Privacy Policy

Version 1.0 — Effective 20 October 2026

1. Controller

For data about Practitioners (our customers), website visitors and billing contacts, the controller is Bojana Radulović PR Računarsko programiranje Rainbowit Dragon Ledinci (trade name: Rainbowit Dragon), Provalije 24A, Ledinci, Novi Sad, Republic of Serbia, MB 64701100, PIB 110170098. Contact: privacy@ophelionone.com.

For data about Practitioners' clients, the Practitioner is the controller and we act as processor (see DPA). Clients should contact their practitioner first.

2. Data we collect

• Account data: name, email, password hash or Google sign-in identifier, profession, practice details, language, time zone.
• Billing data: plan, subscription status, invoices, country. Card details are handled by Paddle; we never see them.
• Usage data: log-ins, feature use, AI usage counters, device/browser, IP address, error logs.
• Support communications.
• Content you enter about your clients (processed on your behalf – see DPA), which may include health-related data (special category, GDPR Art. 9).

3. Purposes and legal bases (GDPR Art. 6)

Purpose	Legal basis
Providing the service and account	Contract (6(1)(b))
Billing, tax, accounting	Legal obligation (6(1)(c)), contract
Security, fraud prevention, abuse monitoring	Legitimate interest (6(1)(f))
Product emails (service, limits, changes)	Contract / legitimate interest
Marketing emails	Consent (6(1)(a)), withdraw anytime
Analytics cookies	Consent

4. AI processing

Arya, summaries, briefs and transcription use the OpenAI API. Under OpenAI's API data policy, data sent through the API is not used to train OpenAI's models unless the customer opts in (we do not), and may be retained for up to 30 days for abuse monitoring. We send only the data needed for the request. AI outputs are not clinical advice.

5. Recipients / subprocessors

See /subprocessors (Vercel, Supabase, OpenAI, Paddle, Resend, Google sign-in).

6. International transfers

Primary data storage is in the EU (Supabase, Stockholm, Sweden). Some providers (e.g. OpenAI, Vercel) may process data in the USA, under the EU–US Data Privacy Framework and/or Standard Contractual Clauses. Ophelion is operated from Serbia, which the EU has not recognised by an adequacy decision [VERIFY]; transfers are covered by [SCCs / Art. 46 safeguards].

7. Retention

Account data: duration of the account + 30 days. Billing records: as required by tax law (10 years in Serbia [VERIFY]). Logs: up to 90 days. Backups: up to 35 days.

8. Your rights

Access, rectification, erasure, restriction, portability, objection, withdrawal of consent, and complaint to a supervisory authority — in the EU your local authority, in Serbia the Commissioner for Information of Public Importance and Personal Data Protection (www.poverenik.rs). Contact privacy@ophelionone.com; we respond within one month.

9. Security

Encryption in transit (TLS) and at rest, row-level security, access control, least-privilege staff access, logging. Report issues to security@ophelionone.com.

10. Children

Ophelion is for professionals aged 18+. Practitioners working with minors are responsible for obtaining parental/guardian consent.

11. Cookies

See /cookies.

12. Changes

We will notify you of material changes. Laws applied: GDPR (EU 2016/679) and the Serbian Law on Personal Data Protection (Official Gazette RS 87/2018).