Privacy policy

Who is responsible for your data

Dirumed is a product built and operated by MTM CYA Corp, trading as MTM Cofounders & Associates (“MTM”), a company incorporated in the United States. MTM is the controller of the personal data described in this policy. “Dirumed”, “we”, and “our” refer to that same entity.

Relationship with MTM and other group products

MTM builds and operates several of its own software products; Dirumed is one of them. You can find the company at mtmcya.com. Because all of those products share a team, infrastructure, and internal support, administration, and billing functions, authorised MTM personnel may access data processed through this site for those purposes. That internal access is not a disclosure to a third party: it remains under MTM’s control and responsibility, with the same safeguards described here.

Each MTM product keeps its own site, its own privacy notice, and its own systems. We do not merge or cross-reference your profile between different products for commercial or advertising purposes. In particular, clinical data held in the Dirumed application is isolated and never shared with any other group product.

What this policy covers — and what it does not

This policy applies only to the dirumed.com marketing site: the public pages, the news section, and the contact, demo, and waiting-list forms. This site hosts no medical records, receives no patient data, and does not connect to the application’s database.

What we collect

We collect data in three situations, and no others:

Do not include patient data in these forms. They are commercial channels, not clinical ones: if you need to show us a real case, we can look at it during the demo, in your own environment.

What we do not collect

We collect no health data through this site, build no advertising profiles, use no social-media pixels, and buy no contact lists.

Legal basis and purpose

We process your data on the following bases, which map onto both Venezuelan data-protection rules and the European GDPR:

• Forms: pre-contractual steps at your request (GDPR Art. 6(1)(b)) — we answer your question and arrange your demo.
• Anti-abuse verification of submissions and server logs: legitimate interest (Art. 6(1)(f)) — keeping the site available and protecting it from automated abuse.
• Google Analytics: consent (Art. 6(1)(a)) — you can decline or withdraw without losing functionality.
• Keeping records of correspondence and responding to lawful requests: legal obligation and legitimate interest (Art. 6(1)(c) and 6(1)(f)).

We never sell personal data, do not rent it, and do not use it for third-party advertising.

Where processing rests on your consent, you may withdraw it at any time from the “Cookie preferences” link in the footer. Withdrawal does not affect the lawfulness of processing carried out beforehand.

Who we share data with

We do not sell or rent your data. We rely on the following providers, who process it on our behalf and on our instructions:

• Google (Firebase Hosting, Cloud Functions, Google Analytics, reCAPTCHA) — site hosting, form processing, measurement, and abuse prevention.
• Google Workspace (Gmail) — delivery of notification and confirmation emails.
• MTM CYA Corp and its authorised personnel — support, administration, and commercial management, as described above.

We may also disclose data where strictly necessary to comply with a legal obligation or a valid request from a competent authority, to establish or defend legal claims, or in connection with a merger, acquisition, or corporate reorganisation — in which case we would tell you before your data became subject to a different policy.

These providers may process data outside your country, principally in the United States. Google relies on the European Commission’s Standard Contractual Clauses and on the EU-U.S. Data Privacy Framework for those transfers. MTM, as a U.S. entity, processes data in the United States under the same contractual safeguards.

Cookies and similar technologies

We use a single strictly necessary first-party cookie (dm_cookie_consent) to remember your analytics decision for about six months so we do not ask again. Google Analytics loads only if you accept it: until then no measurement script runs and none of its cookies are set. Anti-abuse verification of form submissions may load Google resources and set third-party cookies at the moment you submit; it is a security measure without which the forms cannot work.

You can change or withdraw your decision at any time from the “Cookie preferences” link in the footer, and block or delete cookies in your browser settings. The site keeps working, though forms may stop submitting if you block the anti-abuse check. We honour browser privacy-preference signals where applicable law requires it.

How long we keep data

We keep each item only for as long as the purpose that justified it requires:

• Form messages and demo requests: for as long as needed to handle your enquiry and any resulting business relationship, up to 24 months from last contact.
• Country waiting list: until Dirumed is available in your country and we have told you, or until you ask to be removed.
• Google Analytics data: 14 months, in aggregate.
• Server logs: a short period, per our hosting provider’s standard configuration.

Once those periods pass we delete or anonymise the information, unless a legal obligation or the defence of a claim requires us to keep it longer. Retention periods for medical records inside the application are different and are set by the health regulations that apply to your practice.

Your rights

You may at any time request access, rectification, erasure, restriction, portability, or object to processing, and withdraw consent. Email support@dirumed.com and we will respond within 30 days. We may ask for additional information to verify your identity before acting on a request; we use it for that purpose only.

Exercising these rights is free. We will not treat you differently or deny you any service for having done so.

If you believe we have not handled your request properly, you may turn to the data-protection authority or consumer-protection body in your country. If you are in the European Union, you may complain to your member state’s supervisory authority.

If you are a patient of a clinic that uses Dirumed and want to access, correct, or delete your medical record, contact that clinic: it is the controller. We will assist them technically with whatever they need.

Automated decision-making

We make no decisions producing legal effects about you based solely on automated processing, and we do not profile you for that purpose. Anti-abuse verification only determines whether a submission is accepted as legitimate; if one is blocked in error, write to us and we will handle it manually.

Security

The site is served entirely over HTTPS. Service credentials live in Google Secret Manager and never appear in site code. Access to the inbox receiving form submissions is limited to authorised personnel. No system is infallible: if a breach occurred that posed a high risk to your rights, we would notify you and the competent authority within the deadlines the law sets. The safeguards protecting medical records inside the application are described on the security page and in the service agreement.

Minors

This site is aimed at healthcare professionals and is not directed at minors. We do not knowingly collect minors’ data through this site. Processing of minor patients’ medical records inside the application is the responsible clinic’s duty and is governed by applicable health regulations.

Links to third-party sites

This site may link to pages we do not control, including mtmcya.com and the sites of other MTM products. Each has its own privacy notice, and we are not responsible for their content or processing practices.

Changes to this policy

If we change this policy we will update the date shown above. Material changes will be announced prominently on the site and, where the law requires it, we will ask for fresh consent. We encourage you to review this page periodically.