Privacy policy

Controller

Hochschule für nachhaltige Entwicklung Eberswalde (HNEE)
Schicklerstraße 5, 16225 Eberswalde, Germany
represented by its President, Prof. Dr. Matthias Barth.
Project contact: Dorian Zwanzig, [email protected].

Data protection officer

Data protection officer of the HNEE, Schicklerstraße 5, 16225 Eberswalde
E-mail: [email protected]

What we process

  • Account data (registered users only): username, e-mail address, professional context, center affiliation, requested and assigned roles, vetting status, and your notification preferences.
  • Contributed content: submitted cases and benchmark results, linked to the contributing account for attribution, together with the declarations made at submission. Cases must be irreversibly anonymized before submission — the platform stores no patient identifiers, and the submission forms have no fields for them.
  • Case reports: reports sent through the public report form, including the optional contact address the reporter provides.
  • Study uploads (participating study centers only): files encrypted before they reach the platform — either off-platform or in your browser against the study team's published public key. The platform cannot decrypt them. Every upload, download, and deletion is recorded in an access log (account, time, file reference).
  • Technical data: IP addresses and request metadata in server logs, and IP-based counters used to rate-limit sign-in attempts, registrations, and case reports. Logs never contain case content.

The site sets only the cookies technically required for sign-in and form security (session and CSRF cookies). There is no tracking, no advertising, and no analytics, and no external fonts or scripts are loaded from third parties.

  • Operating user accounts and processing contributions: Art. 6(1)(b) GDPR.
  • Operating the platform as a research infrastructure of a public university: Art. 6(1)(e) GDPR in conjunction with the Brandenburg higher education and data protection laws.
  • Securing the platform (logs, rate limiting, access logs): Art. 6(1)(f) GDPR — our legitimate interest is a secure, abuse-resistant service.
  • The underlying multi-center study processes patient data before anonymization exclusively at the participating centers, on the basis of Art. 9(2)(j) GDPR, § 27 BDSG, and § 37(1a) LKHG M-V; the study received a favorable ethics opinion (BB 211/25, Universitätsmedizin Greifswald). Study data reaches this platform only as encrypted files the platform cannot decrypt, and is never publicly accessible.

Service providers

We use the following processors under data processing agreements (Art. 28 GDPR):

  • Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany — server hosting. All platform data is stored on servers in Germany.
  • Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA — network delivery and protection: every request to the platform passes through Cloudflare, which terminates the encrypted connection and processes your IP address and request metadata. Transfers to the USA are based on the EU–US Data Privacy Framework (Cloudflare is certified) and the EU standard contractual clauses.
  • E-mail delivery: notification e-mails are sent through the mail service of our domain provider GoDaddy (GoDaddy.com, LLC, USA), which processes recipient addresses and message metadata; transfers are based on the EU standard contractual clauses.

E-mail

The platform sends account and status notifications only (e.g. a link to verify your address, or that a submission was accepted). E-mails never contain case content. You can opt out of non-essential notifications in your account settings.

Retention and account deletion

  • Account data is kept until you delete your account on the settings page. Deletion removes your personal data; accepted cases and published benchmark results remain in the dataset with your attribution removed, because published, checksummed dataset releases cannot be rewritten.
  • IP-based rate-limit counters are deleted after at most 24 hours.
  • Server logs are rotated automatically by size and overwritten; they are not archived.
  • Encrypted study files are deleted from the platform once their hand-over to the study side is confirmed; the access log entry remains as proof of the hand-over.
  • Case reports are kept until the report has been handled.

Your rights

Under the GDPR you have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and to object to processing based on Art. 6(1)(e) or (f) (Art. 21). Send requests to the controller or the data protection officer named above.

You also have the right to lodge a complaint with a supervisory authority, in particular the authority responsible for the HNEE: Die Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg, Stahnsdorfer Damm 77, 14532 Kleinmachnow, Germany.