Last updated: November 2026
This policy explains how personal data is processed on pharmacopilot.eu, both when you request early access and when you use the PharmaCopilot beta chat assistant. This policy is provided in English only.
PharmaCopilot is a product developed by myHealthbox, Via Spadolini 11/B, 20141 Milano, Italy, VAT IT09255870967, which is the data controller for the personal data described in this policy ("we", "us", "our").
Contact: hello@pharmacopilot.eu. For privacy requests you may also write to info@myhealthbox.eu.
When you request early access, we collect:
Purpose and legal basis. We use this data to manage your request, assess participation in the beta programme, contact you about it and tailor your onboarding. The legal basis is taking steps at your request before you join the beta (Article 6(1)(b) GDPR). The IP address is kept to protect the form against abuse, based on our legitimate interest in the security of the service (Article 6(1)(f) GDPR). We do not send marketing communications unrelated to the beta without your separate consent.
Please do not include patient information or other health data in the free-text field.
Retention. We keep registration data for as long as the beta programme is active, then delete it, unless you become a user of a subsequent service, in which case you will be informed separately. You can ask us to delete it at any time.
PharmaCopilot is an AI assistant: answers are generated automatically by large language models from regulatory documents in the myHealthbox database. Access is by invite code only. When you use the chat, we process:
Do not enter patient-identifiable data (names, dates of birth, contact details, record numbers or any combination of details that could identify a patient), and do not enter other personal health data about yourself or others. Ask your questions in general terms about the medicine or the clinical situation.
Purposes and legal bases.
Retention. Chats, feedback and session data are kept for the duration of the beta and for up to 12 months afterwards for quality review; they are then deleted or anonymised. Technical server logs are kept for a shorter period, only as long as needed for security and troubleshooting.
To generate answers, your messages, the recent conversation history, excerpts of the retrieved documents and the inferred context described above are sent to Anthropic (Anthropic, PBC and its affiliates), which provides the Claude language models and acts as our data processor. Your alias, IP address and user agent are not included in these requests. Under its commercial terms, Anthropic does not use API inputs to train its models; it may retain them for a limited period under those terms, for example for safety and abuse monitoring.
Anthropic processes data in the United States. The transfer is based on the EU-US Data Privacy Framework where the recipient is certified, and otherwise on the European Commission's Standard Contractual Clauses (Article 46 GDPR). You can request further information on these safeguards by contacting us.
Some processing steps (document search, embeddings and, as a fallback, open-source language models) run on our own servers and do not involve third parties.
If you accept analytics cookies (section 6), Google may process the visit data on servers in the United States. Google LLC is certified under the EU-US Data Privacy Framework, covered by the European Commission's adequacy decision of 10 July 2023 (Article 45 GDPR), and Google's data processing terms also include the Commission's Standard Contractual Clauses (Article 46 GDPR).
We do not sell or rent your personal data, and we do not share it with third parties for marketing purposes. Within myHealthbox, data is accessible only to the staff who need it to run and improve the service. Besides Anthropic, we use technical providers (such as hosting) that process data on our behalf under data processing agreements and may not use it for their own purposes.
If you accept analytics cookies, Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) provides Google Analytics and processes the visit data described in section 6 on our behalf, as our processor under Google's data processing terms.
The fonts, style sheets, scripts and icons of our pages are served from our own servers, so loading a page does not send your IP address to third-party content providers. Nothing is sent to Google unless and until you accept analytics cookies.
We do not use advertising or profiling cookies, and no tracking service other than Google Analytics, which runs only with your consent. We use the following storage and no other:
pp_chat_session (technical, no consent needed): an entry
in your browser's local storage containing your chat session token and current
conversation identifier, so that you stay signed in to the chat. It remains until you
clear your browser's storage or start over; you can delete it at any time through your
browser settings.pc_consent (technical, no consent needed): records whether
you accepted or rejected analytics cookies, so that we do not ask again; 180 days._ga and _ga_*,
analytics, consent needed): set only after you click "Accept" in the cookie banner, and
kept for up to 2 years. They hold a random identifier that lets Google Analytics count
visits and returning visitors. Until you accept, the Google Analytics script is not even
loaded, so no data reaches Google.What Google Analytics collects. If you accept, Google Analytics records the pages you view and for how long, the page or search engine that brought you here, your browser, device and screen size, your approximate location (country and region, derived from your IP address; Google Analytics 4 does not log or store the IP address itself) and the random identifier in the cookie. It does not know your name, email address or anything you type in the chat. The legal basis is your consent (Article 6(1)(a) GDPR and Article 122 of the Italian Privacy Code). Google Analytics keeps the data about individual visits (events) for 2 months and the data linked to the identifier in the cookie (user-level data) for 14 months, after which only aggregated statistics remain.
The banner offers "Reject" and "Accept" with equal prominence; closing the page without choosing counts as a rejection and you will be asked again on your next visit. You can change your choice at any time from "Cookie settings" at the bottom of each page, or delete the cookies in your browser. Rejecting does not limit your use of the site or the chat.
Under the GDPR you have the right to:
To exercise these rights, email hello@pharmacopilot.eu or info@myhealthbox.eu. Because the chat uses invite codes and optional aliases, we may ask for your invite code or other details to identify your conversations. We will reply within one month.
You also have the right to lodge a complaint with the Italian supervisory authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it), or with the supervisory authority of the EU country where you live or work.
Answers are generated automatically, but no decision with legal or similarly significant effects is taken about you on the basis of automated processing. The user type and other context inferred from your messages are used only to tailor answers.
We take appropriate technical and organisational measures to protect personal data against unauthorised access, loss or misuse. Data is encrypted in transit (HTTPS), stored in access-controlled databases, and chat exports are restricted to authorised staff.
We may update this policy from time to time. The "last updated" date at the top of this page reflects the latest version. We will inform beta participants of significant changes.
myHealthbox, Via Spadolini 11/B, 20141 Milano, Italy, VAT IT09255870967. Email: hello@pharmacopilot.eu or, for privacy matters, info@myhealthbox.eu. See also our Terms of Use.
We use technical storage to run this site and the beta chat. With your consent we also use Google Analytics cookies to measure visits. We do not use advertising cookies. You can change your choice at any time from “Cookie settings” at the bottom of each page. Privacy and cookie policy