PRIVACY

Privacy Policy

As of: 10 August 2026 · Version 2.2 · This policy governs data processing on lucid-ai.app as well as within the scope of the AI telephone agent service ("Voice Agent"). This English-language version is the authoritative and governing version.

This English-language version is the authoritative and legally governing version of this document.

1. Controller (Art. 4 No. 7 GDPR)

Fabian Ilg · Lucid AI Labs
Kirchbergstraße 5, 93152 Markt Nittendorf
Bavaria, Germany
Email: Fabi@lucidailabs.com

An officially appointed data protection officer is not currently named. The obligation to appoint pursuant to Art. 37 para. 1 lit. c GDPR (core activity = processing of special categories of data pursuant to Art. 9) is continuously assessed. Until regular processing of health data in the voice agent service begins, requests are handled directly by the controller; before the onboarding of the first paying clinic, an external data protection officer is appointed. A written threshold assessment ("not large scale" assessment for the pre-clinic period) is documented internally.

A record of processing activities pursuant to Art. 30 para. 2 GDPR (record of processing activities as a processor, kept separately per clinic controller) is maintained and provided to the supervisory authority (BayLDA) on request.

2. General Notes on Data Processing

We process personal data only insofar as this is necessary for the provision of the website and our services and a lawful basis pursuant to Art. 6 GDPR (and, additionally, Art. 9 GDPR for health data in the voice agent context) exists. No data processing takes place for the advertising purposes of third parties, no profiling for automated individual decisions (Art. 22 GDPR).

3. Collection on Visiting the Website

3.1 Server Logs

On every page request, technical information is automatically collected by the hosting provider Vercel (server logs):

  • IP address (in truncated form, insofar as technically possible)
  • Date and time of access
  • Requested URL and HTTP status code
  • User agent (browser type and version)
  • Referrer URL (if transmitted)

Lawful basis: Art. 6 para. 1 lit. f GDPR (legitimate interest in security, stability, abuse protection). Storage duration: 30 days, then automatic deletion by the host. A profile with personal data is not created from these logs.

3.2 Hosting

The hosting of the website is carried out via Vercel Inc. (USA), the clinic dashboard and the voice agent database via Hetzner Online GmbH (Falkenstein/Nuremberg, Germany). Third-country transfers for Vercel are safeguarded by SCC and the DPF (see § 8). The application-side data of the voice agent clinic is located exclusively in the EU.

4. Cookies and Consent Management

This website sets no cookies and stores no information on your device. There is accordingly no cookie banner: consent pursuant to § 25 para. 1 TDDDG is only required where information is stored on, or read from, your device, and no such access takes place.

  • Necessary: none. The site functions without cookies, local storage or comparable technologies.
  • Analytics (cookieless, no consent required): Vercel Web Analytics (see § 13) works without cookies and without device access. Lawful basis: Art. 6 para. 1 lit. f GDPR (legitimate interest in reach measurement).
  • Marketing: currently not in use. If marketing trackers requiring consent are ever introduced, a consent banner meeting the requirements of Art. 7 GDPR and the EDPB Guidelines 03/2022 will be added first.

5. Contact Form and Email Contact

Data transmitted via the contact form at /contact or directly by email to Fabi@lucidailabs.com (name, email, company, message, optional: budget, timeframe) is used exclusively for the processing of your enquiry.

  • Lawful basis: Art. 6 para. 1 lit. b GDPR (pre-contractual measures / contract performance), for purely informational enquiries additionally Art. 6 para. 1 lit. f GDPR (legitimate interest in handling enquiries).
  • Storage location: Hetzner-hosted Supabase (Falkenstein/Nuremberg, DE) as well as email server (Resend for transactional mail, see § 7).
  • Storage duration: 36 months from the last interaction, then deletion or anonymisation. On conclusion of a contract: statutory retention periods (e. g. AO, HGB).

6. Voice-Agent-Specific Processing

Within the scope of the voice agent service, we process personal data of callers on behalf of the respective clinic (processing on instruction pursuant to Art. 28 GDPR). The controller for this processing is the clinic itself; Lucid AI Labs is the processor. The master DPA is available at /avv.

This privacy policy describes the voice agent processing only in overview; the legally binding detail clauses are in the DPA.

6.1 Data Flow of a Typical Call

  1. Call ingress via Telnyx (USA, SCC + DPF) on a clinic-specific German geo telephone number.
  2. AI announcement at the beginning of the call (see § 6.4), generated via ElevenLabs (USA, SCC).
  3. Speech input to text via Deepgram (USA, SCC), low latency, transient.
  4. Conversation logic (LLM) via Anthropic Claude (USA, SCC, no training with input data).
  5. Response as speech via ElevenLabs, back via Telnyx to the caller.
  6. Persistence of the transcript and the appointment data in Supabase on Hetzner (DE, EU data residency).
  7. Appointment confirmation by email (if the caller provides an address) via Resend (USA, SCC + DPF).

6.2 Lawful Bases

  • General data (name, telephone number, appointment): Art. 6 para. 1 lit. b GDPR (initiation of a treatment contract).
  • Health data within the meaning of Art. 9 para. 1 GDPR, insofar as the caller voluntarily discloses such: Art. 9 para. 2 lit. h GDPR (processing for healthcare provision).
  • Optional audio recording (only if activated by the clinic): Art. 6 para. 1 lit. a GDPR (explicit consent at the beginning of the call).

6.3 Professional Secrecy (§ 203 StGB)

The clinic, as a professional secrecy holder within the meaning of § 203 StGB, expressly authorises, on each conclusion of a contract, Lucid AI Labs as well as all sub-processors named in the sub-processor list as "assisting persons" pursuant to § 203 para. 3 and 4 StGB. The confidentiality obligation is contractually safeguarded.

6.4 AI Announcement (AI Act Art. 50)

At the beginning of every call, the Voice Agent plays a clearly intelligible notice that the caller is interacting with an AI system (example: "You are speaking with the AI telephone assistant of the practice Dr. X. If you would like to speak with a human, please say 'human'."). This obligation arises from Art. 50 AI Regulation (EU) 2024/1689. The applicability of this article begins on 2 August 2026; Lucid AI Labs already fulfils it now.

6.5 Recording (§ 201 StGB)

A permanent audio recording does not take place by default. Voice data is only processed transiently (streaming) and deleted immediately after generation of the transcript. If a clinic explicitly commissions an additional audio recording in the main contract, a separate consent is obtained at the beginning of every call; in the event of objection, the recording is immediately and verifiably deactivated. A recording without notice and possibility of objection does not take place under any circumstances; this would be a criminal offence pursuant to § 201 StGB.

6.6 Functional Limitation

The Voice Agent provides no diagnosis, performs no triage and gives no medical assessments. For any substantive medical concern, an escalation to a human takes place. This limitation avoids a classification as high-risk AI pursuant to Annex III of the AI Regulation.

7. Processors and Recipients

We use the following processors. The complete current list with addresses, data categories and DPA links is available at /sub-processors/.

Provider Seat Purpose Transfer basis
Hetzner Online GmbH DE Hosting database, transcripts EU, no third-country transfer
Vercel Inc. US Marketing hosting, clinic dashboard, cookieless web analytics SCC + DPF
Telnyx LLC US Telephony (SIP trunk, German geo telephone numbers) SCC + DPF
Deepgram Inc. US Speech → text SCC
Anthropic PBC US LLM conversation (Claude) SCC + DPF
ElevenLabs Inc. US Speech synthesis (TTS) SCC
Resend Inc. US Transactional emails SCC + DPF
Indian Type Foundry (Fontshare) IN Webfont delivery (typeface “Satoshi”) Art. 49(1)(b) GDPR

Webfonts. The typeface used on this site is delivered by Fontshare (Indian Type Foundry, India). Calling up a page transmits your IP address and browser user agent to that server, which is technically necessary to render the page. The licence for this typeface does not permit us to serve the font files from our own servers. All other fonts on this site are self-hosted, so no data is transmitted to any third party for them. In particular, Google Fonts is not used anywhere on this site.

We do not sell, rent or lend personal data to third parties for advertising purposes.

8. Third-Country Transfers (Art. 44 ff. GDPR)

Transfers to the USA to the recipients named in § 7 take place on the following bases:

  • Standard contractual clauses of the EU Commission pursuant to Implementing Decision (EU) 2021/914 (modules 2 and, where applicable, 3).
  • Insofar as the recipient is certified: reliance on the adequacy decision EU-U.S. Data Privacy Framework of 10 July 2023 (e. g. Telnyx, Resend, Microsoft, Vercel, Anthropic).
  • Transfer Impact Assessments (TIA) were carried out for each US recipient, in particular with regard to FISA 702 / Executive Order 12333. The TIA documents are available for inspection on request.

9. Storage Duration

  • Server logs (Vercel): 30 days, then automatic deletion.
  • Contact enquiries: 36 months from the last interaction.
  • Voice agent audio data: transient, max. 60 seconds buffering.
  • Voice agent transcripts: 90 days (adjustable per clinic).
  • Appointment records: until expiry of the clinic-side retention obligation.
  • Optional audio recording (if activated): 30 days, then irretrievable deletion.
  • Web analytics (Vercel): aggregated, non-personal statistics only; the daily visitor identifier is discarded after 24 hours (see § 13).

10. Your Rights (Art. 15–22 GDPR)

  • Access (Art. 15): Which data do we have about you?
  • Rectification (Art. 16): Correction of inaccurate data.
  • Erasure (Art. 17): "Right to be forgotten", insofar as no retention obligation exists.
  • Restriction (Art. 18): Blocking instead of deletion, e. g. in the case of disputes.
  • Data portability (Art. 20): Receipt of your data in a machine-readable format.
  • Objection (Art. 21): against processing on the basis of legitimate interests.
  • Withdrawal of consent (Art. 7 para. 3): at any time, without effect on previous lawfulness. Cookie withdrawal via footer link.
  • No automated individual decision (Art. 22): No solely automated decision with legal effect takes place.

To exercise these rights: email to Fabi@lucidailabs.com with subject "Data protection access request". Response within the statutory period of one month (Art. 12 para. 3 GDPR), in complex cases extendable by two further months with reasoning.

11. Right to Lodge a Complaint with the Supervisory Authority (Art. 77 GDPR)

You have the right to lodge a complaint with a supervisory authority. Competent for the seat of the controller:

Bavarian State Office for Data Protection Supervision (BayLDA)
Promenade 18, 91522 Ansbach
Telephone: +49 (0)981 180093-0
Email: poststelle@lda.bayern.de
Web: lda.bayern.de

You can also contact any other EU supervisory authority, in particular the one competent in your state of residence.

12. Newsletter and Marketing

We currently operate no newsletter and no advertising email processing. Should this be introduced in the future, an explicit, documented double-opt-in consent takes place. Data is then not used for marketing purposes without explicit consent (§ 7 UWG).

13. Vercel Web Analytics (Cookieless)

We use Vercel Web Analytics for aggregated reach measurement (page views, visitor counts, referrer, country, device class). Provider: Vercel Inc. (USA), which also hosts this website (see § 3 and the sub-processor list).

  • How it works: no cookies, no local storage, no cross-site tracking. To count a returning visitor within a single day, a hash is computed from the incoming request; it cannot be reversed to your IP address, is not linked across days and is discarded after 24 hours.
  • Data types: visited page path, referrer, country of origin, browser and device class, operating system. IP addresses are not stored.
  • Lawful basis: Art. 6 para. 1 lit. f GDPR (legitimate interest in measuring the reach of our own website). § 25 TDDDG does not apply, as no information is stored on or read from your device. Source: Vercel Web Analytics privacy documentation.
  • Storage duration: the daily visitor identifier is discarded after 24 hours; only aggregated, non-personal statistics are retained.
  • Third-country transfer: SCC + DPF (Vercel is DPF-certified, see § 8).
  • Objection: Art. 21 GDPR; furthermore, script blockers prevent the measurement entirely without impairing the site.

14. Anti-Fingerprinting Obligations

We refrain from browser fingerprinting, canvas fingerprinting and similar techniques for unique re-identification. Technical tracking pixels of third parties are not used. An identification of individual visitors is, on the basis of the collected data, neither intended nor practically possible.

15. Changes to This Policy

Material changes are announced at the top of this page with a new "as of" date and version number. Changes only take effect for future processing; retroactive changes are not made. In case of doubt, existing customers are additionally informed by email.

16. Contact for Data Protection Matters

Directly to the controller: Fabi@lucidailabs.com. Response within one working day, at the latest within the statutory period of one month.

Related Documents