Privacy notice
What we collect, why, where it lives and your rights under GDPR. Health data is special-category data and is handled under explicit consent.
1Controller & DPO
Name and contact of the data controller and Data Protection Officer.
2What we collect
Identity data (email, sign-in) and health data (protocols, logs, documents), stored separately and linked only by an opaque ID. We also record visits to the site — see “Visitor analytics” below.
3Legal basis
Contract for your account; explicit consent (Art. 9(2)(a)) for each health-data purpose, recorded and revocable.
4Where it’s stored
EU hosting. Sub-processors are listed publicly with their region.
5Your rights
Access, rectification, erasure, portability, restriction and objection — mostly self-service in Account.
6Visitor analytics
We measure traffic ourselves, on our own server. There is no third-party analytics service, no advertising network, no tracking cookie and no tracking script. For each page view on the public site we record the page, the time, the language, the referring site, your browser, operating system and device type, any search term you typed into our library search, and your IP address. From the IP address we derive an approximate location (country, region, city) and your network operator, using a database held on our own server — your address is never sent to anyone else. Pages behind sign-in are counted by page address only: no IP address is stored for them, and they are never linked to your account, so we do not build a record of what any individual member reads.
7Why, and on what basis
To understand which pages are useful, to find what the library is missing, and to detect and investigate abuse, scraping and attacks. The legal basis is our legitimate interest (Art. 6(1)(f)) in running and protecting the site. Because no information is stored on or read from your device, this does not rely on cookie consent. You can object at any time using the contact details above.
8Who can see it
Aggregate reports are visible to our staff. IP addresses and the per-visitor view are restricted to administrator and engineer roles, and every time a member of staff opens a visitor’s detail it is written to our audit log.
9Retention
Inactive accounts are warned at 24 months and deleted at 30. Visitor IP addresses are deleted automatically after 90 days; the rest of the visit record is kept without the address for long-term traffic trends.
Draft structure for legal review — not final wording.