Family Portal Privacy Policy

The myopia.kids family portal gives parents and legal guardians access to their child's longitudinal myopia history across participating practices. For this portal, myopia.kids is the data controller. For the medical record held at the practice, the respective practice is the controller; its own privacy policy applies there.

myopia.kids Besser Sehen Landshut Andreas Polzer Veldener Straße 16 84036 Landshut Germany Email: hallo@bessersehen.la

Within the family portal we process: - Account data of the guardian: name, email address (login), relationship to the child - Derived longitudinal record of the child (read-only): measurements (e.g. axial length, refraction), progression charts and therapy data, drawn from the practice records you have granted access to - Access and consent metadata (which practice, timestamps, consent version) The legal basis is your consent under Art. 6(1)(a) in conjunction with Art. 9(2)(a) GDPR (explicit consent, including for health data). For any scientific use we obtain separate, voluntary consent (opt-in, off by default).

Provision of the family-side progression portal and management of practice access by the guardians.

As processors: Hetzner Online GmbH (hosting, Germany), Sendinblue SAS "Brevo" (delivery of emails and one-time codes, France) and Functional Software, Inc. "Sentry" (monitoring of errors and load times, data stored in the EU region). No disclosure to third parties for advertising purposes. Sentry belongs to a US company, so access from a third country cannot be entirely ruled out; it is governed by the data processing agreement concluded with Sentry.

Portal data is stored until you withdraw consent or close the portal account. Important: the medical practice record is unaffected and subject to the statutory retention period of the respective practice.

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), and to withdraw your consent (Art. 7(3) GDPR). Note on the two layers: a request for erasure or withdrawal addressed to myopia.kids concerns the portal record. For the medical record, your practice is the point of contact; there, a statutory retention obligation may preclude erasure (Art. 17(3) GDPR).

You may withdraw your consent or close your portal account; the portal data is then removed. Any further deletion is handled via the retention policy or a controlled operator process. Self-service hard deletion is not provided.

Until the age of majority (18), the guardians give consent and exercise the rights on the child's behalf. Upon reaching the age of majority, the now-adult person becomes solely entitled: they are notified, may take over the account, and must give consent again in their own name.

Scientific evaluation takes place only with your separate, voluntary consent (opt-in, off by default) and on the basis of anonymised or pseudonymised data.