Privacy policy

MEDAZA EUROPE, D.O.O. — PRIVACY POLICY

Effective Date: July 1st, 2026

Medaza Europe, d.o.o. ("Medaza Europe," "we," "us," or "our") operates this store and website, including all related information, content, features, tools, products, and services (the "Services"). The Services are provided primarily to institutional and business buyers ("Business Buyer"), such as veterinary clinics and medical institutions, and, on a limited basis, directly to individual consumers ("Consumer Buyer") solely for the purchase of home medical equipment, subject to the prescription requirement described in Section 2. Medaza Europe is powered by Shopify, which enables us to provide the Services to you.

This Privacy Policy describes how we collect, use, and disclose personal information — including health-related information submitted in connection with Consumer Buyer orders — in accordance with Regulation (EU) 2016/679 (the "GDPR") and applicable national implementing legislation. If there is a conflict between our Terms of Service and this Privacy Policy, this Privacy Policy controls with respect to the collection, processing, and disclosure of personal information.

Please read this Privacy Policy carefully. By using and accessing any of the Services, you acknowledge that you have read this Privacy Policy.

1. Data Controller

Medaza Europe, d.o.o. is the data controller responsible for the personal information described in this Policy. Where Shopify or another service provider acts as an independent controller for certain processing (as described in Section 9), that party's own privacy notice governs that specific processing. Contact details for data protection queries are provided in Section 15.

2. Two Categories of Buyer: Business and Consumer

The Services operate in two distinct modes, and the personal information we collect differs accordingly:

  • Business Buyers purchase on behalf of an institution (e.g., a veterinary clinic or medical facility). We collect business contact and institutional/licensure information, as described in Section 3.
  • Consumer Buyers may purchase directly, but only for home medical equipment, and only upon submission of a valid prescription or equivalent medical authorization issued by a licensed healthcare professional. Orders from Consumer Buyers that do not include a valid prescription will not be fulfilled. Consumer Buyer status is not available for veterinary, institutional, or non-prescription product categories.

3. Personal Information We Collect or Process

Depending on whether you are a Business Buyer or Consumer Buyer, we may collect:

  • Contact details, including name, address, billing and shipping address, phone number, and email address.
  • Business and institutional information (Business Buyers only), including business name, job title, and applicable professional or facility licensure or registration number used to verify eligibility to purchase medical devices institutionally.
  • Prescription and medical authorization information (Consumer Buyers only), including the prescription document itself, the prescribing healthcare professional's name and credentials, the prescribed product or product category, and any information necessary to verify the prescription's validity. This is special category health data under Article 9 GDPR, and is processed only as described in Section 4.
  • Financial information, including payment card or account details, transaction details, and payment confirmation, processed on our behalf by Shopify and its payment processors.
  • Account information, including username, password, and preferences.
  • Transaction information, including items viewed, purchased, returned, or exchanged, and Order history.
  • Communications with us, including customer support correspondence.
  • Device and usage information, including IP address, browser type, and interaction data collected through cookies and similar technologies, subject to your cookie consent choices.

4. Special Category Data: Prescriptions and Health Information

Where you purchase as a Consumer Buyer, submission of a valid prescription is a mandatory condition of the sale, and the prescription necessarily reveals health-related information about you. We process this information under the following legal bases and safeguards:

  • Legal basis. We rely on Article 9(2)(h) GDPR (processing necessary for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care, or management of health or social care systems and services) and/or Article 9(2)(a) GDPR (your explicit consent, obtained at the point of upload) as applicable, together with Article 6(1)(b) GDPR (performance of a contract with you) for the underlying sale.
  • Purpose limitation. Prescription and health-related information is used solely to (a) verify your eligibility to purchase the specific home medical equipment ordered, (b) ensure the equipment ordered corresponds to what was prescribed, and (c) meet our own regulatory recordkeeping obligations as an importer/distributor under the MDR. It is not used for marketing, profiling, or any purpose unrelated to fulfilling and verifying your Order.
  • Access restriction. Access to prescription documents and related health information is restricted to personnel who require it to verify and fulfill your Order, and is not shared with marketing, analytics, or advertising functions.
  • Retention. Prescription documentation is retained only for the period necessary to fulfill the Order, support any warranty, return, or recall process, and satisfy applicable regulatory retention requirements, after which it is securely deleted in accordance with Section 8.
  • No use for automated decision-making. We do not use prescription or health-related information for automated decision-making or profiling producing legal or similarly significant effects.

5. Personal Information Sources

We collect personal information: (a) directly from you, including when you upload a prescription, create an account, place an Order, or contact us; (b) automatically, through your use of the Services and cookies, subject to your consent choices; (c) from our service providers, including Shopify and payment processors; and (d) where necessary to verify a prescription, directly or indirectly from the prescribing healthcare professional or issuing institution.

6. How We Use Your Personal Information

  • Provide and Fulfill the Services, including verifying eligibility (institutional or prescription-based), processing payments, fulfilling Orders, and managing accounts.
  • Regulatory Compliance, including MDR importer/distributor obligations, vigilance and recall coordination, and traceability recordkeeping, as described in Section 8.
  • Business and Order Communications, including confirmations, shipping updates, and account notices.
  • Marketing (where you have separately opted in), limited to product and catalog information relevant to your buyer category; we do not use prescription or health data for marketing purposes.
  • Security and Fraud Prevention, including authentication and detection of fraudulent activity.
  • Legal Compliance, including responding to valid legal process and cooperating with competent authorities.

7. How We Disclose Personal Information

We may disclose personal information to: (a) Shopify and other service providers performing functions on our behalf (payment processing, fulfillment, cloud hosting, customer support); (b) manufacturers or Suppliers, solely to the extent necessary to process warranty claims, recalls, or vigilance reporting, and without disclosing prescription documents unless strictly necessary for a specific recall or safety matter; (c) competent authorities, where required by MDR vigilance or other legal obligations; (d) our affiliates; and (e) a successor entity in connection with a business transaction, subject to continued protection of your information. We do not sell personal information, and we do not disclose prescription or health-related information for marketing or advertising purposes.

8. Retention and MDR Recordkeeping

As a distributor and importer under the MDR, Medaza Europe retains certain Order, Buyer, and product traceability records — including Buyer contact information and purchase history — for the periods required under Articles 13 and 14 MDR and applicable national implementing law, which may exceed general commercial retention periods. Prescription and health-related information is retained separately and for a more limited period, as described in Section 4, and is deleted once no longer necessary for Order fulfillment, warranty/recall support, or a shorter regulatory retention period that specifically applies to it.

9. Relationship with Shopify

The Services are hosted by Shopify, which processes personal information about your access to and use of the Services. Shopify may act as an independent controller for certain processing, including for enhanced features that draw on data across its merchant network. To learn more, see the Shopify Privacy Policy at https://www.shopify.com/legal/privacy.

10. Third-Party Websites and Links

The Services may link to third-party websites, including manufacturer resource or support pages. We are not responsible for the privacy practices of such third parties; review their policies before providing information.

11. Children's Data

The Services are not directed to children. Consumer Buyer purchases require submission of a valid prescription issued to an adult patient or, where the prescription is issued for a minor, submission by the minor's parent or legal guardian acting on the minor's behalf; the purchasing account holder must be an adult. We do not knowingly collect personal information directly from children. If you believe a child has provided personal information to us directly, contact us using the details in Section 15 so we can address it.

12. Security

We implement appropriate technical and organizational measures, proportionate to the sensitivity of the data involved — including enhanced access controls for prescription and health-related information — designed to protect personal information against unauthorized access, loss, or disclosure. No system is completely secure, and we cannot guarantee absolute security.

13. Your Rights Under the GDPR

Subject to the conditions and exceptions set out in the GDPR, you have the right to:

  • Access the personal information we hold about you;
  • Rectify inaccurate or incomplete personal information;
  • Erase your personal information ("right to be forgotten"), subject to the regulatory recordkeeping exception in Section 8;
  • Restrict processing in certain circumstances;
  • Data portability, to receive your data in a structured, commonly used format;
  • Object to processing based on legitimate interests or for direct marketing;
  • Withdraw consent at any time, where processing is based on consent (including consent given for prescription upload under Article 9(2)(a)), without affecting the lawfulness of processing before withdrawal;
  • Not be subject to a decision based solely on automated processing, including profiling, that produces legal or similarly significant effects.

Exception for Regulatory Recordkeeping. Where personal information — including certain Order or prescription-verification records — is retained to satisfy MDR traceability, vigilance, or other legal or regulatory obligations described in Section 8, we may decline or delay an erasure or restriction request to the extent necessary to comply with those obligations, and will explain the basis for any such decision.

You may exercise these rights by contacting us using the details in Section 15. We may need to verify your identity before processing a request.

14. Right to Lodge a Complaint

If you believe our processing of your personal information infringes the GDPR, you have the right to lodge a complaint with the data protection supervisory authority of your habitual residence, place of work, or the place of the alleged infringement.

15. International Transfers

Where personal information is transferred outside the European Economic Area, we rely on recognized transfer mechanisms, such as the European Commission's Standard Contractual Clauses, or transfers to countries benefiting from an adequacy decision, as required by Chapter V GDPR. Prescription and health-related information is not transferred outside the EEA except where strictly necessary (for example, to a manufacturer for recall purposes) and subject to the same safeguards.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal or regulatory reasons. We will post the revised Policy on this website and update the "Last updated" date.

17. Contact

Questions about this Privacy Policy, prescription data handling, or requests to exercise your rights may be directed to Medaza Europe, d.o.o. at contacteurope2@medaza-platform.com.