Privacy

1. Controller

Moritz Pommer
Taunusanlage 8
60329 Frankfurt am Main
Email datenschutz@calenu.app

Calenu has two roles, and they are kept apart. Calenu is the controller for your account, your history in the app and your notifications. The appointment data a practice sees in its day view, Calenu processes on behalf of that practice (Article 28 GDPR); the practice is the controller for it.

2. What data is processed

• Account. With “Sign in with Apple”, an identifier from Apple and, if you allow it, your email address. If you sign in with a code by email instead, your email address. You need no account to search; to book in the app, you do.
• Profile. Name, date of birth, cell phone number, type of insurance and, if given, your health insurer (Kasse) and email address. The practice needs these to set up the appointment.
• Family members. Name and date of birth of the people you book for.
• Appointments. Practice, time, type of appointment, whether there is a referral, whether the appointment was confirmed, canceled or kept, and, if you give one, one of four reasons: Check-up, Something new, Follow-up or Prescription. Also a running-late notice or a cancellation reason, when you send one. Calenu does not store free text about symptoms. This is health data under Article 9 GDPR, because the practice itself reveals what it is about.
• Practices you watch. If you watch a practice to hear about an earlier appointment: the practice, who it is for and until when. Without an account only your iPhone knows about it; with an account the watch is kept on our server in Germany, so the notification can reach you.
• Device. A push token, the language you set, and your choice whether the practice’s name may appear on the lock screen.
• Email reminders. Only if you turn them on in the app: the confirmed email address of your account, the time and length of an appointment booked in the app, and which message is due (confirmation, reminder the day before, cancellation by the practice). Such an email names neither the practice nor the doctor, neither the specialty nor the type of appointment.
• Calu in the app. Runs entirely on your device. What you write to Calu stays there and is neither transmitted nor stored on our servers.
• Calu on this website. Answers from prepared texts, right in your browser. What you type there is neither transmitted nor stored, not in cookies either.
• Location. Used only on your device, to sort practices by distance. It is neither transmitted nor stored.
• Directions. When you tap “Directions”, Calenu opens the practice’s address in the maps app you choose (Apple Maps, Google Maps or Waze). Only the address goes to that app: no name, no time, no specialty. From there, that app’s privacy policy applies.
• Voice input. Turned into text on your iPhone. Calenu offers it only where the device can do this without sending your voice to a server.

No ad tracking, no analytics cookies, no selling of data.

3. Legal bases

• Article 9(2)(a) GDPR, explicit consent, for everything connected with an appointment, which makes it health data. You give it in the app before your first booking and can withdraw it at any time.
• Article 6(1)(b) GDPR, performance of a contract, for the account, the profile, arranging the appointment itself and Calenu Plus.
• Article 6(1)(a) GDPR, consent, for push notifications and email reminders. You turn both on in the app and can turn them off again at any time.
• Article 6(1)(f) GDPR, legitimate interest, for running the service, security and preventing misuse.

4. Who else sees the data

• The practice you book with. It gets your name, date of birth, insurance type and insurer, whether you have been there before, a way to reach you about a cancellation and, if you give it, your reason in one word, and a cancellation reason or a running-late notice when you send one. Other practices get nothing, not even where you move an appointment to.
• A hosting provider in Germany as processor for servers and database. The data is stored encrypted in data centers in Germany, and so is the nightly encrypted backup.
• A web hosting and email provider in Germany as processor: it runs this website and sends the sign-in codes and, if you turned them on, the email reminders. When you visit the website, the web server keeps technically necessary access data such as the IP address in logs for a short time.
• Apple, for Sign in with Apple, for delivering push notifications and for the purchase of Calenu Plus. Without your permission, a notification names no practice.

5. How long

• Your history in the app, meaning your profile, appointments, running-late notices and cancellation reasons: until you delete your account, unless a legal duty to keep records stands in the way.
• What a practice sees in Calenu: until 30 days after the appointment. After that, Calenu no longer shows the practice the entry. What belongs in its medical records, the practice keeps in its own system.
• Bookings without an account through calenu.app: deleted 30 days after the last appointment.
• Messages to Calu: only on your device, for 30 days at most. The app deletes older ones by itself. You can delete them earlier in the app; they also go when the app does.
• Backups: encrypted, with at most 30 daily and 12 weekly copies. A deleted account is gone from them after three months at the latest.
• Practices you watch: until you end the watch, and no later than two days after its end date (14 days after it starts, unless you choose another), or with the account.
• Push token: until Apple reports that it is no longer valid, and no later than 180 days after it was last used.
• Email reminders: the note that an email is due, until it is sent, and 30 days after that. If you turn the emails off or the appointment no longer takes place, any not yet sent are removed at once.

6. Calenu Plus

• Bought through Apple. You buy Plus in the App Store. Apple is the seller and handles the payment. Calenu never sees card or bank details.
• What our server stores. So that Calenu knows whether Plus applies to you: the subscription bought, Apple’s identifier for the purchase, the expiration date, whether the subscription renews, whether Apple has reversed the purchase, after a refund for example, and whether it was a test purchase. Also the identifier of your Calenu account. It is generated at random and has no link to your name. The app gives it to Apple at purchase, so that the purchase is matched to your account.
• Changes to the subscription. Apple tells our server about renewals, cancellations and refunds. Calenu then asks Apple for the current status and stores it.
• Legal basis. Article 6(1)(b) GDPR, performance of a contract. Without these details Calenu cannot activate Plus.
• How long. As long as your account exists. If you delete the account, the entry is deleted with it. That does not end the subscription with Apple. Cancel it in your App Store settings.
• Series and export. For a series, the server stores only the appointments themselves and that they belong together. The app makes the file with your visits on your iPhone. It does not pass through our server.

7. Calenu Praxis, the app for practices

Calenu Praxis is the app for medical, dental, psychotherapy and therapy practices, for their teams and for everyone who treats patients there. Calenu is the controller for the personal data of the people who use this app. What the app shows about patients, Calenu processes on behalf of the practice in question (section 1).

• Account. The email address. Sign-in is with a code by email, without a password. For security, the sign-in service records every sign-in and every code request with the email address and IP address.
• Application for access. The practice’s name, address with its federal state, phone number and kind (medical, dental, psychotherapy or therapy practice), whether it bills the statutory health insurers (Kassen) or privately, for a practice that bills the Kassen its number (Betriebsstättennummer, the billing number of the regional dentists’ association KZV, or Institutionskennzeichen), specialty and field, the name and title of the person applying, their role in the practice and, if given, their lifelong doctor number (LANR) or dentist number (ZANR). The app suggests the federal state from the address; for this, the iPhone sends the address entered to Apple’s maps service. Calenu checks the details at a source that fits the kind of practice: for a practice that bills the Kassen, in the doctor search of the Kassenärztliche Vereinigung (the regional association of statutory health insurance physicians), in the dentist search of the Kassenzahnärztliche Vereinigung (its counterpart for dentists), or against the health insurers’ approval for therapy services (Heilmittel); for every practice, in the register of the chamber of physicians, dentists or psychotherapists, or against the license to practice (Approbation or Berufserlaubnis), which Calenu asks to see in the original. Calenu then calls the practice, where possible at the number in the register. Only the person applying and Calenu see the application.
• After approval. The practice’s name, address, phone number and kind, and the name, title, specialty and field of those who treat patients there, appear in Calenu so that patients can find the practice. The public directory does not show the personal numbers (LANR, ZANR).
• In the team. Colleagues see the name given, the role and, if linked, their entry among the practice’s practitioners. They do not see the email address. The practice lead can add a note to an access code, seen only by the lead.
• Log. When someone in the team changes an appointment, Calenu records it with the identifier of their account, without a name, so that it can be traced who changed what and when.
• Notifications. Only if they are turned on: a push token for the iPhone. A notification names no one, only “Neue Anfrage” (new request), the time and the type of appointment.
• Face ID. The iPhone checks it itself. Calenu receives nothing from it.
• Legal bases. Article 6(1)(b) GDPR for the account, the application, the check and the work in the app; point (a) for notifications; point (f) for the log and security.
• How long. The sign-in log, 30 days. An application, 90 days after the decision or after it is withdrawn. A place in a team, until the practice lead removes it or the account is deleted. A push token, at most 180 days after it was last used. The log, three years after the end of the year in which it was written.
• Deleting the account. In Calenu Praxis under “Praxis” (practice), and as long as there is no access yet, on the app’s start screen or in the application. Deleted are the account, the applications, the place in every team and the push tokens. The practice stays, with its appointments and its practitioners; the log keeps the account’s identifier, without a name. If the Calenu app is used with the same email address, that account is deleted too.

8. Your rights

You have the right of access (Article 15), rectification (16), erasure (17), restriction of processing (18), data portability (20) and objection (21). You can withdraw any consent you gave at any time, with effect for the future.

In the Calenu app, your profile (top right) gives an overview of everything stored (“Everything Calenu holds”). There, with “Delete account”, you yourself delete your account, your profile and everything Calenu stored on your iPhone; in Calenu Praxis you do this under “Praxis” (section 7).

9. Complaints

You can complain to a data protection supervisory authority. The one responsible is the Hessische Beauftragte für Datenschutz und Informationsfreiheit (HBDI), the Hessian data protection commissioner, Gustav-Stresemann-Ring 1, 65189 Wiesbaden.

10. Contact

datenschutz@calenu.app. We usually answer within two business days.

As of October 17, 2026