Experimental research prototype. AI-generated, not reviewed by a clinician. Not medical advice. Read the full disclaimer
Privacy

Privacy policy

Information under Articles 13 and 14 GDPR and the Austrian Data Protection Act. This policy aligns exactly with what our code does. Last updated: 28 May 2026.

In one sentence. We keep as little as possible, encrypt what we keep, let you export or erase everything at any time, and share your health data with only one processor (Anthropic), and only because you explicitly consented.

1. Data controller

Knightify FlexCo, Rauchgasse 28 Top 2, 1120 Vienna, Austria.
Company register: FN 666564 t, Commercial Court Vienna.
Privacy contact: [email protected].

We are not required to designate a Data Protection Officer (Article 37(1) GDPR does not apply to our scope at current scale). You can reach us for any data-protection matter at the address above.

Full provider details in the Imprint.

2. Scope

This policy applies to the website at continuumcare.app, all related applications, our mobile API, and the transactional emails we send you in relation to your account. It does not apply to external sites we link to.

3. What data we process, by feature

3.1 Visiting our public pages

When you load a page, our hosting provider automatically processes your IP address, the date and time, the HTTP method, the requested URL, the referrer header, and your user-agent string. These are technically required to deliver the page and to detect abuse. Legal basis: Article 6(1)(f) GDPR. Retention: 30 days in server logs, then automatic deletion.

We self-host all fonts and CSS. No external font request goes to Google or Adobe. There are no tracking pixels, web beacons, or advertising IDs.

3.2 Creating a brief without an account

You can create a brief without registering. For this, we process:

  • Uploaded documents: PDF, JPG, or PNG, used only to generate your brief. The files are stored in a temporary directory (storage/app/temp/{UUID}) and deleted immediately after the AI pipeline finishes.
  • Document content: Medications, diagnoses, symptoms, allergies, lab values, imaging findings, procedures, histology, molecular tests, treatments, clinical alerts, study dates, facilities, treating clinicians, patient initials, date of birth, age. This is health data within the meaning of Article 9 GDPR.
  • Generated brief: PDF and structured summary. We keep the associated payload at most one hour after generation in storage/app/temp so you can download the brief. Then it is deleted automatically. An hourly cron job sweeps the directory as a safety net.
  • Consent: The fact that you ticked the consent checkbox before upload, in the session store.

The legal basis for processing your health data is your explicit consent under Article 9(2)(a) GDPR. You give consent by ticking the box before upload. You may withdraw consent at any time with effect for the future by cancelling the upload flow or deleting your account.

3.3 Creating an account

When you register, we process:

  • Email address: Required, used for sign-in and administrative notices.
  • Name: Required. Shown to caregivers you give access to.
  • Password, if you choose password sign-in: At least twelve characters, checked against known breaches (Have I Been Pwned), stored only as a bcrypt hash. Never in plain text.
  • Google identifier, if you choose Google sign-in: Anonymous Google user identifier and email. We receive no Google token, no profile picture, no contact list.
  • Passkey credentials, if you use WebAuthn: Public credentials only under the WebAuthn standard. Never private keys or biometric data.
  • Preferred language: DE, EN, FR or ES.
  • Session and CSRF data: Session ID, IP address, user-agent, stored in the database and, in production, encrypted with the app key.
  • API tokens, if you use the mobile API: Hashed Laravel Sanctum token plus last-used timestamp.

Legal basis: Article 6(1)(b) GDPR (contract performance), and for security logs Article 6(1)(f) GDPR.

3.4 Saved briefs

When you save a brief to your account, we keep the structured summary (brief_data) and the medical timeline (timeline_data) encrypted at rest in our database. The original file (PDF, JPG, PNG) is deleted immediately after the AI pipeline finishes and is never stored. We additionally store patient initials, language, the number of source documents, and a flag for low-confidence output.

Legal bases: Article 9(2)(a) GDPR (explicit consent for health data) and Article 6(1)(b) GDPR (contract performance).

3.5 Visit Prep

You enter the reason for the visit, date, symptoms, current medications, past conditions, and notes about recent reports. We store these inputs (input_data) and the AI response containing pre-visit checklist and questions (output_data) encrypted in the visit_preps table. Both fields are health data under Article 9 GDPR. Legal bases: Article 9(2)(a) and Article 6(1)(b) GDPR.

Optionally you create a share link for an accompanying person (see 3.10).

3.6 Plain-language Simplifier

You paste the text of a medical report (up to 12,000 characters). We store the pasted text (source_text) and the explanation (output_data) encrypted in the document_simplifications table. Both fields are health data. Legal bases as above.

3.7 Post-visit Reflection

You record what the clinician said, any new findings, and follow-up items. We store your inputs (input_data), the structured reflection (output_data), the clinician summary (clinician_summary), and the visit date (visited_at) encrypted in the visit_reflections table. You can mark follow-ups as done or open.

3.8 Question Generator

You supply reason, symptoms, medications, and past conditions. We produce four to six calm, doctor-friendly follow-up questions. By default we do not store the request independently; the questions end up in an associated Visit Prep or Brief if you save it.

3.9 Health Timeline

The timeline is a view on your dashboard. It aggregates events from your saved briefs. No additional records are created. All source information is already encrypted in brief_data and timeline_data.

3.10 Visit Prep share link

You can create a read-only share link for a Visit Prep. We generate a random token and an expiry (seven days). Anyone with the link can read the Visit Prep but cannot modify it. You can revoke the link at any time, effective immediately. The content itself stays encrypted.

Please share the link only with people you trust. The link will be visible in the recipient's browser history and server logs. For sensitive handovers we recommend caregiver access (3.11), which requires sign-in.

3.11 Caregiver invitations and accesses

You can grant a trusted person access to a single brief. For this we process:

  • The email address that the invitation is to be sent to and a random token, stored in caregiver_invitations with a 72-hour expiry.
  • On acceptance: the link between owner, caregiver, and brief in caregiver_accesses with a granted_at timestamp.
  • On each caregiver read of the brief we write an entry to our application logs (server log, not a database table): timestamp, caregiver id, owner id, brief id. These entries are kept for abuse detection and deleted with the server logs after 30 days.

You may revoke access at any time. On revocation the caregiver relationship is effective immediately, even if the brief is still open in the caregiver's browser (the server re-checks on every request).

3.12 Account management, export, and deletion

In the "Account" area you can download a complete copy of your data as a JSON file or irreversibly delete your account. The export contains your profile, all briefs (including soft-deleted), Visit Preps, reflections, document simplifications, caregiver records, caregiver invitations, consent log, and AI-request metadata. A deletion removes all these records immediately and irreversibly.

3.13 Cookies and local storage

We currently use only strictly necessary cookies: a session cookie that signs you in, a CSRF cookie that protects against cross-site request forgery, and a cookie for your selected language. These are permitted without consent under § 165(3) TKG 2021 (Austria) and Article 5(3) of the ePrivacy Directive because they are strictly necessary for the service to function.

On your first visit we still show a cookie banner with four categories (strictly necessary, preferences, analytics, marketing). The three optional categories are off by default. They activate only when you explicitly opt in, and we load the associated scripts only then. At present no optional script is loaded, so your choice has no visible effect today. Your choice is stored in a first-party cookie "continuum_consent" (12-month duration) and can be changed or withdrawn at any time via "Cookie settings" in the footer.

We additionally store your theme choice (system, light, dark) in your browser's localStorage. This value never leaves your device and is not transmitted to our servers.

We log each granting or change of your cookie consent in the consent_logs table together with an HMAC hash of your IP address (for abuse defence, not for re-identification) and your user agent. Legal basis: Article 6(1)(c) GDPR (accountability obligation).

4. What we explicitly do not do

  • We do not sell data and do not pass data to ad networks.
  • We do not set tracking cookies, pixels, advertising IDs, or use third-party fonts.
  • We never log the contents of your uploaded files or your inputs.
  • We do not train any model on your data, and our AI processor is contractually prohibited from doing so.
  • We make no automated decisions with legal or similarly significant effect within the meaning of Article 22 GDPR.

5. Special categories of personal data (Article 9 GDPR)

All medical content (diagnoses, symptoms, medications, findings, lab values, treatments, history, reflections) is "special category personal data" under Article 9(1) GDPR. We process this data only on the basis of your explicit consent under Article 9(2)(a) GDPR. You give consent:

  • by ticking the box before each upload (brief generation),
  • by submitting a Visit Prep, Reflection, or Simplifier form,
  • by saving a generated brief to your account,
  • by accepting a caregiver invitation (regarding your own identity as a caregiver).

You may withdraw consent at any time with effect for the future by deleting the relevant data record or your account, or by emailing us at [email protected]. The lawfulness of processing before withdrawal is not affected.

6. Legal bases, overview

Article 9(2)(a) GDPR
Explicit consent for the processing of health data (briefs, Visit Prep, Reflection, Simplifier).
Article 6(1)(b) GDPR
Contract performance for account holders (sign-in, storage of your own data, caregiver features).
Article 6(1)(f) GDPR
Legitimate interest in security, abuse defence, and operational integrity (server logs, IP hash in the consent log).
Article 6(1)(c) GDPR
Legal obligation to demonstrate consent (Article 7(1) GDPR).
Article 6(1)(a) GDPR
Consent for optional cookie categories.

7. Recipients, processors, and international transfers

We disclose your data to third parties only to the extent necessary to operate the service. Each recipient is a processor under Article 28 GDPR.

Anthropic, PBC (USA)
AI provider, Claude. Receives the content of your documents and inputs to produce the Brief, Visit Prep, Reflection, and Simplifier outputs. Anthropic is contractually prohibited from using your data for training and may store it only to process your request. The transfer to the US is covered by (i) Standard Contractual Clauses under Commission Decision 2021/914/EU and (ii) Anthropic's self-certification under the EU-US Data Privacy Framework (Decision 2023/1795/EU).
Google Ireland Limited (EU, with some processing in the US)
Only if you sign in with Google. We send Google only the sign-in request; Google sends us back your anonymous Google identifier, email, and display name. Transfers to the US are covered by Standard Contractual Clauses and the EU-US Data Privacy Framework.
Hosting provider (European Union)
Server infrastructure in a Member State of the European Union, bound by a data processing agreement.
Transactional email provider
Sends caregiver invitations, password resets, and administrative emails. Content: recipient email, invitation or action link, optionally the name of the inviter. Provider based in the EU or with equivalent transfer safeguards in place.
Bunny.net (EU)
We use Bunny Fonts only at build time; the font files are then served from our own servers. No runtime connection to Bunny is made.

No other recipients are involved. We comply with authority requests for disclosure only to the extent required by Austrian or directly applicable EU law.

8. Retention periods

  • Original files: deleted immediately after the AI pipeline finishes. Never kept longer than the duration of an API call.
  • Temporary brief payloads (guest): at most one hour, with an hourly safety-net cron.
  • Saved briefs, Visit Preps, Reflections, Simplifications: as long as you want them. On deletion first soft delete (deleted_at), then permanent, irreversible removal 30 days later via daily cron jobs.
  • Account: as long as you keep it. On account deletion your profile is removed immediately and irreversibly together with all briefs, Visit Preps, Reflections, Simplifications, caregiver records, caregiver invitations, consent logs, AI-request metadata, and API tokens.
  • Caregiver invitations: 72 hours valid. Expired unaccepted invitations are deleted daily.
  • Visit-Prep share tokens: seven days. Automatically invalid afterwards (HTTP 410). Token is removed with the Visit Prep.
  • Session and CSRF data: 120-minute session lifetime. Idle sessions are removed automatically.
  • Server logs and caregiver-read logs: 30 days.
  • Consent log (consent_logs): 13 months from grant (covers the banner cookie lifecycle) or until account deletion, whichever is earlier.
  • AI request metadata (ai_requests): retained for security and cost control. They contain no medical content, only provider, model, stage, token counts, status, and timestamps. On account deletion all your entries are removed immediately.

9. Encryption and technical security

  • Transport only over TLS 1.2 or higher, with HSTS.
  • Encryption at rest: brief_data, timeline_data, all input_data, output_data, source_text, and clinician_summary are encrypted with AES-256 using APP_KEY.
  • Passwords are stored only as bcrypt hashes.
  • Known-breached passwords are rejected (Have I Been Pwned k-anonymity).
  • Content-Security-Policy, rate limiting, CSRF tokens on all mutating requests.
  • Session data encrypted with APP_KEY in production (SESSION_ENCRYPT=true).

Full technical details on the Security page.

10. Your rights

  • Access (Article 15 GDPR): You can download a complete JSON file of all your data at any time from "Account, Export my data". The export covers all tables listed in Section 8.
  • Rectification (Article 16 GDPR): You can change brief titles, your display name, your email, your language, and your password at any time. The content fields of saved briefs are intentionally read-only so they stay aligned with your source documents.
  • Erasure (Article 17 GDPR): From "Account, Delete my account" you and all your data are removed in one step. You can delete individual briefs, Visit Preps, and reflections at any time.
  • Restriction (Article 18 GDPR): On request to [email protected].
  • Portability (Article 20 GDPR): The same JSON export satisfies this. The format is structured, common, and machine-readable.
  • Objection (Article 21 GDPR): You may object to processing at any time by deleting your account or by writing to us.
  • Withdrawal of consent (Article 7(3) GDPR): You may withdraw consent at any time with effect for the future. The lawfulness of processing before withdrawal is not affected.
  • Complaint with a supervisory authority (Article 77 GDPR, § 24 DSG): You may lodge a complaint with the Austrian Data Protection Authority (Barichgasse 40-42, 1030 Vienna, tel. +43 1 52 152-0, [email protected]) or with the supervisory authority of your EU place of habitual residence.

We respond to requests regarding your rights within 30 days of receipt, extendable in complex cases to a total of three months (Article 12(3) GDPR).

11. Automated decision-making and AI

Continuum performs no automated individual decision within the meaning of Article 22 GDPR. AI processing produces a descriptive summary of your documents, a pre-visit checklist, a term explanation, or a list of questions. It makes no decision about you, no diagnosis, no treatment instruction, and replaces no medical advice. When the model is uncertain, we mark the output as low confidence. You stay in full control at every step.

12. Data Protection Impact Assessment (DPIA)

Processing of health data with the help of an AI processor in a third country meets several criteria of the Austrian DPA's mandatory-DPIA list (BGBl. II No 278/2018 as amended). We have carried out and documented a Data Protection Impact Assessment under Article 35 GDPR. We provide a summary of the findings on request.

13. Data breach, notification

In case of a personal-data breach that is likely to result in a risk to your rights and freedoms, we notify the Austrian Data Protection Authority within 72 hours of becoming aware (Article 33 GDPR) and notify you directly without undue delay if there is a high risk (Article 34 GDPR).

14. Minors

Continuum is not directed at persons under 16. Independent grant of data-protection consent is possible from age 14 under Article 8 GDPR and § 4(4) Austrian DSG, provided the necessary discernment is given. For caution, we require a minimum age of 16. When processing data of a minor in your care, you must act as legal representative or with their consent.

15. References to Austrian national law

In addition to the GDPR we observe the Austrian Data Protection Act (DSG, BGBl. I No 165/1999 as amended), the Austrian Telecommunications Act 2021 (TKG 2021, in particular § 165 on cookies), and the Austrian E-Commerce Act (ECG, § 5 on provider identification). Continuum is not connected to ELGA (the Austrian electronic health record) and is not a substitute for ELGA or any other state-provided health infrastructure.

16. Changes to this policy

We update this policy when our processing, the underlying technology, or applicable law changes. Material changes are announced at least 30 days before they take effect, by email to account holders and by a notice in the account area. The current version is always available on this page with the date of its last update.

17. Contact for data-protection matters

Privacy: [email protected].
Security: [email protected].
General: [email protected].