Privacy policy

This is a translation provided for convenience. Only the German version is legally binding; in the event of any discrepancy, the German version prevails. Deutsche Fassung

The essentials in three sentences

The provider stores no data about you. It operates no server on which data of yours would be held, no database and no user account of its own.

What the app stores is held on your device and in the private iCloud of your Apple Account; if you switch on notifications from the provider, a notification subscription with Apple is added, which the provider does not retrieve (point 3.8). Sign-in, subscription and iCloud run via Apple under Apple’s terms; the provider can neither view nor disclose this data.

There are two exceptions, and both originate with you: feedback that you send yourself by email (point 3.7), and, when you delete your account, a code that is passed through to Apple for the duration of a single call (point 3.6).

1. Controller

A controller within the meaning of the General Data Protection Regulation (GDPR) is not necessary, since all responsibility in this respect lies with Apple Inc.

2. Principle: no patient data

UroLotse is a reference work for medical professionals. The app does not process health data of patients.

The app contains calculation aids (point scores, scales, classifications, pathways, calculators for creatinine clearance, PSA doubling time, PSA density and dose by body weight, and schedules) into which findings, answers or a date can be entered. These entries are neither stored nor transmitted; they exist only in working memory while the respective card is open and are lost when it is closed.

There is no field in the app whose content belongs to a patient and would be stored.

3. What data is processed and for what purpose

The following overview lists each processing operation individually. The details are set out in sections 3.1 to 3.8.

3.1 Sign-in

Use requires signing in with “Sign in with Apple”. There are no other sign-in methods; no password is assigned, stored or transmitted.

From Apple, the app receives only a user identifier issued for this app. Name and email address are not requested and not stored; anyone who chooses Apple’s address hiding when signing in also remains protected in this respect towards Apple.

The app does not evaluate the indication of the user’s authenticity that Apple supplies with the first sign-in.

The user identifier is stored in the device’s keychain. At every cold start of the app, Apple is asked whether the sign-in is still valid.

3.2 Data that does not leave the device

The following is stored on the device:

• the identifiers of the articles marked as favourite or on the reading list or recently opened, i.e. file names, not persons; the read marks are also held on the device and are additionally synchronised under point 3.3;
• the pinned calculators;
• the last ten search terms per search field;
• the chosen display settings;
• the chosen language of the app;
• the fields, the mode and the number of questions of the most recently started custom quiz session;
• the confirmation of the legal notice with the time, the confirmed text version and the app version;
• the decision on streak and awards (point 3.4) with the time;
• the selection of notifications with the time of the study reminder and the time of the decision, the notification subscriptions created and the most recently read list of notifications sent; the scheduled study reminders are held in the operating system’s notification service (point 3.8);
• the most recently determined status of the subscription with the time of the check (point 3.5).

This data is not transmitted, with the one exception of the read marks mentioned, and is deleted with the app. The notification subscription that the app creates with Apple for notifications from the provider is described in point 3.8.

3.3 Learning progress in the private iCloud

So that the learning progress is available on several devices of the same person, it is synchronised via Apple CloudKit. The following is stored:

• for each answered question, the next review date and a few figures of the review procedure (stability, difficulty, number of attempts and failed attempts, date of the last review);
• which articles are marked as read, with the date of the last change.

This data is held in the private database of the user’s iCloud account. The controller has no access to it, cannot view it and keeps no copy of it.

Storage takes place under the iCloud contract that the user has concluded with Apple Distribution International Ltd. (point 5). Under Apple’s iCloud terms, the data may be held on servers of Apple or of third parties engaged by Apple, including outside the European Union (point 6).

If no iCloud account is signed in on the device, synchronisation does not take place; the app continues to work with the data on the device, and no session is interrupted as a result.

3.4 Streak and awards

The app offers voluntary learning motivation. For this, the following is stored, likewise in the user’s private iCloud:

• the calendar days on which at least ten questions were answered;
• the awards achieved, with the date on which they were achieved;
• which calculators and which presenting-symptom filters were used;
• two counters for the number of evenings after 22:00 and of nights between three and four o’clock on which the app was used;
• four flags that each switch once: a practice session without errors, a clinical report sent, copied dates, an enlarged figure;
• the state of the associated switch.

All time data is accurate to the day. The data shows on which days learning took place, not at what time and not which individual question was worked on. The two counters are pure numbers without an associated calendar.

This processing is switched off until the user consents to it. The question is asked at first launch, immediately after the legal notice, on a separate screen that states what is stored; both answers lead into the app. Consent (Art. 6 (1) (a) GDPR) can be withdrawn at any time in the app under “More” and also given again there. What has already been recorded is retained when switching off and shown again when switching back on; it is not deleted. Anyone who wishes it to be deleted can delete the account (point 3.6) or contact the address given under point 1.

The question is asked on every device on which the app is opened for the first time. If the switch is later changed on one device of the Apple Account, the other devices adopt the more recent decision at the next synchronisation. Deleting the account also removes the decision.

3.5 Subscription

Access to the app requires an active subscription. Purchase and renewal are handled exclusively via the App Store; to that extent, Apple is the user’s contracting party.

The controller receives no payment data, no billing address and no names. The app only reads whether a valid entitlement exists for the signed-in account. This query takes place at every cold start.

3.6 Account deletion

The account can be deleted in the app. This removes:

• the user identifier from the device’s keychain;
• all data stored on the device under point 3.2;
• the scheduled study reminders and the notification subscriptions with Apple (point 3.8); a notification subscription that cannot be deleted for lack of a connection is removed by the app at the next start, as soon as the question about notifications has been answered without this type;
• the learning progress and the data under points 3.3 and 3.4, locally and in the private iCloud.

In addition, the link with the Apple ID is removed. For this, and only for this, one item of personal data leaves the device towards the controller: the authorisation code issued by Apple on renewed confirmation. It is transmitted to an interface of the controller, which exchanges it with Apple for a token and calls the revocation.

The interface runs as a “Worker” at Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA, on behalf of the controller (processing on behalf of a controller, Art. 28 GDPR; Cloudflare’s Customer Data Processing Addendum, version 6.4 of 3 April 2026). The call is executed in the Cloudflare data centre closest to the request; for devices in Austria this is as a rule a data centre in the European Union, and Cloudflare operates one in Vienna, among others. Cloudflare offers a contractual commitment to the EU only in its enterprise plan; in the free plan chosen there is none. According to its own information, Cloudflare processes the connection data of the request (IP address, time) in data centres in the United States and in Europe. On transfers to the United States, see point 6.

The interface itself keeps no database, no log and no state; the log storage offered by Cloudflare (“Workers Logs”, three days) is switched off for it. What it learns about a user exists for the duration of a single call. It passes the authorisation code on to Apple (appleid.apple.com), which issued it and is the only one that can carry out the revocation. The basis of the associated transfer to the United States is set out in point 6.

3.7 Feedback

The app offers to report a clinical error, a malfunction or a request. A draft email to support@urolotse.at is prepared and handed to the device’s mail app.

The draft visibly contains in its text: the identifier of the article or question concerned, the editorial date, the source, the app version, and the system version and device model. There is no hidden field and no attachment; every line can be changed or deleted before sending.

The message is sent by the user from their own mailbox. The controller thereby receives the sender address and the content of the message.

The mailbox support@urolotse.at is operated by World4You Internet Services GmbH, Wolfgang-Pauli-Straße 2, BT3, 4020 Linz, Austria, as processor (Art. 28 GDPR). The legitimate interest (Art. 6 (1) (f)) lies in handling the report, fixing reported errors and demonstrating that reported clinical errors have been followed up.

Below every draft is the note not to include any patient data.

3.8 Notifications

The app can show three types of notification: a study reminder, what’s new in the app and guideline updates. None is switched on until the user switches it on.

Study reminder

The study reminder is created on the device. The app schedules it via the operating system’s notification service for the chosen time, once a day, at most 14 days in advance and only for days on which ten questions have not yet been answered; once they have been, the reminder for that day is dropped. For this, the app reads the counted days under point 3.4 on the device. Nothing is transmitted for the study reminder.

The study reminder belongs to streak and awards and can only be switched on while these are switched on (point 3.4).

What’s new and guideline updates

Notifications about what’s new in the app and about updated guidelines are written by the provider. It creates them in the app’s public database at Apple (CloudKit) as an entry with type, heading, text and, where applicable, a reference to an article. The content is the same for everyone and contains nothing about the user.

These notifications are delivered by Apple via iCloud and Apple’s notification service (Apple Push Notification Service). For anyone who switches on one of these types, the app creates in the app’s public database a notification subscription that names only the type of notification. According to Apple, such a subscription belongs to the person who created it; Apple keeps it under their iCloud account, which is why an iCloud account must be signed in on the device for this. For delivery, the app registers with Apple’s notification service; the app does not pass on the device identifier assigned by Apple in the process.

A notification subscription applies to the iCloud account, not to an individual device: notifications of this type can appear on any device of the account on which notifications from UroLotse are allowed. If a type is switched off on one device of the account or declined at first launch, the notification subscription ends for all devices of the account.

The switches for what’s new and guideline updates therefore show which notification subscriptions the iCloud account has. At start-up and when “More” → “Notifications” is opened, the app asks Apple on the device which notification subscriptions of the app this account has and sets the switches accordingly; a change on another device of the account thus also shows on this one. A selection on this device that has not yet reached Apple takes precedence. The answer stays on the device. If a type has been switched on in this way, the operating system asks for permission to show notifications only when the user requests it under “More” → “Notifications”.

The provider does not retrieve the notification subscriptions, links them to nothing and does not learn who receives notifications.

Under “More” → “Notifications”, the app shows the notifications sent so far. For this, it reads the app’s public database at Apple when this page is opened, even without a notification subscription and without an iCloud account; the most recently read list stays on the device (point 3.2).

Consent

At first launch, immediately after the question about streak and awards and before sign-in, the app asks on a separate screen which notifications may be sent. All three switches are off; “No notifications” leads into the app without a further question. If a type is switched on, the operating system asks once for permission to show notifications.

The legal basis is consent (Art. 6 (1) (a) GDPR). It is given separately for each type and can be withdrawn and given again at any time under “More” → “Notifications”; permission to show notifications can also be withdrawn in the device’s settings. If the study reminder is switched off, including together with streak and awards, the app removes the scheduled reminders; if a type from the provider is switched off, it deletes the associated notification subscription with Apple. For anyone who chooses no notifications at first launch, the app also removes notification subscriptions that originate from an earlier installation.

The question is asked on every device on which the app is opened for the first time. The study reminder and its time stay on the device; the switches for what’s new and guideline updates follow the iCloud account, as described above. Deleting the account also removes the selection (point 3.6).

4. What does not take place

• No analytics or statistics services, no crash reports to third parties, no tracking, no advertising identifiers. The app contains no corresponding software libraries.
• No advertising and no disclosure of data for advertising purposes.
• No notifications without consent (point 3.8); the app requests permission to show notifications only when a type is switched on.
• No access to location, contacts, camera, microphone or photos.
• No creation of usage profiles and no automated decision-making within the meaning of Art. 22 GDPR.

The app includes one third-party software library, “swift-markdown-ui”, for displaying formatted text, with its two components “swift-cmark” and “NetworkImage”. It displays; the content of the app contains no images from the internet, and the library opens no connection for it.

5. Recipients

Data is not passed on to third parties, with the exception of the following technically necessary bodies:

Apple

Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland, provides the services sign-in (“Sign in with Apple”), iCloud/CloudKit and App Store to persons in the European Economic Area as a controller in its own right, under the contracts that the user has concluded with Apple. Apple carries out the revocation of the sign-in on account deletion (point 3.6) via its interface appleid.apple.com; the controller’s contracting party in the developer programme is Apple Inc., One Apple Park Way, Cupertino, CA 95014, USA.

• as provider of “Sign in with Apple” (sign-in and validity check);
• as operator of iCloud/CloudKit, where the learning progress is held in the user’s private database and via which the provider’s notifications are delivered (point 3.8);
• as operator of the App Store and contracting party for the subscription.

Cloudflare, Inc.

101 Townsend Street, San Francisco, CA 94107, USA, as processor for operating the deletion interface (point 3.6). Representative in the European Union: Cloudflare Portugal, Unipessoal Lda., Largo Rafael Bordalo Pinheiro 29, 1200-369 Lisbon, Portugal; data protection officer: dpo@cloudflare.com. Cloudflare uses its own sub-processors and lists them publicly.

World4You Internet Services GmbH

Wolfgang-Pauli-Straße 2, BT3, 4020 Linz, Austria (FN 232485s), as processor for the mailbox in which feedback is received (point 3.7); data protection contact: dataprotection@world4you.com.

6. Transfers to third countries

The controller itself transfers personal data to a third country in only one case: the authorisation code on account deletion (point 3.6), together with the connection data of the call, to Cloudflare, Inc. and on to Apple Inc., both in the United States.

Cloudflare, Inc. is certified under the EU-US Data Privacy Framework. For companies listed there, the European Commission has recognised an adequate level of protection in the United States (Implementing Decision (EU) 2023/1795 of 10 July 2023, Art. 45 GDPR). In addition, the Commission’s standard contractual clauses (Implementing Decision (EU) 2021/914) from Cloudflare’s Data Processing Addendum apply (Art. 46 (2) (c) GDPR).

Apple’s services (sign-in, iCloud including the delivery of notifications, App Store) are provided to persons in the European Economic Area by Apple Distribution International Ltd., Ireland, as a controller in its own right. Apple states that it bases transfers of personal data from the European Economic Area to third countries on standard contractual clauses (Apple Privacy Policy, as of 30 July 2025); Apple does not mention a certification under the Data Privacy Framework there. Under Apple’s iCloud terms, data in the user’s iCloud may be held on servers of Apple or of providers engaged by Apple, including outside the European Union. These transfers are made by Apple under the user’s iCloud contract, not by the controller.

The adequacy decision for the United States has been challenged before the Court of Justice of the European Union (C-703/25 P). Should it fall, the transfers rest on the standard contractual clauses. A copy of the safeguards is available from the address given under point 1.

7. Storage period

The three-year period for feedback corresponds to the limitation period for damages claims (§ 1489 ABGB). The seven-year retention obligation under tax law (§ 132 BAO) concerns books, records and vouchers; feedback on the app is not among them, the subscription is billed by Apple, and the controller receives no personal vouchers for it.

8. Your rights

Under the GDPR, the user has the following rights:

• access to the data processed (Art. 15);
• rectification of inaccurate data (Art. 16);
• erasure (Art. 17);
• restriction of processing (Art. 18);
• data portability (Art. 20);
• objection to processing based on a legitimate interest (Art. 21);
• withdrawal of consent given, with effect for the future (Art. 7 (3)).

Some of these rights can be exercised directly in the app: erasure via account deletion (point 3.6) and withdrawal of the consents under points 3.4 and 3.8 via the switches there. For everything else, a message to the address given under point 1 is sufficient.

The controller has no technical access to the data in the user’s private iCloud and can therefore neither provide information about it nor hand it over; the user sees it in the app itself and can delete it there.

9. Right to lodge a complaint

Anyone who considers that the processing infringes the GDPR may lodge a complaint with a supervisory authority. In Austria this is:

Austrian Data Protection Authority (Österreichische Datenschutzbehörde)

Barichgasse 40–42, 1030 Vienna · dsb@dsb.gv.at · www.dsb.gv.at · Telephone +43 1 52 152-0

10. Requirement to provide data

Sign-in and the subscription are required for using the app; without them, access to the content is not possible.

The processing operations under points 3.4 and 3.8 are not required and can be switched off without restricting use of the app.

11. Changes to this policy

The controller reserves the right to adapt this policy if the processing changes. Material changes will be announced in the app.

The currently applicable version is available at https://urolotse.at/datenschutz.html.

This website (urolotse.at)

The website urolotse.at is hosted by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany. When a page is requested, the web server processes the connection data technically required to deliver it: the IP address of the requesting device, the time of the request, the page requested, the amount of data transferred, the browser and the operating system. These details are held in the host's server logs; the legal basis is the legitimate interest in operating the website securely (Art. 6(1)(f) GDPR).

The website sets no cookies, uses no analytics or tracking tools and loads no resources from third parties. The style sheet and images are on the same server as the pages; the font comes from the device. There is no contact form; anyone who writes does so by email to one of the addresses given, and point 3.7 applies to these mailboxes. Anyone who asks to be told when the app is released receives that one email; the address is then deleted.