This page is published in English as the authoritative version. Translations of headings are provided for convenience; the legal text below remains in English.
Legal documents governing the use of the MyDosha platform. Last updated: May 2026.
MyDosha ("we", "our", "the platform") is an AI-powered patient intake service for Ayurvedic practitioners. This Privacy Policy explains how we collect, use, store, and protect personal data in connection with the MyDosha service at mydosha.org and its subdomains.
We are committed to processing personal data in accordance with the General Data Protection Regulation (GDPR) (EU) 2016/679 and applicable Dutch data protection law.
This policy applies to two categories of data subjects:
Patient health data is special category data under GDPR (Article 9). It is processed on the basis of explicit consent obtained from each patient during the intake process. Patients are clearly informed about the purpose and scope of data collection before providing consent.
We do not use patient data for any marketing, profiling, or purposes beyond the clinical intake service. We do not sell personal data to any third party.
MyDosha does not share patient data with health insurers, other healthcare providers, accountants, or other third parties on the practitioner's behalf. If a practitioner shares an exported file, care note, referral, or invoice outside MyDosha, that sharing is controlled by the practitioner and should follow their own confidentiality, consent, and professional-record obligations.
The intake conversation, dossier generation, practitioner AI chat, plan-drafting support, dictation parsing, import parsing, and polish tools may be powered by Anthropic's Claude API. Patient responses and relevant practitioner-entered context are transmitted to Anthropic only for the AI feature being used. Anthropic processes this data as a data processor on our behalf, under a data processing agreement. Anthropic's own privacy policy governs their handling of data: anthropic.com/legal/privacy.
Patient data is not used to train Anthropic's AI models under the current API terms. Anthropic's published API retention position is that API inputs and outputs are normally deleted from its backend within 30 days, except where a different contract, zero-data-retention agreement, policy-enforcement need, or legal requirement applies.
Practitioners can disable AI globally or per feature from Account & Settings. The available controls cover AI patient intake, AI dossier generation, AI chat and text polishing, AI dictation parsing, and AI import parsing. These controls are enforced server-side.
Patient intake data (including special category health data under GDPR Article 9) is stored by the following sub-processors. Each has a Data Processing Agreement in place with MyTrueDosha that incorporates the EU Standard Contractual Clauses (SCCs, Commission Implementing Decision (EU) 2021/914) as the lawful mechanism for any transfer outside the EEA. Transfer impact assessments (TIAs) have been conducted for each US processor.
clinical_json column), never as files on Vercel Blob or any public object store.
MyDosha is the data processor; the practitioner (or their clinic) is the data controller for patient records and is responsible for meeting the statutory retention requirements that apply to them. MyDosha is an intake and practitioner-workspace tool, not the practitioner's statutory long-term medical archive. We retain data while the practitioner's account is active and provide self-serve export tools so the practitioner can download and keep their own patient file archive before unsubscribing.
Practitioners must keep patient records for at least the longest applicable period below. These are controller obligations and floors, not ceilings.
| Jurisdiction | Medical / clinical records | Tax / invoice records |
|---|---|---|
| Netherlands | 20 years from last contact (WGBO art. 7:454 BW) | 7 years (Algemene Wet inzake Rijksbelastingen) |
| Germany | 10 years (BGB §630f); some specialties (radiology, transplant) longer | 10 years (HGB §257, AO §147) |
| United Kingdom | 10 years from last contact (NHS Records Management Code of Practice 2021); maternity 25 years; paediatric until age 25 | 6 years (HMRC; longer for VAT-registered businesses) |
| Portugal | 5–20 years depending on context (Decreto-Lei n.º 156/2005; hospital records 20 years) | 10 years (Código do IVA, art. 52) |
Where MyDosha is processor and the practitioner is controller, deletion requests normally reach us via the practitioner. If the practitioner has a legal reason to keep a copy, such as a WGBO patient-file duty or tax-retention duty in their own administration, that retained copy is the practitioner's responsibility outside MyDosha.
Data subjects have the following rights:
To exercise any of these rights, email hello@mydosha.org. Practitioners can additionally export their patient archive (CSV) self-serve from the doctor portal at any time, satisfying the right to portability without contacting us. We will respond to direct requests within 30 days. You also have the right to lodge a complaint with the Italian Garante per la protezione dei dati personali (garanteprivacy.it) — our lead supervisory authority — or with the supervisory authority of your habitual residence (Article 77 GDPR). See the imprint for the full list.
French residents may lodge a complaint with the French data-protection authority (in addition to, or instead of, the Italian lead authority): CNIL — Commission Nationale de l'Informatique et des Libertés, 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France — www.cnil.fr. France transposes the GDPR via the Loi Informatique et Libertés (loi n° 78-17 du 6 janvier 1978, telle que modifiée par la loi n° 2018-493 du 20 juin 2018).
Email your request to privacy@mydosha.org (or tbthijs@gmail.com while that inbox is being configured). Please include:
We will acknowledge the request within 72 hours and respond substantively within one month of receipt, in line with GDPR Article 12(3). If the request is complex, we may extend this by up to two further months and will let you know why. There is no charge for a first request; repeated or manifestly unfounded requests may incur a reasonable fee.
If you are unhappy with our response, you can lodge a complaint with your national data protection authority — see the imprint for supervisory authority contact details.
MyDosha uses logs for security, accountability, support, and incident response. We do not treat logs as a practitioner medical archive, and we design logging paths to avoid storing secrets, full query-string URLs, patient free-text, or full patient records in runtime logs.
For a short operational overview, see Trust & AI Processing.
We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or disclosure. These include HTTPS encryption in transit, access controls on the practitioner portal, and limited staff access to patient data.
The practitioner portal is password-protected. Practitioners are responsible for maintaining the security of their portal credentials.
We may update this Privacy Policy from time to time. Material changes will be communicated to practitioners by email. The current version is always available at mydosha.org/privacy.
These Terms of Service ("Terms") govern your access to and use of the MyDosha platform ("Service"), operated by MyTrueDosha / Thomas Thijs ("we", "us"). By registering for or using the Service, you agree to these Terms. If you do not agree, do not use the Service.
MyDosha provides AI-powered patient intake technology for Ayurvedic practitioners. The Service includes a branded patient intake form hosted at a subdomain of mydosha.org, AI-generated clinical dossier delivery, and (for Clinic plan subscribers) a practitioner portal for managing patient records.
Access to the Service requires a practitioner account. You are responsible for maintaining the confidentiality of your portal credentials and for all activity that occurs under your account. You must notify us immediately of any unauthorised access at hello@mydosha.org.
You must be a qualified Ayurvedic practitioner (or equivalent healthcare professional) to use the clinical features of the Service.
Subscriptions are billed monthly. Payment is processed via Stripe. You may cancel at any time — cancellation takes effect at the end of the current billing period. There are no refunds for partial months.
We reserve the right to change pricing with 30 days' notice to active subscribers.
You agree to use the Service only for its intended purpose: managing patient intake for your Ayurvedic practice. You must not:
The AI dossiers generated by MyDosha are derived entirely from patient self-report and are intended solely to support the practitioner's clinical preparation. They do not constitute medical diagnoses, clinical assessments, treatment recommendations, or medical opinions.
You are solely responsible for your clinical decisions and the treatment you provide to your patients. MyDosha expressly disclaims any liability arising from clinical decisions made in reliance on AI-generated dossiers. Your physical examination and professional judgment always supersede any AI-generated output.
By using the Service, you represent that:
The MyDosha platform, its design, and its underlying AI prompt architecture are the intellectual property of MyTrueDosha. You are granted a limited, non-exclusive, non-transferable licence to use the Service for your practice during your active subscription.
Patient data remains the data of the patient and, by extension, the responsibility of the practitioner. We make no claim to ownership of intake responses or AI-generated dossiers.
We aim to maintain 99% uptime but do not guarantee uninterrupted access. Maintenance, updates, and circumstances beyond our control may cause temporary unavailability. We will communicate planned downtime in advance where possible.
To the maximum extent permitted by applicable law, MyTrueDosha shall not be liable for any indirect, incidental, special, or consequential damages arising from your use of the Service, including but not limited to loss of data, clinical outcomes, or business interruption.
For practitioners and patients in the United States, the following additional terms apply alongside the rest of these Terms:
MyDosha is an intake-summarisation and reference tool. It is not a medical device under Regulation (EU) 2017/745 (MDR) and does not hold a CE marking for medical purposes. MyDosha does not provide diagnosis, treatment recommendations, drug-interaction screening, or any clinical decision support within the meaning of MDCG 2019-11 Rev.1. See Intended use for the full qualification position.
By using MyDosha you acknowledge and agree that: (a) you are a qualified Ayurvedic practitioner or healthcare professional in your jurisdiction; (b) all clinical decisions — including but not limited to diagnosis, prescription, treatment planning, drug-safety screening, and referral — are your sole responsibility; (c) MyDosha's AI-generated outputs are a reorganisation of patient self-report or reference-library content, not clinical findings or recommendations; (d) you will exercise independent clinical judgment in reliance on any information MyDosha presents; (e) you will inform patients that MyDosha is an administrative tool used by you, not an autonomous clinical system.
You indemnify MyTrueDosha against any claim, loss, damage, or regulatory action arising from clinical decisions you make in reliance on MyDosha's outputs.
Our total liability under these Terms shall not exceed the total fees paid by you in the 12 months preceding the event giving rise to the claim.
Either party may terminate the subscription at any time. We reserve the right to suspend or terminate access immediately in cases of material breach of these Terms, non-payment, or where continued access poses a risk to the platform or other users.
Upon termination, you may request an export of your patient records within 30 days. After this period, records will be deleted in accordance with our retention policy.
These Terms are governed by the laws of Italy. Any disputes shall be subject to the exclusive jurisdiction of the competent court at the operator's main establishment (Sorano, Province of Grosseto, Italy), unless mandatory consumer-protection law in your country provides otherwise.
We may update these Terms from time to time. Material changes will be communicated by email with at least 14 days' notice. Continued use of the Service after the notice period constitutes acceptance of the revised Terms.
Questions about these Terms: hello@mydosha.org.