Privacy Policy

Natara — last updated: August 8, 2026

1. Introduction and controller identity

This Privacy Policy explains how Natara ("the App", "we", "the Controller") collects, uses, stores, and protects the personal data of its users — doctors and patients — in accordance with Regulation (EU) 2016/679 (GDPR) and applicable Romanian legislation.

Data controller:

• Company name: GYNESIS MED SRL
• Registration number: 49740575
• Registered office: ROMANIA, BUCHAREST, SECTOR 2, BD. BASARABIA, NR.192-198, BL.A, SC.D, ET.2, AP.129, ZIP CODE: 022128
• Data protection contact: contact@natara.app

2. What data we collect

2.1. Patient data

• Identification data: full name, national ID number, date of birth, phone, email
• Medical data: blood tests and their results, scanned medical documents, blood type, allergies, medical history, pregnancy risk level
• Pregnancy data: last menstrual period date, pregnancy week, estimated due date
• Menstrual log and pregnancy symptom log
• Fetal movement data (kick counter)
• Chat conversations with connected doctor(s)
• Medical appointments

2.2. Doctor data

• Identification data: full name, email, phone
• Professional data: specialty, competencies, clinic/practice
• Billing/subscription data (processed via Stripe — Natara does not store card data directly)

3. Legal basis for processing

• Explicit consent — for health data, requested at registration, withdrawable anytime from Security.
• Contract performance — for the app's core functionality.
• Legitimate interest — for security and fraud prevention.
• Legal obligation — for billing data.

4. Purposes of processing

• Providing the app's services: electronic medical record, appointments, doctor-patient communication
• Automated, AI-assisted interpretation of blood test results (only when actively chosen by the user, per document)
• Processing subscription payments for doctors
• Relevant notifications (appointment reminders, confirmations)
• Account security and unauthorized access prevention

5. Use of artificial intelligence

The App offers an optional feature for automated interpretation of blood test results, activated exclusively by the user's explicit choice (tapping the AI scan button), using an artificial intelligence model (Claude, developed by Anthropic).

The AI-generated result is strictly informational and does not constitute a medical diagnosis. Final interpretation remains solely the responsibility of the treating physician.

6. Who we share data with

6.1. Access within the App

• A patient's primary doctor has access to her full medical record.
• A second doctor may receive shared access, only with the patient's explicit consent.
• The patient can revoke a shared doctor's access at any time. Revocation stops visibility of information added afterward; information that already existed remains accessible to the former doctor, and the chat channel remains active, for continuity of medical care.

6.2. Third-party processors

• Supabase — database, authentication, and file hosting
• Stripe — payment processing
• Resend — transactional emails (Ireland region, EU)
• Anthropic — processing of medical test images, exclusively for users who choose the AI interpretation feature

7. Data retention period

Account data remains active as long as the account is active. Medical data is kept for the duration of the doctor-patient relationship and afterward, in accordance with legal obligations regarding medical record archiving.

When an account is deleted, directly identifying data is anonymized immediately. Medical records remain stored, decoupled from identity, strictly for the legally required period, after which they are permanently deleted. Data with no legal retention requirement is deleted completely, immediately.

8. Your rights

• Right of access to your data
• Right to rectification
• Right to erasure/anonymization — see section 7 for legal limitations applicable to medical data
• Right to restriction of processing
• Right to data portability
• Right to object
• Right to lodge a complaint with the Romanian Data Protection Authority (ANSPDCP)

To exercise any of these rights, contact us at contact@natara.app, or use the options directly in the app: Security → Delete account.

9. Security measures

• Role-based access control, enforced at the database level
• Encrypted communication (HTTPS/TLS) for all data transfers
• Secure authentication, with mandatory email confirmation
• Access to medical files restricted based on verified ownership

10. Children's data

The App is intended for adults. We do not knowingly collect data about minors without the consent of a legal guardian.

11. Changes to this policy

We reserve the right to update this policy. Any significant change will be communicated via in-app notification or email, before it takes effect.

12. Contact

For any question regarding this policy, contact us at contact@natara.app.