Medregia
Choose language, current: English
Clarify your project scopeClarify scope

Back to the home page

Privacy Policy

This policy explains which personal data we process on medregia.eu and in the customer account at app.medregia.eu, for what purpose and to whom it is passed on.

This translation is provided for convenience; the German version is authoritative.

1. Controller

Medregia, Owner: Lukas Efrahim Zenker (sole proprietorship)
Traithenstraße 14
83026 Rosenheim, Germany
Email: kontakt@medregia.eu

We have not appointed a data protection officer. If you have questions about data protection, please contact the address above.

2. Overview

  • Our services are aimed at businesses, mainly manufacturers of medical devices and their contact persons.
  • On medregia.eu we do not use analytics or advertising services, do not load fonts or scripts from third-party servers and do not embed third-party content.
  • On your device we only store what is needed for a function you use (section 4). That is why we do not ask for consent to cookies.
  • A customer account is only created by invitation as part of an order.

3. Hosting and server logs (Vercel)

The website and the customer account are operated by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. Vercel delivers the pages of medregia.eu through a worldwide server network, usually from a location near you. The server functions of the customer account and of the check tools run in the Frankfurt am Main region.

With every request, Vercel processes technically necessary data: IP address, date and time, requested address, browser and operating system details, and error messages. The purpose is the delivery, stability and security of our services. The legal basis is our legitimate interest in secure and functional operation (Art. 6(1)(f) GDPR). Vercel deletes the logs automatically after a short period that depends on the plan.

Vercel processes this data on our behalf. The data processing agreement (Art. 28 GDPR) is part of Vercel's terms. Vercel Inc. is certified under the EU-U.S. Data Privacy Framework; transfers to the USA are based on the adequacy decision of the EU Commission (Art. 45 GDPR).

4. Storage on your device

We only use the following storage. It is strictly necessary for a function you have expressly requested to work (§ 25(2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act)) and contains no identifier with which we recognise you.

  • medregia_lang (cookie, medregia.eu): Only set when you select a language. Content: only the language code (de, en or tr). Lifetime: 180 days.
  • medregia_pc (sessionStorage, medregia.eu): Stores your answers in the Project check so that they are kept when you go back. During the check, the answers are stored only in your browser. Only when you submit a project request do we transmit the selected answers together with your details. It is deleted when you close the tab.
  • sprache (cookie, app.medregia.eu): Only set when you change the language in the customer account. Content: only the language code. Lifetime: 180 days.
  • medregia_session (cookie, app.medregia.eu): Set when you log in and keeps you logged in. Contains a signed session identifier. Lifetime: 30 days or until you log out.

You can delete cookies and website data in your browser at any time. The default language then applies again, and you have to log in again to the customer account.

5. Project request

Via “Request a proposal” you send us your company, business email address, optionally phone number and message, and your answers from the Project check. The request is non-binding. The data is transmitted to app.medregia.eu, stored in our database (section 9) and delivered to us by email (section 11). You receive a confirmation of receipt by email.

We only use the data to answer your request and, where applicable, to prepare an offer. The legal basis is Art. 6(1)(b) GDPR, insofar as you yourself are our future contractual partner. If you make the request for a company, we process your contact data on the basis of our legitimate interest in answering business requests (Art. 6(1)(f) GDPR).

If no order results, we delete the request no later than 12 months after the last contact. If an order results, we keep the correspondence relevant to the contract in accordance with commercial and tax law requirements (§ 257 HGB, § 147 AO; six, eight or ten years depending on the document).

6. Ready-Check

For the Ready-Check you select a product list (CSV or Excel). The file is transmitted to app.medregia.eu and checked there in the Frankfurt am Main region, without an AI service. We do not store the file itself. It is discarded after the check.

Without an email address we store neither the file nor the result. If you enter an email address, we store the email address, optionally the company, the file name, the language and the summarised result, send you the report by email and receive a notification ourselves. The legal basis is Art. 6(1)(b) GDPR (handling your request) or, if you act for a company, Art. 6(1)(f) GDPR.

Only if you tick this separately will we write to you once by email a few days later about the results (consent, Art. 6(1)(a) GDPR). For this we store the time and text version of your consent. You can withdraw it at any time by email to kontakt@medregia.eu. The lawfulness of the processing carried out until then remains unaffected.

We delete Ready-Check data no later than 12 months after the check if it does not lead to a request or an order.

Please only upload product lists. Personal data, such as names of employees or patients, does not belong in the file.

7. EUDAMED check and log checker

The EUDAMED check sends the company name you enter from our server to the public EUDAMED database of the EU Commission and shows you the results. The log checker uses the verification key you enter to check whether the event chain of a decision log is unchanged. We do not store the entries in our database. The company name is part of the request address and may therefore appear in the server logs under section 3.

To prevent misuse, we briefly count requests per IP address in the server's memory, not in the database. The counters apply for 10 to 15 minutes. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in information and secure operation).

8. Customer account (app.medregia.eu)

For an order we set up a customer account for your team. There we process name, email address, password (only as a hash value), language, the product data and documents you provide, queries, approvals with name and date of the reviewing person, and the decision log for each product. When the order terms are accepted, we store the time and version.

The legal basis is Art. 6(1)(b) GDPR, insofar as you yourself are our contractual partner. If you use the account as an employee of a customer company, the legal basis is our legitimate interest in performing the contract with your company (Art. 6(1)(f) GDPR).

We store the data for the duration of the cooperation. After that we delete it, unless there is a retention obligation or you request the handover of the data and logs. We keep invoices and order-related documents in accordance with § 257 HGB and § 147 AO.

If we process personal data from your documents on your behalf, we conclude a data processing agreement (Art. 28 GDPR) before we start.

9. Database (Neon)

We store account, order, request and Ready-Check data in a database of the Neon service (Neon, LLC, a company of Databricks, Inc., 160 Spear Street, Suite 1300, San Francisco, CA 94105, USA) with storage location Frankfurt am Main. A storage location in the EU does not rule out that the provider or its sub-processors access the data from the USA for operation and support. Neon processes the data on our behalf; the data processing agreement is part of the terms. Databricks, Inc., including Neon, LLC, is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR).

10. AI-assisted analysis in the customer account (Anthropic)

In the customer account we use an AI model via the programming interface of Anthropic to prepare product files. In doing so we transmit product data and texts, and for PDF import the complete document. The public demo at app.medregia.eu/demo also sends your entries to Anthropic. The Ready-Check on the website does not use this service.

Anthropic processes the data on our behalf. The contractual partner for customers in the European Economic Area is Anthropic Ireland, Limited, Dublin, Ireland; processing takes place at Anthropic, PBC in the USA. The transfer is based on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) in Anthropic's data processing agreement. Anthropic is not certified under the EU-U.S. Data Privacy Framework.

Under Anthropic's commercial terms, the transmitted data is not used to train models. According to the published information, Anthropic usually deletes inputs and outputs within 30 days. They may be stored for longer, for example if a breach of the usage policies is suspected or due to legal obligations. We do not have an agreement without any storage (Zero Data Retention).

The legal basis is Art. 6(1)(b) GDPR or (f) as in section 8, and for the demo Art. 6(1)(f) GDPR (providing the function you use). Before uploading, please remove patient data and personal data that is not needed for registration.

11. Sending emails (Resend)

We send reports, confirmations of receipt, invitations, status messages and internal notifications via Resend (Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA). The recipient address and message content are transmitted. Resend processes the data on our behalf; the data processing agreement is part of the terms. Resend is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR); the contract additionally contains EU Standard Contractual Clauses. The legal basis is the one stated in sections 5, 6 and 8 respectively.

12. Contact by email

If you send us an email, we process your address and the content to handle your matter. The legal basis is Art. 6(1)(b) GDPR if it concerns a contract with you, otherwise Art. 6(1)(f) GDPR (answering requests). We delete the messages when the matter is settled, no later than after 12 months, unless there is a retention obligation under § 257 HGB or § 147 AO.

13. Obligation to provide data, no automated decisions

You are not obliged to provide us with data. Without the details marked as required, however, we cannot answer a request or set up an account. No solely automated decision within the meaning of Art. 22 GDPR takes place.

14. Your rights

  • Access (Art. 15 GDPR)
  • Rectification (Art. 16 GDPR)
  • Erasure (Art. 17 GDPR) and restriction of processing (Art. 18 GDPR)
  • Data portability (Art. 20 GDPR)
  • Objection to processing based on Art. 6(1)(f) GDPR on grounds relating to your particular situation (Art. 21 GDPR)
  • Withdrawal of consent with effect for the future (Art. 7(3) GDPR)

An email to kontakt@medregia.eu is sufficient.

You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.

15. Changes

We will update this policy if the website, the customer account, the services used or the legal situation change.

Last updated: October 2026