Privacy Policy

This policy applies to the Elara Health website. The app has a separate Privacy Policy.

1. Controller and contact

MS Nucleus GmbH
Gundelfinger Straße 5
10318 Berlin, Germany
Local Court Berlin (Charlottenburg), HRB 243388
Managing Director: Frederik Marquart
E-Mail: frederik@elara-health.de

For privacy enquiries, access, erasure and withdrawal: datenschutz@elara-health.de.

2. Website access and hosting

Vercel hosts the website. Connection and technical data such as IP address, timestamp, requested resource, browser information and technical status data are processed to deliver, secure and troubleshoot the site. The legal basis is Art. 6(1)(f) GDPR. Opening a self-check page creates these connection data even though its answers remain local.

3. Contact form and email

When you contact us, we process your name, email address, optional subject and message to respond. Depending on the request, Art. 6(1)(b) or (f) GDPR applies. Resend handles email delivery. Required form details are needed to process the request; the form cannot be sent without them. Contacting us does not subscribe you to advertising.

Please do not send medical reports, diagnoses or other sensitive health details through this general contact form. Technical app support only needs a description of the problem without medical details. This notice does not rule out unsolicited receipt of such data; they are not intended for routine handling.

4. Questionnaires and self-checks

Public self-checks work without an account. Answers and results are calculated in your browser and temporarily encrypted in that tab’s session storage. Results are valid for 30 minutes; expired records are discarded on subsequent access or cleanup. Session storage normally ends with the tab session, though browser session restoration may restore it. You can also clear the site’s storage yourself.

The normal questionnaire flow does not send answers to our server. Results (scores only, never answers) are stored only if you are signed in and have consented to storing health details; section 6.4 applies. Questionnaire, contact, account, experience-report, OAuth, password and API sections are excluded from website analytics. Results are not a medical diagnosis.

The PEM diary (/pem-tagebuch) can also be used without an account. Your entries (day, energy, exertion, symptoms, crash yes/no, note) are stored encrypted only in this browser’s local storage and are not sent to us; we have no access to them. The key is kept in the same browser, so the encryption does not protect against others using this browser profile. Entries older than two years are removed on the next save. You can delete all entries on the page; clearing your browser data removes them as well. Storing them on your device is strictly necessary for this function you expressly use (Section 25(2) no. 2 TDDDG).

The website provides no iframe/embed routes and no postMessage interface for transmitting questionnaire answers or results to third-party sites.

5. One-time app-link email

After a self-check, you may optionally request a single email with an app link and general pacing tips. The basis is your separate consent under Art. 6(1)(a) GDPR. Without consent, no such email is sent; the self-check remains available. This is not a newsletter subscription.

Supabase stores the email address, language, the general source “website email request”, time, version and wording of consent. Questionnaire type, answers and results are not stored in this record. Resend receives the email address and general message needed for delivery. The request is normally removed after 30 days in a daily cleanup. This does not automatically delete separate provider delivery logs or backups, which have their own purpose-limited deletion rules.

You can withdraw consent or request erasure using the privacy contact above. Withdrawal applies prospectively and cannot recall an email already delivered.

6. Abuse prevention

Form limits use salted, pseudonymous hashes instead of raw IP addresses as keys. Upstash processes keys, counters and expiry times: IP-based limits last one hour. An additional recipient-address hash lasts up to 24 hours to prevent repeated app-link emails. This is pseudonymous, not anonymous processing. The basis is Art. 6(1)(f) GDPR and our interest in preventing spam and misuse.

6.1 Website account and sign-in

For learning progress, your saved list, contributions to the Elara Guide and – only with your separate consent – health details (section 6.4) you can create a free website account. It lives in its own Supabase project and is separate from your Elara app account: health data from the app is not linked to the website account. We store your email address, the time of sign-in and technical sign-in data held by Supabase. The legal basis is Art. 6(1)(b) GDPR.

Signing in works without a password, using a 6-digit code we send to your email address. Alternatively you can sign in with Google or Apple where offered. In that case the provider learns that you are signing in with us and passes us the email address held there plus an identifier; with Apple you can choose a relay address instead of your real one. The provider’s own privacy notice applies in addition.

After signing in we set a technically necessary, signed session cookie for this website. It contains account ID, pseudonym and email address, but no health scores. Your contributions and learning progress are stored under a derived pseudonym. Learning progress and saved items are synchronized at Supabase with your website account; existing browser data are transferred only after you select “Add browser data”. You can choose to use only your account data instead. You can delete your website account under “My account”. This removes the account, learning progress, saved list, profile details, health details, account-linked experience reports and uploaded Guide images. Your long-form contributions, including drafts and revisions, are withdrawn and their text is removed. Directory entries, reviews and discussions remain without your display name; photos you uploaded are removed, including from approved entries. Personal details in those texts are not automatically removed; contact our privacy team about erasing them before deleting your account.

6.2 Elara Guide and public community contributions

When you create a community profile or submit content in the Elara Guide, we process, depending on the feature, your internal account ID, chosen community name, submitted content, topic assignments, moderation status and timestamps. Your email address is not published as part of a public contribution. Drafts and content in moderation are not public. Approved contributions, directory entries, experiences and discussions may be publicly accessible; approved long-form contributions and eligible Guide pages may also be indexed by search engines.

A combined public profile page showing your community name, profile picture, level, approved reviews, reviewed products and other community contributions is created only if you enable the separate “Show my profile publicly” setting. Without it, individual approved contributions may still appear on their own public pages, but not as a combined profile history. Your email address, private health profile and saved questionnaire results are not published as profile fields. However, public reviews, product mentions and free-text contributions may still reveal information about illnesses, treatments or everyday life. You can disable the combined profile at any time; this does not automatically remove contributions already published on other public pages.

Optional title images and photos for directory entries are resized and re-encoded to WebP in the browser before upload; embedded metadata such as the capture location is dropped in the process. Draft and revision images are stored in a private Supabase storage area and shown to the signed-in author only through a protected route. Until approval, photos for directory entries are visible to moderation only; photos of rejected entries are removed in the daily deletion run. An image is delivered publicly only through an approved contribution page. Please do not upload images that unintentionally show people, addresses, documents, medical reports or other identifying information.

By default your profile picture is a drawn avatar that this website generates itself from a random string; no data is sent to third parties for this. Optionally you can upload your own profile picture. It is cropped to a square and re-encoded to WebP in the browser (dropping metadata such as the capture location), stored in the private storage area and reviewed by moderation before it is ever published; until then others see your drawn avatar. Once approved it appears next to your community name, for example on your experiences and your profile. You can remove it at any time in your profile; replaced, rejected and removed pictures are deleted in the daily deletion run. The legal basis is Art. 6(1)(b) GDPR. A photo of yourself is not required – please do not upload pictures of other people.

Publishing a community contribution at your request is part of providing this feature under Art. 6(1)(b) GDPR. Moderation, abuse prevention and handling reports also rely on Art. 6(1)(f) GDPR; our legitimate interest is a safe, reliable and non-manipulative community service. If you voluntarily include information about your own health in a contribution intended for publication, we obtain explicit consent before submission; Art. 9(2)(a) GDPR applies to such health data. Please do not publish health data or other sensitive data about other people.

You can withdraw your own long-form contributions from the authoring page. This ends public publication and removes the article content, including an associated article image, from the contribution record or related storage object. Technically necessary security, moderation or evidence records may continue only where an independent legal basis or retention obligation applies. For other community content and additional erasure or correction requests, contact the privacy address above.

6.3 Sharing care experiences (“Gehört werden”)

Under “Share your story” you can voluntarily describe how you were treated with ME/CFS, long COVID or another post-infectious illness in practices, hospitals, rehabilitation, assessments or by payers. We process your free text and who is telling the story (affected yourself, on behalf of someone else, or professionally). Optionally we also process what would have helped (a second free text), where and roughly when it happened, the diagnosis and severity at the time, and whether your health worsened afterwards. These are health data. The purpose is to identify patterns in care and make them visible in aggregated form.

The legal basis is your explicit consent under Art. 6(1)(a) and Art. 9(2)(a) GDPR, given before submission. Participation is voluntary; without consent the story cannot be submitted, and all other website features remain available. You may withdraw consent at any time with effect for the future; we will then delete the story.

You may report about yourself, or about another adult with their explicit consent and authorisation. When reporting as a relative or from a professional perspective, you must confirm before submission that the person has permitted processing of their health details and authorised you to submit consent on their behalf. Professional confidentiality duties still apply. Do not enter names or other identifying details about uninvolved people. We store the confirmed consent version with the perspective and submission time; consents are not restored from a local draft.

The data are stored at Supabase in a project located in the EU (Frankfurt), separate from the Elara app. If you save with a website account, the story is stored under a pseudonym of your account, not under your email address. If you save without an account, we store neither an account nor an email address, only a cryptographic hash of an access code that we show you once. No IP address is stored with the story; abuse prevention follows section 6, with a 24-hour window for this form. Because free text may allow conclusions about you, we treat stories as personal data, not as anonymous.

Until submission, your draft is encrypted in this browser’s local storage so you can pause and continue later. It is not sent to us. It is deleted on submission or through “discard draft”. A draft older than seven days is discarded the next time the form is opened; without another visit, it may remain in the browser. The decryption key is also stored in this browser. Encryption therefore does not protect against other people using the same browser profile. On a shared device, discard your draft when you stop, or clear the site’s browser data.

The voice input offered by this form is available only if the browser can explicitly require on-device speech recognition. Every recognition session starts with local processing required; there is no automatic fallback to an online speech service. If a local language model or browser support is missing, you can type instead. The website does not automatically download language models. Elara receives only the text on submission, not an audio recording. An independently used keyboard or operating-system dictation feature is governed by its provider’s settings and privacy notice.

We do not publish individual stories. Only aggregated results are published, and only for groups of at least ten stories. The data are not used for advertising, not sold and not linked to the Elara app.

No research permission is collected for new reports. These reports are not shared with universities or other research partners. If such use is offered in the future, we will provide separate information in advance about the research purpose, data scope, recipients and withdrawal, and obtain any new consent required. An earlier blanket research permission is not treated as permission for new transfers.

Stories are deleted automatically in the daily cleanup five years after submission. You can have them deleted earlier: with a website account by deleting your account or contacting the privacy contact; without an account via the privacy contact, quoting your access code. Without the code, attribution may be impossible (Art. 11 GDPR). If you have lost the code, you can still contact us; we will assess whether the story can be attributed using additional information you provide voluntarily. We do not advise on individual cases, and no automated decisions are made about you.

6.4 Health details in your website account

With a website account you can voluntarily have health details stored in your account: a self-assessment of your severity in five levels (from “barely limited” to “very severe”), optionally a value on the Bell scale (0 to 100), and questionnaire results (FUNCAP-27: total score and eight domain scores; Bell scale: value), each with a date. Individual questionnaire answers are not stored; as described in section 4, they remain only in your browser.

The purposes are to let you compare your results over time, to prefill your reviews in the Elara Guide with your level and – only if you give a level with a review – to show that level on the review and to evaluate reviews grouped by level. We show averages per level only from five reviews onwards.

The legal basis is your explicit consent under Art. 6(1)(a) and Art. 9(2)(a) GDPR. We ask for it once, as a separate yes/no decision, after registration or at your next sign-in. Consent is voluntary; without it your account and all questionnaires remain available, just without saving. You can withdraw it at any time with effect for the future under “My condition” in your account. We then delete your self-assessment, Bell value and saved results and remove the level from your reviews; the reviews themselves remain.

The data are stored at Supabase in a project located in the EU (Frankfurt), separate from the Elara app and under a pseudonym of your account, not under your email address. Your Bell value, self-assessment and questionnaire results are visible only to you. The only thing shown publicly is the level on a review for which you gave it; it is copied on submission and not linked to your other health details. The data are not used for advertising, not sold, not transferred to the Elara app and not used for automated decisions. They remain stored until you withdraw consent, remove individual results or delete your account; you can download a copy in your account settings.

6.5 Optional feedback on learning lessons

Below lessons you can voluntarily give feedback using Yes or No and predefined reasons. Free text is not accepted. We store the chapter, lesson, choice, reasons and time at Supabase without account linkage or an IP address in the feedback record. Only our editorial team uses the non-public responses to improve the content. The legal basis is Art. 6(1)(f) GDPR, our interest in clear and helpful content. Feedback has a retention period of one year; expired records are removed by daily cleanup. Abuse prevention uses Upstash to process a pseudonymous limit key derived from the IP address and counters. Technical connection data at hosting and other providers are processed separately; anonymous transmission is not promised. New feedback does not set persistent browser markers; old lesson markers are removed on the next visit to a lesson with the feedback feature.

7. Consent and limited website analytics

PostHog loads only after affirmative statistics consent. We capture general website sections and explicitly allowed app-link clicks with a temporary pseudonymous identifier. Detailed article or health-page URLs, query strings, URL fragments, referrers, form contents, Guide search terms and questionnaire data are excluded from analytics events. With consent, the Guide may record only coarse interactions such as the type of public content viewed, the type of content shared, the sharing method or the type of related content opened; specific slugs, titles, topics and author names are not transmitted. Automatic click capture, session replay, performance capture, surveys and person profiles are not used for this website analytics setup.

The analytics identifier is kept only in the page’s memory. Technical connection data still arise when communicating with the provider. The decision is stored in the browser with its time, version and expiry for 180 days, a period chosen by us. Optional analytics relies on Art. 6(1)(a) GDPR and Section 25(1) TDDDG. We do not use Google Analytics or Google Tag Manager for website analytics.

You can accept, reject or withdraw via “Cookie Settings” in the footer. Rejection is available at the same level as acceptance. Withdrawal is also respected in other open tabs of this site. Earlier consent versions and expired decisions are not treated as fresh consent. Storage inventory in the Cookie Policy.

8. Technical error diagnosis

Sentry is used for limited technical error diagnosis, not usage analytics, based on Art. 6(1)(f) GDPR and our interest in a secure, working website. Only minimized errors with error type and permitted technical code locations are sent. Free-text errors, form data, user profiles, request contents, breadcrumbs and attachments are not included. Sensitive sections are excluded. Performance transactions, session replay and automatic session reports are disabled.

Technical transmission can produce connection data, including the IP address, at the provider. Omitting an IP field in an event does not guarantee that the provider processes no IP address.

9. Recipients and international transfers

Depending on the feature, providers include Vercel (hosting), PostHog (consented statistics), Sentry (error diagnosis), Supabase (email requests, learning feedback, website accounts, health details in the account, community content and shared experiences), Resend (delivery) and Upstash (abuse prevention). If you sign in with Google or Apple, that provider is involved as well. Providers may use subprocessors. A European server region does not automatically exclude access or processing outside the EEA.

Processing on our behalf is governed by Art. 28 GDPR. Transfers to third countries require the conditions of Arts. 44 et seq. GDPR, such as an applicable adequacy decision or Standard Contractual Clauses with necessary supplementary measures. The applicable safeguard depends on provider, contract and processing activity. Contact us for details and a copy of the safeguards applicable to your data. The provider documents below explain contractual terms, not the particular configuration used.

Vercel · PostHog · Sentry · Supabase · Resend

10. Retention and erasure

Browser data, email requests, Guide content, health details in the account (until withdrawal, removal or account deletion), lesson feedback (one year with daily cleanup) and shared experiences (five years) have the periods and erasure options described above. Contact requests are deleted after handling is complete unless contract performance, statutory retention or a specific legal claim requires retention. Technical-log retention depends on whether a record is still needed to investigate an error or security incident; closed cases do not justify indefinite retention. Personal analytics data cease to be retained once the relevant analysis can continue without individual events. Separate provider logs and backups must be considered in their respective systems. Your erasure rights remain unaffected.

11. Your rights

Subject to statutory conditions, you have rights of access, rectification, erasure, restriction, portability and objection under Arts. 15–21 GDPR. You may withdraw consent for the future without affecting prior lawful processing. You may object to processing based on legitimate interests for reasons relating to your particular situation. You may complain to a supervisory authority, including the Berlin Commissioner for Data Protection and Freedom of Information.

12. No decisions with legal effect

This website does not make solely automated decisions under Art. 22 GDPR with legal or similarly significant effects. Self-check calculations only generate the displayed result.

Last updated: 26 October 2026