Privacy policy

The PHASE application potentially processes special categories of personal data within the meaning of Art. 9 GDPR (health data). Protecting this sensitive data is a central development goal.

Current status: PHASE is a prototype in active development. Application data is processed in a cloud database, not only locally on the device. The required evidence and agreements (including a data processing agreement and a data protection impact assessment) are currently being put in place. Use with real health data only takes place as part of the pilot use after explicit consent.

You can generally use this website without providing personal data. If you use the contact form, the data you enter (name, email address, role, interests, optionally organisation and message) and the time of your consent are stored in a database and used only to handle your request and to contact you.

To protect against misuse (limiting requests per hour), we also store a check value (hash) of your IP address, not the IP address itself.

We are notified internally by email about every request. This email contains your details from the form and is sent to our mailbox via the email service Resend (see section 5). Data is not passed on to third parties for advertising purposes.

We delete your request once it has been fully handled and no further contact is wanted, but at the latest when you withdraw your consent.

On our website we offer a voluntary survey that helps us develop PHASE further. Participation is anonymous. The controller is the party named in section 1.

What data we store: We store the answers given, the date of participation and whether the survey was completed on the website or at our exhibition stand. We do not store names, IP addresses or the time of day with the answers. We do not use analytics or tracking tools on the survey page. The answers therefore cannot be linked to any person. Some answers relate to health, for example stating that you are affected by bipolar disorder yourself, or experiences with health apps. These details are also stored anonymously only. Please do not enter names or other details that could identify you in the free-text fields. When the page is accessed, our hosting provider processes technically necessary connection data, as described in the section on hosting (section 8).

If an answer cannot be transmitted immediately because of a poor internet connection, it is temporarily stored in your browser's storage (localStorage), automatically sent again and deleted there after successful transmission.

Contact details: At the end of the survey, you can voluntarily leave an email address and optionally a name to receive news, help with testing, take part in a pilot project or support PHASE. We store these details separately from the survey answers; they cannot be linked. The legal basis is consent according to Art. 6 (1) (a) GDPR. You can withdraw your consent at any time with effect for the future by email to info [at] phase-health.eu . The contact details are then deleted.

Storage location: Survey answers and contact details are stored in the database of our website provider Lovable (Lovable Cloud).

Storage period: We keep survey answers until the evaluation is complete, for a maximum of two years. We delete contact details as soon as consent is withdrawn or we no longer need them for the stated purpose.

Your rights: The rights described in this privacy policy apply (section 7). As the survey answers are anonymous, we cannot link them to individual people and therefore cannot provide information about them or delete them specifically.

To run the website, we use the following service providers, who process data on our behalf and according to our instructions (Art. 28 GDPR):

• Database (contact form, survey): Lovable Cloud by Lovable Labs Incorporated, 1 Lincoln St, Boston, MA 02111, USA, on infrastructure of Supabase Inc. Transfers to third countries are secured by EU standard contractual clauses.
• Email sending (notifications for the contact form): Resend, operated by Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA. Processing takes place in the USA. The company is certified under the EU-U.S. Data Privacy Framework (adequacy decision of the EU Commission, Art. 45 GDPR); EU standard contractual clauses apply in addition.
• Email mailbox: STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany.

Personal data is processed on the basis of Art. 6 (1) (a) GDPR (consent) and Art. 6 (1) (b) GDPR (performance of a contract). Where health data is involved, it is processed only on the basis of explicit consent according to Art. 9 (2) (a) GDPR. The misuse protection in the contact form (check value of the IP address) and the server logs are based on our legitimate interest in secure operation (Art. 6 (1) (f) GDPR). Taking part in the survey is voluntary; the answers are stored without personal reference.

You have the right at any time to:

• Access to your stored data (Art. 15 GDPR)
• Correction of incorrect data (Art. 16 GDPR)
• Deletion of your data (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Object to processing (Art. 21 GDPR)
• Withdraw consent you have given (Art. 7 (3) GDPR)

This website is run by an external hosting provider. When you visit the website, information that your browser transmits is automatically stored in server log files (e.g. IP address, browser type, time of access). This data is not combined with other data sources.

This website currently uses no tracking cookies and no analytics services. Should this change, you will be informed in advance and asked for your consent. We only use your browser's storage for technically necessary purposes, for example to temporarily store survey answers when the connection is poor (see section 4).

You have the right to lodge a complaint with a data protection supervisory authority about the processing of your personal data.