Privacy policy

The controller responsible for data processing on this website is:

AI²POC research group
Heidelberg University Hospital
Mannheim site (University Medicine Mannheim)
Theodor-Kutzer-Ufer 1–3
68167 Mannheim
Germany

Email: info-ai2poc@umm.de

Protecting your personal data is important to us. We process personal data only to the extent necessary to provide a functional website and our content and services, or where you have given us your consent.

Personal data means any information relating to an identified or identifiable natural person.

When you access our website, our web server automatically collects information and stores it in so-called server log files. In particular, the following data may be processed:

• IP address of the requesting device
• date and time of access
• page or file accessed
• amount of data transferred
• browser type and operating system
• referring website (referrer)

Processing takes place to ensure trouble-free operation of the website, system security and technical administration. The legal basis is Art. 6 para. 1 lit. f GDPR (legitimate interest). Log files are deleted as soon as they are no longer required for these purposes, at the latest after 30 days, unless longer retention is required for security reasons.

If you contact us by email, we process the data you provide (e.g. name, email address, message) to handle your enquiry.

The legal basis is Art. 6 para. 1 lit. b GDPR if your enquiry relates to the performance of a contract or pre-contractual measures; otherwise Art. 6 para. 1 lit. f GDPR (legitimate interest in responding to your enquiry). If you have given consent, Art. 6 para. 1 lit. a GDPR also applies.

Data is deleted once your enquiry has been fully processed and no statutory retention obligations apply.

To remember your chosen language (German or English) on return visits, we store a technically necessary cookie named ai2poc_locale in your browser.

The cookie contains only your language preference, is stored for up to one year and is required for the language switcher. The legal basis is Art. 6 para. 1 lit. f GDPR (legitimate interest in a user-friendly, consistent presentation of the website).

On your first visit to our website, we ask whether you agree to anonymised reach measurement. We store your decision (consent or refusal) in your browser's local storage so that we do not have to ask you again on every visit.

Only your chosen setting is stored; no personal usage profiles are created. The legal basis is Art. 6 para. 1 lit. a GDPR (consent) and Art. 6 para. 1 lit. f GDPR (legitimate interest in documenting and implementing your decision in a traceable manner).

You can withdraw your decision at any time by choosing “Privacy settings” in the footer. Your stored choice is deleted and the consent banner appears again. Alternatively, you can delete website data in your browser.

If you have consented in the consent banner, we carry out cookie-free, anonymised reach measurement using the open-source software Umami to statistically evaluate use of our website and tailor our offering accordingly. Umami runs on an instance operated for the website and processes measurement data on our behalf.

In particular, the following information may be processed:

• pages accessed and times of access
• browser type and operating system
• device type
• country of origin (based on anonymised network data)
• referring website (referrer)

No cookies are set. No full IP addresses are stored and no cross-user profiles are created. We cannot draw conclusions about individual persons.

Reach measurement is activated only after you have consented in the consent banner. The legal basis is Art. 6 para. 1 lit. a GDPR.

The data collected is evaluated exclusively for statistical purposes and is not passed on to third parties for advertising purposes. Data is deleted as soon as it is no longer required for evaluation, at the latest after 24 months.

Your personal data is transferred to third parties only where this is necessary to fulfil the purposes stated, you have consented, or there is a legal obligation to do so.

Where we use technical service providers to operate the website, this is done on the basis of data processing agreements pursuant to Art. 28 GDPR. These may include in particular:

• hosting provider for operating the website and server log files
• Umami (reach measurement after your consent; see section 7)
• Lovable (platform used to deploy the website): in the event of errors, technical stability reports (e.g. error message, page accessed) may be sent to Lovable to analyse and resolve outages

You have the following rights regarding your personal data:

• right of access (Art. 15 GDPR)
• right to rectification (Art. 16 GDPR)
• right to erasure (Art. 17 GDPR)
• right to restriction of processing (Art. 18 GDPR)
• right to data portability (Art. 20 GDPR)
• right to object to processing (Art. 21 GDPR) where processing is based on Art. 6 para. 1 lit. f GDPR
• right to withdraw consent (Art. 7 para. 3 GDPR) with effect for the future

To exercise your rights, please contact us using the details given in section 1.

You have the right to lodge a complaint with a data protection supervisory authority about the processing of your personal data. The authority responsible is in particular the supervisory authority of your habitual residence, place of work or the place of the alleged infringement.

For Baden-Württemberg:
The State Commissioner for Data Protection and Freedom of Information Baden-Württemberg (LfDI BW)
Königstraße 10a
70173 Stuttgart
www.baden-wuerttemberg.datenschutz.de

We reserve the right to amend this privacy policy so that it always complies with current legal requirements or to reflect changes to our services. The current version applies when you visit again.

As of: August 2026