Szilva Privacy Policy

Last updated: November 2, 2026

This policy explains how Szilva handles personal data. For some of it, such as our customers’ staff accounts, we decide how it’s used, and we’re its controller. The information healthcare providers collect from their patients through Szilva is theirs to decide about, and we process it on their behalf.

1. Who we are

Szilva (“Szilva Health”, “we”, “us”) is run by Rudolf Bárdos, a sole proprietor (egyéni vállalkozó) registered in Hungary.

• Registered name: Bárdos Rudolf e.v.
• Registered address: 7623 Pécs, Szabadság utca 19/2, Hungary
• Registration number: 52430642, in the register of sole proprietors kept by Hungary’s National Tax and Customs Administration (NAV)
• Tax number: 68913964-1-22
• Email, for anything about your data: contact@szilvahealth.com

2. If you’re a patient

If you fill in a form, or have a patient account, on a healthcare provider’s website that uses Szilva:

• Your healthcare provider decides what is collected and how it’s used. We store and process your information for them, as their processor under the GDPR and their business associate under HIPAA, and only as they instruct us.
• Their notices apply. Their privacy policy and, in the US, their Notice of Privacy Practices explain your rights. To see, correct or delete your information, contact your healthcare provider. If you contact us instead, we pass your request on to them.
• What they store with us: typically your name, date of birth and contact details; your account’s email address, and its password, stored only as a salted hash; your answers to their forms, including health information; your signatures and the files you upload; and the history of changes to your records.
• Where: on Amazon Web Services servers in the United States (Northern Virginia).
• In your browser: what you type into a form stays in your browser until you create an account or sign in, which you do to send the form, save it to finish later, or attach a file. From then on, your answers are saved to your account as you go. To keep you signed in, the form stores a sign-in token in your browser’s local storage on that website. Szilva sets no cookies and doesn’t track you. When you create an account, Google reCAPTCHA checks that you’re not a bot (see section 5).

3. Information we’re responsible for

• Staff accounts. Your name, email address and password (stored only as a salted hash), and your organization and role. We use them to give you access to the service, based on our contract with your organization and our legitimate interest in providing the service to it (GDPR Article 6(1)(b) and (f)). To keep you signed in, Szilva’s apps store a sign-in token in your browser’s local storage. We keep your account details while your account exists.
• Projects and websites. Your organization’s project, and the name and address of each website connected to it, with a random ID for each WordPress installation. We use them to link your website to your project, on the same basis, and keep them while the project exists.
• Sign-in records. The time of each sign-in to a staff or patient account, and the IP address and browser it came from. We use them to keep accounts secure and to investigate misuse, based on our legitimate interest in the service’s security (Article 6(1)(f)). We keep them for 1 year.
• Server logs. IP addresses and the requests made to the Szilva server. We use them to keep the service running and secure, based on the same legitimate interest, and keep them for 90 days.
• Emails with us. What you write to contact@szilvahealth.com, and our replies. We use them to answer you, based on our legitimate interest in doing so, or on steps you ask for before a contract (Article 6(1)(f) or (b)). We keep them for up to 2 years after our last exchange.
• Billing, once there are paid plans. Your organization’s billing details and invoices. We use them to bill you, and keep them because tax and accounting law requires it (Article 6(1)(c)), for as long as Hungarian law requires.
• Visits to szilvahealth.com. Cloudflare, which hosts our website, processes your IP address and the details of your request to deliver the pages and protect them from attacks, based on our legitimate interest in running the website. The website uses no analytics or advertising cookies, and we keep no logs of visits ourselves.

4. What we don’t do

• We don’t sell personal data, or share it for advertising.
• We don’t use patients’ information for anything but providing the service to their healthcare provider.
• Nobody at Szilva looks at patients’ information unless it’s needed to run, secure or support the service, or the law requires it.

5. Who else receives personal data

Our sub-processors process personal data only for us, under data protection terms:

• Amazon Web Services hosts the Szilva server: its database, its files, and the emails it sends, such as password resets. United States (Northern Virginia).
• Cloudflare runs the DNS for szilvahealth.com, and hosts the website. A global network, run by Cloudflare, Inc. in the United States.
• Zoho hosts our email, contact@szilvahealth.com. European Union.

Your browser also contacts these services directly, under their own privacy policies:

• Google reCAPTCHA, on the forms that create an account. Google receives information about your browser and how it’s used, including your IP address, to tell people from bots, and may set cookies. See Google’s Privacy Policy: https://policies.google.com/privacy.
• The U.S. National Library of Medicine’s Clinical Table Search Service, only when staff use the form builder’s LOINC search. It receives the search words and the IP address, never anything about patients. See NLM’s privacy policy: https://www.nlm.nih.gov/web_policies.html.

We also disclose personal data when the law requires it, for example to a court or an authority. For patients’ information, we tell their healthcare provider first, unless the law forbids it.

6. Transfers outside the EU

We’re based in Hungary, and the Szilva server is in the United States, where our customers are. Transfers to the US rely on the EU–US Data Privacy Framework when the recipient is certified under it, and otherwise on the European Commission’s standard contractual clauses.

7. Security

We protect personal data with safeguards suited to health information: encryption in transit and at rest, passwords stored only as salted hashes, access limited to the people and systems that need it, two-factor sign-in for our own administrative accounts, records of sign-ins, a history of every change to every record, and backups.

If a breach affects patients’ information, we tell their healthcare provider without undue delay. If it affects information we’re responsible for, we notify the Hungarian data protection authority within 72 hours where the GDPR requires it, and you, where the breach puts you at high risk.

8. Your rights

Under the GDPR, you can ask us for a copy of your personal data, and to correct it, delete it, restrict its use or transfer it to you in a portable format. You can also object to our using it based on our legitimate interests. Write to contact@szilvahealth.com. We answer within one month; for complex requests, we can take two months more, and tell you if we do. We may need to confirm your identity first. If you’re a patient, see section 2.

If you think we’ve handled your data unlawfully, you can complain to the Hungarian data protection authority, the Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH): 1055 Budapest, Falk Miksa utca 9–11, Hungary; +36 1 391 1400; naih.hu. You can also complain to the authority where you live or work, or go to court.

If you live in the US: we don’t sell personal information, or share it for targeted advertising.

9. Children

Staff accounts are for adults. Patients’ information, children’s included, is for their healthcare provider to decide about, as section 2 describes.

10. Changes to this policy

We post updates here, with a new date. If a change affects how we use your data, we tell our customers by email at least 30 days before it applies.