Privacy Policy

Information under Art. 13 and 14 GDPR

Convenience translation. Only the German version is legally binding.

1. Controller and roles

DocPilot AI is operated by Artificians (Einzelunternehmen), Korsörer Str. 12, 10437 Berlin, Deutschland.

Roles matter here: for patient data, the clinic is the controller under Art. 4(7) GDPR — it decides the purposes and means of processing. Artificians acts solely as a processor under Art. 28 GDPR and processes that data only on the clinic's documented instructions, under a data processing agreement.

For the clinic's own data — registration, user accounts, billing and support — Artificians is the controller.

Privacy contact: info@artificians.com

2. Health data (Art. 9 GDPR)

Patients can send free-text messages through the booking widget. These may contain information about health and then constitute a special category of personal data under Art. 9 GDPR. Booking an appointment in a particular specialty may itself reveal health information.

3. Data collected by the booking widget

Name (required) — to assign the appointment
Phone number (required) — so the clinic can reach the patient
Email address (optional) — appointment confirmation only
Chat messages (optional) — free text, may contain health data
Appointment details (required) — service, date and time

4. Recipients and sub-processors

Supabase (Supabase Inc.)

Third-country transfer

Datenbank, Authentifizierung und Storage. Speichert Kliniken, Benutzerkonten, Termine, Patientenstammdaten und Chat-Verläufe.

Location: AWS ap-southeast-1 (Singapur)

Anthropic (Anthropic PBC)

Third-country transfer

KI-gestützte Beantwortung von Patientenanfragen im Buchungs-Widget. Die Nachricht der Patientin oder des Patienten wird zur Erzeugung der Antwort an die Claude-API übermittelt.

Location: USA

Resend (Resend, Inc.)

Third-country transfer

Versand von Transaktions-E-Mails: Terminbestätigungen an Patientinnen und Patienten sowie Benachrichtigungen an die Klinik.

Location: USA

Hostinger (VPS)

EU/EEA

Hosting der Anwendung; Verarbeitung von Server-Logdaten.

Location: Deutschland/EU

5. Retention

6. Cookies

Only strictly necessary cookies are used, so no consent banner is required (§ 25(2)(2) TDDDG).

sb-<projekt>-auth-token — session cookie for clinic sign-in; sign-in is not possible without it.

7. What we do not do

No web analytics or tracking (no Google Analytics, Matomo, Plausible, PostHog)
No advertising or marketing cookies, no retargeting
No social media plugins
No runtime web fonts — fonts are bundled locally at build time via next/font, so no connection is made to Google Fonts
No third-party CDN for application code

(5 items, verified against the codebase on 2026-09-29.)

8. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and to object (Art. 21 GDPR). Consent can be withdrawn at any time with effect for the future.

Who to contact: for data processed through a booking, please contact the clinic directly as the controller. We support the clinic in fulfilling such requests.

You may also lodge a complaint with a supervisory authority (Art. 77 GDPR); for Berlin this is the Berliner Beauftragte für Datenschutz und Informationsfreiheit.