Privacy Policy – hearbetter India

Application: hearbetter India (Google Play: com.medel; App Store: com.medel.hearbettercircle)

Controller: MED-EL Elektromedizinische Geräte GmbH, Fürstenweg 77a, 6020 Innsbruck, Austria

Data protection contact: privacy@medel.com

Effective date: 19 October 2026

hearbetter India is an exclusive, invite-only app designed to raise awareness about hearing implants and their indications for the target group of referring ENTs and other hearing care professionals in India.

MED-EL Elektromedizinische Geräte GmbH (“MED-EL”, “we”, “us”) is the controller responsible for the personal data processed in the hearbetter India app. This policy explains what data we process, why, on which legal basis, which service providers help us, how long we keep the data and what rights you have.

Providing the app

hearbetter India app data is stored in Pantheon Systems, Inc., 717 California Street, San Francisco, CA 94108, USA. Privacy Policy: https://legal.pantheon.io/privacy-policy.html

To deliver the app and protect it against misuse, our hosting providers process technical data of each request, such as your device’s IP address and the time of the request.

Purpose: Inform and educate about hearing implants and their indications.

Legal Basis: Performance of a contract – Art. 6 (1) b GDPR.

Registration and sign-in

For registering for the app (which is by invitation only), we collect: first name, family name, email address, telephone number, profession, place of work, and geographic region (State / UT). We use this information for adding the professionals to specific geographic circles.

You sign in with a one-time code sent to your email address. We store only a protected version of the code, for a few minutes, and keep session tokens on your device and on our server so that you stay signed in.

To send invitations, sign-in codes and account emails we use “Simple Email Service” of Amazon Web Services, Inc., 410 Terry Avenue North, Seattle, WA 98109-5210, USA, operated in the EU (Ireland) region. Privacy Policy: https://docs.aws.amazon.com/ses/latest/dg/data-protection.html

Purpose: Registering, signing in securely, and being added to a specific geographic circle.

Legal Basis: Consent – Art. 6 (1) a GDPR. You can withdraw your consent at any time by deleting your account (see “Deleting your account” below). Withdrawal does not affect the lawfulness of the processing carried out before it.

Profile picture

If you choose to upload a profile picture, this image is stored with your profile and is visible to other members of your circle. Uploading is always initiated by you. The camera and photo library are accessed only at that moment, and refusing those permissions does not prevent you from using the rest of the app.

Purpose: Personalising your app profile.

Legal Basis: Performance of a contract – Art. 6 (1) b GDPR.

Content you create in your circle

Within your circle you can create posts, comments and replies, like content, respond to polls, and upload photographs and documents. This content is stored with your profile and is visible to the other members of your circle, to your Circle Leader and to MED-EL administrators.

The app is not intended for patient data. Our Terms and Conditions prohibit sharing patient-identifiable information (such as names, addresses, phone numbers, medical records, photographs or videos) in case discussions.

Purpose: Providing the community features of the app.

Legal Basis: Performance of a contract – Art. 6 (1) b GDPR.

Reporting, blocking and moderation

If you report a post, comment or reply, we store the report with the reason you selected, any description you add, and your identity as the reporting member. Reports are reviewed by your Circle Leader and by the MED-EL moderation team. The reported content is hidden from you immediately.

If you block another member, we store the block and the reason you optionally select. The block only changes what you see. The blocked member is not notified.

We keep records of moderation decisions (content removed, members restricted, accounts suspended or terminated) and of account deletion requests, so that we can show how each case was handled.

Purpose: Keeping the community safe, enforcing our Terms and Conditions, and documenting how reports and requests were handled.

Legal Basis: Performance of a contract – Art. 6 (1) b GDPR, and our legitimate interest in the safety and integrity of the community – Art. 6 (1) f GDPR.

Delivery of push notifications

We use push notifications to inform you of updates in the app, e.g., newly assigned content. These notifications can be received by the smartphone also when the app is not active. We use Firebase Cloud Messaging (FCM), a service of Google LLC, 1600 Amphitheatre Pkwy, Mountain View, CA 94043, USA. Privacy Policy: https://policies.google.com/privacy

To deliver these notifications we store the push token that your device issues to the app. It identifies the device, not you. It is used only to send you your own notifications, and it is deleted when you sign out or delete your account.

Purpose: Delivery of push notifications.

Legal Basis: Consent – Art. 6 (1) a GDPR. You give consent by allowing notifications on your device, and you can withdraw it at any time in the app’s notification preferences or in your device settings.

What we do not collect

The app contains no analytics SDK, no advertising SDK and no data broker integration. We do not collect location data, contacts, health or clinical data, or advertising identifiers. We do not track you across apps or websites, and we do not sell personal data or share it for advertising. The only Firebase component in the app is Cloud Messaging, used to deliver the notifications described above.

Service providers and transfers outside the EU

We use the following service providers, each bound by a data processing agreement:

  • Pantheon Systems, Inc. (USA): hosting of the app’s server and database.
  • Amazon Web Services, Inc. (USA; EU Ireland region): sending of emails.
  • Google LLC (USA): delivery of push notifications.
  • Microsoft Corporation, One Microsoft Way, Redmond, WA 98052, USA (Microsoft Azure): hosting of the administration web application and of the public account-deletion page. Privacy Statement: https://privacy.microsoft.com/privacystatement

Where personal data is transferred to the United States, the transfer is covered by the EU Standard Contractual Clauses (SCCs) as suitable guarantees, in accordance with Art. 46 GDPR. For more information see: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj

Data retention

We keep your registration data for as long as you hold an account.

When you delete your account:

  • The personal data in your registration is erased: your name, email address, telephone number, profile picture, profession, place of work and region.
  • You are removed from your circle.
  • Every session, sign-in code and push token is destroyed.

The app uses soft deletion: the account record itself remains in the database, without those personal details and marked as inactive, so that the registration cannot be reused. This is done to ensure system integrity, maintain secure backup and recovery processes, prevent accidental data loss, investigate security incidents, and establish, exercise or defend legal claims where necessary. Access to this data is strictly limited, and it is not used for active business operations or user-facing functionality.

Posts, comments and replies you made in a circle are retained in anonymised form, shown as “Deleted User” and no longer linked to you or to any of your personal details, so that conversations other members took part in remain coherent.

Records of moderation decisions and of account deletion requests are retained for as long as we need them to show how a case was handled and to meet our legal obligations.

Legal Basis: Compliance with a legal obligation – Art. 6 (1) c GDPR, and our legitimate interest in the security and integrity of the system – Art. 6 (1) f GDPR.

Deleting your account

You can delete your account at any time:

  • In the app: open the menu and tap Delete account. It is also available under Profile → Edit profile → Delete account. The app explains what is erased and asks you to confirm. No email exchange and no contact with support is required.
  • On the web, without installing the app: https://hearbetter-circle.medel.com/data-removal. Enter the email address of your account and confirm the request through the link we send you.

Deletion cannot be undone, and the account can no longer be used to sign in. What is erased and what is retained is described under “Data retention” above.

Your rights

Under the General Data Protection Regulation (GDPR) you have the right to request access to your personal data, its rectification or erasure, the restriction of its processing, and a portable copy of it. You also have the right to object to its processing and to withdraw any consent you have given. You also have the right to lodge a complaint with a supervisory authority. In Austria this is the Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna.

Under India’s Digital Personal Data Protection Act, 2023, you have the right to obtain information about the personal data we process, to have it corrected, completed, updated or erased, to grievance redressal, and to nominate another person to exercise your rights in the event of death or incapacity. If your grievance is not resolved, you may approach the Data Protection Board of India.

To exercise any of these rights, write to privacy@medel.com. For general questions about the app, contact hearbetter.circle@medel.com.

Minimum age

The app is intended for hearing care professionals and is not directed at children. You must be at least 18 years old to register. We do not knowingly collect data from anyone under 18.

Terms and Conditions

Your use of the app is also governed by our Terms and Conditions. They are available in the app and at https://hearbetter.medel.com/en-int/hearbetter-app-terms-of-use/, and they set out the rules of conduct for the community, how content is moderated, and how reporting and blocking work.

Changes to this policy

We may update this policy from time to time. We will publish any change in the app and on this page and update the effective date above.