Privacy policy

Last updated: 30 September 2026

The publisher of this app is responsible for processing your data and can be reached at ….

1. Your data stays on your device

The Ernst app needs no account and runs without a server connection. People, doctors, medications, requests and e-mail drafts are stored only on your device. We operate no servers and cannot access this data.

The app contains no tracking, analytics, advertising or crash-reporting services, and no usage profiles are created.

Two notes on local storage:

• The data sits in your device's app storage unencrypted. Please protect your device with a passcode.
• The data is part of your device backup (e.g. iCloud or iTunes/Google Backup) and is therefore passed on to the backup provider you chose. That is your responsibility.

2. E-mail

When you create a request for your doctor, the app opens your e-mail client with a ready-made draft. It is sent solely through the mail client on your device. The app makes no network access for this and neither reads nor stores its content. The recipient is the doctor you selected.

3. The one exception: the photo scan

This single feature is the only one that sends data off your device.

3.1 What happens

You tap "Add by photo" and photograph one or more packs. The first time, a dialog asks whether you agree. If you say no, nothing is sent and nothing is stored.

Only the following is transmitted:

• the resized photo with its metadata removed — device, timestamp and GPS data are stripped, and
• a fixed text stored in the app instructing the model to read only the names on the packs.

Your name, address, date of birth, insurance number, medication list, doctors' e-mail addresses, device identifiers and location data are not transmitted. Your IP address is technically visible to the providers involved.

3.2 Who receives the photo

• Cloudflare, Inc. (USA) forwards the request and provides access to Google. Cloudflare is our processor.
• Google LLC (USA) operates the Gemini model that reads the packs. The Google key stays with Cloudflare and is never given to your app.

We do not see the photo and do not store it.

3.3 How long it is stored

• We have switched off logging in the Cloudflare AI Gateway and request "zero data retention" for every request.
• Google may store content for up to 55 days for security purposes (abuse monitoring), regardless of that setting. Content that Google's automated systems flag as problematic may be reviewed by authorised staff. Because we use the paid API, Google does not use your photos to train or improve its models.
• Nothing is stored by us.

3.4 Legal basis and where processing happens

The basis is your consent (Article 6(1)(a) GDPR), which you give in the dialog. You can withdraw it at any time by simply not using the photo feature. E-mails you have already sent cannot be recalled, and nothing is stored with us that you would need to delete.

Processing takes place in the USA, outside the EU/EEA. There is no EU-only processing. We rely on the EU-US Data Privacy Framework for this transfer: Google LLC and Cloudflare, Inc. are certified under it (https://www.dataprivacyframework.gov/list). Cloudflare additionally uses standard contractual clauses in case a certification ever lapses.

4. Your rights

You can request access, deletion, restriction, correction, portability, or object at any time. In practice: delete the app and all locally stored data is gone. Questions about processing by Cloudflare and Google go to the address above.

You also have the right to lodge a complaint with a data protection supervisory authority.