Privacy Policy
Last updated: December 11, 2025
1. Introduction
This privacy policy describes how Lavamilk AS processes personal data when you use the Attestio service. We are committed to protecting your privacy and process all personal data in accordance with applicable privacy legislation, including the EU General Data Protection Regulation (GDPR). Attestio is an AI-powered service for generating medical certificates and attestations. We have designed the service with privacy as a top priority and never store patient data or medical information in our systems.
2. Data Controller
The data controller for personal data processed in connection with Attestio is:
Lavamilk AS
Organization number: 935 746 485
Email: support@lavamilk.org
3. What personal data do we process?
Account Information
- Email address
- Name (optional)
- Authentication data (encrypted tokens)
Payment Information
- Payment history
- Subscription status
- Billing information
Card details must be provided when starting a trial. Payment details (card numbers, etc.) are handled directly by our payment provider Stripe and are never stored in our systems.
Technical Data
- IP address (anonymized)
- Browser type and version
- Access time
- Language settings
Medical Content
We NEVER store patient records, medical information, or generated certificates.
All medical information is processed exclusively in real-time (2-5 seconds) and immediately discarded. No patient data is stored in our databases or logs.
4. Purpose of Processing
- Service delivery: Authentication, access control, and certificate generation
- Subscription and payment: Payment processing and billing
- Communication: Service notifications and support
- Service improvement: Anonymized analysis and security improvements
5. Legal Basis
- Performance of contract - Account management, payment processing, and AI processing
- Legitimate interest - Security measures and technical analysis
- Consent - Marketing (where applicable)
6. Storage and Deletion
Medical content: 0 seconds - never stored
- Account information - As long as the account is active, deleted within 30 days after deletion
- Payment information - According to accounting legislation (normally 5 years)
- Technical logs - Automatically deleted after 90 days
7. Sharing with Third Parties
| Provider | Purpose |
|---|---|
| Supabase | Authentication and user database |
| Stripe | Payment processing |
| Google (Gemini) | AI processing (transient only) |
| Vercel | Hosting and infrastructure |
All subprocessors are subject to data processing agreements and process data in accordance with GDPR. Google does not store or use data sent through Attestio for training AI models.
8. Your Rights
- Right of access - You can request information about what personal data we process about you
- Right to rectification - You can request that incorrect information be corrected
- Right to erasure - You can request that your personal data be deleted
- Right to restriction - You can request that processing be restricted in certain situations
- Right to data portability - You can request to receive your personal data in a machine-readable format
- Right to object - You can object to processing based on legitimate interest
To exercise your rights, contact us at support@lavamilk.org. We will respond within 30 days.
9. Cookies
We only use technically necessary cookies for:
- Authentication and session management
- Security features (CSRF protection)
- Language settings
We do not use analytics tools like Google Analytics, marketing cookies, or third-party trackers.
10. Security
- All data transmission occurs via HTTPS with TLS encryption
- CSRF protection against request forgery
- Medical content is never logged
- Strict access restrictions to systems
11. Changes to Privacy Policy
We may update this privacy policy from time to time. For material changes, we will notify you via email or through the service.
12. Contact Us
Have questions about privacy or want to exercise your rights? We typically respond within 2-3 business days.