Privacy Policy

Last updated: 4 November 2026

1. Controller

The controller responsible for processing personal data on mammologicum.de is:

Mammologicum GmbH Alstertwiete 1b 20099 Hamburg, Germany Registered in the commercial register of the Local Court (Amtsgericht) of Hamburg under HRB 183465 Managing director: Dr. med. Sergej Popovich Email: info@mammologicum.de

Please send data protection requests to info@mammologicum.de. We have not appointed a data protection officer because we are not required to do so.

2. Overview

Mammologicum is a continuing-education platform for physicians (mammography, ultrasound, MRI) with courses, trainings with practice cases, exams and certificates. We process personal data only where this is necessary to operate the platform and our services, where we are legally required to do so, or where you have consented.

All practice cases and images on the platform are anonymised; they contain no names, dates of birth or patient identifiers. We therefore do not process patients' health data. We currently use no analytics or advertising tools (such as Google Analytics) and do not carry out profiling for advertising.

3. Hosting, server logs and fonts

When you visit the website, our hosting provider processes technically necessary data: IP address, date and time, requested URL, browser and operating-system information, referrer and data volume. The country (and, where applicable, region and city) is briefly derived from the IP address, for example to pre-fill the country and phone prefix in the registration form. We do not store this information.

The font we use is delivered from our own server. No connection to Google Fonts is made.

Purpose: delivering the pages, security and stability. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure and functional operation).

Recipient: Vercel Inc., USA (hosting; processor). Transfer to the USA relies on the EU Commission Standard Contractual Clauses (Implementing Decision (EU) 2021/914) agreed in Vercel's data processing agreement. How long server logs are kept depends on the technical settings of the hosting provider.

4. Account, registration and sign-in

When you create an account we process: email address, name, country, phone number, password (only as a hash), academic degree, medical specialty (if provided), preferred language, a referral or partner code if applicable, and the time of registration. At each sign-in we also store a session token and the IP address and browser identifier (user agent) of the session.

Purpose: providing the account and the platform, authentication, protection against misuse. Legal basis: Art. 6(1)(b) GDPR (user agreement); for session data kept for security, Art. 6(1)(f) GDPR.

The details marked as mandatory in the registration form are required to set up an account; without them we cannot create one. Sign-in through third-party accounts (e.g. Google) is not offered.

If a course organiser invites someone by email who does not yet have an account, we store that email address together with the course until the invitation is accepted or deleted (Art. 6(1)(f) GDPR; legitimate interest in running group courses).

Recipient: account data is stored in a database operated on Google Cloud (Cloud SQL) servers in Frankfurt am Main, Germany.

5. Courses, trainings, exams, surveys and certificates

We store your course bookings and access periods, your learning progress, your answers to practice cases and exams (e.g. BI-RADS ratings, markings, free text, timestamps), results calculated from them (e.g. sensitivity and specificity), survey answers, and certification attempts and pass status. We also record simple usage events (e.g. start or completion of an exercise).

There are also short games and tests: in the "Game of the Day", answers of signed-in users are linked to their account. In the "Safety-Net Trainer" without an account, answers are stored under a random session ID. For clinic assessments we store the participant's name, email address and clinic.

Certificates. If you pass a course or exam, we generate and store a certificate as a PDF containing your name, the date and, where applicable, result values. The certificate can be retrieved without signing in through a non-guessable link (QR code): anyone who knows that link can view the certificate. Therefore share the link or QR code only with people to whom you want to show the certificate. A certificate is issued automatically once the published passing criteria are met. There is no further automated decision with legal effect within the meaning of Art. 22 GDPR and no profiling.

Practice cases and images. The practice cases consist of anonymised X-ray, ultrasound and MRI images and case descriptions. Images and certificates are held in the storage service of Supabase (Supabase, Inc., USA) and are provided only to authorised signed-in users via time-limited links. The transfer relies on the EU Commission Standard Contractual Clauses agreed in Supabase's data processing agreement.

Purpose: delivering the courses, evaluation, issuing certificates, improving the learning content. Legal basis: Art. 6(1)(b) GDPR; for evaluation to improve the content, Art. 6(1)(f) GDPR.

6. Payments

Courses may be paid. Card payments are processed by Stripe. Your card data goes directly from your browser to Stripe and does not reach us. We transmit to Stripe the amount, currency, description, your email address (for the receipt) and internal identifiers (user, course and price ID). We receive the payment status from Stripe and store transaction and refund data (course, price, currency, status, time, transaction ID).

Purpose: performing the contract and bookkeeping. Legal basis: Art. 6(1)(b) GDPR; for retention, Art. 6(1)(c) GDPR (§ 147 AO, § 257 HGB).

Recipients: Stripe Payments Europe, Ltd. (Ireland) and affiliated companies, including Stripe, Inc. (USA). For transfers to the USA, the safeguards provided in Stripe's data processing agreement apply (EU Commission Standard Contractual Clauses or the EU-U.S. Data Privacy Framework). For certain purposes (e.g. fraud prevention, legal obligations) Stripe also processes data as an independent controller. When the payment page loads, Stripe.js is loaded from Stripe; Stripe may set cookies or similar identifiers used for payment processing and fraud prevention.

7. Email, forms, webinars and marketing

Transactional emails. We send welcome emails, password-reset emails, course access and consensus requests and other system messages through the service Resend (Resend, Inc., USA). Recipient address, name and message content are processed. Legal basis: Art. 6(1)(b) GDPR. The transfer to the USA relies on the EU Commission Standard Contractual Clauses and the EU-U.S. Data Privacy Framework provided in Resend's data processing agreement.

Forms. If you use the feedback, contact or consultation form, you transmit, depending on the form, e.g. name, email address, phone, country, topic or message, preferred time, role, experience, goals, time zone and language. This information is sent by email (via Resend) to our team mailbox and is not stored in our database. To protect against misuse, the IP address is briefly held in memory to limit requests. Purpose: handling your request. Legal basis: Art. 6(1)(b) or (f) GDPR.

Webinar registration. Our webinar pages are still in use. When you register for a webinar we send your name, email address, phone number, the page visited (referrer URL) and any referral code to SendPulse (SendPulse Inc., New York, USA), where they are stored in an address list. Purpose: handling your webinar registration and sending information about the webinar. Legal basis: Art. 6(1)(b) GDPR. The transfer relies on the EU Commission Standard Contractual Clauses that form part of SendPulse's data processing agreement.

Marketing emails. We occasionally send customers who have bought a course from us, via Resend, emails about our own similar courses and promotions. The legal basis is Art. 6(1)(f) GDPR in conjunction with § 7(3) UWG (existing customers, own similar services). Other registered users receive such emails only with their consent (Art. 6(1)(a) GDPR). You can give it voluntarily by ticking a box when you register; we store the time of consent as proof. Consent can be withdrawn at any time with effect for the future. You can object to the use of your email address for advertising at any time, at no cost other than the transmission costs at basic rates: simply reply to the email or write to info@mammologicum.de. We will then stop sending them; you will still receive system messages about your account.

8. Error monitoring (Sentry)

To detect and fix errors and to measure performance we use Sentry (Functional Software, Inc., USA). When errors occur, technical information is transmitted (error message, stack trace, requested URL, browser and device information). For signed-in users only an internal user ID is also transmitted, no email address and no name. A share (about 10%) of page views is recorded for performance measurement. No session recording (session replay) takes place. For technical reasons the IP address is visible to the recipient when the connection is established.

Purpose: stability and security of the platform. Legal basis: Art. 6(1)(f) GDPR. Sentry processes the data in the US region. The transfer relies on the safeguards provided in Sentry's data processing agreement (EU-U.S. Data Privacy Framework or EU Commission Standard Contractual Clauses). Data is kept only for a limited period according to the settings of our Sentry project.

9. External content (videos) and links

Videos from YouTube and in some cases Google Drive are embedded in courses, webinars and promotional pages. These videos are not loaded automatically. First you see only a neutral placeholder with a notice. Only when you click play is the video loaded; we load YouTube videos using the enhanced privacy mode (youtube-nocookie.com). Your browser then connects to Google servers (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; possibly Google LLC, USA). Google receives your IP address and technical browser data and may use cookies or similar technologies. A transfer to the USA is possible; details are in Google's privacy policy (policies.google.com/privacy).

Legal basis: your consent by clicking play (Art. 6(1)(a) GDPR, § 25(1) TDDDG). Without a click, no connection to Google is made. You can withdraw consent for the future by leaving or reloading the page or deleting cookies in your browser.

Our site also links to Telegram, WhatsApp, Instagram and Google Forms. Data is transferred to the respective provider only when you click these links; the provider is responsible for that processing.

10. Cookies and local storage

We use only cookies and local storage that are necessary for operation or for saving your choices (§ 25(2) TDDDG):

• Session cookie __Secure-better-auth.session_token (sign-in; up to 7 days; not readable by JavaScript; set only after sign-in).
• mammo-user-lang (chosen language; up to 400 days).
• ref (referral or partner code; set only if you open a link with a referral parameter; session cookie; linked to your account at registration).
• Your browser's local storage: display and filter settings (e.g. dashboard, course selection, sound in training), daily progress in the "Game of the Day" and the participant ID in clinic assessments. This data stays in your browser; only the participant ID is transmitted to us.

When paying (Stripe, see section 6) and after clicking an embedded video (see section 9), third parties may set their own cookies. Google Analytics or comparable audience measurement is not used.

11. Recipients and third-country transfers

• Vercel Inc. (USA): hosting. Standard Contractual Clauses.
• Google Cloud (data centre in Frankfurt am Main, Germany): database with account data. No third-country transfer by us.
• Supabase, Inc. (USA): storage of images and certificates. Standard Contractual Clauses.
• Stripe Payments Europe, Ltd. (Ireland) and Stripe, Inc. (USA): payments. Safeguards under the Stripe data processing agreement.
• Resend, Inc. (USA): email sending. Standard Contractual Clauses and EU-U.S. Data Privacy Framework.
• SendPulse Inc. (USA): webinar address list. Standard Contractual Clauses.
• Functional Software, Inc. (Sentry, USA): error monitoring. Safeguards under the Sentry data processing agreement.
• Google (YouTube, Google Drive): only after you click a video, see section 9.
• Tax advisers, authorities and courts: where legally required.

With service providers acting as processors for us, contracts under Art. 28 GDPR or their data processing terms apply. You can obtain the Standard Contractual Clauses on request. We do not pass data on to other third parties unless we are legally obliged to do so.

12. Retention

We store personal data only as long as necessary for the stated purposes or as required by statutory periods.

• Account data, learning progress, exam results and certificates: until your account is deleted; afterwards only where statutory retention duties apply.
• Accounting vouchers (e.g. invoices, payment and refund data): 8 years; books and annual accounts: 10 years; commercial letters: 6 years (§ 147 AO, § 257 HGB), in each case from the end of the calendar year in which they arose.
• Session data: until the session expires, at the latest until the account is deleted.
• Requests by form or email: as long as needed to handle them; afterwards only if they are business correspondence subject to retention.
• Marketing emails: until you object or the account is deleted.
• Data at SendPulse: until your webinar registration is handled or you request deletion.

You can ask for your account to be deleted at any time at info@mammologicum.de.

13. Your rights

Under the GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). Where processing is based on your consent, you can withdraw it at any time with effect for the future (Art. 7(3) GDPR); this does not affect the lawfulness of processing carried out before.

Right to object (Art. 21 GDPR): Where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation. You may object to the use of your data for direct marketing at any time without giving reasons.

To exercise your rights, an email to info@mammologicum.de is sufficient.

Right to lodge a complaint: You can complain to a data protection supervisory authority. The authority responsible for us is:

Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit (HmbBfDI) Ludwig-Erhard-Str. 22, 7th floor 20459 Hamburg, Germany Email: mailbox@datenschutz.hamburg.de

14. Security

Transmission is encrypted (HTTPS). We store passwords only as a hash. Access to practice cases and images is restricted to authorised signed-in users and takes place through time-limited links.

15. Changes

We update this notice when features or the legal situation change. The current version is available at https://mammologicum.de/en/privacy-policy.