How are medical certificates handled?
As GDPR special-category data: uploaded with the sickness request, visible only to approvers and admins, hosted in the EU, included in data exports and permanently purged when a person is erased. They are never copied into notifications or payroll exports.