Privacy Policy

Last updated: October 2026

This page is provided in English for convenience; the German version is authoritative for legal purposes.

1. Data Controller

The data controller within the meaning of the General Data Protection Regulation (GDPR) is:
Mario Günther
August-Bebel-Str. 23, 08645 Bad Elster
E-Mail: info@podologix.de Email: info@podologix.de

2. This Website

2.1 Hosting

When you visit this website, our hosting provider automatically collects technical access data (including IP address, date and time of access, page requested, browser used) in so-called server log files. This processing is based on our legitimate interest (Art. 6(1)(f) GDPR) in the secure and stable operation of the website. Hosting provider: Alfahosting GmbH, Edmund-von-Lippmann-Straße 13-15, 06112 Halle (Saale), Server location: Germany

2.2 Cookies & Tracking

This website does not use analytics, marketing, or tracking cookies. No user profiles are created.

2.3 Fonts

This website serves the "Inter" and "Space Grotesk" fonts locally from our own server. No connection is made to Google servers or any other third party, and no data is transmitted to third parties.

2.4 Contact Form

The contact form on this website is processed and delivered exclusively through our own server infrastructure – no third-party service is used. The data you enter (name, email address, subject, message) is transmitted to our server, stored there to process your inquiry, and forwarded to us by email. The legal basis is Art. 6(1)(b) GDPR (processing your inquiry).

3. The Podologix App

Podologix is deliberately designed offline-first and end-to-end encrypted:

  • All sensitive customer and treatment data is encrypted locally on the device with AES-256-GCM before it is ever transmitted to the server.
  • The key required for decryption is derived from your password and a server salt and lives exclusively in the device's memory – it is discarded on logout or when the app is closed and is never stored unencrypted or transmitted to the server.
  • Client, treatment and assessment data is stored on our server in encrypted form only (so-called blobs) and is unreadable to us as the operator without your password. The optional calendar sync is an exception – see section 4.
  • Account master data (e.g. the email address used for login, device identifier, license status) is processed unencrypted on the server insofar as this is necessary for operation, synchronization, and license verification.

In addition, you can protect your account with two-factor authentication (time-based one-time codes, TOTP). The feature is optional and switched off by default; the secret required for it is stored encrypted on the server.

The legal basis for this processing is the performance of the app usage contract (Art. 6(1)(b) GDPR).

4. Calendar Sync (CalDAV)

Podologix can optionally sync your appointments with a CalDAV calendar – either with a calendar we provide at cal.podologix.de or with a calendar of your choice (e.g. Nextcloud, ownCloud, Apple iCloud). This feature is disabled by default and has to be set up by you.

Important: Unlike the rest of your data, calendar entries (appointment title, date, time, location) are stored unencrypted on a CalDAV server. This is not an oversight but follows from the purpose of the feature: calendar sync is only useful to you if other programs – Thunderbird, the iPhone calendar, DAVx⁵ or Nextcloud, for example – can actually display the appointments. Those programs only understand the open iCalendar format; encrypted appointments would arrive as an unreadable string of characters. If an appointment title contains a client's name, that name is therefore stored in plain text on the calendar server – and if you use a calendar of your choice, on that provider's server, over which we have no influence.

Our own calendar server only reads the start, end and type of an entry in order to answer time-range queries from calendar apps; the entry itself is stored in full. This data is protected by transport encryption (HTTPS), per-user credentials and strict separation between calendars. If you would rather avoid this, do not use the calendar sync, or use appointment titles without real names – the appointments inside the app itself remain encrypted either way.

5. Payment Processing (PayPal)

We use PayPal as our payment service provider for paid licences. The provider is PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg.

When you purchase a paid licence, you are forwarded to PayPal for payment. The data required for the payment is transmitted to PayPal; for details on what PayPal collects and processes beyond that, please refer to PayPal's privacy policy. From PayPal we only receive whether a payment was made and for which plan, plus a transaction reference for matching it to your account.

The legal basis is the performance of the user agreement (Art. 6(1)(b) GDPR). Without payment processing through a payment service provider we cannot offer paid licences.

6. Note for Practices: Data Processing on Behalf

If, as a podiatry practice, you use Podologix to process health data of your patients (special categories of personal data under Art. 9 GDPR), you are the data controller under data protection law, and mgon acts as processor. For compliant use, we recommend entering into a data processing agreement (DPA) pursuant to Art. 28 GDPR. Please contact us at info@podologix.de.

7. Data Retention

Personal data is only stored for as long as necessary for the respective purposes or as required by statutory retention periods. Account content is deleted when you delete your account or upon request; data stored locally on your device can be deleted by you at any time.

Our host creates a daily backup of the entire webspace. These backups rotate: an individual backup is overwritten after 15 days at the latest. Deleted content may therefore remain in a backup for no more than 15 days beyond the deletion date; selectively deleting an individual backup is technically not possible. These backups are not accessed during normal operation, and there, too, your customer and treatment data is stored exclusively in encrypted form.

8. Your Rights

Under the GDPR, you have the following rights:

  • Right of access to your stored data (Art. 15 GDPR)
  • Right to rectification of inaccurate data (Art. 16 GDPR)
  • Right to erasure of your data (Art. 17 GDPR)
  • Right to restriction of processing (Art. 18 GDPR)
  • Right to data portability (Art. 20 GDPR)
  • Right to object to processing (Art. 21 GDPR)
  • Right to lodge a complaint with a data protection supervisory authority

To exercise these rights, simply send an email to info@podologix.de.

You can also delete your account together with all customer, treatment, prescription and appointment data yourself at any time – in the app under Settings → Delete account or via our Delete account page, even without the app installed. After confirming you have 14 days to cancel the deletion. Invoice data is retained due to statutory retention obligations (see section 7).

9. Changes to this Privacy Policy

We update this privacy policy whenever legal requirements or our data processing practices change. The current version is always available on this page.