When you tell a doctor about your symptoms, you are sharing something very personal. As Treat's CTO, I am responsible for keeping that information safe and only in the right hands. Here is how it works in practice, without the legal language. The precise description is in our privacy policy; this post is its plain-English summary.
Two controllers, one contact address
At Treat your data falls into two baskets, and each has its own responsible party.
- Account data: name, personal identity code, email, phone number, identification, acceptance of terms, billing, service logs and feedback. The controller of this data is Treat Health Oy.
- Patient-record data: the symptoms you describe, your answers to follow-up questions, the AI's summary, the doctor's notes, prescriptions and referrals. The controller of this data is the licensed professional who reviews your case. They are registered with the Finnish Supervisory Agency (Lupa- ja valvontavirasto, formerly Valvira) and act as an independent healthcare provider. Treat processes patient-record data on their behalf as a processor (GDPR Art. 28).
The split is not a formality. Finland's Patient Act makes the treating professional responsible for the data created in the care relationship, and they are bound by a statutory duty of confidentiality. You still do not need to work out which basket your question belongs to: every privacy request goes through [email protected], and we forward patient-record requests to the professional.
Where your data physically lives
The Treat application runs on Google Cloud in Finland, in the europe-north1 region in Helsinki. The project is also fenced with Assured Workloads EU Data Boundary, which means data staying in the EU is a technical constraint, not just a contractual promise. Personal data stays within the EEA with every processor.
Two important clarifications:
- Cloudflare protects and serves only the marketing site treat.health. It never handles patient conversations, case data or account data.
- Idura, a Danish identity broker, relays your sign-in and keeps its data in the EU. I cover sign-in in more detail in a separate post.
Who can see your data
- You.
- The healthcare professional who reviews your case.
- Access to Treat's production environment is restricted per service account with Google IAM. There are no shared credentials, and every access is logged. Every employment and subcontracting contract includes a confidentiality commitment.
- Authorities, only when a request has a lawful basis.
We do not share your data with advertisers or data brokers, and we do not sell it.
Your employer never sees your health data
If your employer pays for Treat, it receives only aggregated, anonymised reporting: usage volumes, timings and case categories. Small groups are suppressed so that no individual can be inferred. Your employer sees no names, symptoms, diagnoses or conversations. Treat complements occupational healthcare; it does not replace it.
Kanta and Omakanta
Kanta is Finland's national health data archive, run by Kela, the social insurance institution. The reviewing professional is responsible for the patient-record entries and submits them, together with prescriptions, to Kanta through their own patient record system. Prescriptions go to the national Prescription Centre, so any pharmacy can dispense them. The visit shows in Omakanta (the citizen's view of Kanta) like any other healthcare visit.
In the other direction, data moves only with your permission. If the doctor wants to see your earlier Kanta records, we ask for your explicit consent and record its scope, wording and timestamp. The fetched records are copied to the case temporarily and are not kept beyond it.
How the data is protected technically
- The database, files and secrets are encrypted at rest with KMS keys that Treat manages in the europe-north1 region.
- Every connection uses TLS 1.2 or newer, and the database accepts only encrypted connections.
- The personal identity code and free-text clinical fields are redacted from Treat's application-level service logs before they are written. Possible abuse-monitoring logging on Google's AI platform is a separate matter, described in the privacy policy.
- Passwords are protected with Argon2 hashing, and you can sign in with a passkey.
- Backups support point-in-time recovery and are encrypted with the same keys.
- If a breach meets the GDPR notification threshold, we notify the Data Protection Ombudsman within 72 hours and you without undue delay.
How long data is kept
The retention period for patient records is not Treat's choice but the law's: typically 12 years after the patient's death or 120 years after birth. Bookkeeping material is kept for six years. Service logs are deleted after 90 days by default.
Your rights
You have the right to access your data, to request its correction, erasure or restriction of processing, to have it transferred, to withdraw consent you have given, and to object to processing based on legitimate interest. For the patient record, some rights are limited by law, because patient documents may not be deleted before their retention period ends.
Send requests to [email protected]; we reply within a month. You can also always lodge a complaint with the Office of the Data Protection Ombudsman.
If anything is still unclear, read the privacy policy or ask us directly. I am happy to answer.