Privacy policy

1. Controller

The controller responsible for the processing of personal data on this website and for study enquiries made through it, within the meaning of the General Data Protection Regulation (GDPR), is:

MediOra Health
Owner and operator: André Salm
Sole proprietorship (Einzelunternehmen)
Fliederstraße 9
66578 Schiffweiler
Germany
Email: trials@mediorahealth.com
Website: mediorahealth.com

André Salm is the controller within the meaning of Article 4(7) GDPR. Questions about data protection and requests to exercise your rights can be sent to trials@mediorahealth.com.

2. Overview

PatientCapsule (trials.mediorahealth.com) is the patient portal of MediOra Health. It explains how clinical studies work, presents selected studies and allows you to send an enquiry about a study. Enquiries are received and managed in PatientOrbit, the recruitment system of MediOra Health, and forwarded to a participating study site.

An enquiry is not enrolment in a study, not a medical diagnosis and not a binding assessment of your eligibility. Consent to an enquiry is separate from any consent to take part in a clinical trial, which you give to the study site.

This policy explains what data is processed when you visit the website, when you send an enquiry, when you join the study pool and when you agree to analytics or advertising technologies, who receives it, how long it is kept and what rights you have.

3. Visiting the website

PatientCapsule is hosted on Google Cloud in Frankfurt am Main, Germany (region europe-west3). When you open a page, your browser sends technical data that the hosting infrastructure processes and records in server log files:

• IP address;
• date and time of access;
• requested address (URL), including search terms, a postcode or a condition you entered in the study search;
• referring website;
• browser type and version, operating system and device information;
• server response status, transmitted data volume and technical error information.

This processing is necessary to deliver the website, keep it stable and secure, analyse technical errors and prevent misuse. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is the secure and reliable operation of the website. Server log files are deleted after 30 days, unless a specific security incident requires them to be kept longer for its investigation.

Study search and postcode search: You can read about studies without sending an enquiry. When you search by postcode, the postcode is compared on our own server with a list of places (GeoNames); no other service is used for this. Your search terms and postcode are part of the page address. If you have agreed to statistics or marketing, this page address is passed to those services (see section 18). Please do not enter information about your health in the search field beyond the name of a condition.

Without your consent, the website only stores the cookie that records your consent choice. Cookies and similar technologies of the consent management and, with your consent, of analytics and advertising services are described in sections 12 to 18 and in the cookie policy.

4. Study enquiries

On a study page you can answer a short questionnaire and send an enquiry. The questionnaire is provided by PatientOrbit: your answers go directly from your browser to PatientOrbit on Google Cloud in Frankfurt and are stored there. Depending on the study, we process:

• first name and last name, year of birth and gender;
• postcode and town;
• email address and, if you provide it, telephone number and preferred contact times;
• a message, if you write one;
• your answers to the study questions, for example about diagnoses, symptoms, treatments and medical history;
• the study of your enquiry, the questionnaire version and language, the time you opened, started and sent the questionnaire, the device type, the page from which you sent it and a record of the consent you gave.

The questionnaire shows before you send it which information is requested and which consent you give. Information about your health is special category data under Article 9 GDPR. Please only give information in free-text fields that is relevant to your enquiry.

Purpose: We use the data to receive your enquiry, to forward it to a participating study site near you, to enable the study site to contact you and check whether you may be eligible, and to manage the enquiry until it is closed. Your postcode is used to find the nearest participating study site; it is looked up on our own server and not sent to any other service.

Legal basis: your consent under Article 6(1)(a) GDPR and your explicit consent to the processing of health data under Article 9(2)(a) GDPR. Giving your consent is voluntary. Without it, we cannot process your enquiry.

Campaign information: If you have agreed to the category "Marketing" in the cookie banner and you arrived through one of our campaigns, the campaign parameters contained in the page address (source, medium, campaign, content, keyword and the identifiers of the campaign, ad group and advertisement) are stored with your enquiry so that we can see which campaigns help people find studies. Without that consent, no campaign information is stored. Your answers are never passed to advertising or analytics services (see section 18).

5. Who receives your data

Study site: The participating study site to which your enquiry is assigned receives the information it needs to handle your enquiry: your contact details and your answers. It can view them in PatientOrbit and contacts you by email or telephone. Once the study site has received your enquiry, it processes your data under its own responsibility, in particular for the medical assessment, the information discussion and any participation in the study. The study site will give you its own privacy information.

MediOra Health: Authorised staff of MediOra Health have access to the enquiries to administer PatientOrbit, assign enquiries, answer questions and resolve problems.

Sponsors and contract research organisations: Companies that fund or conduct a study (sponsors and contract research organisations) only receive totals, for example the number of enquiries, contacts and enrolments per study and study site. They do not receive names, contact details, answers or data about individual enquiries.

Service providers: We use service providers that process data on our behalf under a data processing agreement pursuant to Article 28 GDPR:

• Google Cloud EMEA Limited – hosting of PatientCapsule and PatientOrbit, including the database (Google Cloud, Frankfurt);
• Google – sending of emails through Google Workspace (see section 10);
• Usercentrics A/S – consent management with Cookiebot (see section 12).

With your consent, providers of analytics and advertising services receive data as described in sections 13 to 17. Data may also be disclosed to professional advisers bound to confidentiality, where necessary, and to public authorities, where required by law.

We do not sell personal data.

6. No automated decisions

Your answers are not automatically compared with study criteria, and no enquiry is automatically rejected – apart from automatic protection against spam and misuse (for example, too many enquiries from one device in a short time). The only automated step in handling your enquiry is its assignment to the nearest participating study site based on your postcode. Whether you can take part in a study is decided by the staff of the study site after a personal discussion. There is no automated decision-making within the meaning of Article 22 GDPR.

7. How long data is kept

While your enquiry is open: We keep your enquiry while it is being processed. If a study site enrols you in the study, your enquiry remains open until the end of your participation and is then closed by the study site.

After your enquiry is closed: We delete the personal data of your enquiry six months after it was closed, for example after you were told that the study is not suitable, after the study site could not reach you, after you decided not to take part or after the end of your participation. We send you an email when your enquiry is closed, stating the date of deletion.

After a withdrawal: see section 9.

What remains: When the personal data is deleted, the enquiry becomes an anonymous statistical record. It contains only the study, the country, the language, the study site, gender, age group, the stage reached, the reason for closure, the type of source and campaign, and the time between the steps (for example the number of days until the first contact). Your name, contact details, answers, notes, consent records, emails, personal links and the reference number of your enquiry are deleted, and all dates are moved into the first week of the month. This record no longer allows anyone to identify you. We use it to report figures such as how many people found a study through us and how quickly study sites made contact.

Other periods:

• Server log files: 30 days (section 3).
• Copies of the emails we send you, stored with our email provider: 30 days.
• Backups of the database: overwritten after 14 days at the latest.
• If a legal obligation or a legal dispute requires it, the deletion of individual data may be postponed for as long as that obligation or dispute lasts.

These periods apply to the data held by MediOra Health in PatientCapsule and PatientOrbit. They do not apply to documents that study sites or sponsors must keep under the laws on clinical trials; the study site will inform you about these.

8. Study pool

The study pool is optional and separate from your enquiry about a particular study. If you join, we inform you about future clinical studies that may suit you.

Joining: You can tick the separate consent for the study pool in the questionnaire. You only join once you confirm this with the link in the confirmation email (double opt-in); the link is valid for 14 days. You can also join after your enquiry has been closed, using the link in the email about the closure.

Joining without an enquiry: You can also join the study pool on our home page without an enquiry about a particular study. You choose the conditions you are interested in and confirm with the link in the confirmation email (double opt-in); the link is valid for 14 days. If you do not confirm, we delete your details after 14 days.

What is stored: your first name and last name, email address, telephone number (if provided), year of birth, gender, postcode and town, and the study of your enquiry. If you join on our home page: your first name and last name, email address, telephone number (if provided), year of birth, gender, country, language and the conditions you chose. Your answers to the study questions are not stored in the study pool. The study pool data is kept separately from your enquiry and is not deleted when your enquiry is deleted.

Use: We may contact you by email or telephone about future studies. To select suitable studies, we use the condition that the study of your enquiry relates to, or the conditions you chose when joining on our home page. Joining the study pool does not enrol you in a study, and your details are not passed to new study sites automatically – only if you send an enquiry about a new study.

Duration and renewal: Membership lasts twelve months from your confirmation. We send you an email 30 days before it ends, and further reminders every seven days until you renew, leave or the twelve months end. No reminders are sent after the end. Renewal requires you to confirm again with the link in the email; your membership then runs for a further twelve months from the renewal. It never happens automatically. Without renewal, your membership ends and your contact details in the study pool are deleted.

Leaving: You can leave the study pool at any time with the link in our emails or by writing to trials@mediorahealth.com. Your name, contact details, year of birth and address in the study pool are then deleted immediately. Only an entry without them remains for documentation (gender, age group, study or chosen conditions, country, language and the period of membership).

Legal basis: your consent under Article 6(1)(a) and Article 9(2)(a) GDPR.

9. Withdrawal and deletion

You can withdraw your consent to your enquiry and to the study pool at any time with effect for the future, using the link in our emails, by writing to trials@mediorahealth.com or by telephone. The withdrawal does not affect the lawfulness of processing carried out before it.

What happens: As soon as your withdrawal has been received and processed, we stop all processing based on your consent: your enquiry is closed, you are no longer contacted, your data is no longer passed on, and the study site can no longer see your enquiry in PatientOrbit. If you are in the study pool, your membership ends as well and your contact details in the study pool are deleted immediately; they are not restored if you undo the withdrawal. You can join the study pool again after your enquiry has been closed.

Deletion: We delete the personal data of your enquiry 14 days after your withdrawal. During these 14 days the data is kept with restricted access only, so that a withdrawal made by mistake can be undone: you can undo it within this period with the link in the email confirming your withdrawal. If you want your data to be deleted immediately, you can request this with the same email, by email or by telephone. After deletion, only the anonymous statistical record described in section 7 remains.

Withdrawing your consent to PatientCapsule does not end your participation in a clinical trial and does not remove documents that another controller must keep by law. If you are taking part in a study, please also contact your study site.

10. Emails

We send you emails about your enquiry: a confirmation of your enquiry with links to manage your consent, a confirmation of a withdrawal or deletion, a message when your enquiry is closed and, if you are in the study pool, reminders before your membership ends. These emails do not name the study, your condition or the study site, because emails are often read on shared devices.

The emails are sent from trials@mediorahealth.com through Google Workspace, with Google as our processor. Copies of the sent emails are deleted after 30 days. The study site may contact you by email or telephone using the details you provided.

The legal basis is the consent you gave for your enquiry or for the study pool (Article 6(1)(a) and Article 9(2)(a) GDPR).

11. Contacting us

If you contact us by email or telephone, we process your name, contact details and message to answer your request. The legal basis is Article 6(1)(f) GDPR (our legitimate interest in answering enquiries) or, where your request concerns your study enquiry, the consent given for it. Please do not send medical records or detailed health information to our general email address. We keep your message for as long as is necessary to deal with your request and any follow-up questions.

12. Consent management with Cookiebot

This website uses the Cookiebot consent management platform of Usercentrics A/S, Havnegade 39, 1058 Copenhagen K, Denmark, to obtain, store and document your choices about cookies and similar technologies.

When you first visit the website, the consent banner lets you accept, reject or configure optional categories. Cookiebot processes your IP address, the consent decision, date and time, browser and device information, the website domain and an identifier used to document your decision.

The legal bases are Article 6(1)(c) GDPR, where processing is necessary to comply with legal obligations to document consent, and Article 6(1)(f) GDPR, based on our legitimate interest in managing and documenting your choices.

You can change or withdraw your consent at any time with the link "Cookie settings" at the bottom of every page and in the cookie policy. Withdrawal does not affect the lawfulness of processing carried out before it. Your consent to cookies is separate from your consent to the processing of your health data in a study enquiry.

Further information: Cookiebot privacy policy

13. Google Tag Manager

This website uses Google Tag Manager of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Tag Manager is a tool that loads other website services ("tags") – here the Cookiebot consent banner and, with your consent, the analytics and advertising services described below. Tag Manager itself does not set cookies and does not create user profiles.

Tag Manager is loaded on every page, also before you make a choice in the consent banner, because the banner itself is loaded through it. When it is loaded, your browser connects to Google's servers and Google receives technical connection data such as your IP address. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is the central management of the consent banner and of the services that you can allow. Analytics and advertising services are only started after you have given the corresponding consent; until then, the categories "Statistics" and "Marketing" are denied.

Further information: Google privacy policy

14. Google Analytics 4

With your consent to the category "Statistics", this website uses Google Analytics 4 of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to understand how visitors use the website and which content is helpful.

Google Analytics processes the pages you visit (including the page address), your navigation, interactions, the referring website, date and time, approximate location, browser, device and operating system information and online identifiers stored in cookies. Google Analytics does not store full IP addresses; they are used only briefly to derive the approximate location.

The legal bases are section 25(1) of the German Telecommunications Digital Services Data Protection Act (TDDDG) and Article 6(1)(a) GDPR. You can withdraw your consent at any time in the cookie settings. Data is deleted after the retention period set in our Google Analytics account, at the latest after 14 months.

Google may process information in the United States and other countries outside the European Economic Area (see section 20).

Further information: Google privacy policy · Safeguards in Google Analytics

15. Google Ads

With your consent to the category "Marketing", this website uses technologies of Google Ads of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to measure whether visitors reach the website through a Google advertisement.

For this purpose, Google processes the pages you visit, date and time, the referring advertisement or campaign, browser and device information, approximate location and advertising identifiers. Google Ads stores identifiers of advertising clicks in cookies and local storage, in particular _gcl_au and _gcl_ls.

At present, no conversion events are sent from PatientCapsule – in particular, sending an enquiry is not reported to Google.

The legal bases are section 25(1) TDDDG and Article 6(1)(a) GDPR. You can withdraw your consent at any time in the cookie settings. Google may process information in the United States and other countries outside the European Economic Area (see section 20).

Further information: Google privacy policy · Google Ads data protection terms

16. Meta Pixel

With your consent to the category "Marketing", this website uses the Meta Pixel of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland, to measure whether visitors reach the website through advertisements on Facebook or Instagram.

Meta receives a page view for each page you visit, with the page address, date and time, the referring website, browser and device information, your IP address and identifiers stored in cookies and local storage (in particular _fbp, lastExternalReferrer and lastExternalReferrerTime). Automatic advanced matching is switched off: Meta does not receive information from the forms on this website.

At present, no conversion events are sent from PatientCapsule – in particular, sending an enquiry is not reported to Meta.

The legal bases are section 25(1) TDDDG and Article 6(1)(a) GDPR. You can withdraw your consent at any time in the cookie settings. Meta may process information in the United States and other countries outside the European Economic Area (see section 20).

Further information: Meta privacy policy · Meta Business Tools

17. OpenAI Ads Measurement

With your consent to the category "Marketing", this website uses the Ads Measurement Pixel of OpenAI Ireland Limited, 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland, to measure whether visitors reach the website through advertisements in ChatGPT.

If you arrive through a ChatGPT advertisement, OpenAI adds a click reference (oppref) to the page address. The pixel stores it in the cookie __oppref. OpenAI processes the click reference, the address of the website, date and time, browser, device and connection information.

At present, no conversion events are sent from PatientCapsule – in particular, sending an enquiry is not reported to OpenAI. Contact details are not passed to OpenAI.

For this processing, MediOra Health and OpenAI generally act as independent controllers. The legal bases are section 25(1) TDDDG and Article 6(1)(a) GDPR. You can withdraw your consent at any time in the cookie settings. OpenAI may involve companies and service providers outside the European Economic Area (see section 20).

Further information: OpenAI privacy policy · OpenAI ad tools terms

18. Health information and advertising

Visiting a study page can indicate an interest in a particular condition. We therefore apply these rules:

• Your answers to the questionnaire, your name, contact details and any other information from your enquiry are never passed to Google, Meta, OpenAI or other analytics or advertising services. The questionnaire sends them only to PatientOrbit and does not report them to Tag Manager.
• Sending an enquiry is not reported to analytics or advertising services as an event.
• Analytics and advertising services only run with your consent. Without it, these providers receive no information about the pages you visit.
• With your consent, these providers receive the address of the pages you visit. It can contain the name of a study, a condition or your search. If you do not want this, please do not agree to the categories "Statistics" and "Marketing" – the website works fully without them.

Your consent to cookies is not consent to the processing of your health data for advertising purposes.

19. Cookies and similar technologies

Necessary technologies are used to deliver the website, keep it secure and store your consent choice. Analytics and advertising technologies are only used with your consent. The legal bases are section 25(2) TDDDG and Article 6(1)(f) GDPR for necessary technologies and section 25(1) TDDDG and Article 6(1)(a) GDPR for optional technologies.

With your consent to the category "Marketing", campaign parameters from the page address (for example the source and name of a campaign) are also stored in your browser for up to 30 days, so that later visits can be attributed to the campaign.

The cookie policy contains the current list of all cookies and similar technologies with their purpose, provider and storage period.

20. Transfers outside the European Economic Area

Your enquiries and the study pool are stored on Google Cloud in Frankfurt. Some service providers or their group companies may nevertheless process personal data outside the European Union or the European Economic Area, in particular in the United States – for example Google (also in connection with Google Workspace), Meta and OpenAI.

Such transfers are based on an adequacy decision of the European Commission, in particular the EU-U.S. Data Privacy Framework for certified recipients, or on the European Commission's standard contractual clauses and, where necessary, additional safeguards (Chapter V GDPR).

21. Data security

We protect your data with technical and organisational measures, in particular:

• encrypted transmission (HTTPS);
• encrypted storage of contact details and answers to the study questions in the database;
• access only for authorised persons, according to their role; a study site only sees the enquiries assigned to it;
• records of changes without patient data;
• regular updates, backups and monitoring.

No system connected to the internet can guarantee absolute security.

22. Your rights

Under the applicable legal requirements, you have the right:

• of access (Article 15 GDPR);
• to rectification (Article 16 GDPR);
• to erasure (Article 17 GDPR);
• to restriction of processing (Article 18 GDPR);
• to data portability (Article 20 GDPR);
• to object (Article 21 GDPR) – where processing is based on Article 6(1)(f) GDPR, on grounds relating to your particular situation;
• to withdraw your consent at any time with effect for the future (Article 7(3) GDPR).

To exercise your rights, please write to trials@mediorahealth.com.

23. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority (Article 77 GDPR). The authority responsible for MediOra Health is:

Unabhängiges Datenschutzzentrum Saarland (Independent Data Protection Centre Saarland)
Fritz-Dobisch-Straße 12
66111 Saarbrücken
Germany
datenschutz.saarland.de

You can also contact another supervisory authority, in particular in the EU Member State where you live or work or where the alleged infringement took place.

24. Changes to this privacy policy

We update this privacy policy when legal requirements, the website, our service providers or the processing change. The version published on this website applies.