Privacy Notice
How Layon Med collects, uses, and protects personal data — including patient imaging data submitted by healthcare professionals — under the EU General Data Protection Regulation (GDPR) and the Swiss Federal Act on Data Protection (revFADP).
This document is provided in several languages for convenience. In case of any discrepancy, the English version prevails.
LAYONMED DIGITAL S.R.L. is a company registered in Romania. “LayonMed”, “Layon Med”, “we” and “us” in this notice refer to this company.
1. Controller
The controller responsible for processing personal data through this website and in connection with Layon Med's design services is:
- Company Registration Number (CUI)
- 55646387
- Trade Register Number
- J2026056078000
- Share Capital
- 500 RON
- contact@layonmed.com
2. What we collect and why
| Category | Purpose | Lawful basis |
|---|---|---|
| Case submission form for healthcare professionals (name, work email, clinic or hospital, case summary) | Respond to your enquiry; scope and prepare a planning proposal | Art. 6(1)(b) GDPR (steps preceding a contract) / FADP Art. 31(2)(a) |
| Patient consultation request on the For Patients page (name, email, optional phone number, area of interest, your message — which may contain information about your health) | Answer your request and arrange a consultation | Art. 6(1)(b) GDPR; for health information you choose to share, your explicit consent given with the consent box on the form, Art. 9(2)(a) GDPR / FADP Art. 31(1) |
| Chat assistant (your questions and the answers shown) | Answer your question; improve the answers and the website | Art. 6(1)(f) GDPR (legitimate interest in answering and improving our information) / FADP Art. 31(1) |
| Server logs (visitor IP, user-agent, request time) | Operate the site, detect abuse, maintain security | Art. 6(1)(f) GDPR (legitimate interest in IT security) / FADP Art. 31(1) |
| Patient imaging data (DICOM, CT, CBCT, dental scans) and clinical case files — submitted only through a separately arranged secure channel | Design the patient-specific device requested by the prescribing clinician | Art. 9(2)(h) GDPR (provision of healthcare under contract with a healthcare professional) / FADP Art. 31(2)(c) |
| Correspondence (email, written communication) | Operational delivery and after-sales / vigilance follow-up | Art. 6(1)(b) and (f) GDPR / FADP Art. 31(2)(a) |
Medical images are never accepted through the public website forms. We send a secure, per-case upload link after the initial enquiry. Please do not enter health or identifying details into the chat assistant. The treating clinician is responsible for obtaining patient consent before transferring any identifiable imaging data.
3. Where data is processed and stored
- Website and forms: the website is hosted by Netlify, Inc. (USA), which also receives the two website forms and forwards them to us. Medical images are never stored on the website host.
- Patient imaging: images are encrypted in the sender's own browser before upload and sent over a per-case secure link to LayonMed's own receiving service in Switzerland. Only LayonMed's internal systems can decrypt them; case files are then kept on LayonMed's internal design systems under appropriate technical and organisational measures.
- Chat assistant and website analytics: processed on LayonMed's own server in Switzerland. Answers are written by an AI model that runs on that server, so your question is not sent to any external AI provider. Connections to this server are forwarded by Tailscale Inc. (USA) as an encrypted relay: it handles connection data such as your IP address but cannot read the content.
- Fonts: served from this website itself; no font service of a third party is used.
4. Sub-processors
We use the following service providers to run this website and our service:
- Netlify, Inc. (USA) — website hosting and form handling
- Tailscale Inc. (USA) — encrypted connection relay to our own server
- ip-api.com — approximate location lookup, used only if you accept analytics
- Manufacturing partner(s) producing the finished medical device — acting as separate controller and/or processor under their own quality management system
5. International data transfers
Some providers are based outside Switzerland and the EEA (Netlify and Tailscale, USA). For these transfers Layon Med relies on appropriate safeguards under GDPR Chapter V and revFADP, in particular Standard Contractual Clauses and supplementary measures where required. Patient imaging, chat questions and analytics are processed on our own server in Switzerland, which the EU recognises as providing an adequate level of data protection.
6. Retention
- Website server logs: typically 90 days.
- Enquiries that do not become projects: 12 months from the last contact.
- Chat questions and website analytics: 24 months, then deleted.
- Case files of completed projects: retained for the period required by Regulation (EU) 2017/745 Art. 10(8) — at least 10 years from placing the last device on the market, and at least 15 years for implantable devices — and as required by Swiss MedDO.
7. Your rights
Under GDPR and revFADP you have the right to:
- request access to your personal data and information about how it is processed;
- request rectification of inaccurate or incomplete data;
- request erasure ("right to be forgotten") where conditions are met and no legal obligation requires retention;
- request restriction of processing or object to processing;
- request data portability for data you provided to us, where technically feasible;
- withdraw consent at any time, without affecting the lawfulness of prior processing;
- lodge a complaint with a supervisory authority — in particular the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP, www.dataprotection.ro), the Federal Data Protection and Information Commissioner (FDPIC) in Switzerland, or the supervisory authority of your own EU/EEA country.
To exercise your rights, write to contact@layonmed.com with the subject “Privacy”.
8. Patient data — clinician's role
When patient imaging data is submitted, the prescribing clinician (or their institution) acts as data controller for that patient; Layon Med acts as data processor under a Data Processing Agreement signed before any patient data is transferred. The clinician is responsible for obtaining patient consent under the applicable national law before transferring imaging.
When you contact us yourself as a patient through the For Patients page, LAYONMED DIGITAL S.R.L. is the controller of the information you send us.
9. Security
Layon Med applies technical and organisational measures appropriate to the nature of the data and the state of the art, including transport encryption (TLS), access control and authentication, role-based access on internal systems, logical separation of case data, and confidentiality obligations on all personnel and sub-processors. Notwithstanding these measures, no transmission or storage system is entirely free from risk; please report any suspected incident promptly using the contact channel above.
10. Cookies and similar technologies
Under the revised Swiss FADP and the FDPIC's 2025 cookie guidance, Switzerland applies a tiered model: strictly necessary cookies require no consent but must be disclosed; functional cookies may use an opt-out; advertising and profiling technologies require explicit opt-in. The same logic aligns with GDPR and the EU ePrivacy rules.
What this website uses today:
- Strictly necessary (no consent required, disclosed here): a single first-party value,
lm_consent, that records your cookie choice so the notice is not shown again. The chat assistant keeps the conversation in your browser's storage and sets no tracking cookie; what you type is processed as described in section 3. - Advertising / cross-site tracking: none. The website runs no advertising, no third-party ad or social pixels, and no cross-site tracking.
- Analytics (consent required — opt-in via “Accept all”): with your consent, we use privacy-friendly first-party analytics that we host ourselves. It stores a first-party identifier in your browser's local storage and records pages viewed, links and buttons clicked, approximate location (country, region and city), device, browser, language and any questions put to the chat assistant — so we can understand how the site is used and improve it. To estimate the city, your IP address is looked up via a geolocation provider (ip-api.com); we then keep only a truncated IP, never the full one. Apart from that lookup, the data stays on our own infrastructure, is never sold or shared, and is never used for advertising. Choose “Essential only” and no analytics runs.
- Fonts: served from this website; no request goes to a font provider.
A cookie notice is shown on your first visit with an "Accept all" and an "Essential only" choice. You can change your choice at any time via the Cookie settings link in the footer.
11. Changes to this notice
Layon Med may update this notice from time to time. The date of the current version is shown at the end of this page.
12. Contact
For privacy enquiries, write to contact@layonmed.com with the subject “Privacy”.
Last updated: 13 October 2026