What we do with your data.

This notice describes how Novo Lab processes personal data on novolab.io and in its portal and API, under Regulation (EU) 2016/679 (GDPR), the German Federal Data Protection Act (BDSG) and the Telecommunications Digital Services Data Protection Act (TDDDG).

Controller

Novo Lab. Data protection contact: contact@novolab.io.

Representative in the Union

A representative under Article 27 GDPR is being appointed and will be named here. Until then, data protection requests reach us at contact@novolab.io and are answered on the same deadlines.

Data protection officer

None is appointed. Fewer than twenty people are permanently engaged in automated processing (§ 38 (1) BDSG), and processing special categories of data on a large scale is not a core activity (Article 37 (1) (c) GDPR), because the engine works on published literature and needs no patient identifiers. We test this again whenever the service or the volume changes.

Where the data lives: the application, its databases and the search index run on servers in Germany. Encrypted backups are kept in Germany for fourteen days with a second storage provider. The AI models that write the answers do not run in the Union yet: questions are sent to AI model providers based in the United States, and a prompt can be processed there. Under their commercial API terms inputs are not used to train their models, but they may be kept for a limited time for abuse monitoring, and no zero-retention arrangement is in place. Moving inference to European endpoints with zero retention is planned and will be stated here when it is live.

Visiting the site

The web server and the content delivery network record an IP address, the time of the request, the requested resource, the status, the referrer and the user agent. Legal basis: Article 6 (1) (f) GDPR, our interest in delivering and defending the site. The site runs no advertising. Analytics runs as described below.

Analytics

We use a web analytics service to understand how the site is used. Until you make a choice, it sets no cookies and keeps no identifier on your device: it sends the analytics service cookieless signals about the visit, such as the page viewed, the time, your browser and device type, your approximate location derived from your IP address and your consent choice, which the service uses to estimate overall figures and cannot tie to earlier visits. If you accept, it also sets cookies that recognise your browser on later visits and attaches a pseudonymous identifier to the same data. If you reject, analytics stops completely: nothing more is sent during that visit, its cookies are removed and it is not loaded on later visits. Until you reject, the site reports the pages you view, the links and buttons you use, how far you scroll, which sections you see, whether a contact message was sent and which topic it had, and how quickly pages load; never anything you type into the contact form. The analytics service may process the data in the United States; that transfer rests on the EU-US Data Privacy Framework. Advertising features and cross-device signals are switched off. Legal basis: for measurement without cookies, our legitimate interest in understanding how the site is used, Article 6 (1) (f) GDPR; for the cookies, your consent under Article 6 (1) (a) GDPR and § 25 (1) TDDDG. Analytics data is kept for fourteen months. You can change your choice at any time under Cookie settings in the footer; withdrawing consent removes the analytics cookies with effect for the future. You can object to measurement without cookies under Article 21 GDPR by writing to us, and a browser add-on that blocks analytics stops it on your device.

Writing to us

By email or through the contact form: your name, your address, your organisation if you give it, and your message. A form message is sent on to our inbox by our email provider and is not stored on this site. Kept as long as the enquiry needs and then for as long as commercial and tax law requires. Legal basis: Article 6 (1) (b) GDPR for a request tied to a contract, otherwise Article 6 (1) (f).

The human check on the contact form

Before a form message is accepted, a check run by our network security provider looks at signals from your browser to tell a person from an automated script. It runs only on the contact page and only to protect the form from abuse, and it is not used to track you. Legal basis: Article 6 (1) (f) GDPR, our interest in keeping the form usable; reading the signals it needs is strictly necessary to send the message you asked us to send, under § 25 (2) no. 2 TDDDG.

A portal account

Name, email address, your password in a form that cannot be read back, your role, the organisation you belong to, and for each session a session record with the IP address and the user agent. Legal basis: Article 6 (1) (b) GDPR. Kept for the life of the account. You can delete it yourself under Settings, Data & privacy: your name, email address and password are erased and every session ends at once. If you are the last person in your organisation, its API keys are revoked at the same moment. The audit log of account changes and any invoices are kept, and copies in the encrypted backups age out within 14 days.

Using the API

One metadata row per request: timestamp, the route pattern, the status code, the latency, the organisation, an identifier of the API key that is not the key itself, the IP address and the user agent. Question text, answer text and request bodies are never written to any log, and identifiers in the requested path are not recorded. Kept for ninety days, then deleted.

Asking a question

The question is sent to a model provider to produce the answer, as described above. The audit record for an answer keeps a fingerprint of the question rather than its text, with the sources used and the grades, so any answer can be reconstructed and challenged later. Legal basis: Article 6 (1) (b) and (f) GDPR, kept for at least six years as a traceability record. Each answer also adds a row to the AI output event log described under AI transparency, which holds identifiers and the ids of the cited sources but no question or answer text, and is deleted after 365 days. In the iOS app your threads are your history: the questions you ask and the answers you get are stored in readable form on our servers so you can open them again, and they stay until you delete the thread or your account. A thread you delete is removed 30 days later. When you delete the account, every thread is removed within 25 hours. Copies in the encrypted backups age out within 14 days after that. Legal basis: Article 6 (1) (b) GDPR.

Clinical inputs from a clinic

A clinic can store a protocol note together with medication and indication fields so the engine can run interaction and contraindication checks. That content can be health data under Article 9 GDPR. For it we act as a processor and the clinic remains the controller, on a data processing agreement under Article 28 GDPR concluded before the feature is used. The service requires no patient name, no address and no insurance number, and uploading direct identifiers is not permitted.

Billing

Organisation, plan, invoices and usage totals, kept for the statutory retention periods.

Professional secrecy: where we work for physicians and other professionals bound by § 203 of the German Criminal Code, we act as a person participating in their professional activity under § 203 (3) StGB. Our staff and our subprocessors are bound to secrecy in writing and told what a breach means, as § 203 (4) StGB requires.

Infrastructure

Hosting, databases and search index in Germany, and encrypted backup storage in Germany

Network and security

Delivery of the site and the service, and protection against attacks

AI model providers

The AI models that write the answers, run by providers based in the United States

Business services

Email and the tools used to answer you

A contract under Article 28 GDPR is being concluded with every processor, and not every one is in place yet. Transfers to the United Kingdom rest on the European Commission's adequacy decision of 19 December 2025, which runs to 27 December 2031. For the AI model providers in the United States, the safeguards for the transfer under Chapter V GDPR are being put in place together with those contracts. The current list of subprocessors, naming each company and what it does, is available on request and is attached to every data processing agreement.

Cookies and similar technologies: the public site stores nothing on your device beyond what the browser needs to render a page, and the human check described above, which runs only on the contact page. The portal sets one session cookie that is strictly necessary to deliver the service you asked for, which § 25 (2) no. 2 TDDDG exempts from consent. The analytics service sets its cookies only after you accept them on the consent notice, runs without cookies until you choose, and stops completely if you reject; Cookie settings in the footer reopens the notice.

Your rights: access (Article 15), rectification (16), erasure (17), restriction (18), portability (20), objection to processing based on legitimate interests (21) and withdrawal of a consent you gave, with effect for the future (7 (3)). Write to contact@novolab.io. You can also complain to a supervisory authority under Article 77 GDPR, for example the authority where you live or work. Where we act as a processor for a clinic, send the request to the clinic and we will support it.

No automated decision with legal effect is made about you under Article 22 GDPR. The engine generates graded evidence for a professional to read. The professional decides.

How the data is protected: data is encrypted in transit, passwords and keys are never stored in readable form, organisations are strictly separated, logs hold metadata only, backups are encrypted and kept in Germany, and administrative access is limited to named accounts. The backups are restore-tested monthly, and access-log rows older than ninety days are deleted.