Documents
Evidence
This page collects what can be evidenced: how the data flows, what has been tested and which documents you can download here directly. What we cannot evidence is not on this page.
1Where your data sits
Encrypted before it leaves your device
Your information is end-to-end encrypted directly on your device (X25519 key exchange, AES-256-GCM). Only the practice you selected can decrypt it again.
After your practice has picked it up — after 30 days at the latest — the encrypted package is deleted from the server.
2Security reviews
Security reviews
The application was examined for security flaws in several rounds in 2026. All confirmed findings have been fixed or documented as deliberate decisions. We name no details here — a summary is available on request.
3Documents
Documents for your data protection officer
Both are available here as a direct download — no request, no waiting for us.
Data processing agreement (Art. 28 GDPR)
Including all annexes: technical measures, sub-processors, confidentiality undertaking under § 203 StGB.
Technical and organisational measures (Art. 32 GDPR)
What is stored, for how long — and what DiggAI cannot see by design.
Preliminary version as of 1 August 2026. Legal review is still under way; you will receive the binding version for signature before your practice is activated.
Documents on request
For data protection officers, procurement and management we keep the following documents ready. Write to us and we will send them.
Summary of the security reviews
4What we do not claim
What we do not claim
DiggAi is not a medical device and currently holds no certification (e.g. ISO 27001). This page describes the architecture as actually built — verifiable on the live system.