Contact

Privacy Policy

Last updated: 13 August 2026

This policy explains how Cancilico processes personal data through this website, recruitment, and our products and services.

Controller and contact

Cancilico GmbH, Tatzberg 47, 01307 Dresden, Germany

Email: privacy [at] cancilico.com

Data protection officer

MAMS Consulting GmbH, Landsberger Straße 155, 80687 Munich, Germany

Email: datenschutz [at] pri-com.de

Website: www.pri-com.de

Your rights

Subject to the applicable legal requirements, you may request:

  • access to your personal data (Art. 15 GDPR);
  • rectification of inaccurate or incomplete data (Art. 16 GDPR);
  • erasure of your data (Art. 17 GDPR);
  • restriction of processing (Art. 18 GDPR); and
  • receipt or transfer of data you provided in a structured, commonly used, machine-readable format where the requirements for data portability are met (Art. 20 GDPR).

Where processing is based on consent, you may withdraw that consent at any time with effect for the future. Withdrawal does not affect processing that took place before it.

Where processing is based on Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation. We will stop the relevant processing unless we demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or the processing is required to establish, exercise, or defend legal claims.

To exercise these rights, contact privacy [at] cancilico.com or the data protection officer. You may also lodge a complaint with a supervisory authority. Our competent authority is the Saxon Data Protection and Transparency Commissioner, Maternistraße 17, 01067 Dresden, Germany, email: post [at] sdtb.sachsen.de, www.datenschutz.sachsen.de.

Products and services

This section covers the c.vision platform and the c.digitize iPhone application.

Users and customers must not enter directly identifying patient information. The customer is responsible for ensuring an appropriate legal basis, notices, permissions, pseudonymization, and access controls.

Authorized users should direct requests concerning an institutional account or submitted data to their organization. Privacy requests may also be sent to privacy [at] cancilico.com.

c.vision

c.vision is the Cancilico web platform for AI-assisted morphological analysis of digitized samples. It enables authorized users to manage cases, upload and view microscopy images assigned to a case, view and correct AI results, and export reports. The platform is for Research Use Only and is not intended for diagnosis, treatment, or other clinical decision-making.

Cases and images reach c.vision either through its web interface, via c.digitize, or via other file monitoring or API integrations.

c.vision runs on servers operated by Hetzner Online GmbH in Germany, where cases and uploaded images are stored. Cloudflare, Inc. provides DNS and edge security for public access and may process technical connection data such as IP addresses. Monitoring and error tracking are self-hosted on the same infrastructure rather than provided by a third party.

The current c.vision terms are available at cancilico.com/cvision/terms/.

c.digitize

c.digitize is an iPhone application. It captures or imports microscopy images, organizes them locally, and enables authorized c.vision users to upload selected images to cases in c.vision. The application is for Research Use Only and is not intended for diagnosis, treatment, or other clinical decision-making.

The application requests access to the iPhone camera to photograph samples through a microscope ocular, and uses it only for that purpose. Importing existing images uses the standard iOS photo picker, so the application receives only the images the user selects and does not request access to the photo library as a whole. It asks for permission to add images to Photos only if the user chooses to save one back from the share sheet. Camera access can be withdrawn at any time in iOS Settings. The application does not request or process location data.

The application processes the account email address, account identifier, and authentication credentials needed to sign in. The password is sent to the c.vision authentication service but is not stored by the application. The access token and last-used email address are stored in the iPhone Keychain. Captures, case identifiers, acquisition metadata, crop settings, and the upload queue remain in the application sandbox until the user deletes them. Users can also export an image through the iOS share sheet to a recipient they choose.

When uploading images to c.vision, acquisition metadata embedded in the image file, such as camera and exposure settings and the orientation tag, is preserved and accompanies it; location metadata is not included.

The application contains no advertising SDKs, third-party analytics, or cross-app tracking.

Data held on the iPhone remains there until the user deletes it in the application or removes the application. Signing out removes the stored access token from the Keychain. To have a c.vision account and the data submitted through it deleted, contact your organization’s c.vision administrator, or email privacy [at] cancilico.com. We handle these requests as described under Your rights above.

Website processing

Hosting and server logs

When you visit this website, your browser transmits technical access data, including the IP address, date and time, requested page, referrer, browser and version, operating system, HTTP status, and amount of data transferred. We process this data to deliver the website, maintain security, diagnose errors, prevent misuse, and understand technical usage. Legal basis: Art. 6(1)(f) GDPR. Operational logs are generally retained for no longer than 30 days unless a security incident or legal obligation requires longer retention. IP addresses are shortened or anonymized where technically possible.

Contact form and email

If you contact us, we process the information you provide, such as name, email address, organization, subject, message, and related correspondence. The contact form is processed through Netlify Forms; Netlify also processes technical connection data such as IP address and submission time. We use the data to respond to your inquiry and handle related follow-up. Providing it is voluntary, but without the required contact details we may be unable to respond.

Legal basis: Art. 6(1)(b) GDPR where the inquiry relates to a contract or pre-contractual steps; otherwise Art. 6(1)(f) GDPR based on our legitimate interest in responding to inquiries. We delete correspondence when it is no longer needed for its purpose, subject to statutory retention periods and the establishment, exercise, or defence of legal claims.

Analytics

We use Umami, a cookieless analytics tool hosted on Cancilico-controlled infrastructure, to understand and improve this website. Umami does not track visitors across websites or build personal profiles. It processes minimized usage data such as visited pages, referrer, and approximate device and browser information. Contact-form values and other free-text content are not sent to Umami.

Because Umami does not store or read information on your device, consent under § 25 TDDDG is not required. Legal basis for any personal-data processing is Art. 6(1)(f) GDPR, based on our legitimate interest in understanding and improving the website. You may object using the contact details above.

LinkedIn and external platforms

Cancilico maintains a company page on LinkedIn, operated in the EU by LinkedIn Ireland Unlimited Company. If you visit or interact with our LinkedIn page, LinkedIn processes data under its own responsibility and may make profile information or interactions public. We may process messages, comments, and other information you provide there to communicate with you, present our company, or respond to inquiries. Legal basis: Art. 6(1)(f) GDPR, or Art. 6(1)(b) GDPR where the contact concerns a contract or pre-contractual steps.

The LinkedIn posts displayed on our homepage are fetched at build time through a Cancilico-controlled feed service rather than embedded directly from LinkedIn. Referenced post images may be served by that service. LinkedIn does not receive data merely because this feed is displayed; following a link to LinkedIn is subject to LinkedIn’s privacy policy.

Hosting, DNS, and international transfers

Netlify, Inc. hosts the website and processes server logs and contact-form submissions. Cloudflare, Inc. provides DNS, content-delivery, and security services and may process technical connection data such as IP addresses. Our processors are selected carefully, bound by our instructions, and engaged under Art. 28 GDPR where required.

Some providers may process data in the United States or another country outside the European Economic Area. Where required, transfers rely on an adequacy decision, including the EU–U.S. Data Privacy Framework for certified recipients, or appropriate safeguards such as the European Commission’s standard contractual clauses under Art. 46 GDPR.

We use TLS encryption to protect data in transit and apply appropriate technical and organizational measures to protect personal data against accidental or unlawful loss, alteration, disclosure, or access. Internet transmission cannot be guaranteed to be completely secure.

Applications and recruitment

We receive applications directly by email and, where offered, through LinkedIn or Indeed. We may also receive information from recruitment platforms or references you authorize. We process the data needed to assess and manage an application, including contact details, CV, cover letter, qualifications, employment history, references, interview notes, and correspondence.

Please do not provide special-category data unless it is necessary for the application. If such data is processed, an additional legal basis under Art. 9 GDPR and § 26(3) BDSG must apply.

Legal basis for deciding whether to enter an employment relationship is § 26(1) BDSG in conjunction with Art. 6(1)(b) GDPR. Where you consent to additional processing, such as inclusion in a candidate pool or an authorized reference check, the basis is Art. 6(1)(a) GDPR; you may withdraw that consent at any time with effect for the future.

Application data is available only to people involved in the hiring decision and service providers needed to support recruitment. If an application is unsuccessful, we generally delete it six months after the process ends unless longer retention is required for legal claims. If you consent to inclusion in our candidate pool, we retain the application for up to three years unless you withdraw consent sooner.

Recipients and processors

Access is limited to employees and service providers who need personal data for the purposes described above. We may also disclose data where required by law, to public authorities, or to establish, exercise, or defend legal claims. Service providers process data only within the contractually defined scope and are reviewed for appropriate technical and organizational safeguards.

Retention

Unless a specific period is stated above or agreed with an institutional customer, we retain personal data only as long as necessary for the relevant purpose. We may retain data longer where required by tax, commercial, regulatory, or other law, or where needed to establish, exercise, or defend legal claims. Data is deleted or anonymized when no longer required.

Automated decision-making

We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR on this website. c.vision produces AI-assisted analysis results for authorized users to review and correct; these results support the user’s own assessment and do not by themselves produce legal or similarly significant effects on an individual.

This website contains links to third-party websites. Their operators process data under their own responsibility. Review the relevant privacy policy before providing personal data on an external website.

Changes to this policy

We update this policy when our services, processing activities, or legal requirements change. The current version is available through the Privacy link on this website. You may request an older version using the contact details above.

Contact

For privacy requests, contact privacy [at] cancilico.com.