Privacy Policy

1. Who we are

This Privacy Policy explains how DRM Pharma & Diagnostic GmbH, Odenwaldring 41, 63110 Rodgau, Germany (“DRM”, “we”, “us”), acting as data controller, processes personal data in connection with the DRM HealthLink^™ platform. This includes DRM HealthLink CarePoint^™ kiosks, DRM HealthLink^™ Home Kits, the DRM HealthLink^™ mobile application and patient portal, teleconsultation services powered by DRM CarePoint AI^™, and this website.

For deployments outside the European Union, a local DRM entity or authorised partner may act as controller or joint controller together with DRM. Market specific privacy notices will identify the responsible entity where this applies.

2. Scope

This Policy applies to patients and users of DRM HealthLink^™ services, visitors to our website, and business contacts who communicate with us. It applies in all markets where DRM HealthLink^™ operates, subject to additional local notices required by applicable law.

3. Data we collect

3.1 Identity and contact data

Name, mobile number, email address, date of birth, gender, and preferred language, collected when you register at a CarePoint^™ kiosk, in the app, or through our website forms.

3.2 Health data (special category data)

Measurements and test results captured at a CarePoint^™ or connected from a Home Kit (for example blood pressure, ECG, blood glucose, hemoglobin, lipid values, screening questionnaire responses), teleconsultation records, prescriptions, and reports. Health data is processed only with your explicit consent or as otherwise permitted by applicable law.

3.3 Technical and usage data

Device identifiers, log data, kiosk and app usage events, and, on the website, cookie based analytics data as described in Section 11.

3.4 Business contact data

Details submitted through our contact and partnership forms, such as name, organisation, role, country, email, and phone number.

4. Why we process your data and on what legal basis

• To provide health screening, teleconsultation, reports, and records Performance of a contract; explicit consent for health data under Art. 9(2)(a) GDPR
• To deliver your reports via WhatsApp, SMS, and email Consent
• To enable physicians to review your results and provide care Explicit consent; provision of health care under Art. 9(2)(h) GDPR where applicable
• To operate, secure, and improve the platform including fault diagnosis, device calibration records, and fraud prevention Legitimate interests
• To produce anonymised, aggregated population health insights for partners and public health bodies This data cannot identify you
• To respond to enquiries and manage partnerships Legitimate interests; steps prior to entering a contract
• To comply with legal obligations Including medical record keeping and regulatory reporting duties

5. How we protect your data

• Encryption of personal and health data in transit and at rest.
• Secure, encrypted teleconsultation channels.
• Role based access controls: only authorised clinical and operational staff can access identifiable health data, and only to the extent required.
• Complete audit logging of access to records and prescriptions, with anomaly detection.
• Pseudonymisation and data minimisation in analytics environments.
• Administrative, physical, and technical safeguards aligned with internationally recognised frameworks, including safeguards consistent with HIPAA where relevant to a deployment.
• Regular security testing and staff data protection training.

6. Who we share data with

• Licensed physicians and clinical staff involved in your care, including specialists who review ECGs and other results.
• Pharmacies and laboratories, only where you request a prescription to be dispensed or a referral to be made, and only the data needed for that purpose.
• Service providers (hosting, communications delivery, payment processing) acting under data processing agreements and our instructions.
• Deployment partners receive only anonymised, aggregated utilisation and outcome reporting. They never receive your identifiable health data without your separate, explicit consent.
• Authorities, where disclosure is required by law.

7. International transfers

Where personal data is transferred outside the European Economic Area or your home jurisdiction, we use recognised transfer mechanisms such as adequacy decisions or the European Commission’s Standard Contractual Clauses, together with supplementary technical measures. Local data residency requirements are respected where applicable law requires health data to remain in country.

8. How long we keep data

Health records are retained for the period required by applicable medical record keeping laws in the relevant market, and otherwise for as long as you maintain your DRM HealthLink^™ record. Enquiry data is kept for up to 24 months after our last contact. Anonymised data may be retained indefinitely. When retention ends, data is securely deleted or irreversibly anonymised.

9. Your rights

Subject to applicable law, you have the right to:

• Access your personal data and receive a copy of your health records.
• Rectify inaccurate data.
• Erase your data (“right to be forgotten”), subject to legal retention duties.
• Restrict or object to processing based on legitimate interests.
• Data portability, including receiving your records in a structured, machine readable format.
• Withdraw consent at any time, without affecting processing already carried out.
• Lodge a complaint with a supervisory authority. In Germany this includes the Hessian Commissioner for Data Protection and Freedom of Information.

To exercise any right, contact info@drmhealthlink.com. We respond within the timelines required by applicable law.

10. Children

DRM HealthLink^™ services are intended for adults. Minors may be screened only with the consent and involvement of a parent or legal guardian, where local law permits.

11. Cookies and website analytics

Our website uses strictly necessary cookies and, with your consent, analytics cookies to understand how the site is used. You can manage preferences through the cookie banner and your browser settings. We do not use advertising cookies.

12. Changes to this Policy

We may update this Policy from time to time. Material changes will be announced on this page and, where appropriate, notified to registered users. The “Last updated” date above always reflects the current version.

13. Contact and Data Protection Officer

DRM Pharma & Diagnostic GmbH, Odenwaldring 41, 63110 Rodgau, Germany.