← Back to certmd.com

Privacy Policy

Last updated: June 2026

1. Who we are

CertMD is operated by Yeshwanth Seshadri, Berlin, Germany. Contact: info@certmd.com

2. What data we collect

When you use CertMD or book a demo, we may collect the following categories of data:

Account data: name, email address, company name, and job title when you register or book a demo
Document data: medical device technical documentation, QMS procedures, risk management files, clinical evaluations, and other compliance documents you upload for compliance analysis
Usage data: anonymised interaction data via Google Analytics, including page views, feature usage, and session duration
Communication data: emails and messages exchanged with our support team
Connected cloud sources: if you choose to import documents from Microsoft SharePoint/OneDrive, Atlassian Confluence or Google Drive, we store an encrypted access token for that connection and copy only the files you select into your workspace. You can disconnect at any time, which deletes the stored token.

3. How we use your data

We use your data solely for the following purposes:

Providing the CertMD compliance analysis service
Responding to demo requests and support inquiries
Improving and developing our platform based on anonymised usage patterns
Complying with legal obligations (e.g., tax records, data subject requests)

We do not sell your personal data to third parties. We do not use your document data for any purpose other than providing the service you requested.

Your documents are never used to train AI models. Documents uploaded for analysis are processed in isolated sessions and are not retained beyond the active session unless you explicitly save them to your account. They are never used to train, fine-tune, or improve any AI or machine learning model. Prompts and document content are not logged or stored for model improvement purposes.

4. Legal basis for processing (GDPR)

We process your personal data under the following GDPR legal bases:

Contract performance (Art. 6(1)(b)): processing necessary to provide the CertMD service under our Terms of Use
Consent (Art. 6(1)(a)): for optional cookies and analytics tracking
Legitimate interests (Art. 6(1)(f)): for platform security, fraud prevention, and service improvement, where our interests do not override your data protection rights
Legal obligation (Art. 6(1)(c)): where we are required to retain data by applicable law (e.g., tax retention periods)

5. Data storage and security controls

We have implemented the following information security controls aligned with ISO 27001:2022:

Encryption in transit: all data transmitted via TLS 1.3 with strong cipher suites (AES-256-GCM, ECDHE key exchange)
Encryption at rest: all data stored using AES-256 encryption at the storage layer (Google Cloud Platform default encryption)
Access control (A.9): dedicated per-service service accounts with least-privilege IAM roles; no shared keys or static credentials
Network security (A.13): all services run in private VPC with ingress restricted to authenticated requests; no public SSH or RDP access
Logging and monitoring (A.12.4, A.8.15): all IAM policy changes and service account key operations are logged and monitored via Cloud Audit Logs with alerts
Data residency: all infrastructure is hosted in Google Cloud Platform's europe-west4 region (Netherlands). No data leaves the European Economic Area
Vendor security: Google Cloud Platform is certified under ISO 27001, SOC 1/2/3, FedRAMP, and PCI DSS. We maintain a subprocessor register as described below
Incident response: we maintain a documented security incident response process. Notifications to affected parties are made within 72 hours as required by GDPR Art. 33

6. Data retention and deletion

We retain your personal data only as long as necessary to provide the service or comply with legal obligations:

Account data: retained for the duration of your account plus 90 days after account deletion, after which it is permanently deleted
Document data: retained only during active sessions unless explicitly saved; saved documents are retained until you delete them or close your account
Usage analytics: retained in anonymised form for up to 26 months (Google Analytics retention)
Communication data: retained for the duration of the support inquiry plus 12 months

You may request early deletion of any or all of your data at any time (see Section 7).

7. Your rights (GDPR)

Under the EU General Data Protection Regulation, you have the following rights:

Right of access (Art. 15): request a copy of all personal data we hold about you
Right to rectification (Art. 16): request correction of inaccurate or incomplete data
Right to erasure (Art. 17): request deletion of your personal data ("right to be forgotten")
Right to restrict processing (Art. 18): request restriction of how we process your data
Right to data portability (Art. 20): request your data in a structured, machine-readable format
Right to object (Art. 21): object to processing based on legitimate interests or for direct marketing
Right to lodge a complaint (Art. 77): file a complaint with your local data protection supervisory authority

To exercise any of these rights, contact us at info@certmd.com. We will respond within 30 days. If you are a registered user, you can also delete your data directly from within the platform.

8. Subprocessors

CertMD uses the following subprocessors to deliver the service. All subprocessors are contractually bound to process data only on our documented instructions and to maintain equivalent security standards:

Google Cloud Platform (Ireland/Netherlands): cloud infrastructure and AI services (Vertex AI). ISO 27001 certified. Compliance details
Google Firebase (Belgium/us-central1): authentication and database services. SOC 2 certified
Microsoft Bookings (EU): demo scheduling. Data retention per Microsoft's GDPR commitments
Google Analytics (US): anonymised usage analytics. Data is anonymised at collection; IP masking is enabled
Microsoft Graph & Atlassian Cloud: reading the SharePoint/OneDrive and Confluence content you explicitly choose to import, on your behalf

9. Cookies

This website uses minimal cookies. We do not use advertising or tracking cookies beyond basic analytics:

Google Analytics (_ga, _gid): anonymised page view statistics. Retention: 26 months. You can opt out via the Google Analytics opt-out browser add-on
Session cookies: necessary for the operation of the portal.certmd.com application. These are strictly functional and expire when you close your browser

You can disable cookies in your browser settings at any time. Disabling functional cookies may affect the operation of the portal application.

10. Contact and Data Protection Officer

For privacy-related queries, data subject requests, or security concerns:

Email: info@certmd.com
Response time: within 30 days (typically within 7 days)

As a micro-enterprise, we are not required to appoint a formal Data Protection Officer under GDPR Art. 37. Privacy and data protection matters are handled directly by the data controller.