Privacy policy

oncolabels sets no cookies, has no accounts and does not follow you across sites. This page says what data the site handles, why, and for how long.

Who is responsible

Tillmann Bedau, Ebertplatz 10, 50668 Köln, Germany. Email: contact@oncolabels.com. See also the legal notice.

Delivering the site

The site runs on Cloudflare (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA), which processes it on my behalf. To deliver pages and protect the site from abuse, Cloudflare handles your IP address and the usual request data: the address requested, the time, your browser's identification and the page you came from. The site's own error logs keep request data for at most seven days. The legal basis is my legitimate interest in a secure and fast site (Art. 6 (1) (f) GDPR). Cloudflare is certified under the EU-U.S. Data Privacy Framework, and its data processing agreement includes the EU standard contractual clauses.

Visitor statistics

To see how many people use the site and what they use, each page view and a few actions (a search, opening an indication, opening the SmPC, sending a report) are counted with Cloudflare Workers Analytics Engine. A count holds the page, the action, the country Cloudflare derives from the request, the website you came from, whether the screen is narrow, and for searches the recognised terms (such as “HER2 + Gastric cancer”), never the text you typed. No IP address, browser identification, cookie or other identifier is kept, and nothing is stored in your browser, so a count cannot be traced to you. Counts are deleted after three months, and the totals are public. The legal basis is my legitimate interest in knowing how the site is used (Art. 6 (1) (f) GDPR).

Search and the AI reader

Your browser downloads the dataset, and searches run on your device. Only when a search contains words the site does not recognise is the text of the search sent, through this site's server, to an AI model (Jev by TypeSafe, through OpenRouter, Inc., USA) that maps the words to a tumour, biomarker, line or setting. The text is sent without your IP address or any identifier, and the answer is kept for 30 days so the same search is not sent again. Please do not type anything that identifies a patient or another person into the search.

Writing to me

When you write to contact@oncolabels.com, Cloudflare Email Routing forwards the email to my mailbox at Google (Gmail). I use your message and address only to answer you, and I delete the email when the matter is settled, unless the law requires me to keep it. The legal basis is my legitimate interest in answering you (Art. 6 (1) (f) GDPR).

Reports and feedback

When you send a report or feedback, your message, the reason you chose, the page and indication it is about, the dataset version, the country of the request and your email address, if you give one, are emailed to my mailbox at Google (Gmail) through Cloudflare Email Service. The site itself stores nothing. The email is used only to check and fix the data and, if you left an address, to answer you, and it is deleted when the report has been dealt with, after twelve months at the latest. The legal basis is my legitimate interest in correct data (Art. 6 (1) (f) GDPR) and, for your email address, your consent (Art. 6 (1) (a) GDPR), which you can withdraw at any time. Please leave out anything that identifies a patient.

API and MCP server

Requests to the JSON API and the MCP server are handled like page requests. Calls are counted per endpoint or tool, without identifiers, and your IP address is used only briefly to limit how many requests one network can make.

What your browser stores

If you choose a light or dark appearance, the choice is kept in your browser's local storage. The site's service worker keeps the site's files and the dataset in your browser so that it opens quickly and works offline. Both only serve the site you asked for (§ 25 (2) no. 2 TDDDG), and you can delete them in your browser's settings. The site sets no cookies and loads no fonts, scripts or images from other companies.

Links to other sites

Links to the product information, the EPAR and other pages lead to the European Medicines Agency and other sites, whose own privacy policies apply once you follow them.

Your rights

You have the right to access the data about you, to have it corrected or deleted, to restrict its processing, to receive it in a portable form and to object to processing based on legitimate interests (Art. 15 to 21 GDPR). You can withdraw a consent at any time with effect for the future. To use these rights, write to the address above. You also have the right to complain to a data protection supervisory authority, for example the one in the German state where you live (Art. 77 GDPR).

Changes

This policy is from 24 Oct 2026 and changes when the site changes how it handles data.