Privacy policy
1. Controller
R. R., MDInform, [address], Germany. Email: info@mdinform.com
2. What MDInform is — and is not
MDInform is a research aid for medical professionals. The platform searches exclusively publicly available scientific articles and publications from specialist databases (e.g. PubMed, Europe PMC, OpenAlex) and produces AI-assisted summaries and answers.
We do not process any patient data or treatment data. MDInform makes no diagnoses and no treatment decisions.
3. Which personal data we process
Even though no patient data is involved, we process personal data of our users:
- Account data: email address, password (stored encrypted), first name, last name, specialty, optionally title/institution/country.
- Usage data: search terms, questions asked to the AI, saved articles, generated reports.
- Technical data: login time, IP address, browser information.
- Payment data: for paid subscriptions, the information required for processing (see section 6).
4. Where your data is stored
Your account and usage data are stored on a server in Germany in a PostgreSQL database. We do not pass this data to third parties, except where technically required for operation (see section 5).
5. Transfer to services outside the EU (important)
For certain functions we transmit specific content to external service providers. This may result in data being transferred to countries outside the EU. Specifically:
- AI summaries and Q&A (DeepSeek): When you request a summary or ask a question about an article, we transmit the text of your request and the relevant article content to the AI provider DeepSeek. Its servers are located in China — a country without an EU adequacy decision. Please do not enter any personal or confidential information in your requests.
- Web search (Google): For supplementary searches we use Google services (USA).
- Specialist databases: Search queries are sent to the respective databases (incl. PubMed/USA, Europe PMC/EU).
- Payment providers: PayPal (see section 6).
The legal basis for these transfers is the performance of the usage contract (Art. 6(1)(b) GDPR) and your consent when using the respective function. Use of these functions is voluntary; without using them, no corresponding transfer takes place.
6. Payment processing
For paid subscriptions we use PayPal. When you pay, the required data (e.g. email, payment amount) is transmitted directly to PayPal and processed there under its privacy policy. We do not process or store full credit card data ourselves. Credit card payment is currently in a test phase and not yet active.
7. Retention period
We store your data as long as your account exists. After deletion of your account, personal data is deleted unless statutory retention obligations (e.g. tax law) apply.
8. Your rights
You have the right to access, rectification, erasure, restriction of processing, data portability and objection. You may also lodge a complaint with a data protection supervisory authority. To exercise your rights, a message to the email address above is sufficient.
9. Cookies
We use only technically necessary cookies for login and operation. No tracking for advertising purposes takes place.