Privacy Policy

The party responsible for data processing on this website is:
Avor Medical Intelligence UG (haftungsbeschränkt)
In der Lake 5b
33739 Bielefeld
Germany
Email: datenschutz@avor.med

The protection of your personal data is of particular concern to us. We therefore process your data exclusively on the basis of statutory provisions (GDPR, BDSG, TDDDG, DDG). In this privacy policy, we inform you about the most important aspects of data processing on our website.

This website informs you about our company and what we offer. Through it, you can send us a message and subscribe to our newsletter. Until 12 October 2026 you could also use it to book a meeting at our booth at the 2026 annual meeting of the societies for hematology and medical oncology (DGHO, OeGHO, SGMO, SGH) in Vienna. No goods or services are sold through this website.

A separate privacy policy applies to the AVOR Assistant (app.avor.med) and to the two forms through which access to it is granted (signup.avor.med, register.avor.med). Those services process different data than this website.

The pages of our website are hosted by GitHub Pages, a service provided by GitHub Inc., 88 Colin P Kelly Jr St, San Francisco, CA 94107, USA (a Microsoft Corporation company).

When you access our website, information is automatically collected by the hosting provider and stored in so-called server log files. This information includes:

• IP address of the requesting computer
• Date and time of access
• Name and URL of the retrieved file
• Website from which access was made (referrer URL)
• Browser used and, if applicable, your computer's operating system

This data is processed on the basis of Art. 6 para. 1 lit. f GDPR. Our legitimate interest lies in the technically error-free presentation and optimization of our website.

GitHub Inc. is certified under the EU-US Data Privacy Framework, which ensures an adequate level of data protection. For more information, please refer to GitHub's privacy policy: https://docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement

Our own server for the contact form and booking

The contact form, the newsletter sign-up and the meeting booking do not run through GitHub: your browser sends what you enter directly to our own server at cloud.avor.med. We rent this server from Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany; it is located in Nuremberg, Germany. We have a data processing agreement with Hetzner pursuant to Art. 28 GDPR. We run the Nextcloud software there ourselves; no external form or booking service is involved.

Every request to cloud.avor.med creates technical log data, including your IP address, the time and target of the request, and information about your browser. This data serves the operation and security of the server; the legal basis is Art. 6 para. 1 lit. f GDPR. The logs are not kept permanently but are continuously overwritten once a set volume is reached. To prevent abuse, the server also limits the number of requests per sender; for this, it briefly keeps your IP address, or a value derived from it, in memory.

For recovery in the event of a failure, our hosting provider makes automatic backups of the server, which are kept for seven days and then overwritten. Data that we delete may therefore remain in these backups for up to seven days.

You can send us a message through the contact form on our home page. We process the following data:

• Name
• Email address
• Phone number (if provided)
• Your message
• Whether you would like to receive our newsletter (see section 6)
• Date and time of submission

The form is processed by the Nextcloud forms app on our own server (see section 3); we do not use an external form service. Your IP address is not stored with your message. Only the staff who handle enquiries can see your message. The server notifies us of new messages by email; this notification contains nothing from your message.

The form is not intended for health data. Please do not send us any patient data through it.

This data is processed on the basis of Art. 6 para. 1 lit. b GDPR to process your inquiry, or on the basis of Art. 6 para. 1 lit. f GDPR due to our legitimate interest in communicating with interested parties.

Your data submitted via the contact form will be stored by us until your inquiry has been fully processed or until we are obligated to continue storage due to legal retention requirements. The data will then be deleted unless further statutory retention obligations apply.

The meeting is over, and our website no longer offers the booking. This section describes it as it was offered until the end of the meeting. It stays here for as long as we keep data from these bookings.

From 9 to 12 October 2026, we were at the annual meeting of the societies for hematology and medical oncology (DGHO, OeGHO, SGMO, SGH) in Vienna. You could book a meeting at our booth on our home page. Bookings ran through the appointment feature of the Nextcloud calendar on our own server (see section 3).

As soon as you reached the booking area on the home page, your browser fetched the available times directly from our server. Nothing you entered was sent; only the technical log data described in section 3 was created. You only saw which times were still free and, once you had booked, your own meeting; you could not see who else had booked.

For a booking, we processed the following data:

• Name
• Email address
• Company or organisation
• Role (if provided)
• Sector, such as hospital, practice or pharma
• The topic you would like to discuss (if provided)
• The time you chose and the language of the page you booked from

After you submit the form, you will receive an email with a confirmation link. The meeting is only booked once you open this link. The server automatically deletes the booking request itself one to two days after submission, whether you confirmed it or not; after that, the link no longer works.

When you confirm, the server enters the meeting with your details in our booking calendar and lists you as a participant. You receive a booking confirmation with a calendar file; we are informed of the booking by email and in Nextcloud. If we move or cancel the meeting, you are notified automatically. Only the staff who hold or organise the meetings at our booth have access to the booking calendar.

When you open the confirmation link, our server shows a confirmation page at cloud.avor.med and sets technically necessary cookies: session cookies, which expire when you close your browser, and two cookies that contain only the value “true” and tell the server that a request does not come from another website. These two have a long lifetime; you can delete them in your browser at any time. The legal basis is Section 25 (2) no. 2 TDDDG and, for the related processing, Art. 6 para. 1 lit. f GDPR.

The legal basis for the booking is Art. 6 para. 1 lit. b GDPR (steps taken at your request prior to entering into a contract) or Art. 6 para. 1 lit. f GDPR; our legitimate interest lies in planning and preparing the meetings at our booth.

We delete the meeting and your details no later than six months after the annual meeting. If the meeting leads to further exchange, we keep the details needed for it for as long as that exchange continues.

Our newsletter occasionally informs you by email about news from AVOR, such as new features, events and awards. We only send it with your consent (Art. 6 para. 1 lit. a GDPR).

You can subscribe by ticking the newsletter box in the contact form. If you chose the newsletter when registering for our AI symposium, we receive your data as described in the symposium's privacy policy (in German).

Before we send you the first newsletter, we send you an email asking you to confirm your subscription. Only once you reply do we add your address to the mailing list. This ensures that no one subscribes someone else's email address. If you do not reply within 30 days, we delete your sign-up.

For sending the newsletter, we store your email address and your name and, if you signed up through the symposium, your institutional affiliation if provided. We also store when and how you signed up, and your reply to our confirmation request as proof of your consent. We keep the mailing list on our own server (see section 3).

We send the newsletter ourselves, without a newsletter service, through the mail server of our domain provider Variomedia AG (see section 7). All recipients are in blind copy, so no one sees the others' addresses. We do not track whether or when you open the newsletter or click links in it.

You can withdraw your consent at any time with effect for the future: through the unsubscribe link in every newsletter, which opens a prepared email to us, or with an informal message to info@avor.med. We will then remove you from the mailing list promptly. Withdrawal does not affect the lawfulness of processing carried out before it.

After you withdraw, we keep the proof of your consent and of your withdrawal for up to three years so that we can show that we sent the newsletter lawfully. We do not use this information for any other purpose. The legal basis is Art. 6 para. 1 lit. f GDPR.

When you email us or we respond to your inquiry by email, we use our email service operated through our domain provider Variomedia AG, Kronprinzendamm 21, 10711 Berlin, Germany. We also send the newsletter through it. The booking emails and the notifications about new messages are likewise sent by our server cloud.avor.med through Variomedia's mail server.

Variomedia processes data exclusively on servers in Germany. Processing is carried out on the basis of Art. 6 para. 1 lit. b GDPR for the implementation of pre-contractual measures, or on the basis of Art. 6 para. 1 lit. f GDPR due to our legitimate interest in responding to inquiries, and for the newsletter on the basis of your consent (see section 6).

Our website does not use cookies. Neither technically necessary nor analytical or marketing cookies are used. No cookies are set or sent when your browser fetches available times or submits the contact form or a booking either. Only the booking confirmation page on cloud.avor.med sets technically necessary cookies (see section 5).

We use GoatCounter, an open-source web analytics tool operated by GoatCounter BV, the Netherlands, to collect anonymous usage statistics. GoatCounter does not use cookies, does not collect personal data, and does not create user profiles.

The following non-personal data is collected:

• Page URL (without query parameters)
• Referrer header
• User-Agent header (browser and operating system)
• Screen size
• Country based on IP address (the IP address itself is not stored)
• Preferred language

This data is processed on the basis of Art. 6 para. 1 lit. f GDPR. Our legitimate interest lies in understanding how our website is used in order to improve it. GoatCounter processes data on servers within the European Union. For more information, please refer to GoatCounter's privacy policy: https://www.goatcounter.com/help/privacy

We operate a company page on LinkedIn at https://www.linkedin.com/company/avor-med. The provider is LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland (parent company: LinkedIn Corporation, 1000 W. Maude Avenue, Sunnyvale, CA 94085, USA).

On our website avor.med itself, we only embed a simple hyperlink (no social plugin) to our LinkedIn page. Merely visiting our website does not transmit any data to LinkedIn; data processing by LinkedIn only takes place when you actively click the link and visit the LinkedIn page.

When you visit our LinkedIn company page, LinkedIn processes personal data (including IP address, browser information, device information, interactions with the page). LinkedIn provides us with aggregated, anonymized statistics (Page Insights) about the use of our page. For the processing in connection with these Page Insights, we are jointly responsible with LinkedIn pursuant to Art. 26 GDPR. The main responsibility for processing the personal data lies with LinkedIn. The Joint Controller Addendum (LinkedIn Page Insights Joint Controller Addendum) can be found at https://legal.linkedin.com/pages-joint-controller-addendum.

When you visit the LinkedIn page, personal data may be transferred to servers of LinkedIn Corporation in the USA. LinkedIn is certified under the EU-US Data Privacy Framework; in addition, LinkedIn uses EU Standard Contractual Clauses as a basis for third-country transfers.

The legal basis for processing is Art. 6 para. 1 lit. f GDPR. Our legitimate interest lies in the public presentation of our company and in communication with interested parties and the professional public. You can assert your rights as a data subject (see section 12) both against us and directly against LinkedIn.

For more information on data processing by LinkedIn, please refer to LinkedIn's privacy policy: https://www.linkedin.com/legal/privacy-policy

The content of this website may not be used for training artificial intelligence (AI), machine learning models, or similar technologies. This includes, but is not limited to, large language models (LLMs), generative AI systems, and automated data collection systems for the purpose of model training.

Automated crawling of the website for indexing purposes by search engines is permitted.

You have the following rights with regard to your data stored by us:

• Right of access: You may request information about your personal data processed by us (Art. 15 GDPR).
• Right to rectification: You may request the correction of inaccurate data (Art. 16 GDPR).
• Right to erasure: You may request the deletion of your data, provided no legal retention obligations apply (Art. 17 GDPR).
• Right to restriction of processing: You may request the restriction of processing of your data (Art. 18 GDPR).
• Right to data portability: You may request to receive your data in a structured, commonly used, and machine-readable format (Art. 20 GDPR).
• Right to object: You may object to the processing of your data if it is based on legitimate interests (Art. 21 GDPR).
• Withdrawal of consent: You may withdraw consent you have given, for example for the newsletter, at any time with effect for the future (Art. 7 para. 3 GDPR).

To exercise your rights, please email us at datenschutz@avor.med.

You have the right to lodge a complaint with a data protection supervisory authority regarding the processing of your personal data (Art. 77 GDPR). The competent authority for us is the State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia (Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen).

This privacy policy is currently valid as of October 2026. Due to the further development of our website or changes in legal or regulatory requirements, it may become necessary to update this privacy policy. The current version can always be accessed on this website.