Privacy Policy
Last updated: July 2026
mQ-up GmbH ("mQ-up", "we", "us") is committed to protecting your personal data. This policy describes what we collect, how we use it, and your rights regarding that data.
- 01
Data We Collect
We collect information you provide directly: your name, email address, phone number, and organisation name when you register or sign in. We automatically collect technical data including IP address, browser User-Agent, and session timestamps each time you access the platform. Usage and interaction data is generated across all platform modules — mqDiagnostic, mqTherapy, mqData, mqGenerator, mqPrompt, mqHub, and mqConsult.
- 02
How We Use Your Data
Your data is used exclusively to provide and improve our services, authenticate your account, and communicate service-related information. We do not use your personal data for advertising. Anonymised, aggregated clinical data may be used for product development and research purposes.
- 03
Data Sharing & Sub-processors
We do not sell your personal data. We share data only with trusted sub-processors who are contractually bound to equivalent data-protection obligations under Art. 28 GDPR. Current sub-processors: Scalingo SAS (infrastructure and hosting, EU data centres); Resend Inc. (transactional email delivery, United States — transfers protected by Standard Contractual Clauses under Art. 46(2)(c) GDPR). We disclose data to authorities only where legally required.
- 04
Payment Data
Payment card details entered during subscription signup are processed directly by our PCI-compliant payment processor. mQ-up stores only non-sensitive metadata: card brand, last four digits, and expiry date. Full card numbers and CVCs are never stored on our systems.
- 05
Medical & Clinical Data
Cardiovascular and biometric data processed through mQ-up products is treated with the highest level of confidentiality. Access is strictly limited to authorised personnel of the respective organisation. We operate in compliance with applicable medical data regulations in Germany.
- 06
Lawful Basis for Processing
We process personal data under the following legal bases: (a) Contract — Art. 6(1)(b) GDPR — processing necessary to provide the platform services you have contracted; (b) Legitimate interest — Art. 6(1)(f) GDPR — fraud prevention, security monitoring, and service improvement; (c) Legal obligation — Art. 6(1)(c) GDPR — retention of invoicing records as required by law. For special-category health data we rely on your explicit consent under Art. 9(2)(a) GDPR. You may withdraw that consent at any time by deleting your account in the profile settings.
- 07
Data Security
We implement technical and organisational measures appropriate to the risk, including encryption in transit and at rest, access controls, and regular security reviews. Our infrastructure is hosted on Scalingo within EU data centres.
- 08
Your Rights
Under GDPR you have the right to: access your personal data (Art. 15); correct inaccurate data (Art. 16); request erasure (Art. 17); restrict processing (Art. 18); receive your data in a portable format (Art. 20); withdraw consent at any time without affecting the lawfulness of prior processing (Art. 7(3)); and object to processing based on legitimate interests (Art. 21) — in which case we will cease processing unless we can demonstrate compelling legitimate grounds. To exercise any right, contact us at the address below or use the account deletion and data export tools in your profile settings.
- 09
Retention
We retain personal data for as long as your account is active or as needed to provide services. Upon account deletion, personal data is removed as promptly as technically feasible unless retention is required by law. Contact us to request expedited data deletion.
- 10
Supervisory Authority
You have the right to lodge a complaint with a data-protection supervisory authority. The competent authority for mQ-up GmbH is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany. Email: poststelle@ldi.nrw.de · Phone: +49 211 38424-0.
- 11
Cookies
We use strictly necessary cookies to keep you authenticated. We do not use tracking or advertising cookies. See our Cookie Policy for full details of all cookies set by the platform.
- 12
Changes to This Policy
We may update this policy as our services evolve. Material changes will be communicated by email or via an in-app notice at least 14 days before taking effect.