Privacy policy: what we do with your data.

In short

We collect as little as we can, we tell you where it goes, and we delete it on a schedule. The essentials:

• We only use Google Analytics if you allow it in our cookie banner. No advertising cookies, no tracking pixels. You can change your choice at any time via "Cookie settings" at the bottom of every page.
• When you use one of our forms, your details go to our Google Workspace account (Google Forms and Google Sheets). Nobody else receives them.
• You only get updates from us if you tick the box for it. You can withdraw at any time.
• Form entries are deleted 24 months after your last contact with us, unless a business relationship develops or the law requires us to keep them longer.

Who is responsible

The controller under the EU General Data Protection Regulation (GDPR) is:

EvoMed Consulting GmbH
Hafenallee 43
63067 Offenbach am Main
Germany

Represented by the managing director, Dr. med. univ. Amel Havkic.
Email: info@evomed-consulting.eu
Phone: +49 176 1794 7614

We are not legally required to appoint a data protection officer and have not done so. For any question about your data, write to info@evomed-consulting.eu.

Hosting and server log files

This website runs on WordPress. Domain, web hosting, server and caching services are provided by two companies: Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus, and GoDaddy (GoDaddy.com, LLC and its affiliates, USA). When you open a page, the server automatically records technical data that your browser sends: your IP address, date and time of the request, the page requested, the website you came from, your browser and operating system, the amount of data transferred and whether the request succeeded.

We need this to deliver the website, keep it stable and detect attacks. The legal basis is our legitimate interest in a secure, working website (Art. 6(1)(f) GDPR). Both providers process these data on our behalf under data processing agreements (Art. 28 GDPR). Log files are deleted automatically after a short period set by the providers, normally within 30 days, unless we need a specific entry to investigate a security incident.

Hostinger is based in the EU. GoDaddy is based in the USA. Where personal data are transferred to the USA or another country outside the EU or the European Economic Area, the transfer is based on an adequacy decision, such as the EU-U.S. Data Privacy Framework where the recipient is certified under it, or on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

Security

All pages are delivered over an encrypted connection (TLS), recognisable by the padlock in your browser.

We protect the website with the security plugin Wordfence (Defiant, Inc., USA). Its firewall checks incoming requests, including the IP address, against known attack patterns and block lists, and logs blocked requests. The legal basis is our legitimate interest in protecting the website and your data (Art. 6(1)(f) GDPR).

Cookies and browser storage

We do not use cookies or similar technologies for advertising. We use analytics cookies only with your consent (see Google Analytics below). Apart from that, storing information on your device is limited to what is strictly necessary for a function you actively use (Section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act, TDDDG):

• Your cookie choice. When you allow or decline analytics in our banner, we store your choice and its date in your browser's local storage, so we do not ask you again on every page. We ask again after 12 months.
• Website administration. WordPress sets cookies only when a member of our team logs into the admin area. Visitors do not receive them.
• StarMap^® Alignment Check. The check runs entirely in your browser. So that you can come back to your result, your answers and the time of completion are kept in your browser's local storage for 30 days. The financial figures you enter in the optional cost calculation are never stored or transmitted. You can delete the stored answers at any time by clearing this website's data in your browser.

Our forms do not store anything on your device.

Google Analytics

If you allow it in our cookie banner, we use Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. It helps us understand how visitors use our website, for example which pages are read, how people arrive and which resources are downloaded, so we can improve our content. Nothing is loaded from Google Analytics before you give your consent.

Google Analytics sets cookies (_ga and _ga_ followed by an ID, each stored for up to two years) and processes information about your visit, such as pages viewed, time spent, device and browser type, approximate location derived from your IP address, and the website you came from. According to Google, Google Analytics 4 does not log or store IP addresses. We have switched off Google Signals and advertising features. Analytics data are deleted after 14 months.

The legal basis is your consent (Art. 6(1)(a) GDPR and Section 25(1) TDDDG). You can withdraw it at any time with effect for the future via "Cookie settings" at the bottom of every page; we then stop the analytics and delete its cookies from your browser. Google processes the data on our behalf under a data processing agreement. A transfer to Google LLC in the USA cannot be ruled out; Google LLC is certified under the EU-U.S. Data Privacy Framework.

Google Search Console

We use the WordPress plugin Site Kit by Google to connect this website with Google Search Console. Search Console shows us aggregated figures on how our pages appear in Google Search, such as search terms, impressions and clicks. Search Console itself does not place code or cookies on our pages and does not record your visit to our website. The legal basis is our legitimate interest in understanding how people find us (Art. 6(1)(f) GDPR).

Download and waiting-list forms

On some pages you can download a resource (for example our whitepaper or industry report) or join the waiting list for our book. We collect:

• your email address (required),
• your name and your role, where the form asks for them,
• whether you ticked the box for updates,
• technical context of the submission: the page and resource concerned, the version of the consent text shown to you, the page address, the website that referred you (if your browser shares it) and campaign parameters contained in the link you used (utm_source, utm_medium, utm_campaign).

We use these data to give you what you asked for (the download, or a message when the book is available), to keep a record of it, and to understand which of our materials are useful and to whom. The legal basis is Art. 6(1)(b) GDPR for providing what you requested and Art. 6(1)(f) GDPR for our interest in understanding our readership. We do not send you marketing emails on the basis of a download. That only happens if you tick the box for updates (see the next section).

The form sends your entry directly to Google Forms, and it is stored in a Google Sheet in our Google Workspace account. Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, processes these data on our behalf under a data processing agreement. A transfer to Google LLC in the USA cannot be ruled out; Google LLC is certified under the EU-U.S. Data Privacy Framework.

We delete form entries 24 months after your last contact with us, unless a business relationship develops or statutory retention periods require us to keep them longer.

Updates and Ward Notes

If you tick the box "Keep me updated", we send you occasional emails with news from EvoMed Consulting and our Ward Notes. The legal basis is your consent (Art. 6(1)(a) GDPR). We send these emails from our own Google Workspace account (Google Ireland Limited, see above).

To be able to prove your consent, we record when you gave it and which version of the consent text you saw (Art. 7(1) GDPR).

You can withdraw your consent at any time, without giving reasons, by writing to info@evomed-consulting.eu or by replying to any of our emails. The withdrawal does not affect the lawfulness of emails sent before it. After a withdrawal we remove you from our mailing list. We keep the record of your consent for up to three years to be able to prove it (Art. 6(1)(f) GDPR in conjunction with Art. 7(1) GDPR).

Email, phone and booking a call

If you write to us or call us, we process your details and your message to answer you. If you book a screening call, the booking runs through Google Calendar appointment schedules (calendar.app.google), where you enter your name, email address and preferred time. Google Ireland Limited processes these data on our behalf as part of our Google Workspace account (see above).

The legal basis is Art. 6(1)(b) GDPR where your request relates to a possible engagement, and otherwise Art. 6(1)(f) GDPR, our interest in answering enquiries. We delete these data when they are no longer needed, normally 24 months after our last contact, unless statutory retention periods under German commercial and tax law apply.

Please do not send us confidential patient data or other health information about identifiable persons.

Bloom

We are moving our contact management to Google Workspace. During the transition we still use Bloom (bloom.io), a provider based in the USA, for contacts who signed up through our earlier Bloom forms and for parts of our client communication. Bloom processes these contact data on our behalf under a data processing agreement. Transfers to the USA are based on the EU Standard Contractual Clauses or, where the recipient is certified, the EU-U.S. Data Privacy Framework. The legal basis is the one that applied when you gave us your details, as described in the sections above. We will update this policy when we stop using Bloom.

YouTube videos

Some pages show videos from YouTube, a service of Google Ireland Limited. The video player is not loaded when you open the page. To show a preview, the video's thumbnail image is loaded from a Google server, which transmits your IP address to Google, but no player is loaded and no cookies are set. Only when you click play is the video loaded from youtube-nocookie.com. From that point, Google may set cookies and process information about your use of the video under its own privacy policy.

The legal basis for the preview image is our legitimate interest in presenting our videos (Art. 6(1)(f) GDPR). The legal basis for loading the player is your consent, which you give by clicking play (Art. 6(1)(a) GDPR and Section 25(1) TDDDG).

Links, fonts and images

Links to LinkedIn, YouTube, Instagram and other websites are plain links. No data are sent to these services until you click a link. After that, their own privacy policies apply.

Fonts and images are served from our own server. We do not load fonts from Google or other third parties.

Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you (Art. 15),
• have incorrect data corrected (Art. 16),
• have your data erased (Art. 17),
• have processing restricted (Art. 18),
• receive your data in a common, machine-readable format (Art. 20),
• withdraw any consent at any time with effect for the future (Art. 7(3)),
• lodge a complaint with a supervisory authority (Art. 77).

The supervisory authority responsible for us is the Hessian Commissioner for Data Protection and Freedom of Information (Der Hessische Beauftragte für Datenschutz und Informationsfreiheit), Gustav-Stresemann-Ring 1, 65189 Wiesbaden, Germany.

Other information

Providing your data is voluntary. Without an email address we cannot provide a download or add you to the waiting list. We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.

We update this policy when our website or the law changes. The current version is always available on this page.