1. Data Controller
The controller of the personal data processed through the cardisong.com website (the ‘Site’) and the CardiSong platform (the ‘Platform’) is:
- Inovato Clinical EOOD, UIC 203748990
- Registered seat and address: 96 Knyaz Boris I St., fl. 2, apt. 6, Sofia, Bulgaria
- Data protection contact:
This policy describes how we process personal data in accordance with Regulation (EU) 2016/679 (GDPR) and the Bulgarian Personal Data Protection Act.
2. What Personal Data We Process
Depending on how you use the Site and the Platform, we process:
- Identification and contact data – names, email address, phone number, country;
- Account data – user role (patient or doctor), settings, activity history;
- Health data – ECG recordings made with the CardiSong device, your doctor's assessment, recording quality, symptoms and notes, data about the device used. These are special categories of data under Art. 9 GDPR;
- Telephone call recordings – when an ECG is transmitted over a telephone channel, the recording of the transmitted signal and related metadata (number, time, duration) are processed;
- Technical data – IP address, browser and device type, system access and security logs;
- Mobile app data – the sound produced by the CardiSong device, recorded with the phone microphone only when you start a recording (no sound is recorded outside this process). The app sends the recording unchanged to the Platform, where it is stored for your doctor to review; while there is no internet connection, the recording is kept temporarily on the phone and deleted once the Platform has accepted it. Also a device identifier for push notifications and the messages you exchange with your doctor in the app;
- Cookie data – as described in the ‘Cookies’ section below.
3. Purposes and Legal Bases of Processing
We process personal data for the following purposes and on the following legal bases:
- Providing the Services (creating an account, receiving, storing and forwarding recordings to your doctor, access to your doctor's assessment) – performance of a contract (Art. 6(1)(b) GDPR);
- Processing of health data – your explicit consent (Art. 9(2)(a) GDPR) and, where applicable, for the purposes of medical diagnosis and the provision of health care (Art. 9(2)(h) GDPR);
- Compliance with legal obligations (accounting, medical documentation) – Art. 6(1)(c) GDPR;
- System security, abuse prevention and defense of legal claims – legitimate interest (Art. 6(1)(f) GDPR);
- Analytics and marketing cookies – only with your consent (Art. 6(1)(a) GDPR).
4. Recipients of Personal Data
The following may have access to personal data:
- your treating doctor and authorized medical staff within the Platform;
- hosting and cloud infrastructure providers (DigitalOcean, EU data centers), acting as data processors under contract;
- communication service providers (telephone, SMS, email), to the extent necessary to provide the Services;
- competent authorities – where we are legally obliged.
We do not sell personal data and do not share it with third parties for their own marketing purposes.
5. Transfers Outside the EEA
- Data is stored in data centers located within the European Union.
- Should a transfer outside the European Economic Area become necessary, it will take place only with appropriate safeguards under Chapter V of the GDPR (for example, standard contractual clauses).
6. Retention Periods
- Account data is retained for the lifetime of the account.
- Health records (ECG recordings and your doctor's assessments) are retained in accordance with the statutory retention periods for medical documentation or, in their absence, for the period necessary for the purposes for which they were collected.
- System and security logs are retained for a limited period appropriate to security purposes.
- After the applicable period expires, data is deleted or anonymized.
7. Your Rights
As a data subject, you have the right to:
- access your personal data and information about its processing;
- rectification of inaccurate or incomplete data;
- erasure ('right to be forgotten') under the conditions of Art. 17 GDPR;
- restriction of processing;
- data portability;
- object to processing based on legitimate interest;
- withdraw consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.
You can exercise your rights by contacting us at the contact details below. We will respond within one month.
You have the right to lodge a complaint with the Commission for Personal Data Protection (CPDP): 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria, www.cpdp.bg.
8. Cookies
The Site uses cookies and similar technologies:
- Necessary cookies – for account login, language settings and storing your cookie choices. They are essential for the operation of the Site;
- Analytics cookies – activated only after your explicit consent via the cookie banner. Where consent is given, the public part of the Site loads Google Analytics 4 (Google Ireland Limited), measurement ID G-EPFGM2BS1X, which processes IP address, device identifier, pages visited and usage data so that we can measure traffic. Google acts as a data processor and transfers to third countries may occur on the basis of Standard Contractual Clauses. The retention period is up to 14 months;
- Google Analytics is NOT loaded in the authenticated areas of the Platform (admin, doctor and patient accounts), nor on the sign-in and registration pages. Health data, ECG recordings, and page addresses containing patient or result identifiers are never transmitted to Google under any circumstances. Only the path and campaign marketing parameters (utm_*, gclid) are sent from page addresses; all other parameters are stripped before transmission;
- Marketing cookies – at present the Site does not load any third-party marketing tools;
- You can change your choices at any time via 'Cookie Settings' at the bottom of the Site.
9. Data Security
- We apply technical and organizational measures: encryption in transit and at rest, role-based access control, and audit logs of access to patient data.
- Access to health data is limited to authorized persons on a need-to-know basis.
- In the event of a security breach posing a risk to your rights, we will notify the CPDP and the affected persons as required by the GDPR.
10. Children's Data
- The Site and the Platform are intended for persons aged 18 or over. Data of minors is processed only with the consent and under the supervision of a parent or guardian.
11. Changes to this Policy
- We may update this policy. The current version, with its last-updated date, is always available on the Site.
- Registered users will be notified of material changes in an appropriate manner.
12. Contact
For all matters relating to the processing of personal data:
- Inovato Clinical EOOD, UIC 203748990
- 96 Knyaz Boris I St., fl. 2, apt. 6, Sofia, Bulgaria
- Email:
- Support: