MDInformAI

Privacy policy

Note: this is a careful draft, not legal advice. Please have it reviewed by a lawyer before going public — especially regarding transfers to services outside the EU.

1. Controller

Ramy Amirah, MDInform, Auwaldstr. 1, 79110 Freiburg, Germany. Email: info@mdinform.com

2. What MDInform is — and is not

MDInform is a research aid for medical professionals. The platform searches exclusively publicly available scientific articles and publications from specialist databases (e.g. PubMed, Europe PMC, OpenAlex) and produces AI-assisted summaries and answers.

We do not process any patient data or treatment data. MDInform makes no diagnoses and no treatment decisions.

3. Which personal data we process

Even though no patient data is involved, we process personal data of our users:

4. Where your data is stored

Your account and usage data are stored on a server in Germany in a PostgreSQL database. We do not pass this data to third parties, except where technically required for operation (see section 5).

5. Transfer to services outside the EU (important)

For certain functions we transmit specific content to external service providers. This may result in data being transferred to countries outside the EU. Specifically:

The legal basis for these transfers is the performance of the usage contract (Art. 6(1)(b) GDPR) and your consent when using the respective function. Use of these functions is voluntary; without using them, no corresponding transfer takes place.

6. Payment processing

For paid subscriptions we use PayPal. When you pay, the required data (e.g. email, payment amount) is transmitted directly to PayPal and processed there under its privacy policy. We do not process or store full credit card data ourselves. Credit card payment is currently in a test phase and not yet active.

Newsletter

If you choose “News by email” at registration or in your account, we occasionally send you information about new MDInform features to your email address. The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time in your account under “News by email”; emails are sent via our own mail server. We only store your email address and the time of consent.

7. Retention period

We store your data as long as your account exists. After deletion of your account, personal data is deleted unless statutory retention obligations (e.g. tax law) apply.

Storage of your searches and questions

We store your search terms and the questions you ask the AI so that you can find your history and reports again, so that we can trace errors and detect misuse, and for aggregated usage statistics (e.g. which tools are used how often and which topics are frequent – without names). The legal basis is the performance of the usage contract (Art. 6(1)(b) GDPR) and our legitimate interest in operating and improving the service (Art. 6(1)(f) GDPR). The texts of your searches and questions are deleted automatically after 90 days; only the count remains (e.g. “one Research Finder search on 3 May”) without content. Operators see no search texts of individual persons in the statistics. Access to the search texts of an account is only possible with a documented reason (e.g. your support request or suspected misuse); every such access is logged.

8. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection. You may also lodge a complaint with a data protection supervisory authority. To exercise your rights, a message to the email address above is sufficient.

Hosting and server logs

The website runs on servers of IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Deutschland. When you visit, the server stores technically necessary data (IP address, date and time, page requested, browser identifier) in log files to ensure secure operation and defend against attacks. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR). Logs are deleted after 14 days at the latest. A data processing agreement (Art. 28 GDPR) is in place with the host.

Sending emails

We send confirmation, security and service emails (e.g. login code, password reset, reports) via an email service of Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Your email address and the message content are processed. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR).

Legal bases at a glance

Account, research features and AI answers: performance of contract (Art. 6(1)(b) GDPR). Newsletter: your consent (Art. 6(1)(a) GDPR), revocable at any time. Security, abuse prevention and server logs: legitimate interest (Art. 6(1)(f) GDPR). Retention duties for payments: legal obligation (Art. 6(1)(c) GDPR).

Transfers to third countries

Where data is transferred to providers outside the EU (see section 5), this is based on an adequacy decision of the EU Commission (e.g. EU-US Data Privacy Framework) or the EU standard contractual clauses (Art. 46 GDPR). Please do not enter patient data or other third-party health data in MDInform.

Right to lodge a complaint

You can lodge a complaint with a data protection supervisory authority. The authority responsible for us is: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart.

Obligation to provide data, no automated decisions

An account with an email address is required to use MDInform; without this data we cannot provide the service. No automated decision-making, including profiling within the meaning of Art. 22 GDPR, takes place.

9. Cookies

We use only technically necessary cookies for login and operation. No tracking for advertising purposes takes place.

← Back to home