This Privacy Policy explains how Biostar Technology International ("Biostar," "we," "us," or "our"), operated by Ulysses Angulo, collects, uses, stores, and protects personal data through the Biostar CMA platform ("Platform") available at biostarcma.com.
Biostar CMA is an AI-assisted health technology platform that enables health practitioners to conduct structured patient interviews and generate analysis reports. Given the nature of our services, we process special categories of personal data, including health data, and we take our obligations under applicable data protection law extremely seriously.
This Policy applies to all users of the Platform, including health practitioners ("Practitioners"), patients and clients ("Patients"), and guest users ("Guests").
Data Controller:
Biostar Technology International
Owner: Ulysses Angulo
Email: privacy@biostartechnology.com
We process personal data in compliance with:
| Data Category | Examples | Applies To |
|---|---|---|
| Registration data | Name, email address, professional credentials, licence number | Practitioners |
| Authentication data | Hashed passwords, session tokens, multi-factor authentication data | Practitioners, Patients |
| Profile data | Professional specialty, practice information, profile preferences | Practitioners |
| Patient account data | Name, email address, date of birth | Patients |
| Guest session data | Temporary session identifiers | Guests |
When Practitioners use the Platform to conduct structured interviews, the following health-related data may be processed:
This data constitutes special category data under Article 9 GDPR and is subject to enhanced protections as described in this Policy.
| Purpose | Legal Basis (GDPR) |
|---|---|
| Account creation and management | Article 6(1)(b) — Performance of contract |
| Platform operation and service delivery | Article 6(1)(b) — Performance of contract |
| Security and fraud prevention | Article 6(1)(f) — Legitimate interest |
| Legal compliance | Article 6(1)(c) — Legal obligation |
| Analytics and service improvement | Article 6(1)(f) — Legitimate interest |
| Marketing communications (where applicable) | Article 6(1)(a) — Consent |
Processing of health data requires an additional legal basis under Article 9(2) GDPR. We rely on:
In many cases, the Practitioner who uses Biostar CMA to conduct patient interviews acts as an independent data controller or joint controller with respect to their patients' health data. Practitioners are responsible for:
A Data Processing Agreement ("DPA") is available to Practitioners upon request at privacy@biostartechnology.com.
Biostar CMA uses artificial intelligence to assist Practitioners in analysing structured interview data and generating reports. Specifically, we use the Anthropic Claude API as our AI processing engine.
Important: AI-generated outputs are assistive tools only and do not constitute medical diagnoses, medical advice, or clinical decisions. All outputs are subject to Practitioner review and professional judgment.
| Detail | Information |
|---|---|
| Sub-processor | Anthropic, PBC |
| Location | United States |
| Purpose | AI language model processing for interview analysis and report generation |
| Data processed | De-identified or pseudonymised interview content as submitted by the Practitioner |
| Safeguards | Standard Contractual Clauses (SCCs); Anthropic's data processing terms; data is not used to train Anthropic's models under our commercial API agreement |
We may engage additional sub-processors for hosting, payment processing, email delivery, and analytics. A current list of sub-processors is available upon request at privacy@biostartechnology.com. We will notify Practitioners of any material changes to our sub-processor list with at least 30 days' advance notice.
We apply the principle of data minimisation to AI processing:
Certain sub-processors, including Anthropic, are located outside the European Economic Area ("EEA"). When personal data is transferred outside the EEA, we ensure adequate protection through one or more of the following mechanisms:
We conduct Transfer Impact Assessments for transfers to jurisdictions without an adequacy decision, evaluating the legal framework of the recipient country and implementing supplementary measures where necessary.
Copies of the relevant transfer safeguards are available upon request at privacy@biostartechnology.com.
| Data Category | Retention Period | Rationale |
|---|---|---|
| Practitioner account data | Duration of account + 2 years after deletion | Contract performance; legal obligations |
| Patient account data | Duration of account + 1 year after deletion | Contract performance |
| Health data (sessions & reports) | As configured by the Practitioner (default: 12 months), or until deletion is requested | Practitioner's clinical and legal requirements |
| Guest session data | 30 days | Temporary access; no ongoing relationship |
| Technical/usage logs | 12 months (anonymised thereafter) | Security and service improvement |
| Payment records | 7 years | Tax and legal compliance |
| Support correspondence | 3 years after resolution | Service quality and legal defence |
Practitioners may configure retention periods for patient session data within the Platform, subject to minimum periods required by applicable healthcare regulations. Practitioners are responsible for ensuring their configured retention periods comply with their own regulatory obligations.
Upon expiry of the applicable retention period, or upon valid deletion request, personal data is:
| Right | Description |
|---|---|
| Access (Art. 15) | Obtain confirmation of processing and a copy of your personal data |
| Rectification (Art. 16) | Correct inaccurate or incomplete personal data |
| Erasure (Art. 17) | Request deletion of your personal data ("right to be forgotten") |
| Restriction (Art. 18) | Restrict processing in certain circumstances |
| Portability (Art. 20) | Receive your data in a structured, commonly used, machine-readable format |
| Objection (Art. 21) | Object to processing based on legitimate interests or direct marketing |
| Withdraw consent (Art. 7) | Withdraw previously given consent at any time |
| Automated decisions (Art. 22) | Not be subject to solely automated decisions with legal or significant effects |
Submit requests to: privacy@biostartechnology.com
We will:
You may export your data in the following formats:
Export functionality is available within your account settings or by contacting privacy@biostartechnology.com.
If you are a Patient whose data was processed via a Practitioner's use of Biostar CMA, you may exercise your rights by contacting either:
We will coordinate with the relevant Practitioner to fulfil your request.
| Category | Purpose | Consent Required |
|---|---|---|
| Strictly necessary | Authentication, security, load balancing | No (legitimate operation) |
| Functional | Language preferences, saved settings | No (legitimate interest) |
| Analytics | Anonymised usage statistics, performance monitoring | Yes |
| Marketing | Third-party advertising (if applicable) | Yes |
Upon your first visit, we present a cookie consent banner allowing you to accept or reject non-essential cookies. You may update your preferences at any time via the cookie settings link in the Platform footer.
We may use privacy-focused analytics tools to understand Platform usage. Where analytics tools are used:
We implement appropriate technical and organisational measures to protect personal data, including:
Given that Biostar CMA processes health data at scale using AI technologies, we have conducted a Data Protection Impact Assessment (DPIA) in accordance with Article 35 GDPR. This assessment is reviewed annually or when significant changes to processing activities occur. A summary is available upon request to supervisory authorities.
Biostar CMA is not intended for use by individuals under the age of 16. We do not knowingly collect personal data from children. Where a Practitioner treats minor patients, the Practitioner is responsible for obtaining appropriate parental or guardian consent and ensuring compliance with applicable laws regarding minors' data.
We may update this Privacy Policy from time to time. Material changes will be communicated via:
Continued use of the Platform after notification constitutes acceptance of the updated Policy. If you do not agree with any changes, you may close your account and request deletion of your data.
For questions, concerns, or requests regarding this Privacy Policy or our data protection practices:
Data Protection Contact
Biostar Technology International
Email: privacy@biostartechnology.com
You have the right to lodge a complaint with a data protection supervisory authority in the EU Member State of your habitual residence, place of work, or place of the alleged infringement.
A list of EU supervisory authorities is available at: https://edpb.europa.eu/about-edpb/about-edpb/members_en
Biostar Technology International
Email: privacy@biostartechnology.com
Website: biostarcma.com
This Privacy Policy is provided for informational purposes and should be reviewed by qualified legal counsel to ensure compliance with all applicable laws in your jurisdiction.