Privacy Policy

The controller for personal data processed by this website and the SaaS audit platform is:

The controller is established in the European Union; no Article 27 representative is required.

2.1 Public assessments and scorecards (anonymous funnel)

2.2 SaaS audit platform — user accounts

2.3 SaaS audit content — high sensitivity

When SaaS customers use the audit platform, the audit content they enter (findings, evidence, non-conformities, corrective actions, names of audited individuals, third-party data referenced in audits) is processed on their behalf. The customer is the controller for that data; DiagnosticMind is the processor. The processing terms are governed by the Data Processing Addendum.

2.4 Special category data (Article 9 GDPR)

No special category data is intentionally collected. If audit content uploaded by SaaS customers includes health, criminal, or other Article 9 data of third parties, the customer (as controller) is responsible for the Article 9 lawful basis. This responsibility is made explicit in the Data Processing Addendum.

Personal data is shared only with the sub-processors below, each engaged under a written agreement that includes confidentiality and security obligations. All transfers outside the EU rely on Standard Contractual Clauses combined with the EU-US Data Privacy Framework.

Anthropic — additional facts. The Standard API tier is used. Inputs and outputs sent to the Anthropic API are not used to train Anthropic's models, per Anthropic's Commercial Terms. Default retention is 30 days for abuse monitoring. Zero Data Retention is available on enterprise request and will be pursued at the first paid SaaS contract that requires it.

Sub-processor change notification. Any change to this list will be notified by email to existing paid customers and updated on the Data Processing Addendum page at least 30 days before the new sub-processor goes live.

Cloudflare, Anthropic, and Resend are US-based providers. All transfers rely on the European Commission's Standard Contractual Clauses (Module 2 — controller to processor) supplemented by the EU-US Data Privacy Framework, where the provider is DPF-certified. Transfer impact assessment material is available to enterprise customers on request.

The EU-US Data Privacy Framework remains valid: the EU General Court upheld it on 3 September 2025 (Latombe v Commission, T-553/23). An appeal to the Court of Justice of the EU is pending (C-703/25 P, filed 31 October 2025). Because the Standard Contractual Clauses are the primary transfer mechanism used here — with the Data Privacy Framework as a supplement rather than a sole reliance — transfers remain lawful independently of the appeal's outcome. Developments are monitored.

This platform does not use third-party advertising cookies, third-party analytics cookies, or any tracking that requires a cookie consent banner. The only analytics is Cloudflare Web Analytics, which is cookieless and aggregates traffic at the edge without storing browser fingerprints.

Functional cookies (or equivalent local storage) are used only by the SaaS audit platform for authentication session continuity. These are strictly necessary for the platform to function and are not subject to consent under ePrivacy Directive Article 5(3) exemption.

Under the GDPR, you have the right to:

• Access your personal data (Art. 15)
• Rectify inaccurate data (Art. 16)
• Erasure — request deletion (Art. 17)
• Restriction of processing (Art. 18)
• Portability of data you provided (Art. 20)
• Object to processing based on legitimate interest (Art. 21)
• Withdraw consent at any time, where processing is based on consent (Art. 7(3))

How to exercise your rights

Send your request to privacy@diagnosticmind.eu. The response time is 30 days from receipt of a valid request, extendable by 60 days for complex requests with notification under Article 12(3).

Identity verification

• If you are a SaaS account holder, send the request from your registered account email.
• If you are not an account holder, a government-issued ID is required to verify the request. The ID is deleted immediately after verification. Verification correspondence is retained for 12 months for audit trail.

Right to lodge a complaint

The lead supervisory authority is the Comissão Nacional de Proteção de Dados (CNPD) in Portugal. You retain the right to lodge a complaint with the CNPD or with your local supervisory authority — cnpd.pt.

The technical and organisational measures protecting personal data are documented on the Security page. Highlights:

• HTTPS enforced with HSTS preload
• Encryption at rest by Cloudflare default for D1, KV, R2
• Passwordless authentication (magic links — no stored passwords)
• 72-hour breach notification to authority and affected customers, per Articles 33 and 34

AI features in the platform are documented in detail on the AI Governance page. Summary relevant to data handling:

• The model used is Claude Sonnet 4.6, accessed via the Anthropic Standard API.
• Inputs and outputs are not used to train Anthropic's models.
• All AI suggestions in the audit platform are reviewable, editable, and final decisions are made by the human lead auditor — never automatically applied.
• Self-classification under the EU AI Act: Limited Risk (Article 50 transparency obligations apply from 2 August 2026; the Digital Omnibus deferral of high-risk obligations does not affect this classification).

This policy is versioned. Material changes — meaning changes that affect lawful basis, retention, sub-processors, or your rights — will be notified by email to existing paid customers at least 30 days in advance and will be reflected in the updated date at the top of this page. Non-material editorial changes (clarifications, typo corrections) are made silently.

For full transparency:

• A formal Data Protection Impact Assessment is committed before the first paid SaaS customer onboards. It is not yet completed because conducting it without active customers operates on hypothetical processing patterns.
• Lawyer-reviewed legal documentation is committed at the first enterprise contract. The current pages are best-effort defensible — accurate, considered, and reflective of operational reality, but not yet externally counsel-reviewed.
• Formal Records of Processing Activities (Article 30) and a documented Legitimate Interest Assessment are committed at the first enterprise contract. The substantive analysis underlying both has been performed; only the formal documentation is deferred.

These residuals are accepted consciously, not concealed.