Privacy Policy

Last updated: 23 September 2026

This privacy policy applies to our website quickguide.health and to QuickGuide itself – the QuickGuide app (iOS app and web version) and QuickGuide Studio. In accordance with Art. 13 and 14 GDPR, it explains which personal data we process, for what purposes and on what legal basis, and what rights you have.

1. Controller and contact

QuickGuide GmbH
Parkallee 12, 20144 Hamburg, Germany
Email: info@quickguide.health

For all questions regarding data protection, you can reach us and our data protection officer at datenschutz@quickguide.health or at the address above, marked "Data Protection".

2. Your organisation and QuickGuide

QuickGuide is used by employees of organisations – usually hospitals – that have concluded a contract with us. This results in two roles:

• Your organisation is the controller for who is granted access, which teams and roles you belong to, which content you see, and for that content itself. For these purposes, we process data as a processor under Art. 28 GDPR, on the basis of a data processing agreement and on the instructions of your organisation. The legal basis is determined by your organisation (e.g. Art. 6(1)(b), (c) or (f) GDPR in conjunction with employee data protection law).

• QuickGuide is itself the controller for our website, for sign-in and account security, for security logs and error diagnostics, for product analytics and quality assurance of the AI assistant, and for your professional profile, which you use across several QuickGuide products.

3. Our website

3.1 Visiting the website

When you visit our website, the server automatically processes data transmitted by your browser: browser type and version, operating system, the previously visited page (referrer), the subpages accessed, date and time of access, a shortened (anonymised) IP address and your internet service provider. We need this data to deliver the website, to ensure its operation and security, and to investigate attacks. We do not draw any conclusions about you as a person. Server log files are deleted after seven days. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest arises from these purposes.

3.2 Hosting by Framer

Our website is hosted by Framer B.V., Rozengracht 207B, 1016 LZ Amsterdam, Netherlands. In the process, your data, such as your IP address in log files, is processed on Framer's servers. We have concluded a data processing agreement with Framer under Art. 28 GDPR. The legal basis is Art. 6(1)(f) GDPR – our legitimate interest in a secure and reliable website. More information: https://www.framer.com/legal/privacy-statement/

3.3 Cookies

Our website uses only technically necessary cookies, for example for page navigation and language settings. They are usually deleted at the end of your visit. No consent is required for this (Section 25(2) no. 2 TDDDG); the legal basis for any further processing is Art. 6(1)(f) GDPR. We do not use cookies for analytics or advertising purposes on our website.

3.4 Appointment booking via Calendly

We use Calendly, operated by Calendly LLC, 271 17th St NW, 10th Floor, Atlanta, GA 30363, USA, to book demo appointments. When you book an appointment, your details (such as name, email address and, where applicable, telephone number) and technical data (IP address, browser information) are transmitted to Calendly and also processed in the USA. The sole purpose is to book and manage the appointment. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures) and Art. 6(1)(f) GDPR. For transfers to the USA, see Section 7. More information: https://calendly.com/privacy

3.5 Contacting us

If you write to us via the contact form or by email, we process your details in order to respond to your enquiry. The legal basis is Art. 6(1)(f) GDPR and, for enquiries relating to the conclusion of a contract, additionally Art. 6(1)(b) GDPR. We delete the data once your enquiry has been dealt with and no statutory retention obligations apply.

3.6 Job applications

We use application documents exclusively for the application process and do not pass them on to third parties. We delete them after the process has been completed, at the latest after six months – unless you have consented to longer storage or you are hired. The legal basis is Art. 6(1)(b) GDPR in conjunction with Section 26 BDSG and, where applicable, your consent (Art. 6(1)(a) GDPR). Please note that emails may be transmitted unencrypted.

4. QuickGuide app and QuickGuide Studio

4.1 Account and sign-in

You receive access to QuickGuide through your organisation: via an invitation to your email address or via your organisation's single sign-on (for example Microsoft Entra ID). We process your name, email address, internal user ID and your ID with the sign-in service; with single sign-on, additionally the information transmitted by your organisation's identity provider, such as your name and group or role information that we use to assign you to teams. The purpose is to create your account, sign you in securely and restrict access to authorised persons. We operate the sign-in service (Logto) ourselves in the EU. The legal basis is Art. 6(1)(b) GDPR (use in accordance with our terms of use) and Art. 6(1)(f) GDPR (secure access).

4.2 Professional profile

During onboarding, you provide your professional group, specialties, place of work and, optionally, your department. We use the profile to tailor QuickGuide to your work and show you relevant content first. The profile applies across all QuickGuide products that use the same sign-in – currently QuickGuide and our community app Turfle – so that you only have to enter it once. The legal basis is Art. 6(1)(b) GDPR.

4.3 Organisations, teams and content

We process your memberships in organisations and teams as well as your roles and permissions in order to determine which content and features you can use. When you create, edit, comment on or approve content in QuickGuide Studio, we store your name as author or editor, the version history and your comments; authorised persons in your organisation can see this information. We process this data on behalf of your organisation.

4.4 App features

We store favourites, recently read documents, shortcuts and your onboarding progress in order to provide these features to you – on behalf of your organisation. We do not use this data to monitor performance or behaviour and do not provide your organisation with any personal usage analyses.

4.5 AI assistant

The AI assistant answers questions based on your organisation's approved content. To generate an answer, your question, the previous course of the conversation and relevant excerpts from your organisation's content are transmitted to AI models operated exclusively in data centres in the EU (Amazon Bedrock and Google Vertex AI, each with processing in the EU). To find relevant excerpts, your question is also processed by a search model that we operate ourselves on Google Cloud in the Netherlands. Your name, email address and profile are not transmitted; the providers do not use the data to train their models. We store your conversations in our database in the EU so that you can access them again.

You can only use the assistant after giving your consent in the app; the app shows the full information before you consent and at any time under Settings → AI Assistant. The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it there at any time with effect for the future; all other features remain available without consent. If there is any change to which data is transmitted or to whom, we will ask you again. For the recording of requests for quality assurance purposes, see Section 4.12. Do not enter any data that could identify patients.

4.5.1 Dictation feature in the iOS app

In the iOS app, you can speak questions to the AI Assistant using the app’s dictation button instead of typing them. Use of this feature is voluntary.

After you grant permission, the app accesses your iPhone’s microphone and speech-recognition functionality. Speech-to-text conversion takes place exclusively on your device. The audio recording is processed only temporarily for speech recognition, is not stored by QuickGuide, and is not transmitted to QuickGuide, Apple, or any other recipient. If on-device speech recognition is not available for your device or selected language, the dictation feature will not be available. The app does not recognise or identify individuals based on their voice.

The recognised text is first displayed in the input field. You can review and edit it. Only when you submit your question is the text transmitted to QuickGuide and processed in the same way as a typed input in accordance with Section 4.5. The purposes, legal bases, recipients, and retention periods described in Section 4.5 apply.

When you first use the feature, the app asks for permission to access the microphone and speech recognition. You can disable these permissions at any time in the iOS settings for QuickGuide. All other QuickGuide functions remain available.

Please do not dictate information that could identify patients or other individuals. Review the recognised text before submitting it, and ensure that no conversations involving other persons are recorded.

This information applies exclusively to the dictation button in the QuickGuide iOS app. If you use the dictation feature of the iOS keyboard instead, Apple processes the voice input under its own privacy notices.

4.6 Emails

We send invitations and notices relating to your account – such as confirmation of a requested account deletion – via our notification service using the email delivery provider Resend (Resend, Inc., USA). Email address, name and the content of the message are processed. The legal basis is Art. 6(1)(b) GDPR and, for invitations, processing on behalf of your organisation. For transfers to the USA, see Section 7.

4.7 Security and log data

To ensure secure operation, prevent misuse and keep security-relevant events traceable, we log IP address, information about the app or browser and operating system, time and actions performed, such as sign-ins, role changes and consents. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is secure and stable operation (cf. Art. 32 GDPR).

4.8 Error diagnostics with Sentry

To detect and fix crashes and errors, the app and Studio send technical error reports to Sentry (Functional Software, Inc., USA), which are processed in Sentry's EU region in Germany: device model, operating system, app version, error trace and time. For a portion of sessions and in the event of errors, Sentry additionally records the sequence of user interactions; all text is masked and images are hidden so that no content is visible. We do not transmit IP addresses, cookies or user IDs. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is an error-free application.

4.9 Storage on your device

The app stores on your device or in your browser what it needs to operate: sign-in tokens, settings and cached content so that it loads quickly. This is permitted without consent under Section 25(2) no. 2 TDDDG. There is no advertising or tracking across apps or websites of other companies in the app. For product analytics, see Section 4.11.

4.10 Deleting your account

You can delete your account in the app under Settings → Profile → Delete account, or request deletion by email to datenschutz@quickguide.health. We delete your account no later than 14 days after your request (usually immediately when deleted in the app) and confirm this to you by email. In doing so, we remove you from all organisations and teams, delete your profile, profile picture, favourites, recently read documents, shortcuts, AI conversations and your entries in the search indexes, and delete your sign-in identity – this also ends your access to Turfle. Content you have written for your organisation remains with it; the author is then shown as "Deleted person". If you sign in via your organisation's single sign-on solution, your account there remains unaffected. Analytics events (Section 4.11) and recordings of AI requests (Section 4.12) are automatically deleted when their respective retention period expires.

4.11 Product analytics (OpenPanel, self-hosted)

To understand which features are used and where workflows get stuck, we record individual events in the app and in Studio – for example a sign-in, opening a piece of content, a search, adding a favourite, switching organisation or accepting an invitation.

For each event, we process: time, type of event, app version, platform (iOS, Android, web), your user ID, your organisation, and your profession and specialty from your profile. Our server adds this information based on your access token; the app itself does not transmit it.

For searches, we additionally process the search term. Before storing it, we automatically remove information that indicates a person (email addresses, telephone numbers, IBANs, dates, longer sequences of digits and names following a form of address) and shorten it to 120 characters.

The analysis runs entirely on our own infrastructure in the European Union (OpenPanel and ClickHouse in our cluster). We do not use cookies for this and do not pass this data on to third parties. We do not use this data to monitor performance or behaviour and do not provide your organisation with any personal analyses.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is improving the product and keeping it stable. You can object to this processing under Art. 21 GDPR by writing to datenschutz@quickguide.health.

We automatically delete the events after 90 days.

4.12 Recording of AI requests (Langfuse, self-hosted)

So that we can review and improve the quality of the AI assistant's answers, we record the following for each request: your question, the previous course of the conversation, the text passages used from your institution's approved content, the generated answer and technical metrics (model, duration, cost).

Before storing, we automatically mask information that indicates a person: email addresses, telephone numbers, IBANs, dates, longer sequences of digits and names following a form of address. This masking is rule-based. Clinical free text is retained so that the quality of answers can be assessed at all; therefore, do not enter any information that could identify a patient.

The recording runs on our own infrastructure in the European Union (Langfuse in our cluster). The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is ensuring the quality and safety of the answers.

We automatically delete the recordings after 90 days.

5. Recipients

Within your organisation, authorised persons, such as administrators, can see your account data, your team and role assignments and your name on content you have written. Only your own account can see your AI conversations.

The following service providers process data on our behalf (Art. 28 GDPR):

• Exoscale (Akenes SA, Switzerland): operation of QuickGuide, in particular servers and databases. Processing takes place in the EU, in Frankfurt. We operate product analytics (OpenPanel) and quality assurance of the AI assistant (Langfuse) ourselves on this infrastructure; this does not create any additional recipients.

• Gcore (G-Core Labs S.A., Luxembourg): delivery of QuickGuide Studio and files via a content delivery network (CDN). Processing takes place in the EU.

• Google Cloud (Google Cloud EMEA Ltd., Ireland): operation of the search model and the planning step of the AI assistant via Vertex AI. Processing takes place in the EU, in particular in the Netherlands; Vertex AI is operated in an EU region.

• Amazon Web Services (Amazon Web Services EMEA SARL, Luxembourg): answer generation for the AI assistant via Amazon Bedrock. Processing takes place in the EU.

• Sentry (Functional Software, Inc., USA): error diagnostics and analysis of technical errors. Processing takes place in the EU, in Germany.

• Resend (Resend, Inc., USA): sending emails, in particular invitations and account-related notifications. Processing takes place in the USA.

• Framer B.V., Netherlands: hosting of our website. Processing takes place in the EU.

• Calendly LLC, USA: booking and management of demo appointments. Processing takes place in the USA.

We do not sell personal data. Authorities only receive data if we are legally obliged to provide it.

6. Retention periods

• We store account, profile and usage data for as long as your account exists; thereafter Section 4.10 applies.

• We store AI conversations until your account is deleted.

• We delete website server log files after seven days and error reports in Sentry after 90 days at the latest.

• We delete analytics events and recordings of AI requests after 90 days.

• We retain security logs for as long as they are needed to investigate security-relevant events and delete them afterwards.

• Data subject to statutory retention obligations is retained until the end of the respective period.

7. Transfers to third countries

We process QuickGuide data in data centres in the EU. Our hosting provider Exoscale is based in Switzerland, for which an adequacy decision of the European Commission exists; the data is stored in Frankfurt. Some service providers belong to groups of companies based in the USA (Google, Amazon Web Services, Sentry, Resend, Calendly); Calendly and Resend also process data in the USA. Appropriate safeguards are in place for these transfers: the European Commission's adequacy decision on the EU-US Data Privacy Framework for certified providers (Art. 45 GDPR) and otherwise the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR).

8. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw consent at any time with effect for the future (Art. 7(3)); consent for the AI assistant can be withdrawn directly in the app.

Right to object: Where we process data on the basis of Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation (Art. 21 GDPR).

Where we act on behalf of your organisation, please contact your organisation; we will forward any requests we receive to it. For all other matters, you can reach us at datenschutz@quickguide.health.

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Hamburg Commissioner for Data Protection and Freedom of Information (Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit), Ludwig-Erhard-Str. 22, 20459 Hamburg, Germany.

9. No automated decision-making

We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR).

10. Changes

We update this privacy policy when our services or the legal situation change. The version published here applies; the date at the top shows when it was last updated.