Privacy Policy

1. Controller

The controller responsible for the processing of personal data on this website and in connection with our research service is:
Oncocon FZ-LLC, represented by its managing director Ayah Arshad Mohamed Rashed
FDRK5100, Compass Building, Al Shohada Road, Al Hamra Industrial Zone-FZ, Ras Al Khaimah, United Arab Emirates
Email: info@dr-adem.online

2. Overview

We process personal data only to the extent necessary for operating this website and for our research service, or where you have given your consent. For the research, we also process health data, i.e. specially protected data under Art. 9 GDPR. We process this data only with your explicit consent.

3. Hosting and server log files

This website is hosted by Hostinger (Hostinger International Ltd., Cyprus). When you access the website, your browser automatically transmits technical data that is stored in log files: IP address, date and time, page accessed, previously visited page, browser and operating system. We need this data to provide the website securely and reliably. The legal basis is Art. 6(1)(f) GDPR (legitimate interest). The log files are automatically deleted after a short time.

4. No cookies, audience measurement with Umami

This website does not set any cookies and does not use any advertising or tracking services.

To understand how our website is used and which pages and access routes are helpful for patients, we use the analytics service Umami (Umami Software, Inc., USA), with storage in the European Union. Umami does not set cookies and does not create user profiles. It records aggregated information such as the page visited, the referring page or link identifier, country, language, device type and browser, and whether the registration section was viewed and the registration form was submitted. Your form entries are not recorded. Your IP address is not stored. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in data-minimising audience measurement).

The fonts are stored on our server; no connection to Google is established. If you close the notice about another language version, your browser remembers this in its local storage. This entry remains on your device and is not transmitted to us.

5. Sign-up, medical questionnaire and medical records (Tally)

For sign-up, the medical questionnaire and the upload of medical records, we use online forms from Tally (Tally BV, Ghent, Belgium). The forms are loaded from Tally’s servers; in the process, Tally receives your IP address and technical data about your browser. Your entries and files are transmitted in encrypted form and stored in the European Union. Tally processes the data on our behalf (Art. 28 GDPR).

• Sign-up: form of address, name and email address, in order to send you the link to the medical questionnaire. The legal basis is Art. 6(1)(b) GDPR (steps prior to entering into a contract).
• Medical questionnaire and medical records: information about your illness and treatment as well as your medical records, in order to prepare your research report. The legal basis is your explicit consent (Art. 9(2)(a) GDPR), which you give in the questionnaire.

6. Contact by email

If you send us an email, we process your details in order to answer your enquiry (Art. 6(1)(b) GDPR). Our mailbox is provided by Google (Google Workspace, Google Ireland Ltd., Dublin, Ireland). Regular emails are not encrypted end-to-end. Please therefore send medical documents via the upload form and not by email.

7. Technical service providers

We use technical service providers that process personal data for specific purposes on our behalf and in accordance with our instructions (Art. 28 GDPR). Some of these service providers are based outside the European Union, for example in the USA. In such cases, the transfer takes place on the basis of the EU-US Data Privacy Framework or EU standard contractual clauses.

8. Payment

Once your request has been accepted, you pay by bank transfer or credit card. For this purpose, we process your name, billing details and payment information (Art. 6(1)(b) and (c) GDPR).

9. Transfers to countries outside the EU

The controller is based in the United Arab Emirates. Your data, including health data, is therefore processed outside the European Union. There is no adequacy decision by the EU Commission for the United Arab Emirates. The transfer takes place because it is necessary for preparing your research report (Art. 49(1)(b) GDPR) and on the basis of your explicit consent (Art. 49(1)(a) GDPR). For service providers outside the European Union, see section 7.

10. Storage period

• Sign-ups that do not result in an order: deleted after 6 months.
• Questionnaire, medical records and research report: deleted 3 years after completion of the order.
• Invoices: 10 years (retention obligation under tax law).
• Server log files: a few days.

11. Your rights

You have the following rights:

• Access (Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR), unless there is a retention obligation
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing based on legitimate interests (Art. 21 GDPR)
• Withdrawal of your consent with effect for the future (Art. 7(3) GDPR)

An informal message to info@dr-adem.online is sufficient.

12. Right to lodge a complaint

You can lodge a complaint with a data protection supervisory authority, in particular in the EU Member State in which you live or work (Art. 77 GDPR). A list of the authorities is available from the European Data Protection Board (edpb.europa.eu).

13. No automated decision-making

We do not make any decisions based solely on automated processing, including profiling (Art. 22 GDPR).