English | Deutsch

Privacy Policy

The protection of your personal data is of particular importance to us. We process your data confidentially and in accordance with legal data protection regulations, in particular the General Data Protection Regulation (GDPR), and this privacy policy.

1. Controller

Node Health UG
Kastanienallee 98A
10435 Berlin
Email: legal@nodehealth.de

Data Protection Officer

We have appointed a Data Protection Officer for our company. You can contact them as follows:

legal.solutions GmbH
Sophienstraße 1
10178 Berlin
Email: g.wirtz@pagestreet.de

Use by minors: The app is not intended for persons under 18 years of age. We do not knowingly process personal data of minors.

2. Principles of Data Processing and Categories of Data

2.1. Local Storage and Device-Based Processing

The app is designed so that your data is generally processed and stored locally on your device. Core functionalities operate directly on your iPhone or iPad. Certain Premium features require secure processing via Google Cloud infrastructure, as described below.

Locally stored data categories:

Health-related data constitute special categories of personal data within the meaning of Art. 9 GDPR. All such data remain stored locally on your device until you delete them or uninstall the app.

No tracking, no advertising, no behavioral profiles: The app does not use tracking technologies, third-party analytics tools, advertising technologies, or behavioral profiling.

2.2. App Analytics and Crash Reports (Apple — optional)

If you have enabled device analytics in your iOS settings (Settings → Privacy & Security → Analytics & Improvements), Apple may collect pseudonymized diagnostic and crash data. We may receive aggregated technical reports from Apple to improve stability.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in ensuring technical stability).

Your control: You can disable this transmission at any time in your system settings.

3. Data Processing for Laboratory Data and AI Analysis

The app allows you to extract biomarkers from PDF documents or photos and to generate AI-supported analyses. In doing so, health data within the meaning of Art. 9(1) GDPR are processed.

3.1. Legal Basis: Explicit Consent

Processing of health data is carried out exclusively on the basis of your explicit consent (Art. 9(2)(a) in conjunction with Art. 6(1)(a) GDPR). Consent is obtained prior to using AI-supported features.

Withdrawal: You may withdraw your consent at any time pursuant to Art. 7(3) GDPR with effect for the future by discontinuing use of the feature and deleting your data. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

3.2. Technical Processing Structure

Uploaded documents are first processed locally on your device for text extraction. For AI-supported analysis, relevant data are transmitted to Google AI services hosted on Google Cloud infrastructure.

We operate our own backend which communicates with Google solely for the purpose of performing the requested analysis. The transmitted data are processed temporarily and are not used for model training. Google does not use the data for its own purposes.

3.3. External Processing by Google

Recipient: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Role: Google acts as a processor pursuant to Art. 28 GDPR.

We have concluded a Data Processing Agreement including EU Standard Contractual Clauses where required. Due to the global corporate structure of Google, access from third countries (including the United States) cannot be entirely excluded.

3.4. Backend Logging and Technical Error Analysis

To ensure technical stability and resolve errors (e.g., failed uploads or matching issues), we maintain limited backend logs. These logs may include technical metadata, error messages, and limited portions of uploaded data where necessary to identify the cause of failure.

Logs are used exclusively for debugging and troubleshooting purposes and are retained only as long as necessary.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in ensuring technical stability and security), and Art. 9(2)(a) GDPR where health data are affected.

3.5. No Automated Decision-Making

There is no automated decision-making or profiling within the meaning of Art. 22 GDPR. AI-generated analyses are informational only and do not produce legally binding effects.

4. Subscription Services (Apple App Store)

Premium subscriptions are offered exclusively via the Apple App Store. Payments are processed solely by Apple. We do not receive or store credit card data, banking details, or Apple ID credentials.

Subscription validation is performed locally on your device using Apple’s receipt validation mechanisms.

Legal basis: Art. 6(1)(b) GDPR (performance of contract).

5. Deletion of Data

You may delete your data at any time within the app. Uninstalling the app removes all locally stored data completely and irretrievably, unless you have created your own backup.

6. Your Rights

As a user, you have the following rights regarding personal data processing:

If you wish to exercise your rights, please contact the controller listed above.

7. Competent Supervisory Authority

Berlin Commissioner for Data Protection and Freedom of Information
Alt-Moabit 59–61
10555 Berlin
Germany
Email: mailbox@datenschutz-berlin.de

8. Changes to this Privacy Policy

We reserve the right to adapt this privacy policy. The latest version can be viewed within the app.

In the event of material changes, we will inform you in advance and — if required — obtain renewed consent.

Berlin, March 2026 (App Version 2.1)