Privacy Policy

Protecting your personal data is a core concern for us. This policy describes which data is processed when you visit this website and when you use the PocketAid apps - and which deliberately is not.

Controller

Controller

PocketAid GmbH

Address

Marktgasse 20, 6330 Kufstein, Österreich

Email

office@pocketaid.app

What this website does not do

• No cookies. No cookies of any kind are set - which is why there is no cookie banner.
• No profiling in local storage. We only store there whether you identified yourself as a physician or as a patient on arrival, so the question does not reappear on every visit. This entry never leaves your device and can be removed by clearing your browser data.
• No tracking, no analytics. Neither Google Analytics nor comparable tools are embedded.
• No social media plugins and no external advertising networks.
• No external fonts. Manrope and Space Grotesk are served from our own server. No connection to Google servers is established and your IP address is not transmitted to third parties.

Server log files

When the website is accessed, the web host automatically processes technical access data (IP address, date and time, file requested, volume of data transferred, browser type and operating system). This processing is technically necessary for the secure and stable operation of the website. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in trouble-free operation and IT security). This data is not merged with other data sources.

Hosting

Web host

IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Deutschland

A data processing agreement pursuant to Art. 28 GDPR is in place with the host. Data is processed within the European Union.

Contact and enquiries

The contact and demo forms and the enquiry from the module configurator do not send your input to our server; they open a pre-filled email in your own email programme which you send yourself. The form for the 4-week free trial works differently: there your details (name, email address, institution, speciality, phone number, number of test users, modules of interest and your note) are transmitted directly to our server in Germany, stored there and additionally reported to us by email. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures). We use this data solely to set up your trial access and to contact you about it. It is deleted once the trial has concluded and no contract is entered into, at the latest after twelve months, unless a statutory retention period applies.

Checkout and payment processing

If you take out a subscription in the configurator, we transmit your name and email address to our server and create a customer account there. For payment processing we pass this data to our payment service provider Mollie B.V., Keizersgracht 126, 1015 CW Amsterdam, Netherlands; Mollie collects the payment details itself and processes them under its own responsibility. Your payment details never reach us. The legal basis is Art. 6(1)(b) GDPR (performance of a contract). For each subscription we store which module and plan were booked and whether and when a free month was granted - the latter in order to enforce the contractually promised one-time-only rule.

Use of the PocketAid apps

The following sections apply to our apps and web applications: the PocketAid patient app, PocketAid AI, PocketAid Ortho, PocketAid Motion, the practice portal, PocketAid Pro and the Hub. The sections above continue to apply to visiting this website.

Who is responsible for what

For patient data processed by a practice or clinic in our applications, that practice or clinic is the controller within the meaning of Art. 4(7) GDPR; it decides on the purposes and means of treatment. PocketAid GmbH acts as a processor under Art. 28 GDPR and strictly on instructions. Please therefore address requests for access, rectification or erasure of treatment data to your treating practice; we support the practice in handling them. For your user account, for contractual matters with practices and for the operation and security of our systems, we are the controller ourselves.

Account and usage data in the apps

When you register and use the services we process master data (name, email address, role and assignment to a practice) and authentication data. The legal basis is Art. 6(1)(b) GDPR (performance of the user agreement). Technical logs for operation and security are processed on the basis of Art. 6(1)(f) GDPR.

Health data

Depending on the product used, health data within the meaning of Art. 9(1) GDPR is processed - for example medical history and symptom details, findings, diagnoses, therapy and training plans, X-ray and scan data, exercise videos and histories from AI-assisted features. The legal basis is Art. 9(2)(h) GDPR (treatment and care in the health sector by professionals bound by secrecy) in conjunction with Art. 6(1)(b) GDPR, supplemented where necessary by your explicit consent under Art. 9(2)(a) GDPR.

Wearables and health monitor

If you voluntarily connect a smartwatch or fitness account in PocketAid Motion, we process the values it transmits, such as heart rate and the duration and distance of a training session. This connection is based on your explicit consent and can be withdrawn at any time in the settings with effect for the future.

AI-assisted features

• The content transmitted is not used to train the models.
• We transmit only what the respective feature requires and avoid unnecessary personal details in the model context.
• This concerns PocketAid AI, PocketAid Ortho, the Trainer Buddy in Motion and PocketAid Pro.

The results serve decision support only. No decision based solely on automated processing within the meaning of Art. 22 GDPR takes place - every clinical decision remains with the treating professional.

Retention period

We process personal data only for as long as is necessary for the respective purposes or as required by statutory retention obligations (in particular under the Austrian Commercial Code and Federal Fiscal Code, generally seven years).

Retention periods in the apps

• Treatment-related data: as instructed by the responsible practice. The medical documentation obligation in Austria is regularly ten years; we delete on instruction.
• Account and contract data: until the end of the user relationship plus statutory retention periods.
• Billing data: seven years under the Austrian Commercial Code and Federal Fiscal Code.
• Technical logs: as briefly as possible.
• AI requests: zero or minimal retention at the vendors; internal caches are time-limited.

Recipients and third-country transfers

Your data is received solely by our web host as a processor, additionally by the payment service provider Mollie B.V. (Netherlands) when you take out a subscription, and by bodies to which we are legally obliged to disclose it. A data processing agreement pursuant to Art. 28 GDPR is in place with the host. When you visit this website, no transfer to countries outside the EU or EEA takes place.

Processors used by the apps

Google Ireland Ltd.

Authentication, database, file storage and server functions (EU region)

Microsoft Azure

Hosting and operations (Austria and Switzerland)

Anthropic PBC, OpenAI Inc.

Language models for the AI features (processing in the USA)

D-ID Ltd.

Avatar rendering in PocketAid Pro (spoken text only)

Mollie B.V.

Subscription billing (Netherlands)

IONOS SE

Transactional email delivery (Germany)

Where data is transferred to the USA in this context - which concerns the AI features - we base the transfer on the EU-US Data Privacy Framework or on standard contractual clauses pursuant to Art. 46 GDPR.

Your rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and a right to object (Art. 21 GDPR). To exercise these rights, simply contact office@pocketaid.app.

Right to lodge a complaint

If you believe that the processing of your data infringes data protection law, you may lodge a complaint with the supervisory authority: Austrian Data Protection Authority, Barichgasse 40-42, 1030 Vienna, dsb@dsb.gv.at, dsb.gv.at.

Relationship to agreements with practices

This policy applies to visiting this website and to the use of the PocketAid apps. In addition, we conclude a data processing agreement pursuant to Art. 28 GDPR with every practice and clinic, setting out the processing of patient data in detail. In the relationship with the practice, that agreement takes precedence over this policy.