Protected access
My OrthoMetiQ and WebPlanner access are permission-based and protected by server-side checks.
OrthoMetiQ
Privacy Policy
Transparent information on data processing for the OrthoMetiQ website, My OrthoMetiQ, WebPlanner, protected case workflows, payments and technical security.
Last updated: 03 May 2026Health data
Medical images and DICOM data are treated as particularly sensitive data where they contain patient information.
Stripe payments
Paid plans and subscriptions are processed through Stripe; full card data is not stored by OrthoMetiQ.
No external tracking
According to the current technical implementation, no external tracking, captcha, font or script providers are used.
Overview
This policy is tailored to the current OrthoMetiQ website and WebPlanner architecture, including My OrthoMetiQ, protected case workflows, WebPlanner licence handling, Stripe payments and optional DICOM/PACS-related functions.
This privacy policy reflects the implemented technical functions. Operational details such as hosting contracts, data processing agreements, deletion routines and Stripe account configuration must be kept consistent with the actual live operation.
1. Controller
The controller responsible for the processing of personal data on orthometiq.com, in My OrthoMetiQ and in the OrthoMetiQ WebPlanner is Bastian Pesl – Mediengestaltung / OrthoMetiQ, Bastian Pesl, Mühlenstr. 36, 93176 Beratzhausen, Germany.
Contact: info@orthometiq.com, phone +49 9493 8289674.
2. Scope of this privacy policy
This privacy policy applies to the public website, the Newsroom, the contact form, My OrthoMetiQ, registration, login, account activation, password reset, WebPlanner trial and licence management, protected case upload and download, the browser-based WebPlanner, local and cloud-based planning functions, PDF/image/DICOM exports, optional PACS/DICOMweb functions and payment or subscription flows through Stripe.
- Website and public content
- Customer portal and protected case workflows
- WebPlanner access, planning, export and licence functions
- Stripe checkout, subscription and invoice-related payment processing
3. Legal principles and purposes
Personal data is processed only where this is necessary for the relevant purpose. Processing is carried out in particular to provide the website, manage customer accounts, process contact and case requests, enable secure WebPlanner access, perform planning workflows, provide exports, administer licences and protect the technical infrastructure.
The main legal bases are Art. 6(1)(b) GDPR for contract-related processing, Art. 6(1)(f) GDPR for security, operation and legitimate administrative interests, Art. 6(1)(c) GDPR for statutory obligations and, where health data is processed, Art. 9 GDPR in conjunction with the applicable professional, contractual or consent-based legal basis.
4. Website access and server log data
When the website is accessed, technically necessary log data may be processed. This can include IP address, date and time, requested page or file, browser and operating system information, referrer URL, transferred data volume and HTTP status code.
The processing is necessary to deliver the website, maintain system stability, analyse technical errors and protect the platform against misuse or attacks.
- No profiling based on server logs
- No use of server logs for advertising tracking
- Retention follows hosting and security requirements
6. Contact requests
If contact is made by form, email or other communication channels, the submitted data is processed to handle and document the request. This may include name, company, email address, telephone number if provided, interest area, message content, language and request time.
- Processing for communication and request handling
- Legal basis: Art. 6(1)(b) GDPR for contract-related requests and Art. 6(1)(f) GDPR for general communication
7. Customer account and My OrthoMetiQ
For protected functions, users can create an OrthoMetiQ account. The account may contain first name, last name, email address, hashed password, company, phone number, country, specialty, language setting, role, account status, registration time and technical security data.
Passwords are not stored in plain text. Activation and password reset tokens are processed in hashed form and are time-limited.
- Registration, login and account administration
- Account activation and password reset emails
- Role and permission checks for protected areas
8. WebPlanner access, trial phase and licence status
Access to the OrthoMetiQ WebPlanner is protected and is intended to start through My OrthoMetiQ after successful authentication. Direct unrestricted access to the WebPlanner is blocked by server-side checks.
The licence system can process status values such as Active, Trial phase and Inactive, trial requests, trial history without time of day, licence duration, licence acquisition information and administrative approval decisions. Users may receive transactional status emails in the selected language.
- 15-day trial request and administrative approval
- Licence runtime and purchased licence flag
- No WebPlanner start without valid portal authentication and approval
9. Protected case upload and download
Users can upload planning cases and download results through My OrthoMetiQ. Depending on use, processed data may include account assignment, case ID, upload date, planning type, anatomical region or side, manufacturer or implant information, notes, file names, technical file information, status data and result files.
Uploaded medical image data, especially DICOM files, can contain patient data and health data. Users should provide anonymised or pseudonymised data wherever this is possible for the specific purpose.
- Protected upload and download through permission checks
- Processing for case handling and result delivery
- Health data is not made publicly accessible
10. OrthoMetiQ WebPlanner
The WebPlanner is a browser-based environment for digital preoperative planning. Users can import images, view DICOM metadata, perform measurements, use implant and prosthesis information, create planning screenshots, generate reports and export planning data.
Depending on use, the WebPlanner may process imported images, DICOM metadata, patient information contained in source files, measurements, planning steps, implant and prosthesis data, text notes, screenshots, PDF reports and DICOM export data.
- Many planning steps run locally in the user’s browser
- Local browser storage can be used for working data and preferences
- The final medical assessment and operative decision remain the responsibility of the treating professional user
11. Cloud saving, reports and exports
Where cloud saving is used, planning files and associated metadata can be stored server-side for later restoration and continued processing. Export functions may create PDF reports, planning images and DICOM-based output files.
Exported files can contain medical images, health data, measurements, implant information and notes. Responsibility for further use, archiving or disclosure of exported files lies with the user or the organisation on whose behalf the user acts.
- PDF, image and DICOM export functions
- Planning image and report generation
- Cloud save only where the relevant function is used
12. Optional PACS and DICOMweb integration
The WebPlanner may support optional PACS or DICOMweb integration for professional medical environments. Depending on configuration, this can involve PACS endpoint data, DICOMweb URLs, encrypted access information, DICOM study/series/image metadata and technical protocol data.
The customer or operator of the connected PACS system is responsible for ensuring that the connection has a valid legal basis and is technically and organisationally secured.
- Optional professional integration
- Processing depends on customer-side configuration
- Sensitive connection data should be protected by appropriate encryption and access controls
13. Newsroom and WebPlanner article feed
The public Newsroom provides OrthoMetiQ articles and updates. The WebPlanner can display public Newsroom content such as title, category, excerpt, preview image and link to the article. No additional advertising tracking is performed through this feed according to the current technical implementation.
14. Payments, subscriptions and Stripe
Paid tariffs, subscriptions and payments are processed through Stripe. If a paid plan is selected or a payment is carried out, Stripe may process payment and contract-related data such as name, email address, billing details, selected tariff, amount, currency, payment status, subscription status, invoice and transaction information and security or fraud-prevention data.
Full payment card data is not stored on the OrthoMetiQ servers but is processed by Stripe. Stripe may act as processor or as an independent controller depending on the specific payment-processing context.
- Legal basis: Art. 6(1)(b) GDPR for payment and contract performance
- Art. 6(1)(c) GDPR for statutory accounting and retention obligations
- Art. 6(1)(f) GDPR for payment security and fraud prevention
15. Transactional email communication
OrthoMetiQ sends transactional emails, including account activation, password reset, contact replies, WebPlanner trial request confirmations, licence status changes, trial activation notices and administrative notifications. These emails are used for account, security, contractual and administrative communication and not for marketing tracking.
- Emails are sent in the selected German or English language where available
- Content is limited to the relevant transaction or status change
16. Administration and technical security
To protect the platform, OrthoMetiQ processes security and administrative data such as login and session information, access permissions, role data, WebPlanner approval status, rate-limit information, system logs, error information and administrative changes.
Security measures include protected session management, hashed passwords, hashed and time-limited tokens, server-side permission checks, protected private storage, no authentication token in visible URLs, restricted access to WebPlanner and administration areas, honeypot fields, rate limiting and an in-house security question for contact and registration forms. No external captcha provider is used for this mechanism.
- Security by server-side permission checks
- Protected private storage areas
- Role-based administrative access
17. Recipients and processors
Personal data is disclosed only where this is necessary for the relevant purpose, required by law, permitted by a legal basis or requested by the user. Recipients or recipient categories may include hosting and server providers, email infrastructure providers, Stripe, technical maintenance providers, tax advisors, public authorities where legally required and customer-configured PACS or DICOMweb systems.
Where service providers process personal data on behalf of OrthoMetiQ, appropriate data processing agreements under Art. 28 GDPR are used where required.
18. International transfers
Processing within the EU or EEA is preferred. When using certain providers, especially Stripe, processing by affiliated companies or subprocessors outside the EU or EEA cannot be excluded. Where data is transferred to third countries, this is carried out on the basis of appropriate safeguards such as adequacy decisions, standard contractual clauses or additional protection measures.
19. Retention and deletion
Personal data is stored only for as long as required for the relevant purpose or for statutory retention periods. Account and contract data is stored for the duration of the customer relationship and thereafter according to legal retention duties. Reset and activation links are time-limited. Case and planning data is stored for the required processing, delivery, contractual documentation or cloud-save purpose.
After the purpose no longer applies or statutory periods expire, data is deleted or anonymised unless legal reasons require further retention.
20. Special protection of medical image and health data
Medical image data, DICOM data, planning data and patient-related information may contain health data. Health data is particularly sensitive and is processed only within the intended upload, planning, WebPlanner, export or PACS functions.
Users and customers must ensure that they upload or process only data for which a valid legal basis exists. Where possible, medical images should be anonymised or pseudonymised before upload. If OrthoMetiQ processes health data on behalf of a customer, a separate data processing agreement may be required.
- No public publication of health data
- No advertising use of medical image data
- Data minimisation and anonymisation are strongly recommended
21. No automated decision-making
OrthoMetiQ does not make automated decisions within the meaning of Art. 22 GDPR that produce legal effects concerning users or similarly significantly affect them. Stripe may use its own security and fraud-prevention systems in the context of payment processing.
22. Rights of data subjects and supervisory authority
Data subjects have the statutory rights of access, rectification, erasure, restriction of processing, data portability, objection to processing based on legitimate interests, withdrawal of consent with future effect and complaint to a supervisory authority. Requests can be sent to info@orthometiq.com.
For private-sector controllers in Bavaria, the competent supervisory authority is generally the Bavarian State Office for Data Protection Supervision, BayLDA, Promenade 18, 91522 Ansbach.
- Right of access
- Right to rectification and erasure
- Right to restriction and data portability
- Right to object and withdraw consent
23. Updates to this privacy policy
This privacy policy may be updated if legal requirements, technical functions, service providers or processing operations change. The current version is available on this website.