Privacy Policy

Version: 30 September 2026

The German version is binding ("Die deutsche Fassung ist maßgeblich"). This English translation is provided for convenience only.

This privacy policy explains which data doctormic processes, why, who receives it and how long it is kept. It applies to the doctormic app (iOS) and to the website www.doctormic.de.

We have written it so that it can be understood without prior knowledge. Where the law requires precise terms, we give them in brackets.

The essentials in three sentences: your recording stays on your device until it has been turned into text, and is then deleted. No audio file is stored on our servers. The transcript is deleted after at most 31 minutes; only the recap remains in your account until you delete it.

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Bennet Jørgensen

Lindenstr. 34, 50674 Cologne, Germany

Email: info@doctormic.de

doctormic is operated by an individual (sole proprietorship). There is currently no company. If a company is founded later, it will become the controller; we will then update this policy and inform you in the app.

2. Data protection officer

We have not appointed a data protection officer. Please send questions about data protection to info@doctormic.de.

3. What doctormic does — and what it does not do

The intended purpose of the app is: "Doctormic is a personal documentation tool for patients. With the explicit consent of those present, it records the audio of a medical appointment, transcribes it, and produces a structured, plain-language recap of what was discussed (visit overview, main points, follow-up steps, mentioned medications, referrals, and points to clarify). Its sole purpose is to help patients remember and understand a conversation that has already taken place with their healthcare professional. It is a memory and comprehension aid, not a source of medical advice."

The recap is generated from the transcript by an AI language model. It is not medical advice, not a diagnosis and not a treatment recommendation. It may contain errors. Check everything important — above all medications and dosages — with your doctor or against the package leaflet. In an emergency, call the emergency number 112.

4. Which data we process

4.1 Account data

Email address and password. Our sign-in service stores the password only as a checksum (hash), never in plain text.
If you choose "Sign in with Apple" or "Continue with Google": the sign-in credential (ID token) that Apple or Google hands to us, and the email address associated with it.
Display name (username) and an optional profile picture.
App language, the language of your recaps, notification settings.
Your answers during onboarding to the question "What brings you to doctormic?" (for example "read back my appointments" or "care for someone"). They are stored in your profile. They are not health data, and we only evaluate them in aggregate to understand why people use the app.
Your consent to recording (yes/no) and, for each recording, the time at which this consent was active.

4.2 Health data (special category, Article 9 GDPR)

The conversation with your doctor contains information about your health. This data is specially protected. We process it only because you have explicitly consented and want a recap.

Audio recording of the appointment: it is created only on your device and only when you tap "Record". It is handed over an encrypted connection to our server, which passes it straight on to the transcription service. It is not stored on our servers.
Transcript: the text of the conversation, with speaker labels ("Speaker 1", "Speaker 2"). It sits on our server only briefly (see section 9) and is never shown to you; the app receives only the recap.
Recap: overview, main points, next steps, medications mentioned, tests and referrals, questions for your doctor. It is stored in your account until you delete it.
Topic tags: from the transcript, our server derives up to four topics (high blood pressure, diabetes, anxiety, depression), but only if the word was explicitly said in the conversation. The tags are stored together with the recap and used only on your device to select matching health articles on the Home screen. No diagnoses are inferred.
Reminders: dates and notes you take over from a recap (for example a follow-up appointment). They are stored in your account. The notification for them is scheduled locally on your device. If you allow it, we add an event to your device's calendar.

4.3 Family sharing

Your invitation code and the people who have redeemed it (your caregivers), as well as the people whose invitation you have accepted.
Which recaps you share: either all of them or individually selected ones.
Linked people see your display name and profile picture as well as the shared recaps with medications, next steps and reminders. You can revoke access at any time.

4.4 Purchase data

A subscription is purchased through the Apple App Store. Through our subscription service RevenueCat we receive from Apple: whether a subscription is active, which plan you chose, whether a trial is running, when the period ends, and an anonymous customer number.
We do not see any payment data. Card numbers or bank details are held only by Apple.
If you redeem a voucher code, we store which code you redeemed and when.

4.5 Device and usage data

Counters: how many recaps you have created this month and how many recording attempts you have started in the last hour. We use them to enforce the quotas of your plan and to prevent abuse.
One technical log line per processing step: which service was used, length of the recording in seconds, processing time, amount of text (tokens), language, a job number and, on failure, the error code. These logs never contain the content of a recording, a transcript or a recap; that is technically ruled out.
Server logs of our hosting provider: IP address, time and function called, as with any internet service. They are kept for 7 days.
Permissions on your device: microphone (for recording), notifications, calendar and photos (only for a profile picture). You grant them individually in iOS and can revoke them there at any time.

4.6 Website www.doctormic.de

Waitlist: if you sign up, we store your email address and your role (patient, physician, caregiver).
To protect the form against abuse, we store your IP address for one hour with our service Upstash (at most five sign-ups per hour and IP address).
Contact form for events (for example www.doctormic.de/yfc at YFC Berlin 2026): if you send it, we store your name, your email address, your role (patient or caregiver, doctor or practice, investor, founder or other), the event and the language of the page. We use these details only to write to you about this meeting. The form asks for no health data; to prevent abuse it accepts up to 60 entries per hour and IP address, because many people share one Wi-Fi network at events.
Audience measurement: we use Vercel Analytics. The service sets no cookies and stores neither IP addresses nor user profiles.
Hosting: the website runs on Vercel. The usual server logs are generated (IP address, time, page requested, browser).

5. What we use the data for and on which legal basis

Account and provision of the app (sign-in, settings, family sharing, reminders, PDF export): performance of the user contract, Article 6 (1) (b) GDPR.
Recording, transcript, recap and topic tags: your explicit consent, Article 9 (2) (a) in conjunction with Article 6 (1) (a) GDPR. Section 6 explains how you give it.
Family sharing of recaps: your explicit consent, Article 9 (2) (a) GDPR. You decide whom you invite and what you share, and you can revoke access at any time.
Subscription and trial: performance of the contract, Article 6 (1) (b) GDPR. Insofar as we are subject to tax retention obligations: Article 6 (1) (c) GDPR.
Security, abuse prevention, quotas and troubleshooting (counters, technical logs, server logs): legitimate interest, Article 6 (1) (f) GDPR. Our interest is a stable and secure service and protecting the AI processing against abuse.
Contact form for events: your consent, Article 6 (1) (a) GDPR.
Waitlist on the website: your consent, Article 6 (1) (a) GDPR. Hosting, audience measurement and abuse prevention on the website: legitimate interest, Article 6 (1) (f) GDPR.
Compliance with legal obligations (for example requests from authorities, where legally mandatory): Article 6 (1) (c) GDPR.
We do not sell data. We never use health data for advertising. We do not build profiles about you.

6. Your consent to recording

You give your consent in three places, and you can withdraw it in one place:

After you create your account, the app shows the screen "Recording with respect". It explains that only you start and stop every recording, that everyone present should consent and that we automatically delete the audio recording as soon as the recap is ready. By tapping "I understand and agree" you consent. Without this consent no recordings are possible.
In the app's privacy settings there is the switch "Recording consent". There you can withdraw your consent at any time. New recordings are then blocked until you switch it on again. Recaps that were already created remain until you delete them. Withdrawal does not affect the lawfulness of processing before the withdrawal.
Before every recording, the recording screen says: "By recording this appointment you confirm that everyone present has consented."
For every recording, our server stores that your consent was active at that moment (only a timestamp, no content). This allows us to show that every recording was made with consent.

7. Recipients: who processes your data on our behalf

We do not run our own data centres. The following service providers process data on our behalf and according to our instructions (processors, Article 28 GDPR). For each service we state what it receives, where it processes and how long it keeps the data. This reflects the processing as of the date of this version.

The app itself contains no keys to the AI services and never sends data to them directly. Every call goes through our server.

Supabase — database, sign-in, server functions

What: all account and profile data, recaps, reminders, family sharing, purchase status, counters, the transcript for at most 31 minutes, your profile picture (in a private storage area accessible only to you and linked people) and the website's waitlist. Our server code (the functions for transcription, recap, subscription sync and account deletion) also runs on Supabase.

Where: in the EU, Frankfurt region, on Amazon Web Services infrastructure.

How long: until you delete the data or your account. Backups: a backup of the database is taken daily and kept for 7 days; there is no point-in-time recovery. Deleted data has therefore left the backups after at most 7 days. Files such as profile pictures are not part of the backups.

Contract: a data processing agreement with Supabase is in place; it forms part of Supabase's terms of service (version of 1 August 2026).

Deepgram — turning the recording into text

What: the audio recording and the selected language of the conversation. The transcript with speaker labels comes back.

Where: via Deepgram's EU endpoint. Every request carries a flag by which we exclude the use of your recording for improving Deepgram's models. Deepgram confirmed to us in writing on 21 September 2026 that for requests to this endpoint all processing, including backups and failover, stays within the EU and no data is transferred to countries outside the EU.

How long: According to Deepgram's published documentation, for requests sent with this flag the recording and the transcript are kept only for as long as the request takes to process and are not stored after the response is returned; Deepgram additionally confirmed to us in writing on 21 September 2026 that your recording is not stored. Request metadata without audio, text or transcript (request ID, timestamps, status, usage and cost figures) stays retrievable at Deepgram for up to 90 days, summarised usage figures beyond that; separate system telemetry without content is kept for up to 12 months (Deepgram, in writing on 21 September 2026). Deepgram's data processing agreement contains the commitment that no personal data is retained for customers who have opted out and that such data is processed in memory only.

Contract: Deepgram states that it provides its data processing agreement on request; we found no publicly available copy, and its terms of service do not include one. Our request has been open since June 2026; since Deepgram's reply of 21 September 2026 the agreement has been in progress, but it had not been countersigned as of the date of this version. As soon as it is countersigned, we will update this paragraph.

AssemblyAI — turning the recording into text for individual languages

What: the audio recording and the selected language. The transcript with speaker labels comes back. Which of the two transcription services processes a recording depends on the language and the length of the conversation. Both services may receive your recording; both process it in the EU.

Where: via AssemblyAI's EU endpoint (Dublin, Ireland). All processing steps run on this EU endpoint. We have switched off the sharing of data for improving AssemblyAI's models (16 September 2026).

How long: our server deletes the transcript at AssemblyAI immediately after reading it — also on errors and on timeout. According to AssemblyAI, the uploaded audio file is deleted together with the transcript. As a safety net, the retention period at AssemblyAI is set to one day.

Contract: data processing agreement (Data Processing Addendum of 22 January 2026) that applies by acceptance of the terms of service; a dated copy of 16 September 2026 is on file.

Amazon Web Services — producing the recap

What: the transcript and the desired language of the recap. Before transmission, our server reduces obvious personal details using fixed text patterns: email addresses, phone numbers, dates of birth, names following "my name is" and street addresses are replaced by placeholders. This is done without guarantee. It is not anonymisation; details in any other form — for example a name that is simply mentioned in conversation — remain in the text. Your audio recording is never sent to the language model.

The language model is Claude by Anthropic; Amazon Web Services runs it in its own data centres. Anthropic does not receive your data: according to Amazon Web Services, requests and responses are not passed on to the maker of the model, and the maker has no access to them.

Where: in Amazon Web Services data centres in the EU. Our server calls the language model in the Frankfurt region. To provide enough computing capacity, Amazon Web Services may process the request in another of its regions within the EU; the transfer there is encrypted and stays within the Amazon Web Services network.

How long: Amazon Web Services stores neither the transcript nor the recap; both are processed only for the duration of the request and are not used to train AI models. In addition, our account is set so that requests and responses are not stored, and we do not record their content in our own AWS account either.

Contract: data processing agreement (AWS Data Processing Addendum), which forms part of the AWS Service Terms and applies to any use of AWS without a separate signature (Service Terms as of 15 September 2026). The contracting party is Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg.

RevenueCat — managing the subscription

What: an anonymous customer number (your internal user ID, no email address and no name) and the purchase information provided by Apple: plan, status, trial, end of period. No health data.

Where: USA. Transfer on the basis of the EU standard contractual clauses.

How long: until your account is deleted. When you delete your account, we also delete the customer record at RevenueCat.

Contract: a data processing agreement with RevenueCat is in place; it forms part of RevenueCat's terms of use (version of August 2026).

Apple — App Store, purchase, sign-in

Apple distributes the app, handles the purchase and billing of the subscription and offers "Sign in with Apple". For these operations Apple is an independent controller; Apple's privacy policy and the Apple Media Services terms apply. We receive no payment data from Apple.

Where: in the EU (Apple Distribution International, Ireland) and, for parts of the service, worldwide under Apple's own privacy terms.

Google — sign-in with Google

Only if you choose "Continue with Google": Google hands us a sign-in credential (ID token) with your email address. For the sign-in at Google, Google is an independent controller; Google's privacy policy applies. If you choose sign-in with email and password, Google receives nothing.

Where: in the EU (Google Ireland) and, depending on the service, worldwide under Google's own privacy terms.

Expo — building the app

The app is built with tools from Expo. When the app runs on your device, no data is sent to Expo. The app uses no over-the-air update service and no push service: notifications are created on your phone and never leave it.

Where: outside the EU. Expo builds the app from our source code; no user data is involved.

Email delivery

Account emails — the confirmation link after registration and password-reset emails — are sent by the built-in mail service of our sign-in service Supabase.

Vercel and Upstash — website only

Vercel hosts the website in the Frankfurt region and provides the audience measurement Vercel Analytics (no cookies, no storage of IP addresses); the data processing agreement with Vercel is part of Vercel's terms. Upstash stores your IP address for one hour in the Frankfurt region to protect the waitlist form against abuse.

Where: Frankfurt region.

Sentry — crash and error reports of the app

What: if the app crashes or hits a technical error, it sends an error report: the place in the program where the error occurred (file and function names, line numbers), the error message, device model, iOS version, device language and time zone, details of the device state (such as free memory, battery level, orientation), app version and build number, and the last technical steps before it (such as "screen opened" or "app moved to background"). In addition, per session, whether the app ended normally or crashed — as a count per version, not per person. A report contains no content of your conversations or recaps, no name, no email address, no user ID, no IP address and no web addresses that were called; an email address inside an error message is replaced by a placeholder on the device before it is sent. The app sends nothing that identifies you as a person.

Where: in the EU, Frankfurt region. Our Sentry organisation is fixed to the EU data location; error reports are stored and processed there. Only the administrative data of our Sentry account (login, settings) is held in the USA according to Sentry; it contains no data about you.

How long: up to 90 days; that is the retention period Sentry publishes for error reports. After that they are deleted automatically.

Contract: data processing agreement (Sentry's Data Processing Addendum, version 5.1.0 of 29 May 2024), accepted in the organisation settings of our Sentry account.

Authorities and courts

We pass data to authorities or courts only if we are legally obliged to do so.

8. Transfers to countries outside the EU

We process your data within the EU as far as possible: database and server functions (Supabase, EU), transcription (Deepgram via the EU endpoint; AssemblyAI in Dublin), producing the recap (Amazon Web Services, EU), error reports of the app (Sentry, Frankfurt region), website hosting and form protection (Vercel and Upstash, each in the Frankfurt region).

Outside the EU, data is processed today by RevenueCat (subscription status, USA). The basis is the EU standard contractual clauses (Article 46 (2) (c) GDPR) or, where the provider is certified, the EU-US Data Privacy Framework (adequacy decision of 10 July 2023).

Until 30 September 2026, Anthropic (USA) produced the recaps, likewise on the basis of the EU standard contractual clauses. Since then we no longer transmit any data to Anthropic; how long Anthropic keeps the texts it received until then is stated in section 9.

You can obtain a copy of the respective contractual clauses on request at info@doctormic.de.

9. How long we keep data

Audio recording on the device: as soon as your recap has been saved or you discard the recording, the app deletes the audio file. If processing fails, the app keeps a copy for up to 24 hours so that you can try again; after that it is deleted automatically. If you sign out, it is deleted immediately.
Audio recording on the server: not stored. On receipt it is passed straight on to the transcription service.
Transcript on the server: at most 30 minutes from creation. As soon as the recap has been created, it is deleted immediately. If the recap is not created (for example because the app was closed), an automatic cleanup deletes it shortly after the 30 minutes have elapsed, that is, after at most 31 minutes.
Recap, topic tags, reminders: until you delete them. You can delete individual recaps, all recaps or your entire account.
Profile picture: in a private storage area at Supabase, until you replace it or delete your account. When you delete your account, all files in your folder are removed.
After you delete a recap, a small processing record without content remains (job number, time, consent timestamp, reference to the former recap). It prevents a delayed retry from re-creating a deleted recap or counting it twice. It is deleted together with the account.
Account and all associated data: until you delete the account. Deletion takes effect immediately and cascades through all tables (profile, recaps, reminders, family sharing, counters, voucher redemptions, profile picture) and to RevenueCat.
After account deletion, a technical blocking marker remains (your former internal user ID and the time of deletion — no name, no email address, no content). It prevents a late purchase notification from Apple from re-creating the deleted account at RevenueCat. It is kept for up to three years after the end of the subscription.
At the transcription service: AssemblyAI — deleted immediately after reading, safety net one day. Deepgram — according to Deepgram's published documentation not stored (for the recording also confirmed in writing on 21 September 2026); request metadata without content retrievable for up to 90 days, system telemetry without content for up to 12 months.
At the AI service: Amazon Web Services — nothing stored; the transcript and the recap are processed only for the duration of the request.
At the former AI service Anthropic, only for recaps produced until 30 September 2026: within 30 days; up to two years if flagged by abuse prevention.
At the error-reporting service: Sentry — up to 90 days.
Backups: daily database backup, kept for 7 days. Deleted data has left the backups after at most 7 days; profile pictures are not included in backups.
Server logs and technical log lines: 7 days.
Waitlist on the website: until you request deletion or the waitlist is no longer needed after the app has launched.
Contact form for events: until you withdraw your consent or request deletion, at the latest twelve months after the event.
Enquiries by email: until the enquiry has been dealt with and no statutory retention obligation remains.

10. Your rights

You have the following rights towards us. Most of them you can exercise directly in the app; for everything else, write to info@doctormic.de. We reply within one month at the latest.

Access (Article 15 GDPR): which data we have stored about you. You can see your recaps in the app at any time; everything else on request.
Rectification (Article 16 GDPR): you change your display name, profile picture, language and settings in the app. The recap itself cannot currently be edited; you can delete it and record the appointment again.
Erasure (Article 17 GDPR): in the app under Profile → Manage data → Data control: "Delete all recaps" or "Delete my account". You delete individual recaps in the visit list by swiping. Deletion is final.
Restriction of processing (Article 18 GDPR): on request.
Data portability (Article 20 GDPR): you can export every recap in the app as a PDF. A machine-readable copy of your data is available on request.
Withdrawal of consent (Article 7 (3) GDPR): in the app's privacy settings via the switch "Recording consent"; for family sharing, by revoking access. Withdrawal applies to the future.
Objection (Article 21 GDPR): to processing we base on a legitimate interest, on grounds relating to your particular situation.
Complaint to a supervisory authority (Article 77 GDPR): you can contact any data protection supervisory authority, in particular the one responsible for us: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, PO Box 20 04 44, 40102 Düsseldorf, Germany, phone +49 211 38424-0, email poststelle@ldi.nrw.de, complaint form at www.ldi.nrw.de.

11. Information for doctors and other people present (Article 14 GDPR)

When a patient records a conversation with doctormic, your voice and your words are recorded as well. We did not obtain this data from you but from the person who records. That is why we inform you here.

What is processed: your voice (only until it has been turned into text, then deleted), your words in the transcript (at most 31 minutes on our server) and the part of your statements that goes into the recap. The recap identifies speakers only as "Speaker 1", "Speaker 2"; your name becomes part of the data only if it is said in the conversation.

For what purpose: solely so that the patient can remember and understand the conversation later. The data is not passed to third parties, not used for advertising and not used to train AI models.

Legal basis: the person recording is obliged to obtain your consent before recording; the app reminds them of this in three places and offers a card "For the doctor" that explains to you before the conversation what is recorded and that you can decline.

Recipients, retention and transfers: as described in sections 7 to 9.

Your rights: you have the same rights as in section 10, in particular access and objection. Since we cannot identify you if your name was not mentioned in the conversation, the simplest route is to contact the patient, who can delete the recap at any time — or to write to info@doctormic.de.

12. If you record for another person

Many people use doctormic for relatives, for example for their own mother. The health data in the recap is then that person's data. Record only if that person (or their legal representative) agrees, and delete the recap if they ask you to.

13. Children and young people

doctormic is intended for adults. Anyone under 18 may not create an account. A parent or legal guardian may use the app for their child, as the child's guardian — for example for the child's medical appointments.

14. No automated decision-making, note on AI

We make no automated decisions that produce legal effects concerning you or similarly significantly affect you (Article 22 GDPR). The recap is produced by an AI language model; it is an aid for reading back and takes no decision about you. The explanations of medical terms ("In plain language") come from a glossary stored in the app, not from an individual assessment.

15. Security

All connections are encrypted (TLS). Data in the database is stored encrypted.
Every database row is bound to the account it belongs to (row level security). Linked people see only what was explicitly shared. This was verified for all tables on 16 September 2026.
The transcript is invisible to the app: it receives only a job number, never the text.
The app contains no keys to the AI services. Your sign-in session is kept in the encrypted iOS keychain.
Logs never contain the content of recordings, transcripts or recaps.
At our hosting provider, encrypted connections to the database are enforced (SSL enforcement), protection against leaked passwords is switched on, and the team login is secured with two-factor authentication. Restriction of database access to fixed network addresses applies from 20 September 2026.

16. Changes to this policy

We update this policy when the app or our service providers change, most recently when we switched the AI service to Amazon Web Services. We inform you about material changes in the app. The current version is always available at www.doctormic.de/en/datenschutz.

17. Language versions

This privacy policy is available in German, English and Turkish. The German version is binding; the other versions are provided to aid understanding.