01Security & privacy
Patient data should be safe.Here is how.
Security is not an add-on. It is the architecture.
BankID sign-in, patient data stored in Norway, AI processing in Medaid's own Azure tenant and automatic deletion. The clinician always approves.
BankID · substantial level
Authentication
Norway
Patient-related storage
EU data zone · transcription global
AI processing
Never on patient data
Model training
02Security architecture
Protection,layer by layer.
Security in Medaid is not one feature. It is several coordinated layers around the core – from infrastructure at the centre to privacy by design at the edge.
Secure infrastructure
Clear purposes and data locations.
Databases, files, search and logs run in Azure Norway East. Notes and assistants run on Azure OpenAI in Medaid’s own Azure tenant in Sweden, within the EU data zone. Transcription runs on global Azure OpenAI capacity and may be processed in another Microsoft region. Video has its data location in Norway.
03The data lifecycle
From consultation to deletion.
Watch one consultation become a controlled clinical note — and follow what remains until the data is deleted.
01 / 08
Consultation
The conversation is underway
The information begins in the encounter.
What happens?
The doctor obtains and confirms consent before recording. Two voices gather into one living Medaid signal.
- ORIGIN
- The clinic
04Controls
Control is a system, not a symbol.
Every safeguard has a clear purpose. Together they limit access, processing time and what can leave Medaid.
No text proceeds to the patient, NAV or the clinical record before the doctor has reviewed and copied it. Diagnosis codes may be suggested, but the doctor selects and approves them.
05Framework
Built for Norwegian healthcare.
Guidance, not an approval scheme.
Medaid follows the supplier guidance in the Norwegian Code and provides material for the clinic’s own assessment. The Code is not a certification or approval scheme.
Clear responsibility
Two roles. One controlled relationship.
THE CLINIC
Data controller
- Own risk assessment
- Clinical responsibility
- Review and approval
MEDAID
Data processor
- Technical processing
- Retention controls
- Supplier management
06Human control
AI creates drafts.The clinician decides.
No text proceeds to the patient, NAV or the clinical record before the doctor has reviewed and copied it.
08Transparency
Who is part of the delivery chain?
Microsoft Azure
Storage, AI and video
Norway · Sweden (EU data zone) · global capacity for transcription
Patient-related data within defined services
Criipto
BankID authentication
EU/EEA
Authentication data
Stripe
Payments
Not stated on the security page
Doctor or clinic customer data · never patient data
Does IT or your privacy officer need documentation?
Request draft DPIA material and answers to technical questions. The DPIA material is draft version 0.4 and has not been reviewed by legal counsel or a data protection officer.
09FAQ
Questions we receive about security
Databases, files, search and logs run in Microsoft Azure Norway East. Notes and assistants run on Azure OpenAI in Medaid’s own Azure tenant in Sweden (the EU data zone). Transcription runs on global Azure OpenAI capacity and may be processed in another Microsoft region. Storage is in Norway only.
Open dialogue
Do you have security questions? We are happy to answer.
For clinic management, IT, privacy officers and healthcare professionals.