OASISMEDICA

Closed beta

Start your private health record.

OASIS MEDICA is in closed beta and we’re opening access gradually. Leave your email and we’ll let you know when you can create your account.

We’ll only use your email to tell you about access. No marketing.

Privacy policy

Last updated: 27 October 2026

At OASIS MEDICA, privacy is part of the product. This policy explains what data we process today on this website and in your account, why, and what rights you have. We will update it before processing any other data, your health records in particular, and let you know if anything important changes.

Who is responsible for your data

Luis Hernández Garrido and Maria del Mar Rodríguez Membrive. We are the people behind OASIS MEDICA while the project is at prototype stage.

For any question about your data, write to us at [PENDIENTE: correo de privacidad].

What data we process

  • If you request beta access: your email address, the language you used and the date.
  • If you create an account: your email, your name if you give it, your language, your password (stored only as an encrypted hash, never in plain text), the version of this policy you accepted and when, and your plan.
  • While you use your account: technical session cookies, needed to keep you signed in. They do not require consent and serve no other purpose.
  • If you write to the assistant: your messages and the records shown on screen are sent to the AI provider to generate the reply. We do not store conversations today, and during the beta the records are a sample: do not type real health data until the app asks you to provide it.
  • When you visit the website: technical data, such as your IP address, that our hosting provider logs temporarily to serve the page and protect it from abuse.

We do not use analytics or advertising cookies, nor any third-party tracking tools.

What we use it for

Access requests are only used to tell you when you can join the beta and to manage that access. Your account data is used to give you access, keep you signed in, send you the necessary emails (confirming your email, resetting your password, changing your email) and apply your plan.

We do not use your data for marketing, we do not sell it, we do not share it with third parties for their own purposes, and we do not use it to train artificial intelligence models.

Legal basis

  • Access requests: your consent, given by ticking the box and submitting the form. You can withdraw it at any time, without affecting earlier processing.
  • Account and assistant: providing the service you ask for when you sign up and use it.
  • Technical data: our legitimate interest in keeping the website secure and running.

How long we keep it

Access requests, until we give you beta access or you ask us to delete them, and for no more than 24 months. Your account data, for as long as you keep the account: you can delete it yourself at any time from “Account”, and it is removed immediately with everything linked to it (the provider’s backups are overwritten in their normal cycle). Technical data, for the limited period applied by the hosting provider.

Who else is involved

  • Supabase: database and account management, with servers in Ireland (European Union).
  • Anthropic: the artificial intelligence model that writes the assistant’s replies. It processes messages only to reply and does not use them to train its models. Anthropic PBC is based in the United States; the transfer relies on the EU-US Data Privacy Framework or the European Commission’s standard contractual clauses.
  • Resend: sending your account emails.
  • Vercel: website hosting, with functions in Ireland (European Union). Vercel Inc. is based in the United States; any transfer outside the EU relies on the EU-US Data Privacy Framework or the European Commission’s standard contractual clauses.

We work with providers that process data on our behalf, under a data processing agreement and only to provide their service to us:

How we protect your data

Data is encrypted in transit and at rest. Each account can only read its own data: the database itself enforces it. We ask for your password again before deleting the account or changing the password. The list of access requests can only be viewed by the team running the beta.

Your rights

You can ask us at any time to access, correct, delete, port or restrict the processing of your data, to object to it, and to withdraw your consent. Write to [PENDIENTE: correo de privacidad]; we will reply within one month at the latest.

If you have an account, you can correct your data, download it as a file and delete the account yourself from “Account”, without asking us.

If you believe we have not handled your data properly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

Minors

The beta is intended for adults. If you are under 14, please do not send us your data.

Changes to this policy

We will publish each new version here with its date. If a change affects how we use your data, we will tell you beforehand by email.