Organized notes and digital documents on a desk.

Legal

Privacy Policy

Information about privacy on this website.

1. Controller and Contact

The controller responsible for processing personal data on this website within the meaning of the General Data Protection Regulation (GDPR) is:

Dr. Dennis Kwiatkowski · Stolpmuender Weg 47g · 13503 Berlin · Germany · Email: info@acneinversa.life · Phone: +49 (0) 17632589560

If you have questions about how your data is handled, please contact us at the address above. Appointment of a Data Protection Officer is not required for this website under Art. 37 GDPR.

2. What Data Is Collected and Why

2.1 Hosting and Server Logs (Vercel)

This website is hosted by Vercel Inc., 340 Pine Street, Suite 701, San Francisco, CA 94104, USA. Every time you access a page, Vercel's infrastructure automatically records the following data in server logs:

  • IP address (partially anonymized)
  • Date and time of the request
  • URL of the page accessed
  • HTTP status code
  • Volume of data transferred
  • Browser type and version
  • Operating system
  • Referrer URL (the page that linked to ours)

Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in the secure and reliable operation of this website. Retention period: server logs are retained for up to 30 days before automatic deletion.

2.2 Vercel Web Analytics

We use Vercel Web Analytics to understand how visitors interact with this site. Vercel Analytics is designed with privacy in mind: it sets no cookies, stores no personal identifiers, and does not track individual users across sessions. Data collected is aggregated and anonymized.

Aggregate data collected includes: page views, referrer source, country (derived from IP address at the network edge but not stored), browser family, and device type.

Vercel Web Analytics is activated only after you give consent via the cookie banner. Legal basis: Art. 6(1)(a) GDPR in conjunction with Section 25(1) TTDSG — your explicit consent, which you can withdraw at any time via the cookie settings in the footer. For further details see Vercel's privacy policy at vercel.com/legal/privacy-policy.

2.3 Vercel Speed Insights

We use Vercel Speed Insights to measure Core Web Vitals (page loading performance, interactivity, and visual stability). When you load a page, your browser sends performance metrics to Vercel. No cookies are set and no personal data is stored. Data is aggregated at the network edge before being reported.

Speed Insights is likewise activated only after you give consent via the cookie banner. Legal basis: Art. 6(1)(a) GDPR in conjunction with Section 25(1) TTDSG — your explicit consent, which you can withdraw at any time via the cookie settings in the footer.

2.4 Contact by Email

If you contact us by email at info@acneinversa.life, the personal data you provide — including your name, email address, and message content — will be processed solely to handle your inquiry and not shared with third parties.

Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in responding to editorial or general inquiries. Retention period: email correspondence is kept for as long as necessary to resolve your inquiry, and no longer than 3 years thereafter, unless statutory retention obligations apply.

2.5 Patient Story Submissions

If you submit a patient story, we process the information you provide in the form, including your email address, selected anonymity option, optional age band and country, and the health-related details contained in your story. This processing is based on your explicit consent under Art. 6(1)(a) and Art. 9(2)(a) GDPR.

Submissions are stored together with your consent record in a database for editorial review and forwarded by email through STRATO mail infrastructure to the editorial inbox. No email is sent to the address you provide at submission time; we contact you before any possible publication. Submissions pass automated safety checks and may additionally be reviewed with AI-assisted moderation run by the editorial team. Publication is not guaranteed, and published stories are edited to remove unnecessary identifiers. Retention: rejected submissions are automatically deleted after 90 days; submissions that are never processed are deleted after 12 months.

2.6 Specialist Profile Submissions

If you submit an HS specialist profile as a physician or clinic representative, we process the information provided in the form, including private review contact details, public clinic contact details, specialty, address, postal code, consultation types, HS-related services, licensure notes, and consent records.

The submission is stored in a database as pending and may be sent by email to the editorial inbox for review. Only fields intended for publication are shown in the public directory after approval. Legal basis: Art. 6(1)(a) GDPR for consent-based publication and Art. 6(1)(f) GDPR for editorial review, verification, and abuse prevention.

2.7 Trial Finder Postal Code Search

If you use the trial finder, your browser sends the entered German postal code to Zippopotam.us for geocoding and sends the resulting coordinates, radius, and Hidradenitis Suppurativa search query to ClinicalTrials.gov. Acne Inversa Life does not receive, store, or combine these searches.

Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in providing the requested trial-search tool. Because the query relates to health-related content, please use the tool only if you are comfortable with these direct external requests.

2.8 Symptom Tracker (Optional Account)

If you create a symptom tracker account, we process your email address, a cryptographic hash of your password, your consent record (consent version, timestamp, and a salted hash of your IP address), and the health diary entries you choose to log — including pain, itching, swelling, lesion counts, drainage, fever, mobility, fatigue, wellbeing, mood, sleep, stress, affected body areas, triggers, and free-text notes. These entries are special-category health data within the meaning of Art. 9 GDPR.

Legal basis: your explicit consent under Art. 6(1)(a) and Art. 9(2)(a) GDPR, given at registration via mandatory consent checkboxes and recorded with a versioned consent text. You can withdraw your consent at any time by deleting your account in the tracker settings.

Storage and retention: tracker data is stored in a Neon PostgreSQL database and processed by Vercel serverless functions solely to provide the tracker to you. It is never used for advertising, profiling, or any other purpose. When you delete your account, all symptom entries are deleted immediately and the account record itself is permanently erased after a 30-day grace period by an automated retention job. Unverified registrations are automatically purged 30 days after the verification link expires; expired sessions and used password-reset tokens are cleaned up daily.

Your rights: you can export all of your entries as a JSON file at any time from within the tracker and delete individual entries or the entire account in the settings. To protect the service against abuse, registration, login, and submission endpoints use rate limiting; rate-limit counters reference your IP address and are automatically deleted within days.

3. Special Note: Health-Related Content

This website covers medical topics related to Acne Inversa (Hidradenitis Suppurativa). Under Art. 9 GDPR, health data is a special category requiring heightened protection. Browsing patterns on health-related pages may, in principle, allow inferences about a person's health condition.

We have selected tools specifically designed to minimize this risk:

  • Vercel Analytics sets no cookies and stores no personal identifiers — aggregate data cannot be linked back to individuals
  • Server logs are retained only briefly and are not used for profiling or behavioral analysis
  • No behavioral tracking, remarketing pixels, or health-data profiling is performed
  • No third-party advertising networks with cross-site tracking capabilities are integrated

If we ever integrate tools that could profile health-related browsing behavior, we will obtain explicit consent under Art. 9(2)(a) GDPR and update this policy accordingly.

4. Data Processors and Third-Party Services

We have entered into a Data Processing Agreement (DPA) with Vercel Inc. as required by Art. 28 GDPR. Vercel acts as a data processor on our behalf for hosting, analytics, and performance monitoring.

Vercel Inc. — 340 Pine Street, Suite 701, San Francisco, CA 94104, USA — provides: website hosting and CDN, Vercel Web Analytics, and Vercel Speed Insights. Privacy policy: vercel.com/legal/privacy-policy.

STRATO AG (Berlin, Germany) provides email mailbox and SMTP infrastructure for all transactional email sent from info@acneinversa.life: patient-story and specialist review notifications as well as symptom-tracker emails (verification links, password resets, account deletion confirmations). If AI-assisted moderation is enabled, the submitted story text may be processed by the configured AI provider solely for safety, privacy, and editorial review before publication. This policy will be updated if additional services are integrated.

Neon Inc. provides PostgreSQL database infrastructure for the symptom tracker (accounts, sessions, and health diary entries), for HS specialist profile submissions and the approved public directory, for patient story submissions, and for short-lived rate-limit counters. Private review fields are not exposed through the public directory API. Processing by Neon takes place under a data processing agreement pursuant to Art. 28 GDPR.

Zippopotam.us provides postal-code geocoding for the trial finder. ClinicalTrials.gov, operated by the U.S. National Library of Medicine, provides public clinical-trial registry data. These requests are made directly by your browser only after you submit the trial finder form.

5. International Data Transfers

Vercel Inc. is headquartered in the United States. Data transferred to Vercel is protected by the Standard Contractual Clauses (SCCs) approved by the European Commission under Art. 46(2)(c) GDPR, which provide an adequate level of data protection.

Vercel's Data Processing Agreement and transfer safeguards are documented at vercel.com/legal/dpa. If you use the trial finder, direct browser requests may also be sent to ClinicalTrials.gov in the United States and to the postal-code geocoding provider.

Database contents (symptom tracker, submissions) are stored with Neon in a European Union region. Neon Inc. is a US company; processing is covered by a Data Processing Agreement including the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). STRATO AG processes email within Germany.

6. Cookies and Tracking Technologies

This website uses no non-essential cookies. Your cookie consent decision is stored in your browser's localStorage, and a technically necessary session cookie is set only when you log in to the symptom tracker. In accordance with § 25 TTDSG, Vercel Analytics and Speed Insights are loaded only after you give consent via the cookie banner; details are described in the Cookie Policy.

Vercel Analytics and Vercel Speed Insights themselves set no cookies and store no personal identifiers — they are nevertheless loaded only with your consent. If additional services are ever added — for example, advertising or third-party analytics — this policy will be updated before those services are activated.

7. Links to Third-Party Websites

This website contains links to external sources, primarily medical and scientific publications. We are not responsible for the content or privacy practices of those websites. We recommend reviewing their privacy policies before submitting any personal data to them.

8. Your Rights Under GDPR

As a data subject, you have the following rights under the GDPR. To exercise any of these rights, please contact us at info@acneinversa.life.

  • Right of access (Art. 15 GDPR): You may request confirmation of whether we process personal data about you, and receive a copy of that data.
  • Right to rectification (Art. 16 GDPR): You may request correction of inaccurate or incomplete personal data.
  • Right to erasure (Art. 17 GDPR): You may request deletion of your personal data where the legal grounds for processing no longer apply.
  • Right to restriction of processing (Art. 18 GDPR): You may request that we restrict how we use your data in certain circumstances.
  • Right to data portability (Art. 20 GDPR): Where processing is based on consent or a contract, you may request your data in a structured, machine-readable format.
  • Right to object (Art. 21 GDPR): You may object at any time to processing based on Art. 6(1)(f) (legitimate interests). We will stop processing unless we demonstrate compelling legitimate grounds that override your interests.
  • Right to withdraw consent (Art. 7(3) GDPR): Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
  • Right to lodge a complaint (Art. 77 GDPR): You have the right to lodge a complaint with a data protection supervisory authority.

We will respond to requests without undue delay and within one month of receipt (Art. 12(3) GDPR). This period may be extended by two further months where necessary, with prior notification.

9. Supervisory Authority

The supervisory authority competent for this website is the Berlin Commissioner for Data Protection and Freedom of Information:

Berliner Beauftragte für Datenschutz und Informationsfreiheit · Friedrichstr. 219 · 10969 Berlin · Germany · Website: datenschutz-berlin.de

You have the right to lodge a complaint with this authority or with any other EU data protection supervisory authority (Art. 77 GDPR), in particular in the Member State of your habitual residence, place of work, or the place of the alleged infringement.

10. Changes to This Privacy Policy

We may update this privacy policy to reflect changes in our data processing practices, newly integrated services, or changes in applicable law. The current version is always published on this page. Material changes will be indicated by an updated effective date.

Effective date: May 2026.