Privacy policy

Controller

Wladimir Are, Aregatou Digital, Stettiner Str. 14, 52078 Aachen, Germany
Email: info@aregatou.com
Phone: +49 163 7910796

In short

This website sets no cookies, stores no information on your device, uses no analytics or tracking tools and loads no content from third parties; the fonts are also served from this website’s server. The demo practice is covered by its own section below.

Hosting

This website is hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The server is located in a data centre in Helsinki (Finland, EU). Hetzner processes the data solely on my behalf under a data processing agreement pursuant to Art. 28 GDPR.

Visiting the website

Each time you visit, the server processes technically necessary connection data: your IP address, date and time, the requested address, your browser’s identifier and its preferred language (to forward you to the German or English version). This is required to deliver the page and to keep it running securely (legal basis: Art. 6(1)(f) GDPR; legitimate interest: secure and functioning provision of the website).

No access log is stored. Technical status and error messages of the server software may in individual cases contain an IP address; they are used only for troubleshooting and are continuously overwritten once the log reaches a fixed size (at most 30 MB per service).

Contact by email or phone

If you email or call me, I process your details (in particular name, email address or phone number and the content of your enquiry) to answer your inquiry. The legal basis is Art. 6(1)(b) GDPR where your inquiry aims at a contract, otherwise Art. 6(1)(f) GDPR; my legitimate interest is answering your inquiry. My mailbox is operated by Zoho Corporation GmbH, II. Hagen 7, 45127 Essen, Germany, as a processor in data centres in the EU. For support and troubleshooting, Zoho group companies in India may access the data where necessary; there is no adequacy decision of the European Commission for India, and Zoho bases this access on the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR). You can obtain a copy of the standard contractual clauses from me on request. I delete your message once it has been dealt with, unless statutory retention obligations apply. After that, it may technically remain in the trash for up to 30 days and then in Zoho’s backups for up to 3 months. Inquiries from practices about CuraNexus are kept in my customer management (section Customer management), where its retention periods apply.

If you suggest a video call, I join via the tool you choose; its provider processes the data under its own terms.

Inquiry form

If you write to me via the inquiry form, I process the details you enter: name, email address, optionally phone number, company or practice and website address, your selections about your project, starting point and timeframe, and your message. I use them to answer your inquiry. The legal basis is Art. 6(1)(b) GDPR where your inquiry aims at a contract, otherwise Art. 6(1)(f) GDPR; my legitimate interest is answering your inquiry. Required fields are marked; without them I cannot reply.

The form is transmitted to this website’s server at Hetzner Online GmbH (address under “Hosting”) in Helsinki (Finland, EU). There the inquiry is kept only until it has been forwarded to my mailbox, usually less than a minute, and is then deleted from the server. From then on, what is stated under “Contact by email or phone” applies, including Zoho and deletion. To protect against misuse, the server limits the number of inquiries per IP address; for this it keeps the IP address only as a check value in memory, never on disk, and discards it no later than eleven minutes after your last inquiry. The form sets no cookies and embeds no third-party services.

Customer management

I keep inquiries, notes on conversations and demonstrations, and non-binding reservations from practices in a customer management system. Depending on the contact, it holds: name and title, practice, address and website, specialty and number of physicians, email address and phone number, the content of the inquiry, notes on conversations, the reservation, source and date of entry, the history of contacts, and consents and objections. The data comes from you, from public information of your practice (such as its website and legal notice) or, in the case of a recommendation, from the person who referred the contact.

I use the data to answer your inquiry, to prepare a reservation or a contract and to maintain the business contact. Practices whose details come from public sources or from a recommendation receive a letter from me introducing CuraNexus; the letter is delivered by Deutsche Post. The legal basis is Art. 6(1)(b) GDPR where a reservation or a contract is concerned, otherwise Art. 6(1)(f) GDPR; my legitimate interest is acquiring orders from practices, including through advertising by letter, and maintaining business contacts. I contact you by email or phone with offers or follow-up questions only if you have consented (Art. 6(1)(a) GDPR); for this I store the date, channel and wording of your consent.

The customer management system runs on a server of Hetzner Online GmbH (address under “Hosting”) in Helsinki (Finland, EU). Its database and the storage for contract documents are operated by Supabase Pte. Ltd., 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513, in the Frankfurt am Main region (Germany, EU). Both process the data solely on my behalf under a data processing agreement pursuant to Art. 28 GDPR. As Supabase is based in Singapore and also uses Supabase, Inc. and other service providers in the USA for support and operations, access from outside the EU cannot be ruled out. There is no adequacy decision of the European Commission for Singapore, and Supabase does not participate in the EU-US Data Privacy Framework; the transfer is therefore based on the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR), which form part of Supabase’s data processing terms (supabase.com/legal/dpa). Emails about your matter are kept in my mailbox at Zoho (see “Contact by email or phone”).

I back up the database myself every night to the server in Helsinki (Finland, EU). These backups are deleted after 14 days at the latest; until then, deleted data may still be contained in them. Supabase’s plan includes no backups that I can access. According to Supabase, however, it makes backups for recovery purposes, for which it states no retention period under this plan; deleted data may also remain in them for some time.

Data on practices to which I have not yet written and with which I have had no contact (for example from public information or a recommendation) is deleted 4 weeks after it was entered. Otherwise, if no contract is concluded, I delete the data, including the related emails, 12 months after my first letter or after the last contact, whichever is later. If a contract is concluded, I keep contract documents and invoices for as long as statutory retention obligations require (§ 147 AO, § 257 HGB).

You may object to the use of your data for advertising at any time without giving reasons (Art. 21(2) GDPR), and you may withdraw a consent at any time with effect for the future (Art. 7(3) GDPR). An informal email to info@aregatou.com is sufficient. After an objection I delete your data immediately, unless statutory retention obligations apply, and keep only check values (hash values) of your email address, practice name and address together with the date of the objection on a block list, without time limit, so that you no longer receive advertising from me.

Demo practice (demo.curanexus.de)

At demo.curanexus.de I operate a demo practice with fictitious data to demonstrate CuraNexus to practices and other interested parties. Please do not enter any real data there, in particular no information about your health; fictitious details are sufficient for the demonstration. Please arrange real appointments and prescriptions directly with your practice.

Whatever you enter in the forms is stored by the demo like a real practice website: for an appointment booking your name, phone number, email address, preferred date, physician, appointment type and the optional reason; for a prescription request first and last name, date of birth, email address, medication, dosage and note; on the waiting list name, email address, phone number, preferred date and note; when signing in to the patient account (“Mein Konto”) the email address; and answers in medical history questionnaires. From this the demo creates a patient record and a log of actions. The reason, notes, medication and questionnaire answers may be health data. The demo is not intended for processing such data: if you nevertheless enter real information about your health, the demo deletes it together with all other entries the following night at the latest (see below). The entries are visible in the demo’s practice portal, including during demonstrations for interested parties. The legal basis is Art. 6(1)(f) GDPR; my legitimate interest is demonstrating the software and protecting the demo against misuse.

Every night at 03:15 (German time) the demo deletes all entries made by visitors (appointments including questionnaires, prescription requests, waiting list, reminders, patient accounts including sign-in links and sessions, patient records and the log) and reloads the fictitious sample data. There are no backups of the demo database that I can access (its Supabase plan includes none). According to Supabase, however, it makes backups for recovery purposes, for which it states no retention period under this plan; deleted entries may remain in them and in Supabase’s logs (see below) for some time.

The demo runs on a server of Hetzner Online GmbH (address under “Hosting”) in Nuremberg (Germany). It stores the entries in a database of Supabase Pte. Ltd., 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513, in the Frankfurt am Main region (Germany, EU). Both process the data solely on my behalf under a data processing agreement pursuant to Art. 28 GDPR. As Supabase is based in Singapore and also uses Supabase, Inc. and other service providers in the USA for support and operations, access from outside the EU cannot be ruled out. There is no adequacy decision of the European Commission for Singapore, and Supabase does not participate in the EU-US Data Privacy Framework; the transfer is therefore based on the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR), which form part of Supabase’s data processing terms (supabase.com/legal/dpa). Your browser loads the demo’s pages from demo.curanexus.de. Images that someone has uploaded in the demo’s practice portal, however, are loaded directly from Supabase; Supabase then receives your IP address and may deliver such images through a global content delivery network. Sign-in and account settings in the practice portal, which I use for demonstrations, also run directly between the browser and Supabase.

The demo sends emails only to fixed addresses of Aregatou Digital, for demonstrations and functional tests. It sends nothing to any other address, including the addresses entered in the forms. For sending I use Brevo GmbH, Köpenicker Str. 126, 10179 Berlin, Germany, as a processor; Brevo hosts the data on servers in France, Germany and Belgium. For customer service and maintenance, analytics and delivery via a content delivery network, Brevo also uses service providers in the USA and in India. The transfer to the USA is based on the European Commission’s adequacy decision on the EU-US Data Privacy Framework (Art. 45 GDPR) and additionally on standard contractual clauses; there is no adequacy decision for India, so the transfer there is based on the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR). Which safeguards apply to which service provider is set out in Brevo’s data processing agreement (Annex 3 to its terms of use, www.brevo.com/de/legal/termsofuse); you can obtain a copy of the standard contractual clauses from me on request. Brevo deletes the logs of these emails one month after sending and does not store previews of them. Brevo counts opens and clicks of these emails only anonymously, without attributing them to a recipient; links in the emails run through a Brevo redirect.

The demo sets only technically necessary cookies: for the selected language and, after signing in, for the session in the patient account or the practice portal. Your choice in the cookie notice is stored locally by your browser. There are no analytics or advertising cookies. The legal basis is § 25(2) no. 2 TDDDG.

When you visit the demo, its server processes the same technically necessary connection data as for aregatou.com (IP address, date and time, requested address, browser identifier and language; legal basis Art. 6(1)(f) GDPR). To protect against misuse, the demo limits the number of requests per IP address; for this limit it keeps IP addresses only in working memory, not in the database. For the session in “Mein Konto” the demo also stores a check value of your IP address formed with a key, and your browser’s identifier; both are deleted with the account at night. No access log is stored on the demo’s server. Technical status and error messages may in individual cases contain an IP address; they are continuously overwritten once the log reaches a fixed size (at most 30 MB per service). Supabase keeps the logs of access to the database and its API that it makes available to me for one day under the demo’s plan, according to the plan description; they may contain parts of your entries, such as an email address. According to Supabase, it also keeps further logs for operational and security purposes, whose retention periods are not published.

Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). An informal email to info@aregatou.com is sufficient.

Right to object (Art. 21 GDPR)

Where I process data on the basis of Art. 6(1)(f) GDPR, you may object to this processing at any time on grounds relating to your particular situation. I will then no longer process the data unless I can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

Right to lodge a complaint

You may lodge a complaint with a data protection supervisory authority. The authority responsible for me is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany, www.ldi.nrw.de.

Obligation to provide data, automated decisions

You are under no statutory or contractual obligation to provide me with data. Without the connection data that is transmitted for technical reasons, however, the website cannot be displayed, and without your contact details I cannot answer your inquiry. No automated decision-making, including profiling (Art. 22 GDPR), takes place.