Privacy Policy

Last updated: October 8, 2026

1. Data Controller and Contact

The responsible party for data processing under the GDPR is:
Dr. med. Christian Kirsch
Klinikum Lippstadt, Klosterstraße 31, 59555 Lippstadt, Germany

Email: [email protected]

2. Data Processing and Legal Bases

  • Account & Profile Data: We process your name, email, and course progress to fulfill our contract with you (Art. 6 (1) (b) GDPR).
  • Payment (Web/Android via Stripe): Payment data on web and Android channels is processed by Stripe to perform the contract. We have a Data Processing Agreement (DPA) with Stripe ensuring GDPR-compliant standards.
  • Payment (iOS App Store via Apple): For purchases made in the iOS App Store app, payment processing is handled by Apple through In-App Purchase according to Apple’s privacy and payment terms.
  • Product analytics (PostHog): To measure sign-up, trial and subscription conversion and cancellations, our servers send a small number of events to PostHog Cloud (EU region, Frankfurt, Germany), operated by PostHog, Inc. as our processor under a data processing agreement. Where data could be accessed from the USA, the agreement’s Standard Contractual Clauses and PostHog’s EU-U.S. Data Privacy Framework certification apply.
    • Data: account creation, onboarding and lesson completion, checkout, subscription and cancellation events, with plan, status and cancellation reason, plus your profession, experience level and role. Events are linked to a pseudonymous ID derived from your account; your name and email are not sent, and IP addresses are not stored. Nothing you enter into the clinical calculators is ever sent.
    • No cookies or device storage: these events are generated on our servers. PostHog is not loaded in your browser.
    • Legal basis: our legitimate interest in measuring and improving our paid service (Art. 6 (1) (f) GDPR).
    • Objection: you can object at any time under Account → Privacy → Usage analytics. We then stop sending events and delete the data held about you at PostHog. The same deletion happens when you delete your account.
    • Retention: up to 12 months (PostHog Cloud default), or until you object or delete your account.
  • Website statistics (Umami): We use a self-hosted instance of Umami on our own server to count page views and in-app steps in aggregate. Umami sets no cookies, stores nothing on your device and does not identify individual visitors. Legal basis: legitimate interest (Art. 6 (1) (f) GDPR).
  • Cookies and local storage: We use only technically necessary cookies and local storage (for example your login session and display preferences). We do not use advertising or tracking cookies on the website, so there is no cookie banner.
  • Server Log Files: To ensure technical stability and security, our servers automatically log technical data (IP address, browser type, timestamp). Legal basis: Legitimate interest (Art. 6 (1) (f) GDPR).

3. EU Data Act Compliance (New for 2026)

In accordance with the EU Data Act, we ensure your right to data portability.

  • Access: You have the right to access and download the non-personal technical data generated by your use of our service.
  • Switching: We facilitate the switching of service providers by allowing you to export your data in a structured, machine-readable format within 30 days of a request.

4. Your Rights

Under the GDPR, you have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), and to object to processing (Art. 21). You may also lodge a complaint with your local Data Protection Authority.

5. Account and Data Deletion (Google Play & GDPR)

In accordance with Google Play Store Developer Policies and GDPR Art. 17, users of EchoMastery Pro (Package: com.echomastery.pro, developed by Dr. med. Christian Kirsch) may request the permanent deletion of their account and all associated data at any time.

You can delete your account self-service inside the app under Account Settings, or request deletion via our dedicated web resource at EchoMastery Pro Account & Data Deletion, or by contacting [email protected].