Privacy policy

1. Controller

The controller is the operator of Approbot. You can reach them about anything concerning your data at [email protected].

2. Overview

Approbot prepares doctors trained abroad for recognition in Germany: a personal roadmap, a self-study German course, exam simulations and trainers. This policy says what personal data we process when you visit the website and when you use Approbot with an account, why, on what legal basis, who receives it and how long we keep it.

We sell no data, show no advertising and do not follow you across other websites. We measure how often our pages are visited and how fast they load without cookies (section 3). Your data is stored and processed in the European Union; section 12 says what may leave it.

3. Visiting the website

Approbot runs on servers in data centres in the European Union and is delivered through a network provider that protects the website against attacks and delivers it quickly. Each request involves technically necessary data: IP address, date and time, the address requested, the referrer, the browser identifier and the server's response. We use it only to deliver the website and keep it secure and working.

The legal basis is Article 6(1)(f) GDPR (our legitimate interest in a secure, reliable website). Our hosting provider and the network provider process the data on our behalf (Article 28 GDPR). We delete our server logs after 14 days at most.

The website loads its fonts and scripts from our own servers, with two exceptions: the scripts of the visitor counts (below) and, only when you open the checkout to buy a pass, Paddle’s checkout from Paddle’s servers (section 9).

Visitor counts: to learn which pages are used, where visitors come from and how fast the pages load, we count page views. Neither tool for this sets cookies, stores anything on your device or follows you across other websites:

• An analytics service receives, for each page view, the page’s address without its query and fragment (the pages of your own simulations and conversations only as the kind of page, without their identifier), its title, the previous page (from another website only its domain), the screen size and the browser language, and, as with any request, the IP address and the browser identifier. From these it derives the country, browser, operating system and device type, and groups page views under a pseudonymous value it forms anew at regular intervals; it does not store the IP address. It stores the data in the European Union.
• The network provider measures how fast the pages load: the page’s address without its query, the previous page, loading and rendering times and technical details of the browser (version, operating system, the page’s memory use). Its script sends them to our own domain.

The legal basis is Article 6(1)(f) GDPR: our legitimate interest in improving the service by how it is actually used and keeping it fast. Both services process the data on our behalf (Article 28 GDPR). You may object at any time (Article 21 GDPR), most simply through your browser: when it sends “Do Not Track” or “Global Privacy Control”, the analytics service does not count your page views, and a content blocker keeps both scripts away.

4. Cookies and storage on your device

When you sign in, we set a cookie that keeps you signed in. It holds a random string and nothing about you. It lasts 180 days at most; a sign-in left unused for 30 days ends sooner. When you sign in with Google, a second cookie holds the sign-in step, for ten minutes at most; it is deleted as soon as Google sends you back. We set no other cookies.

So that the website loads quickly and starts even without a connection, your browser keeps its own files (program code, fonts, interface images) in its cache. In your browser’s local storage the website keeps what it needs for your use: your settings such as language and appearance and, once you are signed in, copies for offline use, card grades not yet sent and drafts of your writing; until you close the tab, also where you were on a page.

All of this is strictly necessary for the service you ask for (§ 25 (2) no. 2 TDDDG), so no consent is needed. We set no cookies for analytics or advertising, and the visitor counts (section 3) store nothing on your device.

5. Your account

To use Approbot you open an account with your email address and a password, or sign in with Google. We store your email address, a hash of your password (never the password itself), your language, when you confirmed your email address, and your signed-in devices (browser identifier and last use). If you turn on two-step sign-in, we store its secret encrypted and your recovery codes as hashes.

Before anything else opens, we send you a link to confirm your email address. It is valid for 24 hours; we store only its hash.

If you sign in with Google, Google tells us your email address and that it is confirmed. Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) processes the sign-in itself under its own privacy policy.

The legal basis is Article 6(1)(b) GDPR (the contract for the use of Approbot), and for the protection of your account also Article 6(1)(f) GDPR.

While Approbot is a private beta, only an invited address opens an account. When you ask for access on our website, we store your email address, the country of your medical degree, the date of your FSP or KP if you give it, the language of the page and when you asked, so that our team can answer you. If we approve your request, we invite that address: the invitation goes to it by email and is kept, with your account once you open one. If we decline it, we delete it and send nothing. The legal basis is Article 6(1)(b) GDPR (steps you ask for before a contract).

6. Your roadmap

For your roadmap you tell us where you studied and whether you have finished, your nationality, where you live, your German level and certificate, the state you plan to apply in and where your application stands (dates, exam results), and, if you wish, your budget. We use these only to work out your roadmap, deadlines and costs and to show what applies to you (Article 6(1)(b) GDPR).

7. Learning and simulations

We store what you do in Approbot so that it can give you your next exercises and show your progress: your answers in the course, the trainers and the KP modules, your cards and when they are due again, your writing and the feedback on it, your conversations with the conversation partner and the simulations, that is each of your turns, typed or transcribed from your speech, and the report. The legal basis is Article 6(1)(b) GDPR.

If you photograph a form filled in by hand, the photo is read by AI to fill in the form and then discarded; we store only that it was uploaded.

Please do not enter data of real patients: the simulations use invented cases. Do not write or say anything that identifies a real patient or another person.

8. Artificial intelligence and voice

The simulated patients and examiners, the conversation partner, the feedback on writing, the grading of simulations and the reading of handwriting use AI models of a specialised provider. For each task we send the model only what it needs: the case or exercise and your turns or your text, not your name and not your email address. Under our contract, the provider does not use this content to train its models.

When you speak in a simulation, your browser sends the recording to us and we pass it to a speech recognition service, which turns it into text in the European Union and does not use recordings to improve its models. We do not store recordings. The spoken replies are made from the text of the reply by a speech synthesis service, which receives only that text. Simulations with AI are marked as such.

For each AI call we store the task, its size and its cost, without its content, and for each time you speak its minutes, to keep your pass’s allowances and to prevent misuse.

Points, ratings and readiness are learning aids. No decision that has legal effects for you or similarly significantly affects you is taken solely by automated means (Article 22 GDPR). The legal basis is Article 6(1)(b) GDPR.

9. Buying passes

Passes are sold by Paddle (Paddle.com Market Limited, Judd House, 18-29 Mora Street, London EC1V 8BT, United Kingdom) as reseller and merchant of record: Paddle takes your payment, issues the invoice and pays the taxes, as a controller in its own right under its own privacy notice. When you open the checkout, your browser loads it from Paddle’s servers.

Paddle tells us what you bought, at what price and in what currency, your country and the state of the order; we never see your card or bank details. We store the order with your account to open your pass, to handle withdrawals and refunds and to keep the records the law requires (Article 6(1)(b) and (c) GDPR).

If you give a pass as a gift, you give us the recipient’s email address so that we can send them the key; we use it only for that (Article 6(1)(f) GDPR).

10. Keys and partner agencies

A key can come from a purchase, a gift, a partner agency or an invitation to test. When you activate it, it is linked to your account. If it comes from a partner agency, the agency sees only how many of its keys were activated, never by whom.

11. Emails

We send the emails that belong to your account: the confirmation link, sign-in and security notices, your keys and your receipts. They are sent through an email service from the European Union. We send a newsletter or advertising only with your consent.

When you write to us, we use what you send to answer you (Article 6(1)(b) or (f) GDPR).

12. Recipients and transfers outside the EU

Only service providers bound by contract to our instructions process your data on our behalf (Article 28 GDPR), each for its purpose:

• hosting: servers, database and backups, in data centres in the European Union
• a network provider: delivering and protecting the website and measuring how fast it loads (section 3)
• an analytics service: counting page views (section 3), stored in the European Union
• a provider of AI models: the tasks in section 8
• speech services: speech recognition, in the European Union, and speech synthesis
• an email service: sending the emails, from the European Union

Your data is stored in the European Union. It may be processed outside the EU only where a task needs it: by the provider of the AI models, in the USA, with what each task needs (section 8), by the network provider, which passes each request through its data centre nearest to you, and by the analytics service, a company in the USA that stores the data in the EU but whose subprocessors may also process it in the USA. These transfers rest on the European Commission’s adequacy decision for the EU-US Data Privacy Framework, where the provider is certified under it, and otherwise on the European Commission’s standard contractual clauses (Article 46(2)(c) GDPR).

As controllers in their own right, only Paddle receives data, for the purchase (section 9), and Google, if you sign in with Google (section 5). The United Kingdom is covered by an adequacy decision of the European Commission (Article 45 GDPR).

On request we tell you which providers these are (Article 15(1)(c) GDPR) and send you a copy of the safeguards.

Beyond these, we pass on data only where a law obliges us to.

13. How long we keep data

• Your account and everything that belongs to it: as long as you have the account. When you delete it yourself in your account, the account and its data are deleted at once; on a request by email, within 30 days. In our backups they are overwritten within five more weeks at most.
• Records we must keep under tax and commercial law, such as those of orders: as long as that law requires, ten years at most, blocked from any other use and, once you delete your account, no longer linked to it.
• The record of each AI call (section 8): 90 days. The daily count of content opened, which protects our library from being copied wholesale, and keys typed wrongly: 30 days.
• The visitor counts (section 3): at the analytics service, two years at most; at the network provider, single measurements for seven days, then only aggregated figures.
• An address our emails could not reach or that reported them as spam: on a list that keeps us from writing to it again, also after its account is deleted (Article 6(1)(f) GDPR).
• So that the free trials are once per mailbox: a hash of each account’s address made with a secret key, without the address itself, also after its account is deleted, for two years from the deletion (Article 6(1)(f) GDPR).
• A request for access to the private beta (section 5): until we answer it; then the invitation takes its place, or nothing is kept.
• Confirmation links: valid for 24 hours, deleted once your address is confirmed. Sign-ins: 180 days at most (section 4), deleted once you sign out or they expire. Server logs: section 3.

14. Security

Connections are encrypted (TLS). Your data is kept in the European Union in a database that only our own services reach and in which each account’s data is kept apart from every other’s. The secrets of two-step sign-in are encrypted; passwords, recovery codes and keys are stored only as hashes.

15. Your rights

• Access (Article 15 GDPR), rectification (16), erasure (17), restriction of processing (18), data portability (20)
• Objection to processing based on legitimate interests (21)
• Withdrawal of consent, at any time and with effect for the future (7(3))
• A complaint to a data protection supervisory authority, in particular in the member state where you live or work (77)

On the Account page, under "Your data", you download a copy of your data and delete your account yourself. For anything else, write to [email protected]. We answer within one month.

16. Minimum age

Approbot is meant for doctors and medical students; an account requires you to be at least 18 years old.

17. Changes

We update this policy when Approbot changes; the date at the top shows which version applies. If the way we use data you have already given us changes, we tell you by email first.

We also offer this policy in German, French and Arabic; if a translation differs from the English text, the English text prevails.

This policy applies from 2026-10-24.