This Privacy Policy informs you about the processing of personal data when using the AI-based assistant for clinical guidelines provided on this website (hereinafter the “AI Assistant”) and when visiting this website.
The controller within the meaning of the General Data Protection Regulation (GDPR) is:
Sciarc GmbH
Schorner Str. 1A
82065 Baierbrunn, Germany
Phone: +49 89 3838 0700
Email: info@sciarc.de
Through this website, we provide medical professionals with an AI-based assistant that answers questions on evidence-based clinical guidelines and scientific publications.
The AI Assistant serves exclusively to provide general, evidence-based information on clinical guidelines for educational purposes. It does not constitute individual medical advice, diagnosis, or treatment recommendation and does not replace independent professional and clinical judgment by qualified personnel.
In connection with the use of the AI Assistant, we process in particular:
The stored chat histories themselves do not contain IP addresses or device information; these are generated exclusively in the server-side log files.
Please do not enter patient data: The AI Assistant is not intended for the processing of personal data of individual patients. Do not enter any identifying or particularly sensitive data within the meaning of Art. 9 GDPR (in particular health data of individual persons) into the chat.
Provision of the service: The processing of your chat inputs and conversation histories is carried out to provide the requested service and to answer your professional inquiries. The legal basis is Art. 6(1)(b) GDPR (performance of the usage relationship) or Art. 6(1)(f) GDPR (legitimate interest in providing a functional professional information service).
Technical security: The processing of technical access data (server log files) is carried out on the basis of Art. 6(1)(f) GDPR to ensure the technical security and stability of the service.
Quality assurance and further development: The time-limited retention of chat histories for the traceability of professional information provided, for quality assurance, and for improving the service is carried out on the basis of Art. 6(1)(f) GDPR (legitimate interest).
To perform the function, your chat inputs are transmitted via the respective application programming interfaces (APIs) to the following providers:
Only the chat contents are transmitted; IP addresses or other direct identifying characteristics of users are not passed on to the providers.
Both providers do not use the contents transmitted via their commercial application programming interfaces (API) to train their models, in accordance with their respective applicable commercial terms of use. To detect and prevent misuse, the providers may store transmitted data for a limited period (generally up to 30 days), unless a statutory retention obligation applies. Data processing agreements (Data Processing Addendum) including the EU Standard Contractual Clauses are in place with both providers.
For the technical operation of the service, we use the following processor pursuant to Art. 28 GDPR:
The following sub-processor is used:
Data processing agreements pursuant to Art. 28 GDPR are in place with all service providers.
Access to the Knowledge Center is only possible from enabled countries. To perform this check, your IP address is transmitted on page load to an external service at r9m.de, which solely determines the associated country and returns "enabled" or "not enabled". No content from your session is transmitted.
The legal basis is our legitimate interest in the regional control of a professionally access-restricted service (Art. 6 (1) (f) GDPR). The result of the check is cached for the duration of your session in order to avoid repeated requests.
The hosting of the service and the storage of all data take place exclusively in data centers in Germany.
However, to generate the responses, your chat inputs are transmitted to the providers Anthropic and OpenAI named under Section 5, which process data on servers outside the European Union or the European Economic Area, in particular in the USA. The transfer is carried out on the basis of the EU Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR, which form part of the data processing agreements concluded with the providers.
Access by our processor LINXYS GmbH from Switzerland is carried out on the basis of the adequacy decision by the EU Commission for Switzerland (Art. 45 GDPR).
Chat histories are stored for a period of 24 months in order to enable the traceability of professional information provided, quality assurance, and the further development and improvement of the service. After this period expires, the histories are deleted or fully anonymized.
Server log files are deleted after 30 days at the latest, unless they are required for a longer period to investigate security-relevant incidents.
Irrespective of this, you may request the deletion of your stored data at any time (see Section 9).
Under the GDPR, you have the following rights:
To exercise your rights, an informal notification to the contact details specified under Section 1 is sufficient. You may withdraw any consent given at any time with effect for the future.
You also have the right to lodge a complaint with a data protection supervisory authority — for example, the Bavarian State Office for Data Protection Supervision (BayLDA).
No automated decision-making in individual cases, including profiling within the meaning of Art. 22 GDPR, takes place that produces legal effects concerning you or similarly significantly affects you. The AI Assistant serves exclusively to provide general, evidence-based information on clinical guidelines for educational purposes.
When you write to us via the contact form, we process the data you provide (first and last name, email address, subject, message) as well as your IP address and the time of submission in order to handle your request.
The message is transmitted to our mailbox in encrypted form via an SMTP service. The legal basis is Art. 6 (1) (b) GDPR (initiation/performance of a contract) or (f) GDPR (responding to general enquiries). The data is deleted once your request has been fully processed, unless statutory retention obligations apply.
We use only technically necessary cookies:
These cookies are required to operate the website; their use is based on Section 25 (2) TDDDG and Art. 6 (1) (f) GDPR. No consent is required for this. No tracking or profiling takes place.
This website uses only fonts stored locally on our server. No connections to Google Fonts or other external font services are established; your IP address is not transmitted to third parties for this purpose.
The transmission of all data is encrypted (TLS). We also take appropriate technical and organizational measures pursuant to Art. 32 GDPR to protect your data against loss, misuse, and unauthorized access.
This privacy policy is updated as needed to reflect changes in the legal situation or in the website's features. The version published here applies in each case.
Last updated: 03.08.2026