Privacy policy

1. Controller

The controller for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

Email: sebastian@basen.health

Data protection contact: Sebastian Weyer, sebastian@basen.health. We have not appointed a data protection officer.

2. Overview

• We use no advertising cookies.
• Google Analytics 4 is only loaded with your explicit consent. Without consent we set no analytics cookies and make no connection to Google Analytics (section 8).
• No connection to Cloudflare is made before you first interact with the contact form (section 5).
• Fonts are served from our own server; no requests are made to Google Fonts.
• Technically necessary are the delivery of the website (section 3), the protection of the contact form (section 5) and storing your cookie choice in your browser (section 8).
• Links to other websites (such as Bosch, Founders Factory or the GKV-Spitzenverband) only share data with that provider once you click them.

3. Hosting and server log files

Our website is served through Firebase Hosting, a Google Cloud service. The provider is:

When you visit the website, technically necessary data is processed: IP address, date and time of access, page requested, amount of data transferred, referrer URL, and browser type and operating system. Pages are delivered through Google's content delivery network so the site is fast and reliably available.

The purpose is to provide the website and keep it stable and secure. The legal basis is our legitimate interest under Art. 6(1)(f) GDPR. We keep server log files as security-relevant logs for 12 months and delete them afterwards.

Our servers run in the Google Cloud region europe-west3 (Frankfurt am Main). We have a data processing agreement with Google under Art. 28 GDPR. A transfer to Google LLC in the USA cannot be ruled out; Google LLC is certified under the EU-US Data Privacy Framework, and the EU Standard Contractual Clauses apply in addition. More information: Google privacy policy.

4. Contact form

When you write to us through the contact form, we process your first name, last name, work email address, phone number, hospital or organisation, your role and, if provided, your message. We use this data to handle your request and to arrange a meeting with you.

The legal basis is Art. 6(1)(b) GDPR (pre-contractual steps at your request) and, in addition, our legitimate interest in handling requests efficiently under Art. 6(1)(f) GDPR. The form can only be sent once you confirm with the checkbox that we may contact you about your request by phone and email.

Form data is sent to our server at Google Cloud in Frankfurt am Main (region europe-west3) and stored from there in our CRM system Attio: as a person record with name, email, phone and role, as an entry in the lead pipeline (channel "Website") and as a note with your message. If your email address already exists in the CRM, we do not change the existing data and only attach a note.

To prevent abuse, we limit the number of requests per IP address; for this we store the IP address only in pseudonymised form, as a keyed hash (HMAC), for one hour. Technical information about the processing status of a request, which contains no names or contact details, is deleted automatically after seven days at the latest. Copies of these entries in backups are removed within a further 30 days. The legal basis is our legitimate interest in secure operation under Art. 6(1)(f) GDPR.

Providing your data is voluntary. Without the required fields, however, we cannot process your request through the form; you can email us instead (section 9).

5. Spam protection: Cloudflare Turnstile

To protect our forms (contact form, hospital check and FAQ question) from automated requests (bots), we use Cloudflare Turnstile. The provider is:

The Turnstile script is only loaded once you click or tap a field in one of these forms. Before that, no connection to Cloudflare is made. Afterwards, your IP address and technical information about your browser and device are sent to Cloudflare to check whether the request comes from a human. When you submit the form, our server sends the generated token together with your IP address to Cloudflare's verification endpoint.

According to Cloudflare's documentation, the Turnstile widget in the default configuration we use sets no cookie; the token is valid once. Turnstile does not set cookies for advertising or tracking.

The legal basis is our legitimate interest in protecting our website from abuse under Art. 6(1)(f) GDPR; access to information on your device is strictly necessary for the service you request under Section 25(2) No. 2 TDDDG. Cloudflare, Inc. is certified under the EU-US Data Privacy Framework, and the EU Standard Contractual Clauses apply in addition. More information: Cloudflare privacy policy.

6. Hospital check

The hospital check lets you compare hospitals based on public hospital-level data published by the GKV-Spitzenverband under Section 275c(4) SGB V. The comparison data is loaded from our server and evaluated in your browser; no connection to third parties is made.

To show you the comparison, we need your work email address and at least one selected hospital. This information is sent to us together with the language and time of the request and stored in our CRM system Attio. The legal basis is Art. 6(1)(b) GDPR (providing the comparison you requested).

The checkbox "Basen may contact me by email about my results" is optional. Only if you tick it may we contact you by email about your results. The legal basis is then your consent under Art. 6(1)(a) GDPR, which you can withdraw at any time with effect for the future, for example by emailing sebastian@basen.health.

7. Questions via the FAQ form

When you send us a question through the form in the FAQ section, we process your question and your email address in order to answer you by email. This information is sent to us and stored in our CRM system Attio. The legal basis is Art. 6(1)(b) GDPR where your question concerns a collaboration, and otherwise our legitimate interest in answering requests under Art. 6(1)(f) GDPR. The form can only be sent once you confirm with the checkbox that we may answer you by email.

8. Web analytics: Google Analytics 4

With your consent, we use Google Analytics 4 to understand how our website is used. The provider is:

Google Analytics is only loaded after you click "Accept" in the banner. If you choose "Decline" or make no choice, no Google script is loaded, no Google cookies are set and no requests are sent to Google. The two buttons in the banner look the same, and nothing is pre-selected.

Data processed: truncated IP address (anonymisation is active), device and browser information, pages visited and interactions on the page. Google Signals and ad personalisation are disabled. Google Analytics sets the cookies _ga and _ga_[measurement ID] with a lifetime of 2 years. We store your choice from the banner in your browser's storage (key "basen-consent") until you clear it; this entry contains no personal data.

Data in Google Analytics is deleted after 2 months. The legal basis is your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You can withdraw your consent at any time via the link Cookie settings. When you withdraw, we remove the Google Analytics cookies from your browser and reload the page without analytics. Withdrawal applies to the future.

Google may transfer data to the USA. We base this transfer on the EU-US Data Privacy Framework and on the EU Standard Contractual Clauses. We have a data processing agreement with Google under Art. 28 GDPR. More information: Google privacy policy.

9. Contact by email

When you write to info@basen.health or sebastian@basen.health, we process your email address, your name and your message in order to answer your request. The legal basis is Art. 6(1)(b) GDPR for pre-contractual requests, and otherwise our legitimate interest in answering requests under Art. 6(1)(f) GDPR. Our email is processed by Google Workspace (Google Ireland Limited, address above); we have a data processing agreement with Google under Art. 28 GDPR.

10. CRM system Attio

We manage requests from our forms in the CRM system Attio. The provider is:

Your data is stored in Attio's EU data region. The European Commission has issued an adequacy decision for the United Kingdom. We have concluded a data processing agreement with Attio under Art. 28 GDPR. More information: Attio privacy policy.

11. Recipients and international transfers

We share your data only with the processors named in this policy, to the extent needed for the stated purposes:

• Google Ireland Limited: Firebase Hosting, Cloud Run and Firestore in region europe-west3 (sections 3 and 4), Google Workspace (section 9) and, only with your consent, Google Analytics (section 8).
• Cloudflare, Inc.: Turnstile (section 5).
• Attio Limited: CRM system (section 10).

We do not share your data with Bosch Health Campus as a development partner or with investors. We have agreements under Art. 28 GDPR with all processors. Transfers to third countries, in particular the USA, are based on the EU-US Data Privacy Framework or on the EU Standard Contractual Clauses.

12. Retention

We review contact and request data in our CRM system annually and delete it once there is no longer a business purpose, and at the latest when you withdraw your consent or ask us to delete it and no statutory retention obligation applies. Statutory retention obligations, in particular under commercial and tax law, remain unaffected. Retention periods for server log files, technical data, backups and Google Analytics are given in the sections above.

13. Your rights

Under the GDPR you have the right to:

• access the data we hold about you (Art. 15 GDPR)
• have inaccurate data corrected (Art. 16 GDPR)
• erasure (Art. 17 GDPR) and restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• withdraw consent at any time with effect for the future (Art. 7(3) GDPR)

Right to object: where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation (Art. 21(1) GDPR). You can object to processing for direct marketing at any time and without further conditions (Art. 21(2) GDPR).

To exercise your rights, simply email sebastian@basen.health. We answer your request within one month.

You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is:

14. Note on our product

This privacy policy covers the website basen.health. Data that hospitals provide to us as part of a project is processed by us as a processor on behalf of the respective hospital under a data processing agreement pursuant to Art. 28 GDPR; the hospital remains the controller for that data. When the product runs in the hospital's own infrastructure (on-premises), the data stays at the hospital. When it runs as a cloud service, the data is processed exclusively in Germany in a BSI C5-attested Google Cloud environment. The statement "BSI C5-certified hosting in Germany" on our website refers to this customer data in the product, not to the website itself.

15. No automated decision-making, changes

We do not use automated decision-making, including profiling, under Art. 22 GDPR on this website. We update this privacy policy when our website or the services we use change. The version published here applies.