Privacy Policy

The controller of your personal data is:

We act as data processor with respect to the patient data entered by the healthcare professional (controller), and as data controller with respect to the professional’s account data (name, email, subscription data).

Myukura processes the following categories of data depending on the user’s role:

Data is kept only for the time necessary for the purpose for which it was collected:

After the subscription is cancelled, the professional has 6 months to export their data in PDF or JSON format before permanent deletion. Export is available from the Settings → Plan and subscription panel.

Myukura uses the following sub-processors, all with appropriate safeguards under the GDPR:

Myukura’s own infrastructure — authentication, database, storage, processing and deployment — is located in the European Union. The optional integrations with Google, Microsoft and Meta operate under each provider’s own infrastructure and terms; you can review how this data is handled in Optional external integrations.

The contact forms on this website are processed through Web3Forms, a provider that receives and forwards by email the data you enter (name, email address, phone number and message) for the sole purpose of handling your request.

The web analytics of this site are provided by Google Analytics 4 (Google Ireland Limited, as data processor) and are only activated if you accept analytics cookies. It may involve transfers to the United States (Google LLC), covered by the EU–US Data Privacy Framework or, failing that, by standard contractual clauses. No clinical or patient data is used in this analytics.

Patients’ clinical data is not shared with third parties except where expressly required by law.

Myukura lets you voluntarily connect the following external accounts, to facilitate administrative and communication tasks:

Each user connects their own account. The external account is linked to their organisation and their Myukura user. The user can disconnect the integration and revoke the permissions granted at any time from Settings → Integrations.

Depending on the integration activated, Myukura may process the following administrative data:

• —Address or identifier of the external account
• —Visible name of the account
• —Identifiers of calendars, files, messages or conversations
• —OAuth permissions granted and connection status
• —Dates of connection, synchronisation and disconnection
• —Content of emails, events or messages, only when the user views, creates, modifies or sends them from Myukura

External integrations are designed for administrative management and communication. Reading or sending clinical information is not part of the integration’s automatic operation. Myukura maintains a clear separation between the administrative data processed by the integrations and the patient’s clinical data.

As a data subject, you can exercise the following rights at any time by writing to privacidad@myukura.com, stating your name and proving your identity:

You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es if you consider that the processing of your data does not comply with the GDPR.

We apply security measures in line with the state of the art and the level of risk of processing health data:

• ✓Encryption in transit using TLS 1.3 for all communications
• ✓AES-256 encryption at rest for all stored data (storage and database)
• ✓Individual authentication and protection of access to user accounts
• ✓Role-based access control (RBAC) — each professional accesses only their own data
• ✓Row-level security policies in the database
• ✓Automatic deletion of audio after report approval (zero-footprint)
• ✓Immutable audit logs for all actions on clinical data
• ✓Encrypted backups with a maximum retention period of 30 days
• ✓Formal breach notification procedure within ≤72 hours (Art. 33 GDPR)

Without your consent, Myukura’s public website does not install analytics cookies or load third-party scripts. The only cookie we store without asking for consent is a technical language-preference cookie, and only when you choose a language with the selector. If you accept analytics cookies in the banner, we use Google Analytics 4 (Google) to measure how the site is used. We do not use advertising cookies or cross-site tracking cookies.

This is what may be stored on your device:

The local storage item contains no personal information and is not sent to our servers or to third parties. The language cookie does not contain personal information either: it is sent to our server only to show you the site in the language you chose. You can change or withdraw your consent at any time from “Cookie settings” in the footer: when you withdraw it, we stop measuring and delete this site’s analytics cookies. You can also delete this data from your browser settings; if you do, the banner will be shown again.

Access to the application for professionals runs on a separate service, which may use technical identifiers strictly necessary to maintain and protect the session, with no advertising purposes. You can see the detail in our Cookie Policy.

Myukura’s service is intended exclusively for healthcare professionals over 18 years of age. We do not knowingly collect personal data from minors as users of the platform.

With regard to minor patients whose data is entered by the healthcare professional, responsibility for processing and for obtaining the consent of legal representatives lies with the professional, in accordance with Law 41/2002 on patient autonomy.

We may update this Privacy Policy to reflect changes to the service, to applicable law or to our processing practices.

In the event of material changes affecting your rights, we will notify you at least 30 days in advance by email and through a visible notice on the platform. Continued use of the service after that period implies acceptance of the updated version.

The historical version of this policy will always be available on request at privacidad@myukura.com.

For any enquiry about privacy or exercising your rights:

If you do not receive a satisfactory reply within 30 days, you can complain to the Spanish Data Protection Agency (AEPD).