3D Organon and related Medis Media products and services
Last updated: June 5, 2026
This Privacy Policy explains how Medis Media handles personal information when you visit our websites, use our applications or services, or interact with our team. It describes the information we process, our purposes, the recipients involved and your privacy rights. It applies to individual users, institutional customers and services supplied through authorized partners.
1. Who we are and how to contact us
Medis Media Pty Ltd, based in Queensland, Australia, provides 3D Organon and related services together with its Medis Media affiliates, including Medis Media Corporation in the United States. “Medis Media,” “we,” “us” and “our” refer to the entity responsible for the activity described. For licensed services, the contracting entity is identified in the applicable Order Form, invoice or agreement.
2. Services and institutional responsibilities
This policy covers our websites, 3D Organon Web, desktop, mobile, tablet and XR applications, Examverse, Medverse, Lessons, medical imaging, quizzes, the AI Study Assistant and related modules and services where available. The information handled depends on the features used and the applicable deployment and settings. Separate notices address employment and recruitment.
We act as controller when we determine why and how personal information is processed, including for our own business relationships and website administration. When an institution determines the purposes for processing learner records, assessments or instructional content, we process that information on its behalf under the applicable agreement. The institution’s privacy notice explains its educational purposes and access decisions. A Data Processing Agreement, where required, defines the parties’ responsibilities.
3. Information we collect and its sources
We receive information from you, your institution, authorized business partners and configured integrations. We also generate technical records when services are used. Personal information can include account identifiers, IP addresses and other records that can be linked to an individual, even where a name is absent.
Account and licensing information may include your name, email address, username, institutional affiliation, role, account identifier, subscription entitlement and authentication records. Commercial and support information may include business contact details, order and billing references, correspondence, inquiries and troubleshooting material you provide.
Technical and usage information may include IP addresses, device and browser characteristics, application versions, diagnostic records, security events and feature activity. Website information may include inquiry forms, communication preferences, cookies and analytics identifiers.
Where the selected features support them, educational and collaboration records may include learner or session identifiers, lessons, quizzes, examination content, submissions, scores, feedback and shared materials. Imaging and AI interactions are described below. We limit collection to information relevant to the service and authorized purpose.
4. How we use information
We use information to provide and administer services, authenticate users, verify licenses, deliver educational features, respond to support requests, maintain security and reliability, manage transactions, communicate service changes and meet legal obligations. We may analyze service performance and improve products within the limits of applicable law and contractual permissions. Institution-controlled information is processed under documented instructions where we act as processor.
Where the EU General Data Protection Regulation (GDPR) or UK data protection law applies and we act as controller, our lawful grounds may include a contract with the individual, legal obligations, consent where required, or legitimate interests in service delivery, security and business administration after considering individual rights. An institutional subscription does not automatically create a contract with each learner. Authorized processing of special-category information requires an additional applicable legal condition.
Information necessary for registration, licensing or a requested function may be required to provide it. Optional information may be declined. Where processing relies on consent, you may withdraw it without affecting earlier lawful processing. Accepting terms or continuing to use a service does not substitute for a separate consent required by law.
5. Institutional learning and assessment records
Institutions determine their authorized users, educational purposes and permissions for institution-controlled records. Institutional administrators may receive records and reports within their assigned access rights. Medis Media personnel access is limited to authorized service, support, security or legal purposes, subject to confidentiality and access restrictions.
Assessment features may store examination materials, submissions and results in encrypted form to deliver the selected functions. Encryption, access and retention follow the applicable service design and agreement. Encrypted records remain subject to privacy obligations where they relate to identifiable individuals. We do not authorize unrelated advertising use of institution-controlled educational content.
Institutions remain responsible for their education-record obligations, including FERPA where applicable. We fulfill the responsibilities assigned to us by applicable law and agreement and assist institutions with requests concerning information processed on their behalf.
6. Medical imaging and sensitive information
Supported medical-imaging workflows process DICOM studies locally on the user-controlled device, including functions designed to remove identifiers and create 3D reconstructions. Local processing does not require automatic upload of raw clinical images to our hosted services. Optional synchronization or sharing of a de-identified model, where supported, is a separate user-selected transfer.
Users and institutions must have authority to use imaging information and verify that permitted exports contain no prohibited identifying information. Identifiers may appear in image metadata, visible text, filenames or associated content. A reconstruction is not automatically anonymous if it can still be linked to an individual. Information that remains identifiable continues to receive applicable privacy protection.
Do not submit patient-identifiable information, protected health information (PHI), raw DICOM files or other restricted sensitive information to hosted or AI services unless Medis Media expressly authorizes the workflow in writing with the required safeguards and agreements. Supported local use remains subject to product documentation and institutional controls. Any authorized HIPAA-regulated hosted processing also requires the applicable business associate arrangements.
7. AI features
The AI Study Assistant uses OpenAI API services for educational assistance. When you use an AI feature, permitted prompts and relevant feature context are sent for processing and a generated response is returned. Associated information may also be processed for service operation and security. Retention depends on the approved feature and provider arrangements; use of the API does not itself mean that every interaction has zero retention.
Do not include unnecessary identifying details or prohibited patient, clinical or sensitive information in prompts. We do not authorize use of customer personal information or confidential institutional content for model training or fine-tuning without specific lawful authorization and applicable contractual permission. AI outputs require human review and must not be used as the sole basis for clinical or other high-stakes decisions.
8. Who receives information
Authorized providers process information to deliver functions such as hosting, infrastructure, communications, support and configured integrations, subject to appropriate contractual and security requirements. Relevant cloud services use hosting in United States data centers. OpenAI supports the AI functions described above. Institutional customers may obtain applicable subprocessor information under their agreements.
We may disclose information to your institution within its authorized scope, to partners administering your transaction or support relationship, to professional advisers under confidentiality obligations, or where required or permitted for a lawful legal process. A corporate transaction may involve transfer of information subject to applicable safeguards and notice requirements.
Independent identity providers, learning platforms, device providers and app stores have their own privacy responsibilities for processing they control. Their notices apply to those activities. We remain responsible for processing we control and for providers acting on our behalf as required by applicable law.
9. International processing
Relevant hosted services store information in the United States. Authorized personnel and service providers may process information in other countries according to the service and support arrangement. International processing can include remote access and onward provider processing as well as storage.
Where international-transfer restrictions apply, an applicable adequacy arrangement or appropriate safeguards, such as valid contractual transfer instruments and additional measures, are required. The relevant mechanism depends on the originating law, recipient and processing. You may request information about applicable safeguards, including an appropriately redacted copy where available under applicable law, through our privacy contact.
10. Security
We apply administrative, technical and organizational safeguards appropriate to the information and service, including access restrictions, encryption controls, secure development and incident response. Institutions are responsible for systems and settings they administer, including local devices, identity integrations, permissions and exported files.
No system provides absolute protection. Report suspected account compromise or unintended disclosure using our Website Contact form. We investigate incidents and provide notifications required by applicable law and agreements.
11. Retention and deletion
We retain personal information for as long as lawfully needed for the stated purpose, considering the service relationship, institution instructions, legal obligations, security needs and the establishment or defense of legal claims. Account, educational, support, technical, commercial and marketing records have different retention requirements. Institutional content follows the applicable agreement and authorized instructions.
On a valid request or termination, we return, delete or irreversibly anonymize information as appropriate, except where lawful retention is required. Information held for a legal obligation or dispute is limited to the relevant purpose. Deleted information may remain in restricted backups until scheduled expiration; applicable deletion and restriction instructions are reapplied if a backup is restored. Backup retention does not create a separate entitlement to continued service or customer retrieval after termination.
12. Cookies analytics and marketing
Our website uses cookies and similar technologies for website functions and analytics, including Google Analytics. Depending on configuration, analytics may involve online identifiers and device or usage information. Essential storage may support authentication, security and preferences. Optional technologies are subject to applicable notice and consent requirements and the available preference controls.
You can manage available choices through website controls and browser settings. Google also provides an Analytics opt-out browser add-on. Blocking essential storage may affect functionality. Application diagnostics and platform integrations are separate from website cookies and may generate technical or usage records.
We send promotional communications only where permitted by law and provide an unsubscribe method. Operational, security and contractual messages may continue where needed. Where an activity is legally classified as a sale, sharing or targeted advertising, applicable notice, choice and recognized preference-signal requirements must be satisfied before it proceeds. This policy does not authorize unrelated advertising use of institution-controlled content.
13. Your rights and complaints
Depending on applicable law, you may request access, correction, deletion, portability, restriction or objection and may withdraw consent. Additional rights may include choices concerning sensitive information, sale, sharing, targeted advertising or qualifying automated decisions, and an appeal against certain request decisions. Rights are subject to applicable conditions and lawful exceptions. We do not unlawfully discriminate against individuals for exercising their rights.
Send requests or complaints to support@3dorganon.com. We verify identity or representative authority only as necessary and respond within the applicable legal deadline. Where GDPR applies, controller requests are ordinarily answered within one month, and any permitted extension is explained within the initial month. We explain refusals or limitations and applicable complaint or review routes.
For institution-controlled information, contact your institution; we route or assist with requests under the applicable agreement. You may also complain to your competent data protection authority, including the relevant European Economic Area supervisory authority, the UK Information Commissioner or the Australian Information Commissioner where applicable.
14. Children and educational use
Our services are not designed for independent consumer use by children under 13, and we do not knowingly invite such registrations. Institutional use involving children requires an approved educational arrangement, age-appropriate information and the permissions required by applicable law. School authorization is limited to legally permitted educational purposes and does not authorize unrelated commercial use of children’s information.
Where parental authorization is required, it must be obtained before the relevant collection. Contact us if you believe a child’s information was collected without required authorization. We investigate and take appropriate action under applicable law and the institutional arrangement.
15. Changes to this policy
We review this policy when services, processing practices or applicable requirements change and update the date shown above. Material changes receive additional notice where required. Updates do not replace required consent or amend separately signed commitments except through the applicable lawful process. Product-specific notices may provide further information. Mandatory privacy law and applicable individual rights prevail over inconsistent contractual wording.
For privacy inquiries, requests or complaints, Legal notices may use our Website Contact form. Please identify the service and, where relevant, your institution so we can direct your inquiry to the responsible entity. Postal contact details and further information about the responsible entity are available through these contacts.