Privacy Policy
Last updated: September 1, 2026
This policy explains what personal data meduxa.ai collects, why, who it is shared with, how long it is kept, and what rights you have over it. It is written to meet both the EU General Data Protection Regulation (GDPR) and Israel's Privacy Protection Law, 5741-1981 (including Amendment 13).
The short version: we collect one email address — only if you typed it into the waitlist form, and only to tell you when the pilot opens. No advertising cookies, no cross-site tracking, and nothing is ever sold or shared with advertisers. You can ask us to delete your data at any time at privacy@meduxa.ai.
1. Who is responsible for your data
MeduXa ("we", "us") operates meduxa.ai from Israel and is the controller of the personal data collected through it. For anything privacy-related, including the rights in section 7, write to privacy@meduxa.ai.
2. What we collect and why
This is a marketing site. It has no sign-up, no user accounts and no identifiable medical data. This is everything it collects:
| Data | Purpose | Legal basis |
|---|---|---|
| Email address — only if you submitted the waitlist form. Stored alongside it: the language of the page you signed up from and the time of signup. | To tell you when the pilot opens, and to write to you in the right language. We do not send you other companies' marketing. | Consent — Art. 6(1)(a) GDPR. Giving us your email is voluntary and there is no statutory obligation to provide it; without it we simply cannot notify you. |
| Messages you type into the AI tutor demo at the top of the home page. | To generate the tutor's reply. Messages are sent to our language-model provider and are not stored in any database of ours. | Consent — an action you initiate yourself by sending the message. |
| Your IP address when you use the demo. | Rate limiting (three requests per hour) to prevent abuse of the demo. Held in server memory for at most an hour and never written to a database. | Legitimate interest — Art. 6(1)(f): protecting the service from abuse. |
| Aggregate traffic data — how many visitors reached which page, roughly which country from, and which on-page events occurred (for example, a form submission). | To understand what works on the page. Measurement runs on Vercel Web Analytics, which sets no cookies and creates no persistent visitor identifier, so it cannot track you across sites or identify you. | Legitimate interest — Art. 6(1)(f): aggregate, non-identifying measurement. |
| Operational server logs (IP address, timestamp, requested URL). | Operations, security and debugging. Created and deleted by our hosting provider under its own retention policy. | Legitimate interest — Art. 6(1)(f). |
3. Cookies
This site sets no advertising cookies, no social-network cookies and no tracking cookies of any kind. The only cookie is:
- mx_lang — a functional cookie that remembers whether you were served the Hebrew or the English version, so the language routing returns you to the same one. Lifetime: one year. It holds no personal data and is never sent to a third party. You can delete it at any time in your browser settings.
Because there are no non-essential cookies and no identifier-based measurement, this site has no cookie consent banner — there is nothing to consent to.
4. Who your data is shared with
We do not sell your data, rent it, or hand it to advertisers. It is processed only by these service providers (processors):
- Supabase — stores the waitlist (the email addresses).
- Vercel — hosts the site, keeps operational logs and runs the aggregate traffic measurement.
- Anthropic — processes the messages typed into the tutor demo, solely to generate the reply.
Beyond that, we will disclose data if a court order or the law requires it.
Transfers outside the EEA and Israel
These providers' servers are located primarily in the United States. Transfers rely on the standard transfer mechanisms in those providers' data processing agreements (DPAs), including the European Commission's Standard Contractual Clauses (SCCs).
5. How long we keep it
- Waitlist email address: up to 24 months from signup, or until you ask us to delete it — whichever comes first. Deletion requests are handled within 30 days.
- Tutor demo messages: not stored by us at all; they exist only in your browser tab until you reload the page.
- IP address for rate limiting: at most one hour, in server memory.
- Aggregate traffic data: held by the measurement provider in aggregate form only, with no way to tie it back to you.
6. Security
The waitlist lives in a managed database with restricted access: the public key embedded in the page can only insert a row, and reading the list is blocked at the database's row-level security policy. Traffic to the site and to our providers is encrypted (HTTPS). The site holds no passwords, no payment details and no identifiable medical data. Should a security incident put your data at risk, we will notify you and the authorities as the law requires.
7. Your rights
Under the GDPR and Israel's Privacy Protection Law you have the right to:
- Access — find out what data we hold about you and get a copy of it.
- Rectification — correct data that is wrong or out of date.
- Erasure — ask us to delete your data.
- Restriction and objection — including objecting to processing based on legitimate interest.
- Portability — receive your data in a structured, commonly used format.
- Withdraw consent — at any time. Withdrawal does not affect the lawfulness of processing carried out before it.
To exercise any of these, write to privacy@meduxa.ai. We reply within 30 days. No reason is needed and there is no charge.
Right to complain: if our answer does not satisfy you, you can lodge a complaint with the data protection supervisory authority in your EU country of residence, or with the Israeli Privacy Protection Authority.
8. Children
This service is intended for physicians, residents and medical students. Do not join the waitlist if you are under 16. If we learn that we hold data about someone younger, we will delete it.
9. Changes to this policy
We may update this policy from time to time. The date of the last update appears at the top of this page, and we will email waitlist subscribers about any material change before it takes effect.
10. Contact
Privacy questions, requests and complaints: privacy@meduxa.ai.