1. Controller and contact
McDougall Digital GmbH, Große Gallusstraße 14, 60315 Frankfurt am Main, Germany. Represented by managing director Kyluke McDougall. Email: hey@mcdougall-digital.de; telephone: +49 (0)69 989 727 - 347. Use these details for privacy questions and rights requests.
2. Our role and your practice’s role
McDougall Digital GmbH is the controller for its website, customer-account administration, contract handling, its own security purposes and enquiries. For patient records, the treating practice normally determines the purposes and essential means of processing; Flectas acts as a processor on documented instructions. The practice provides its own patient privacy notice. This policy replaces neither that notice nor the data processing agreement required before processing under Article 28 GDPR. Employers or practice administrators may create or invite staff accounts and supply names, business email addresses, roles and organization assignments.
3. Website access and technical logs
Delivering the website requires information such as IP address, time, requested address, browser and operating-system information and response data. API logs also include request identifiers, HTTP method, route, status, duration, size and user-agent information. Security and change logs may record the acting user, organization, affected records, IP address and time. We use this information for delivery, troubleshooting and protection against unauthorized access. Our own operational and security processing is based on Article 6(1)(f) GDPR: our interest in a secure and reliable service. Logs maintained solely for a practice follow its instructions. Retention criteria are described in section 12; hosting is covered in section 11.
4. Language preference, cookies, analytics and external links
The website uses the necessary NEXT_LOCALE cookie when saving a different language preference. It contains a language code and is configured as a session cookie; browser session-restoration settings may affect its actual lifetime. It is not used for advertising or recognition across websites. Storage for the requested language function relies on section 25(2), no. 2 TDDDG; related personal-data processing relies on Article 6(1)(f) GDPR. You can delete or block cookies in your browser, in which case the language choice may not persist.
Product analytics on the website are optional and switched off by default. On your first visit a banner asks whether you agree to analytics with PostHog. We use PostHog Cloud EU, provided by PostHog Inc. (USA), with the data stored in the European Union in Frankfurt am Main, Germany. Until you accept, the analytics library sets no cookies, writes nothing to your browser storage and sends no data. If you decline, no analytics cookies are set and no usage data is collected; only your choice itself is stored in your browser so that the banner is not shown again. If you accept, PostHog sets first-party cookies and browser storage to recognise your browser on later visits and receives pseudonymous page views, interactions with page elements, page-leave events, the pages visited, the selected site language, the referring page and technical information such as browser type, device type, screen size and the IP address at the time of the request. We do not link this information to a name or account. The legal basis is your consent under Article 6(1)(a) GDPR and section 25(1) TDDDG. A processing agreement under Article 28 GDPR is in place with PostHog; it includes the EU Standard Contractual Clauses for any access from outside the EU (see section 11). You can withdraw your consent at any time with effect for the future under “Analytics settings” at the end of this privacy policy; analytics then stops, the stored choice and PostHog cookies are deleted and the page reloads. PostHog’s privacy information: https://posthog.com/privacy
Font files are served with the website. Following an external link, such as an App Store link, takes you to that provider, whose privacy information then applies.
5. Contact and support
For email or telephone enquiries we process contact details, message content and communication times to handle and follow up the request. Article 6(1)(b) GDPR applies to enquiries from self-employed contracting parties before or during a contract. For other enquiries and employees of business customers we rely on Article 6(1)(f), with an interest in business communication and support. Legal record-keeping duties rely on Article 6(1)(c). Please do not send identifiable patient records by unencrypted email. If technical support requires patient data, we agree an appropriate transfer method with the practice and act on its instructions.
6. Accounts, organizations and contracts
Registration, email verification, sign-in, invitations, role management and account recovery involve names, email addresses, organization and role information, account status, technical identifiers, verification and sign-in times, and a hashed password. Optional profile images and supplied practice/contact details may also be processed. For self-employed contracting parties the basis is Article 6(1)(b) GDPR. For contacts and staff of business customers it is Article 6(1)(f), to enable the agreed business relationship and authorized access. Required information is necessary for the account and contract; we cannot provide those functions without it. An optional profile image is not necessary.
7. Subscriptions and Apple
Apple handles App Store order and payment data under its own terms and privacy information. Flectas receives or processes product, purchase and transaction identifiers, subscription status, duration and customer-account assignment. These are used to verify and supply purchased entitlements, restore access and resolve errors. The legal basis is Article 6(1)(b) or (f) GDPR depending on the contracting party, and Article 6(1)(c) for statutory retention. Flectas does not receive complete payment-card or bank-account details from Apple through this purchase flow. More information: https://www.apple.com/legal/privacy/en-ww/
8. Patient and health information
Practice users can enter names, birth dates, gender, complaints, treatment and prescription data, training plans, exercises, sets, repetitions, weights, appointments, notes, reports, photographs and consent records. This includes health data under Article 9 GDPR. The practice determines the appropriate basis under Articles 6 and 9 and applicable professional confidentiality obligations. Consent is not automatically the only lawful basis; the appropriate basis depends on the treatment and use. We process these records to provide instructed functions. Authorized practice staff can access them according to their permissions. The practice initiates disclosures through export or sharing functions.
9. Device storage and permissions
The app stores access information in protected device storage and supports local training drafts, cached lookup information and image files. Training drafts and certain caches have additional encryption. That additional encryption does not cover every image file; securing the device and its accounts remains important. Necessary storage enables sign-in, display and supported offline functions under section 25(2), no. 2 TDDDG. Personal-data processing follows the relevant purposes or practice instructions described above. Camera or photo permissions serve the selected capture or import function and can be withdrawn in system settings, limiting that function. A permission description alone does not mean ongoing audio, image or location collection.
10. Analytics and AI
Product analytics in the app are optional and switched off until the practitioner turns them on. At first sign-in, and later at any time in the profile settings, the switch “Share usage analytics” allows you to opt in. While the switch is off, the analytics library sends no data. When it is on, PostHog (PostHog Cloud EU, data stored in Frankfurt am Main, see section 4) receives pseudonymous account and organisation identifiers, feature-usage events such as the screens and functions used, technical error reports, and masked session replays in which all text and images are hidden. No patient names, notes, photographs or health data are sent. The legal basis is your consent under Article 6(1)(a) GDPR and, for storage on the device, section 25(1) TDDDG. You can switch analytics off again at any time in the profile settings; the SDK then stops sending data. Withdrawal does not affect the lawfulness of processing carried out before it. Analytics data is retained in the analytics project only as long as needed for product improvement and troubleshooting and is otherwise deleted according to the criteria in section 12.
AI features are disabled in the German App Store build. In the international build they can be activated per organisation after a signed data processing agreement and per patient with documented consent. When activated, OpenAI, L.L.C. (USA) receives the treatment data needed for the selected report: age, gender, diagnosis and ICD-10 code, prescription details, complaints, training sessions, notes and any photos the therapist explicitly selects for the report. Names, dates of birth and insurance numbers are not transmitted. Before activation, actual recipients, purposes, legal bases, locations, retention and any consent/withdrawal controls must be disclosed separately and required agreements concluded. A privacy notice does not substitute for required consent. This policy makes no claim that possible AI providers process only in the EU or retain no data.
11. Recipients and international transfers
The website, API, patient records, files and backups run on servers in Germany operated by our hosting processor Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, under Hetzner's Data Processing Agreement including its subprocessor arrangements. Amazon Web Services is used for two purposes only: transactional email (Amazon SES) for verification, invitation and recovery messages, and as the storage target for encrypted backups. For a German customer account the contracting AWS entity is generally Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg; the AWS region used for email is documented in the data processing agreement.
Email recipients and their own email providers process delivered messages under their own responsibility. Other recipients include Apple for App Store purchases, technical providers and advisers subject to confidentiality, and authorities where required by law.
Storing data in Germany does not automatically exclude global service, support or legally required access. Where processing involves a third-country transfer, it needs a basis under Articles 44 onward GDPR. The AWS contractual arrangements include Standard Contractual Clauses for relevant transfers; applicability and supplementary measures must be assessed for the actual services. EU hosting does not replace that assessment. Information about actual recipients and copies of relevant safeguards can be requested through the privacy contact. Hetzner information: https://www.hetzner.com/legal/privacy-policy/ · AWS information: https://aws.amazon.com/compliance/gdpr-center/
12. Retention and deletion
We retain data only while needed for its purpose or required by law. Account data supports the contractual relationship; afterwards, unnecessary data is deleted or its use restricted where duties remain. Enquiries are deleted after resolution unless needed for the contract, evidence or legal claims. Security logs have purpose-limited retention, with individual incidents potentially retained longer for investigation. Further retention of contractual and accounting records follows the applicable commercial or tax-law document category. Records needed for legal claims are retained only while that purpose remains. Actual operational and backup-expiry periods will be specified in the deletion schedule and checked against the systems before production.
- Patient data follows the practice’s agreed deletion and retention arrangements. The implemented 30-day patient-deletion grace period is not a GDPR requirement or a promise of automatic complete destruction. Retention holds, approvals and backups may affect final erasure. Practices may be required to retain treatment records for ten years under section 630f(3) BGB; other periods may apply. Account deletion or subscription cancellation does not automatically erase all clinical records, backups or copies on temporarily disconnected devices immediately.
13. Your rights
Contact us using the details above. We assess requests and, where needed, verify authority. If the practice is the controller, direct the request primarily to it; we assist under the processing agreement. Statutory conditions and exceptions, including retention obligations, apply.
- Access to personal data and rectification of inaccurate information (Articles 15 and 16 GDPR).
- Erasure and restriction subject to legal conditions (Articles 17 and 18).
- Data portability for automated processing based on consent or contract (Article 20).
- Withdrawal of consent for the future, without affecting the lawfulness of earlier processing (Article 7(3)).
- Objection on grounds relating to your particular situation to processing under Article 6(1)(f) (Article 21). An objection to direct marketing would require no justification.
- Complaint to a supervisory authority, particularly where you live, work or believe an infringement occurred (Article 77). For our registered location, this includes the Hessian Commissioner for Data Protection and Freedom of Information, Postfach 3163, 65021 Wiesbaden, Germany; https://datenschutz.hessen.de/service/beschwerde-uebermitteln.
14. Automated decisions and updates
For the standard use described here, we do not make solely automated decisions producing legal or similarly significant effects under Article 22 GDPR. Technical subscription verification is not a medical decision. We update this policy when relevant practices change and provide additional notice where required. An update does not give consent or expand an existing authority to process data.