1. Who we are and how this policy is used
AiMED Voice is a service of the company CEE-MED d.o.o., Zaima Šarca 34, 71000 Sarajevo, Bosnia and Herzegovina, JIB 4210007440005 (hereinafter: we). AiMED Voice is an AI assistant that answers the telephone in place of the staff of a healthcare institution (hereinafter: the Institution) and books, reschedules and cancels appointments. The assistant is an auxiliary tool of the Institution: it does not make diagnoses, does not give medical advice and does not replace a healthcare professional. Questions about data protection: in writing to the address above or by email to privacy@aimed.ba
Our role is not the same towards everyone, so this policy has two parts. Read the one that applies to you.
| Who you are | Who decides about your data | Where to read |
|---|---|---|
| A caller or patient who has called the Institution | The Institution you called (controller). We are the processor and act on its instructions | Part B |
| Staff or a representative of the Institution, a user of the AiMED Voice portal | We (controller of the data on your account and sign-in) | Part A |
| A representative of the Institution or another person who has contacted us with an enquiry or for an offer | We (controller) | Part A |
PART A
For Institutions and portal users | CEE-MED d.o.o. is the controller
A.1. Which data we process as controller, why and for how long
| Data | Purpose | Legal basis (ZZLP) | Retention period |
|---|---|---|---|
| Account of the Institution’s staff: first and last name, email, role in the Institution, time of last sign-in, password (in a form in which it cannot be read), sessions and sign-in record (IP address, device) | Access to the portal and administration of accounts | Article 8 paragraph (1) point f) (our legitimate interest in enabling and securing access to the portal used by the Institution with which we have a contract) | While the person has an account. Revoked account: 30 days from revocation. Deleted member of staff: email and instructions 1 year from deletion. Sessions and sign-in record: 90 days. |
| System emails to staff (invitation, setting of password, notice about the password): email address and one-time link. No patient data whatsoever | Access to the portal | Article 8 paragraph (1) point f) | For as long as that is needed for access to the portal and the security of the account |
| Data on the Institution and contact persons, offers, contracts and invoices | Conclusion and performance of the contract, invoicing | Article 8 paragraph (1) point b) (steps prior to the conclusion of, and performance of, the contract) and point c) (accounting and tax regulations) | For the duration of the contract, and the data from invoices for as long as the regulations require |
| What you yourself send us through the form or by email: name, email, name of the institution, message | Reply to the enquiry and, if you wish, an offer | Article 8 paragraph (1) point b) (steps at your request prior to the conclusion of a contract) | 12 months from the last communication, unless a contract arises from it |
We do not use these data for the advertising of third parties and we do not sell them. We keep the portal activity log as processor for the Institution (see Part B, point B.6); as controller we keep only the records of staff sign-in from the first row of the table.
A.2. To whom the data are passed on
To providers of technical services that process the data for us (hosting of servers and of the database, routing and protection of network traffic, sending of email notices to staff). Each is contractually obliged to apply appropriate protection measures. We also give data to the competent authorities when the law obliges us to do so.
A.3. Where the data are processed
The data from this part are processed predominantly in the European Union. Individual providers of technical services and their subcontractors may also access the data from outside the European Union. Transfer to another country is carried out in accordance with Articles 47 and 48 of the Law on Personal Data Protection (“Official Gazette of BiH”, No. 12/25, hereinafter: the Law), that is, on the basis of an established adequacy of the level of protection or with appropriate safeguards.
A.4. Processing agreement with the Institution
For the data of callers and patients that we process for the Institution, the Data Processing Agreement concluded on the form of the Personal Data Protection Agency in BiH applies. We do not publish the list of sub-processors publicly; it is delivered to the Institution with the agreement and on request. We inform the Institution in writing at least 30 days in advance of our intention to include or replace a sub-processor, and the Institution may object. If a sub-processor ceases to operate or a security incident occurs at it, we may engage a replacement immediately, with notice to the Institution without delay.
A.5. Your rights
You have the right to request access to your data and a copy (Art. 17), rectification (Art. 18), deletion (Art. 19), restriction of processing (Art. 20), portability (Art. 22) and to object to the processing (Art. 23). Send the request to the contact in point 1. We reply without undue delay, and at the latest within 30 days of receipt of the request, with the possibility of extension that the Law provides for, of which we inform you. You also have the right to lodge a complaint with the Personal Data Protection Agency in Bosnia and Herzegovina (azlp.ba) or to bring an action before the competent court.
A.6. Security
The data of each Institution are separated; only authorised persons have access; staff accounts are personal (one account, one person); the main actions in the portal leave a record; traffic to the portal is encrypted. If a breach of the data that we process for the Institution occurs, we inform it at the latest within 48 hours of becoming aware of it. The Institution, as controller, notifies the Personal Data Protection Agency in BiH of the breach within 72 hours of itself becoming aware of it, as prescribed by Article 35 of the Law.
PART B
For callers and patients | the Institution you called is responsible for your data
B.1. Who is responsible for your data
The Institution you called decides why and how your data are processed and is therefore the controller. We are the processor and process them exclusively on the instructions of the Institution. We do not use them for our own purposes, we do not sell them and we do not use them for training models or for improving our service. Send a request concerning your data to the Institution. If you send it to us, we may not act on it independently; instead we forward it to the Institution and inform you of that.
B.2. What happens when you call
-
At the beginning of every call you hear an announcement that the other party to the conversation is an AI assistant, not a person, and that the conversation is being recorded. The announcement cannot be skipped.
-
The assistant helps you with booking an appointment, asks for the reason for your visit and answers questions on the basis of the data that the Institution has given it.
-
The assistant is not a healthcare professional. It does not make a diagnosis, does not interpret findings and does not advise on medicines or therapy. In an emergency, call the emergency medical service number (124). The assistant does not itself carry out an assessment or analysis of your condition. If you yourself state that it is urgent, the assistant will direct you to call the emergency medical service on 124.
-
The call may be forwarded back to the Institution. If the forwarding does not succeed, the assistant tells you that the Institution will call you, and the Institution receives a summary of the call in its portal. Recording stops when the call is forwarded.
B.3. Which data are processed
-
the telephone number you are calling from, first and last name, and, if needed to confirm identity, date of birth;
-
the reason for the call (e.g. booking, rescheduling, cancelling, a question about the price or working hours) and the summary of the call;
-
data on the appointment (date, time, service, doctor);
-
the audio recording of the call and the text of the conversation (transcript);
-
the time, duration and outcome of the call.
The assistant asks for the reason for your visit, so the ailments that you yourself mention may be recorded in the recording, the text of the conversation, the summary of the call and the note attached to the appointment, which are seen by the staff of the Institution. The fact that you are booking an appointment with a healthcare institution is in itself data concerning health (Article 4 point s) of the Law). The note attached to the appointment is kept until the deletion of the appointment or of your data at the Institution. The Service does not process findings, diagnoses or other medical documentation and does not use your voice for recognition (no voiceprint is made). The call is linked to your data in the records of the Institution by the telephone number you are calling from.
B.4. Purpose and legal basis
The purpose is the booking and keeping of appointments and of the records of the practice. The Institution processes your data on the basis of Article 8 paragraph (1) point b) of the Law (steps at your request prior to the conclusion of a contract, in this case booking) and Article 11 paragraph (2) point h) of the Law (management of healthcare services) subject to the condition in Article 11 paragraph (3) (processing under the responsibility of a professional bound by the obligation of professional secrecy). The processing is not based on your consent. That is why we do not ask you to confirm anything, and we do not interpret the continuation of the conversation as consent.
Providing data is not a statutory obligation. Without a name and telephone number the assistant cannot book an appointment; in that case you can call the staff of the Institution directly.
B.5. Who sees your data
The staff of the Institution in its portal and sub-processors, that is, providers of technical services without which the Service does not work (including the telecommunications operator), with a contractual obligation to protect the data; we are responsible for their work. We do not listen to recordings or read transcripts, except when that is necessary for technical support or for remedying a fault in the operation of the service. The Institution can show the full list of sub-processors on request.
If a breach of your data occurs, we inform the Institution at the latest within 48 hours of becoming aware of it. The Institution notifies the Personal Data Protection Agency in BiH of the breach within 72 hours, and you when the Law so prescribes.
B.6. How long the data are kept
| Data item | How long it is kept |
|---|---|
| Audio recording of the call | 30 days from the call, then it is deleted |
| Telephone number, reason for the call, summary and transcript | 6 months from the call, then they are deleted |
| Time, duration and outcome of the call (statistics) | No time limit; it does not contain the content of the conversation |
| Appointment, note attached to the appointment and data about you in the records of the Institution | Until deletion by the Institution. You send the request for deletion to the Institution; deletion removes the appointments and the content and recordings of calls linked to you or your telephone number |
| Portal activity log (record of the actions that concern your data) | 2 years |
| Data in the backup copies of the database | At most 30 days; deletion in the database takes effect on the copies only when they expire |
| All data that we process for the Institution, upon termination of our contract with the Institution | They are returned to the Institution or deleted; deletion is completed within 90 days of termination of the contract. The exception is the portal activity log, which is kept until the 2 years expire |
B.7. Where the data are processed
The data are predominantly processed in the European Union; individual providers of technical services (including the telecommunications operator) have their seat or access outside it. The sub-processors, the processing locations and the transfer mechanisms are listed in the annexes to the Data Processing Agreement, which the Institution makes available for inspection on request. Transfer to another country is carried out in accordance with Articles 47 and 48 of the Law, that is, on the basis of an established adequacy of the level of protection or with appropriate safeguards.
B.8. Your rights
You have the right to request access to your data and a copy, rectification, deletion, restriction of processing, data portability and to object to the processing (Art. 17 to 23 of the Law). Send the request to the Institution you called; we are obliged to help it to reply to you. You also have the right to lodge a complaint with the Personal Data Protection Agency in Bosnia and Herzegovina (azlp.ba) or to bring an action before the competent court.
B.9. Automated decision-making
The assistant does not make decisions about your health or about your right to a service, does not assess you and does not rank you. It books appointments according to the free slots. The assistant does not itself carry out an assessment or analysis of the condition. If you yourself state that it is urgent, it tells you to call the emergency medical service on 124. The Institution sees the summary of the call and may contact you.
B.10. Changes
We publish changes on this page with a new version number and date. If a change materially alters the manner of processing, we inform the Institutions at least 30 days in advance.
Contact: CEE-MED d.o.o., Zaima Šarca 34, 71000 Sarajevo | data protection: privacy@aimed.ba | support and complaints: support@aimed.ba