only briefly in server memory to limit abuse of the form and is not stored. | Kept forNot stored in our application database. Kept as long as needed to answer and follow up, then deleted; copies stay in our project mailbox at our email provider, which also keeps delivery logs for a limited period. |
| Technical logs — request and error logs, including IP addresses, created by our hosting provider when your device connects | Why, and legal basisDeliver the service, keep it secure and prevent abuse. Art. 6(1)(f). We do not store your raw IP address in the activity log. | Kept forA limited period defined by the hosting provider. |
Your name, email address and password are required to create an account; without them we cannot create or approve it. Everything else results from your use of MediEasy.
3. Who receives your data, and where
Your data is not sold or used for advertising. It is accessible to:
- Platform administrators (members of the MediEasy team with the administrator role), to approve accounts, provide support and operate the service.
- Railway Corporation (hosting, processor): the application and its database, region EU West (Netherlands).
- Resend, Inc. (email, processor): sends our verification emails, delivers contact-form messages and receives the emails sent to contact@medieasy.be; account region EU West (Ireland).
- Public authorities, only where the law requires us to disclose data.
Railway Corporation and Resend, Inc. are US companies, so access from there (for example for operations or support) cannot be excluded. Any transfer outside the EU/EEA relies on their EU–US Data Privacy Framework certification and/or the Standard Contractual Clauses (Art. 46 GDPR) in their processing agreements; ask contact@medieasy.be for details.
4. Your rights
You have the right to access, rectify, erase, restrict, object to and port your data (Articles 15 to 21 GDPR). You can exercise them yourself or by asking us:
- Delete your account, or change your password, in Settings → Account.
- For anything else, write to contact@medieasy.be or use the contact form (topic “Data protection request”); we answer within one month.
- You may object at any time to processing based on our legitimate interests; core events needed to run your account cannot be switched off selectively.
- Complaint: Autorité de protection des données / Gegevensbeschermingsautoriteit (APD-GBA), Rue de la Presse 35, 1000 Bruxelles, Belgique, https://www.autoriteprotectiondonnees.be, or the authority of your country of residence.
5. Cookies and local storage
On the web we only set cookies that are strictly necessary or that remember a choice you made: the sign-in session cookie (valid for up to 30 days), a security (CSRF) cookie and a sign-in redirect cookie, the last two deleted when you close your browser, plus a language cookie that remembers the language you chose (kept for up to one year, contains only that choice) and a view cookie that remembers which guideline view you used last (interactive, static or reference; kept for up to one year, contains only that choice). They need no consent, and we use no advertising, analytics or tracking cookies. Your browser's session storage also keeps your last list (with its search) and your position in a guideline so that Back works; it stays on your device and is cleared when you close the tab. The mobile app keeps your tokens, basic profile and language in the device's secure storage; signing out clears it.
Have a question or want to exercise your rights? Use the contact form.