Privacy policy

1. Controller

ClinicalReasoning is a non-commercial teaching project of a private person in Germany. Contact: Support in your account. You can exercise all rights in section 6 this way.

2. What we process and why

Account data (username, display name, email, password verifier), your profile (bio, work history, education, publications, links), and what you create: posts, comments, messages, images, PDFs, cases, scripts and margin comments.

Usage data needed to run the service: session cookie, IP address for abuse protection (stored only as a hash), request metrics without content, your answers in played cases, notification and push settings and device tokens.

Never upload identifiable patient data. Cases and images must be anonymised; reported content is reviewed and removed.

3. Legal bases

Art. 6(1)(b) GDPR (providing the platform you joined), Art. 6(1)(f) GDPR (secure operation, abuse prevention, moderation), Art. 6(1)(a) GDPR (consent, e.g. push notifications).

4. Processors and transfers

Cloudflare (hosting, Workers, D1 database, R2 file storage, CDN). Processing may take place in the USA; transfers rely on appropriate safeguards such as standard contractual clauses.

Apple Push Notification service and web push services of your browser, only if you enable notifications. Crossref, NCBI and Europe PMC receive only a DOI or PMID you look up.

5. Retention

Data is kept while your account exists. Read notifications are deleted after 90 days, abuse counters after their window. Deleting your account removes your profile, CV, messages, posts, comments, images and files; jointly edited script versions remain under a deleted-member placeholder.

6. Your rights

Access, rectification, erasure, restriction, data portability (download in Account), objection and withdrawal of consent, and the right to complain to a supervisory authority.

7. Cookies and local storage

Only technically necessary storage: the session cookie, language and theme, and unsent drafts on your device (cleared when you sign out). No advertising or tracking cookies.