At a glance
- 01
Technical capability does not grant a right of access: a purpose, legal basis, role and limited duration are required.
- 02
You manage your consents and permissions; withdrawal ends future access but does not always delete records that must be retained.
- 03
A strong password, checking devices and sharing invitations carefully remain important parts of protection.
Principles that limit processing
BIOS starts with a defined purpose and the minimum data necessary. A new task should not automatically expand an existing permission. Your role, or a doctor's role, determines which views are available, and the specified period limits how long access lasts.
AI should receive only the context needed for a particular task. If the legal basis or data quality is insufficient, it is safer to withhold the result and ask for clarification.
What you can control
In your account, you can view and change the available consent settings, invitations to doctors and active permissions. Withdrawing consent does not affect the lawfulness of processing already carried out, nor does it always mean immediate destruction of records that the data controller must retain by law or to protect legal rights.
Requests for access, correction, restriction or deletion are handled under the applicable rules. A medical document and a record created from it may have different grounds for retention.
How to protect your account
Use a unique password and never forward login codes. Regularly check active devices and security notifications. If you notice an unfamiliar login, end the unrecognised session, change your password and contact support.
Before sharing a link with a doctor, check the recipient and expiry date. Do not post invitations in public channels. On a shared device, sign out and do not save your password in a browser profile that other people can access.
What to do if you suspect an error
If someone else's document, unknown access or an unexpected change appears in your profile, stop working with that data. Record the time and visible event without sharing medical content with others, revoke access if possible, and contact support.