Privacy

1. Controller

You can also use our contact form for general inquiries and privacy requests. This notice covers the website and its inquiry forms. Future app use or research involving patient data requires separate privacy information.

2. Website delivery and security

The website is hosted with Cloudflare, Inc., USA. When a page is requested, connection information such as IP address, time, requested address, browser information and, where applicable, referring page is processed to deliver the website and detect abuse and technical errors.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is providing a secure, reliable website. Recipients include the hosting provider and its relevant service providers. Processing or access outside the EEA, particularly in the USA, may occur.

The Cloudflare service terms incorporate its processing addendum, which provides EU Standard Contractual Clauses for applicable third-country transfers. A copy of the relevant safeguards may be requested using the contact address above. We keep no access logs of our own; persistent Workers logging is disabled. This does not exclude the provider’s technical security logs. Cloudflare bases retention on the processing purpose, operational and security needs and legal obligations; its privacy policy does not specify one universal fixed period.

3. Email inquiries

When you email us, we process your sender address, message, any attachments and technical message information to handle your inquiry. Please do not send patient information or health data.

The contact address uses Google Workspace Individual. The contracting provider is Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland. The Individual terms include data-processing terms for business use. Processing outside the EEA is possible. The account’s applicable transfer safeguards and contract records still need documenting.

General inquiries are processed under Article 6(1)(f) GDPR; our legitimate interest is answering your inquiry. Article 6(1)(b) applies when you personally are a prospective contracting party and request steps before a contract. Inquiries made on behalf of a clinic generally rely on Article 6(1)(f).

Proposed retention rule: ordinary inquiry correspondence is deleted within 90 days after the inquiry is resolved. Necessary contract records, legally required business records or information needed to establish, exercise or defend legal claims follow the relevant retention requirements. Implementation of this rule in the mailbox still needs verification.

4. Contact form and pilot inquiries

Pilot inquiries require your name, email and clinic or organization so we can identify your inquiry and discuss your interest; the message is optional. The general contact form requires only an email address and message; your name and organization are optional. You have no statutory or contractual obligation to supply these details. Without the required fields you cannot submit the form, but you can email us directly.

When the button reads “Send pilot request” or “Send message”, the details are sent to Convex, Inc., USA, and stored with the receipt time, inquiry type and a technical request ID. The legal bases and legitimate interests are described in section 3. Preventing repeated or abusive submissions also serves our legitimate interest in maintaining a working contact channel.

An operator notification is sent through Resend (Plus Five Five, Inc., USA) to our Gmail address. New notifications contain only a link to the protected dashboard, but no requester names, email addresses, organizations or message contents. Resend and the mailbox provider process the operator’s address and technical sending information. No automatic confirmation email is sent to you.

Form records are removed from the active database after 90 days from receipt during the next hourly deletion run. Earlier deletion may be requested, subject to applicable legal grounds. Subsequent correspondence follows section 3. Finalized and abandoned notification records and their contents in the sending component are removed from an age of 30 days during the next hourly deletion run. Previously sent notifications containing inquiry details and backup copies require a separate deletion review.

Convex’s production database is configured in Europe (Ireland). The dashboard currently has no customer-created backups or periodic backup schedule; this does not exclude the provider’s internal backups. The Convex service terms incorporate its processing addendum, which includes EU Standard Contractual Clauses for applicable transfers outside the EEA. Further information: Convex subprocessors.

According to its provider information, Resend stores email and log data in the USA for 30 days and retains backups for seven days. The Resend processing addendum takes effect on registration and includes EU Standard Contractual Clauses. A copy of the relevant safeguards may be requested using the contact address above. The retention period for Convex’s internal backups still needs documenting.

When the button reads “Open email app”, the website opens a draft in your email application. In this mode the website does not store your form entries or send them to Convex or Resend. Your inquiry is sent only when you send the draft yourself in your email application.

5. Cookies, measurement and external content

The website code uses no analytics or marketing services, sets no cookies and uses neither Local Storage nor Session Storage. Fonts and 3D models are served with the website. No external videos, maps or social-media content are embedded.

External websites open only when you choose their links; their own privacy notices apply. The public site check on 4 October 2026 found no additional analytics scripts, cookies or entries in Local Storage or Session Storage. Changes to the hosting configuration require another check.

6. Your rights

Subject to the applicable conditions, you may request access, rectification, erasure, restriction of processing and data portability. Where processing relies on consent, you may withdraw it at any time for future processing.

Objection: You may object to processing under Article 6(1)(f) GDPR on grounds relating to your particular situation. Contact us using the email address above or the contact form. Inquiry data is not used for newsletters or marketing mailings.

You may complain to a supervisory authority, particularly where you normally live, work or where the alleged infringement occurred. The operator’s supervisory authority is the Hessian Commissioner for Data Protection and Freedom of Information.

7. Automated decisions

We do not use inquiries for solely automated decisions producing legal or similarly significant effects or for profiling. The forms only use technical input validation and abuse-prevention checks.