Privacy Policy
Version 2026-10-23 · ملخص بالعربية
1. Who is responsible
⟨OPERATOR NAME / COMPANY NAME⟩
⟨POSTAL ADDRESS⟩
Email: ⟨CONTACT EMAIL⟩
⟨IF UK COMPANY: EU representative under Art. 27 GDPR: NAME, ADDRESS, EMAIL⟩
2. What we process and why
| Data | Purpose | Legal basis (GDPR) | Kept for |
|---|---|---|---|
| Technical access data (IP address, time, browser) in the web host's server logs | Delivering and securing the website | Art. 6(1)(f) — legitimate interest | According to the host, usually ≤ 14 days |
| Your questions, the section you chose on the map (country, state, profession, stage), your ratings and comments | Answering, improving answers, re-using answers to identical questions | Art. 6(1)(b) — providing the service; Art. 6(1)(f) — improving it | Visitors: stored without any link to a person. Account holders: until you delete them or your account |
| A random device ID (stored in your browser) and a one-way hash of your IP address | Counting the free questions before sign-in and preventing abuse. We never store the IP address itself | Art. 6(1)(f); § 25(2) TDDDG (strictly necessary) | 30 days, then deleted automatically |
| Account: name, email address and Google user ID (via “Sign in with Google”) | Running your account | Art. 6(1)(b) | Until you delete your account |
| Survey answers (profession, country of degree, target state, stage, German level, how you found us) | Tailoring answers and understanding who uses MedWeg (statistics) | Art. 6(1)(a) — your consent at sign-up, which you can withdraw at any time | Until you delete your account |
| "About you" (optional): where you studied, profession, where you live now, target state, stage — and short facts MedWeg notes from your own questions (e.g. "has received the Bescheid") | Answering for your situation instead of in general | Art. 6(1)(a) — consent; before sign-up it stays only in your browser | Until you delete it (each item can be deleted in "My account") or your account |
| Anonymous visitor statistics: country/region (looked up from the IP address at that moment in an offline database and then discarded — the IP is never stored), device type, operating system, browser, language, where the visit came from (e.g. Instagram), hour | Understanding which communities use MedWeg and improving it | Art. 6(1)(f) — legitimate interest; only daily totals are stored, nothing that identifies a person or links visits | Daily totals, kept for statistics |
| Your previous chats (questions and the answers shown) | Letting you see and reopen your chats from the last 3 days | Art. 6(1)(b) — providing the service | Shown to you for 3 days — without an account only in your browser (nothing extra is stored on our server); with an account in your account. Deleting a chat, signing out (browser copy) or deleting your account removes it |
| Experiences you share ("Share your experience"): profession, state, month/year of your steps, your text, tips, costs, an optional display name | Helping other doctors: after our review, the content may be used in answers and shown without your name (only initials) | Art. 6(1)(a) — your consent when sending | Until you ask us to delete it |
| Settings in your browser (language, chosen section, closed banners) | Remembering your choices | § 25(2) TDDDG (strictly necessary) | Until you clear your browser data |
Please do not write personal details (names, passport or file numbers, health information) into your questions — they are not needed for an answer.
3. Service providers we use
- Google Cloud (Cloud Run, Firestore, Cloud Storage) — Google Cloud EMEA Ltd., Ireland. Servers in Frankfurt, Germany. Runs the answer service and stores accounts.
- Firebase Authentication — Google Ireland Ltd. / Google LLC (USA) for “Sign in with Google”.
- Qdrant Cloud — Qdrant Solutions GmbH, Berlin. Search database and question log. ⟨CURRENTLY HOSTED IN THE USA (AWS us-east-2) — MOVE TO EU OR KEEP THIS SENTENCE⟩
- OpenRouter (OpenRouter Inc., USA) and, as a fallback, Groq (Groq Inc., USA) — the AI language models that write the answers. They receive the text of your question and matching excerpts, never your name or email.
- Web hosting — Hostinger International Ltd., Cyprus (EU).
All providers process data on our behalf under data processing agreements (Art. 28 GDPR). Transfers to the USA are based on the EU–US Data Privacy Framework where the provider is certified, otherwise on the EU Standard Contractual Clauses (Art. 46 GDPR).
IP geolocation by DB-IP (licensed under CC BY 4.0), used offline on our own server.
Links to Instagram or Telegram are plain links: nothing is loaded from those services until you click them.
4. Your rights
You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and to object (Art. 21), and to withdraw consent at any time with effect for the future (Art. 7(3)). In “My account” you can download all your data and delete your account yourself — this deletes your account, survey answers and all questions linked to it immediately. For anything else, write to the email above.
You can also complain to a data protection authority, e.g. the Bavarian Data Protection Authority (BayLDA), Promenade 18, 91522 Ansbach, www.lda.bayern.de.
5. Other points
- No automated decisions with legal effect are made about you (Art. 22). Answers are AI-generated information, not legal advice.
- MedWeg is meant for adults (16+).
- Content from Telegram groups is shown without members' names (initials only); phone numbers and emails are removed.
- We will update this policy when our service changes; the version date is at the top.
ملخص بالعربية
MedWeg مجاني. منجمع بس الشي اللازم لنجاوب على أسئلتك ونشغّل حسابك: أسئلتك وتقييماتك، اسمك وإيميلك من Google إذا سجلت، وأجوبة الاستبيان القصير. ما في إعلانات ولا تتبع ولا منبيع بياناتك لحدا. الخوادم بفرانكفورت، والذكاء الاصطناعي بيستلم نص السؤال بس — بدون اسمك أو إيميلك. محادثاتك السابقة بتضل ظاهرة إلك 3 أيام: على متصفحك إذا ما عندك حساب، أو بحسابك إذا مسجّل. حذف المحادثة أو حذف حسابك بيمسحها. من "حسابي" فيك تحمّل كل بياناتك أو تحذف حسابك وكل أسئلتك فوراً. النص الإنكليزي فوق هو النص الرسمي.