Medical Project Confidentiality Policy

This policy describes how GTEOM Group OÜ, trading as PangeaVox Translation, approaches confidential medical project information. It supplements our Privacy Policy and any written agreement with the client. Where specific contractual requirements apply, those requirements govern the project.

1. Before sharing medical records

Please do not upload patient-identifiable medical records or protected health information (PHI) through our public Contact or Request a Quote forms. Contact us first to discuss an agreed secure file-transfer method and applicable contractual requirements. Where possible, share de-identified or minimised materials during the quotation stage.

2. Confidential use and access

Medical project materials are used for the agreed linguistic services and associated project administration, in accordance with client instructions and applicable law. Access is restricted to people engaged in the relevant project who require the information for their assigned work.

3. Linguists and international work

Projects may involve independent translators, editors or reviewers who are subject to confidentiality obligations. Their location and any permitted international transfers must be compatible with the client's requirements and applicable law. Any necessary restrictions or additional subcontractor arrangements should be agreed before identifiable data is shared.

4. Technology and AI-assisted processing

Project-specific security and technology requirements are agreed before work begins. We do not submit patient-identifiable material to public AI or machine-translation services without the client's prior written authorisation and any necessary safeguards and agreements.

5. Retention and incidents

Retention of project files and translation memories depends on the agreed client instructions, applicable contracts and legal obligations. Requirements for return, deletion or continued storage should be confirmed as part of the project arrangements. Suspected unauthorised access or disclosure is handled in accordance with the applicable notification obligations.

6. Regulated projects and agreements

Before accepting regulated personal health information, we discuss any required data processing agreement (DPA), HIPAA business associate agreement (BAA), subcontractor terms and security arrangements. A non-disclosure agreement alone may not satisfy these requirements. Acceptance of identifiable records is subject to the necessary arrangements being agreed in advance. This policy does not constitute a certification of HIPAA compliance.

7. Contact

To discuss a confidential medical project or appropriate file transfer, please use our contact form without attaching identifiable patient records.