Privacy Policy

The controller responsible for your personal data is:

• Methos BiOS s.r.o.
• Registered seat: Černého 834/32, Bystrc, 635 00 Brno, Czech Republic
• Company ID (IČO): 24921424
• Registered in the Commercial Register kept by the Regional Court in Brno (Krajský soud v Brně), file ref. C 151197
• Contact: [email protected]

Methos is the controller of the data you store: you are the data subject, and you use Methos to store, organise, and retrieve your own data. Methos does not act as a processor for third-party controllers in respect of your personal use of the service.

We have not appointed a Data Protection Officer, as we are not required to under Article 37 GDPR. Data protection matters can be raised at [email protected].

We process only data you upload or authorise us to import. We do not perform cross-user profiling using your health data.

• Explicit consent — Art. 6(1)(a) and Art. 9(2)(a) GDPR — for all health and biometric data. Consent is freely given, specific, informed, and revocable at any time (see the Data Processing Consent).
• Performance of a contract — Art. 6(1)(b) GDPR — for data strictly necessary to provide the service you requested (e.g. authentication, account management, and billing if you purchase a paid feature).
• Legal obligation — Art. 6(1)(c) GDPR — for records we must keep by law (e.g. accounting records).
• Legitimate interest — Art. 6(1)(f) GDPR — for records we keep to protect our rights and legitimate interests (logs, complaint records).

You can withdraw consent, and reject or terminate the contract, at any time by closing your account, which deletes all of your data (see §9). Withdrawal of consent to the processing of personal data does not affect processing that took place before withdrawal.

We process your data solely to:

• store your uploaded data securely in encrypted form;
• categorise, normalise, and structure it so it can be searched;
• expose your own data back to you through the MCP interface at your request; and
• operate and secure the service, and bill you if you purchase a paid feature.

Your data is not used for marketing, advertising, profiling, or automated decision-making with legal or similarly significant effect. We do not sell, rent, or trade your personal data.

• In transit: TLS 1.3 or higher on all communications.
• At rest: all vault content is stored as Encrypted Envelopes. Encryption is performed on the backend by a dedicated crypto engine using an envelope model — a per-item data-encryption key (DEK) encrypts the content and is itself wrapped by a key-encryption key (KEK) held in HashiCorp Vault. The KEK never leaves Vault.
• Master Password (per-account key in Vault): each account has its own dedicated key created and held exclusively inside HashiCorp Vault (Transit engine). It is never disclosed to you and never accessible to Methos in usable form; Vault uses it internally to derive the KEK that wraps your data-encryption keys and the keys used for pseudonymisation. It is not a user credential and is unrelated to authentication (which is passwordless).
• Event stream: all events carry data only as Encrypted Envelopes; no plaintext personal data is written to the event bus.
• Vector store: holds only vector representations plus minimal non-sensitive metadata (an opaque chunk reference, a profile identifier, and the data category) needed for per-user isolation — no document content or encryption material.
• Time-series metrics are stored under a pseudonymised user ID that is separate from your account identity.
• Access control: zero-trust between components, least privilege, RBAC for administrative access, and audit logging of every access to personal data (GDPR Arts. 15, 30, 32).

AI is used in the ingestion pipeline only for technical functions, none of which interpret your health data or make decisions:

• Categorisation — determines the type of an uploaded item.
• Normalisation and anonymisation — converts a document to structured text and strips direct identifiers. You review and confirm the result before anything is embedded.
• Embedding — converts confirmed, de-identified text into vectors for search.

AI is never used to interpret health values, give recommendations, or make automated health decisions. The MCP interface returns stored records, not AI-generated answers. All AI inference runs through Microsoft Azure AI Foundry in EU regions (see §8–9).

All user data is currently stored and processed on infrastructure physically located in Brno, Czech Republic (EU). AI model inference runs through Azure AI Foundry in EU Azure regions (Sweden), so inference stays within the EU and does not constitute a transfer outside the EU in the normal course of operations, additionally covered by Microsoft's Data Processing Agreement incorporating EU Standard Contractual Clauses.

We do not share personal data with third parties for commercial or analytical purposes. The following processors may receive data under a Data Processing Agreement:

• Vault data is retained for as long as your account exists, or until you delete it or withdraw the relevant consent.
• Account closure. You can close your account at any time. Closing your account deletes all of your data. This is already implemented and available in the service.
• Time-series metrics may be retained and aggregated over time; the policy for very long-term data is under review.
• Audit logs (processing records, consent records, access logs) are retained independently of your data and any paid status, for the period required by applicable law, even after account or data deletion.

You have the right to:

Where a right is exercised through the service's own functionality, please use that path first. You also have the right to lodge a complaint with a supervisory authority — in the Czech Republic, the Office for Personal Data Protection (Úřad pro ochranu osobních údajů, ÚOOÚ), www.uoou.cz.

To exercise any right, contact [email protected].

Methos is a data storage and retrieval infrastructure with no medical purpose. It is not a medical device under EU/US medical software regulations, and the AI functions are assessed as minimal-risk under the EU AI Act. GDPR is the primary regulation that applies.

We may update this Policy. Material changes will be notified in advance through the service or by email. The "Last updated" date reflects the current version.

Privacy matters: [email protected].