Privacy Policy

Two different roles must be distinguished:

• When we process data of website visitors, prospective customers and registered practice users, MS Nucleus GmbH is generally the controller within the meaning of the General Data Protection Regulation (GDPR) and the UK GDPR.
• When a practice processes patient data within Centi, the practice is generally the controller. MS Nucleus GmbH processes that data on behalf of the practice as a processor under Article 28 GDPR and Article 28 UK GDPR.

1. Controller

The controller within the meaning of the GDPR and the UK GDPR is:

MS Nucleus GmbH
Gundelfinger Straße 5
10318 Berlin
Germany

Registered with the Local Court (Amtsgericht) Berlin-Charlottenburg under HRB 243388
Represented by its managing director, Frederik Marquart

Email: support@centi-health.de

Data Protection Officer

MS Nucleus GmbH has appointed a Data Protection Officer. You can contact them at:

Gundelfinger Straße 5, 10318 Berlin, Germany
Email: datenschutz@elara-health.de

You may contact our Data Protection Officer directly with any questions about data protection or to exercise your rights.

UK representative (Article 27 UK GDPR)

We will name our representative in the United Kingdom under Article 27 UK GDPR here once appointed. Until then, please contact us or our Data Protection Officer using the details above.

2. Scope

This Privacy Policy applies in particular to:

• visits to the website centi-health.de,
• contact and demo requests,
• registering and managing a Centi account,
• use of the Centi dashboard by practices and their staff,
• technical access, security and log data,
• digital intake questionnaires,
• patient profiles,
• health and laboratory reports,
• documents and electronic signatures,
• communication with patients,
• automated extraction and structuring of health data,
• supporting analysis, score and AI features,
• and the connection of data shared from the Elara app.

For processing within other services, in particular the Elara Health app, the privacy information provided there applies in addition.

Part A – Website, prospective customers and practice users

3. Visiting our website

When you visit our website, we process data that is technically necessary. This may include:

• IP address,
• date and time of access,
• page or resource requested,
• browser type and version,
• operating system,
• referrer information,
• technical device information,
• error and security information.

We process this data to provide the website, keep it secure, detect errors and prevent misuse.

Legal basis: Article 6(1)(f) GDPR / UK GDPR. Our legitimate interest is the secure, stable and functioning provision of our online services.

4. Website hosting

We use external hosting and infrastructure providers to deliver our website, in particular:

Vercel Inc., USA. Vercel provides infrastructure for delivering the web application. It may process technical access, network and connection data.

Where personal data is processed outside the European Economic Area (EEA) or the United Kingdom, we ensure that the legal requirements for international transfers are met (see sections 16 and 30).

Legal basis: Article 6(1)(f) and, where applicable, Article 6(1)(b) GDPR / UK GDPR.

5. Contact and demo requests

If you contact us by email, form or otherwise, we process in particular:

• name,
• email address,
• practice or company details,
• the content of your enquiry,
• telephone number, where provided,
• any other information you choose to give us.

We process this data to handle and answer your enquiry. Where your enquiry relates to entering into or performing a contract, the legal basis is Article 6(1)(b) GDPR / UK GDPR. Otherwise, the legal basis is our legitimate interest in handling business enquiries under Article 6(1)(f) GDPR / UK GDPR.

Business outreach by email

We occasionally contact practices whose work fits Centi by email. For this purpose we process business contact details of the practice: the name, form of address and title of the owner, practice name, address, business email address, website and recognisable areas of practice.

This information comes from publicly available sources, in particular the practice’s own website and legal notice and public business directories. We use an external AI service to analyse these public texts. It receives only this public business information and no patient data.

We send no more than two messages. We record when a message was sent, whether it could be delivered and whether you replied. If you click a link in an HTML message, we record that click. We do not track whether emails are opened. Messages are sent through our email provider IONOS SE, Germany; the data is stored with our hosting provider (see section 15).

Legal basis: our legitimate interest in direct marketing for Centi under Article 6(1)(f) GDPR / UK GDPR. We have documented our assessment of this interest.

Recipients in the United Kingdom (PECR): Under the Privacy and Electronic Communications Regulations 2003 (regulation 22), we only send unsolicited marketing emails to corporate subscribers, such as limited companies and limited liability partnerships, at their business addresses. We do not send unsolicited marketing emails or direct messages to sole traders or non-limited partnerships without their prior consent. Every message identifies us as the sender and includes a valid address for opting out, free of charge.

Recipients in Switzerland: see section 34.

Right to object: You can object to the use of your data for this outreach at any time, without giving reasons (Article 21(2) GDPR / UK GDPR). A short reply to our email or a message to support@centi-health.de is enough. We will then stop contacting you. We keep your email address only on a suppression list so that we do not contact you again in the future.

6. Registration and Centi user account

When you register and use a Centi account, we may process in particular:

• first and last name,
• email address,
• practice name,
• professional and practice details,
• user ID,
• login and authentication data,
• account and plan information,
• contract and billing information,
• account settings and configuration,
• technical usage and security data.

We process this data to set up and perform the contract for the use of Centi.

Legal basis: Article 6(1)(b) GDPR / UK GDPR. Where we process data to comply with legal obligations, the legal basis is Article 6(1)(c) GDPR / UK GDPR.

7. Technical log and security data

To keep the platform secure, we may process technical log data, in particular:

• IP address,
• login times,
• failed login attempts,
• technical device and browser information,
• security-relevant system events,
• technical error data.

This processing serves IT security, misuse detection, error analysis and system availability.

Legal basis: Article 6(1)(f) GDPR / UK GDPR.

Part B – Patient data within Centi

8. Roles for patient data

For patient data that a practice collects, enters, uploads, receives or otherwise processes within Centi, the practice generally decides on the purposes and means of processing. The practice is therefore generally the controller under Article 4(7) GDPR / UK GDPR.

MS Nucleus GmbH processes this patient data solely on behalf of the practice and acts as a processor under Article 28 GDPR / UK GDPR. A data processing agreement is concluded between the practice and MS Nucleus GmbH for this purpose. For practices in the United Kingdom, the UK addendum to this agreement applies.

The practice is responsible for the lawfulness of collecting and processing patient data, in particular for determining the applicable lawful basis under Article 6 and the condition under Article 9 GDPR / UK GDPR.

MS Nucleus does not use patient data for its own treatment, advertising or profiling purposes.

9. Categories of patient data processed within Centi

Depending on the features a practice uses, this may include:

Identification and contact data

Name, date of birth, sex (where provided), contact details, patient or internal practice identifiers.

Health data

This is generally special category data under Article 9(1) GDPR / UK GDPR, for example:

• intake information,
• symptoms and complaints,
• diagnoses and medical history,
• laboratory values and biomarkers,
• reference ranges and units,
• vital signs,
• treatment information,
• information on medication or therapies,
• health trends over time,
• medical documents,
• findings,
• recommendations and professional assessments.

Document and signature data

Uploaded documents, generated reports, signed documents, signatures, time and status of signing processes.

Communication data

Intake questionnaire links sent, answers given in digital intake forms, communication and delivery information, patient replies and entries.

Shared tracker data

Where a patient app or interface intended for this purpose is used and the patient has shared the data, this may include aggregated information on sleep, energy, symptoms, vital signs, activity and post-exertional malaise (PEM) or exertion events. Which data areas are shared depends on the technical integration and on the choices of the person concerned.

10. Digital intake questionnaires

Practices can provide digital intake questionnaires through Centi. Patients can open them, for example, via a link or QR code and submit their answers digitally. The information entered is assigned to the practice concerned and processed on its behalf.

MS Nucleus GmbH does not use this information for its own medical or marketing purposes. The practice is the controller for the questionnaire and for determining its content and lawful basis.

11. Laboratory reports and automated data extraction

Centi allows practices to upload laboratory reports and other health documents and to capture and present the information they contain in a structured way. This may involve:

• uploading a document,
• optical character recognition (OCR),
• extracting laboratory parameters,
• matching units and reference ranges,
• structuring the data,
• displaying trends over time,
• creating or supporting health reports.

We may use specialised technical processors for OCR, analysis or AI features. These providers may only process patient data in accordance with our instructions and the data protection agreements concluded with them.

We do not use patient or health data to train generally available AI models.

12. AI-supported features and scores

Centi may provide automated features for structuring, summarising or analysing information and for calculating scores or other indicators. These features support the practice user. Professional assessment, interpretation and decisions remain with the treating or supporting practitioner.

Centi does not make solely automated decisions about patients that produce legal effects concerning them or similarly significantly affect them. Automated decision-making within the meaning of Article 22 GDPR / UK GDPR therefore does not take place.

13. Elara connection and tracker data

Centi can be connected to the Elara Health app. A connection is only established if the person concerned actively sets up or confirms it. Where technically provided, the person can also choose which data areas are shared with the practice.

In particular, aggregated information on sleep, energy, vital signs, symptoms and PEM or exertion may be transferred. Data areas that have not been shared are not made available to the practice.

Sharing can be revoked within the features provided. Once sharing ends, no further data from the area concerned is transferred to Centi or to the connected practice. For processing within the Elara Health app, the privacy information of Elara Health applies in addition.

14. Lawful basis for patient data

As controller, each practice is responsible for determining an appropriate lawful basis for processing its patients’ personal data. This concerns in particular a lawful basis under Article 6 GDPR / UK GDPR and, for health data, a condition under Article 9(2) GDPR / UK GDPR (and, in the United Kingdom, Schedule 1 to the Data Protection Act 2018 where relevant).

Which lawful basis applies depends in particular on the type of practice, the profession, the treatment situation, the purpose of processing and any consent given. MS Nucleus does not determine this lawful basis for the practice but processes patient data on the basis of the practice’s instructions under Article 28 GDPR / UK GDPR.

Part C – Service providers and technical infrastructure

15. Processors and sub-processors

We use specialised technical service providers to operate Centi, in particular in the following areas:

• hosting and cloud infrastructure,
• databases and authentication,
• file and document storage,
• OCR and AI processing,
• email and communication infrastructure,
• error analysis and IT security.

Where these providers process personal data on our behalf, we engage them under agreements pursuant to Article 28 GDPR / UK GDPR. For patient data, these providers generally act as sub-processors. Practices receive a current list of the sub-processors used for patient data as part of the data processing agreement and its annexes.

A public overview of important technical services and their data roles is available (in German) at Technische Dienste & Datenrollen. This overview does not replace the contractually binding list in the data processing agreement.

Under the current technical configuration, Centi patient data is primarily stored in a data centre in Frankfurt am Main, Germany.

15a. Main service providers

• Supabase, Inc. — database, authentication, file storage, server functions — USA / Germany (Frankfurt)
• OpenAI (OpenAI Ireland Ltd / OpenAI, L.L.C.) — laboratory OCR, structuring, report texts, selected AI features — Ireland / USA
• Documenso, Inc. — electronic signatures — USA
• Railway Corporation — PDF generation; redaction service before AI calls — USA
• Resend, Inc. — transactional email — USA
• Vercel Inc. — website and web application delivery — USA
• Functional Software, Inc. (Sentry) — error diagnostics — USA / Germany (EU data region)
• PostHog, Inc. — website analytics, with consent only — USA / EU (EU cloud)
• Mollie B.V. — payment processing — Netherlands
• Google LLC (Places API) — looking up your practice during setup — USA
• IONOS SE — mailbox for business outreach — Germany
• AI service for outreach — analysis of public practice information for outreach (no patient data) — we will name the provider and its location here

16. Transfers outside the EEA

We prefer infrastructure within the European Economic Area for processing health and patient data. However, we cannot guarantee that all technical service providers and all metadata are processed exclusively within the EEA.

Where personal data is transferred to or processed in countries outside the EEA, this only takes place under the conditions of Articles 44 et seq. GDPR, in particular on the basis of:

• an adequacy decision of the European Commission (for the USA: the EU-U.S. Data Privacy Framework, for certified recipients),
• appropriate safeguards,
• the EU Standard Contractual Clauses,
• or other transfer mechanisms provided for by law.

For transfers from the United Kingdom, see section 30. For transfers from Switzerland, see section 34.

Part D – Cookies, analytics and error diagnostics

17. Cookies and local storage technologies

Centi distinguishes between the public website and the protected Centi dashboard.

Centi dashboard

In the dashboard we use strictly necessary cookies or similar technologies, in particular for login, authentication, session management and security features. Where access to information on your device is strictly necessary to provide a digital service you have explicitly requested, this takes place without separate consent under section 25(2) of the German Telecommunications Digital Services Data Protection Act (TDDDG) and, for users in the United Kingdom, regulation 6(4) PECR.

Public website

We may also use analytics technologies on the public website. Cookies or similar technologies that are not strictly necessary are only used with your consent. You can change or withdraw your consent at any time in the cookie settings.

18. PostHog

We use PostHog on our public website to analyse how our online services are used. This may include page views, clicks, browser information, device information, IP or network data and interactions with the website.

PostHog is only activated for non-essential analytics if you have given your consent beforehand. We use PostHog’s EU cloud.

Legal basis: Article 6(1)(a) GDPR / UK GDPR and section 25(1) TDDDG or, for users in the United Kingdom, regulation 6 PECR, to the extent information is stored on or accessed from your device. You can withdraw your consent at any time with effect for the future in the cookie settings.

19. Error analysis with Sentry

To detect and analyse technical errors, we may use Sentry, a service of Functional Software, Inc. This may involve technical information such as device type, browser, operating system, time of the error and technical error and diagnostic data. We use Sentry’s EU data region.

The purpose is the stability and security of our online services.

Legal basis: Article 6(1)(f) GDPR / UK GDPR. Our legitimate interest is detecting and fixing technical errors and keeping the platform secure.

Part E – Retention and security

20. Retention

We only store personal data for as long as necessary for the respective purpose.

Website and technical data

Technical log and security data are stored only for as long as necessary to keep the service running and to detect security incidents.

Account and contract data

Data of a practice account is generally processed for the duration of the contract. Certain contract, billing or business data may be stored for longer where statutory retention periods apply.

Patient data

Patient data is generally processed for as long as the practice account exists or until the practice deletes it. After the contract ends, patient data is deleted in accordance with the agreed deletion policy. Unless another instruction or a legal obligation applies, productive patient data is deleted no later than 30 days after the end of the contract. Backups are overwritten or deleted as part of the technical backup and deletion cycle.

21. Data security

We take appropriate technical and organisational measures under Article 32 GDPR / UK GDPR to protect personal data against loss, unauthorised access, alteration or disclosure. Depending on the processing, these include in particular:

• encrypted data transmission,
• encryption of stored data,
• authentication and access controls,
• authorisation and role concepts,
• technical logging of security-relevant events,
• data backups,
• measures to ensure the availability and integrity of the systems,
• organisational restriction of access rights.

Only persons who need access to patient data to perform their tasks, and who are authorised to do so, have access to it.

Part F – Rights of data subjects

22. Your data protection rights

Where the legal requirements are met, you have in particular the following rights:

• access (Article 15 GDPR / UK GDPR),
• rectification (Article 16),
• erasure (Article 17),
• restriction of processing (Article 18),
• data portability (Article 20),
• objection (Article 21),
• withdrawal of consent (Article 7(3)).

Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

23. Where should patients send their data protection requests?

For patient data within a Centi practice account, the practice is generally the controller. Patients should therefore address requests for access, rectification, erasure, restriction, data portability or objection to the practice that processes their data.

If we receive a request directly from a patient in our role as processor, we support the responsible practice in handling it in accordance with our legal and contractual obligations.

For data that MS Nucleus processes as controller, you can contact us directly at datenschutz@elara-health.de.

24. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority (Article 77 GDPR). The supervisory authority responsible for MS Nucleus GmbH is:

Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit)
Alt-Moabit 59–61
10555 Berlin, Germany
Email: mailbox@datenschutz-berlin.de

You may also contact any other supervisory authority competent under the GDPR. For the United Kingdom, see section 31; for Switzerland, see section 34.

25. No use of patient data for advertising or AI training

Patient data processed on behalf of a practice within Centi is not:

• used for personalised advertising,
• sold to data brokers,
• used for advertising profiles,
• used for our own medical treatment decisions,
• or used to train generally available AI models.

It is processed solely to provide the Centi features commissioned by the practice and within the scope of the data processing agreement.

26. Changes to this Privacy Policy

We update this Privacy Policy when legal requirements, technical procedures or Centi’s features change. The current version is available at www.centi-health.de.

If significant changes affect registered users or the processing of patient data, we will inform you appropriately, for example within the platform or by email.

Part G – Information for individuals in the United Kingdom

27. Applicable law

Where we process personal data of individuals in the United Kingdom, the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR) apply in addition to the GDPR. References to articles of the GDPR in this Privacy Policy also refer to the corresponding articles of the UK GDPR.

28. Roles for UK practices

UK practices that use Centi are controllers for their patients’ and clients’ data. MS Nucleus GmbH acts as their processor under Article 28 UK GDPR, on the basis of the data processing agreement and its UK addendum.

Practices that process personal data as controllers in the UK may need to pay the data protection fee to the Information Commissioner’s Office (ICO). This is the practice’s own obligation.

29. UK representative

See section 1 (UK representative).

30. International transfers from the United Kingdom

Our main data centre is in Germany. Transfers from the United Kingdom to the EEA are permitted under UK law because the EEA is recognised as providing an adequate level of protection.

Where personal data is transferred from the United Kingdom to a country without UK adequacy regulations, in particular to the USA, we rely on one of the following safeguards:

• the UK Extension to the EU-U.S. Data Privacy Framework (“UK-US data bridge”), where the recipient is certified and has opted in to the UK Extension;
• the International Data Transfer Agreement (IDTA) or the International Data Transfer Addendum to the EU Standard Contractual Clauses issued by the ICO, together with a transfer risk assessment.

• Supabase, Inc. (USA, data in Germany) — UK Extension or UK Addendum, being confirmed
• OpenAI (Ireland / USA) — UK Extension or UK Addendum, being confirmed
• Documenso, Inc. (USA) — IDTA or UK Addendum, being confirmed
• Railway Corporation (USA) — UK Extension or UK Addendum, being confirmed
• Resend, Inc. (USA) — UK Extension (according to the provider)
• Vercel Inc. (USA) — UK Addendum, being confirmed
• Functional Software, Inc. (Sentry) (USA, EU data region) — UK Extension (according to the provider)
• PostHog, Inc. (USA, EU cloud) — UK Extension, being confirmed
• Google LLC (USA) — UK Extension, being confirmed
• Mollie B.V., IONOS SE (EEA) — UK adequacy for the EEA

You can request a copy of the relevant safeguards from support@centi-health.de.

31. Your rights and the ICO

You have the rights described in section 22 under the UK GDPR. You also have the right to lodge a complaint with the UK supervisory authority:

Information Commissioner’s Office (ICO)
Wycliffe House, Water Lane
Wilmslow, Cheshire SK9 5AF
United Kingdom
Telephone: 0303 123 1113
www.ico.org.uk

We would, however, appreciate the chance to deal with your concerns before you approach the ICO, so please contact us first.

We will add our ICO registration number here once we are registered with the ICO.

32. Marketing by electronic communications

For business outreach to recipients in the United Kingdom, see Business outreach by email in section 5. You can opt out of marketing at any time free of charge; we honour every opt-out across all channels.

Part H – Information for individuals in Switzerland

33. Applicable law

Where we process personal data of individuals in Switzerland, the Swiss Federal Act on Data Protection (FADP) and the Data Protection Ordinance (DPO) also apply.

34. Swiss supplement

We will publish the details for Switzerland (transfers abroad and the Swiss-U.S. Data Privacy Framework, rights under the FADP, the Federal Data Protection and Information Commissioner (FDPIC) as supervisory authority, and the rules for business outreach in Switzerland) in a Swiss supplement to this Privacy Policy.

Language

This English version is provided for convenience. In case of discrepancies, the German version prevails.