AMBOSS SE (“AMBOSS”) operates the online knowledge and learning program AMBOSS, a network-based learning concept specifically for medical students, physicians, and other healthcare professionals. We are aware of the importance and sensitivity of your data and thank you for your trust. Handling it responsibly is of paramount importance to us. Please do not hesitate to contact us if you have any questions.
AMBOSS regularly conducts surveys to even better understand the daily challenges of medical students and physicians and/or to obtain their feedback on current or future AMBOSS products, services, or initiatives. This privacy policy informs participants in surveys created by AMBOSS about the nature, scope, and purposes of the processing of personal data by AMBOSS in this context. It applies to all surveys created by AMBOSS, regardless of the method or medium through which participation occurs (via the website, email, personal conversation, etc.). You can also find further information about data processing by AMBOSS in our general privacy policy, which is available in our general privacy policy.
Data Controller:
AMBOSS SE
Torstrasse 19
10119 Berlin, Germany
E-mail: hello@amboss.com
Phone: +1 (347) 835-5441
Management: Dr. med. Madjid Salimi, Benedikt Hochkirchen
District Court Berlin (Charlottenburg), HRB 2 70315
Contact details of the Data Protection Officer:
AMBOSS SE
Sophia Ampatziadis
Torstrasse 19
10119 Berlin, Germany
privacy@amboss.com
1. General Information
1.1. Regarding the terms used, such as “personal data”, “user” or “processing”, we refer to Article 4 of the General Data Protection Regulation (“GDPR”).
1.2. We process personal data of users exclusively in compliance with the applicable data protection regulations. In accordance with Article 13 of the GDPR, we inform you of the legal basis for our data processing. Unless otherwise stated in this Privacy Policy, the following applies: The legal basis for processing personal data with separate consent is Article 6(1) ( a) GDPR; the legal basis for processing data for the performance of a contract and for taking steps prior to entering into a contract is Article 6(1) (b) GDPR; the legal basis for processing personal data to comply with our legal obligations is Article 6(1) (c) GDPR; and the legal basis for processing personal data to protect our legitimate interests is Article 6(1) (f) GDPR.
2. Surveys
2.1. You have the option to participate in surveys created by AMBOSS. The data you provide may be associated with your AMBOSS user ID. Unless we have informed you otherwise before the survey, we will process and use the personal data you provide in the survey only for the purpose of evaluating the survey and optimizing products. This also includes contacting you.
2.2. Your data will be stored by us for as long as this is necessary for the intended purpose. As soon as storage is no longer necessary for the intended purpose and there are no legal retention obligations preventing deletion, we will delete the data.
2. 3. Your data will be processed on the basis of your consent in accordance with Art. 6 para. 1 lit. a GDPR, insofar as you have given this consent.
3. Data transfer
3.1. Generally, only our employees involved in evaluating the survey will have access to your personal data. Furthermore, we use external IT service providers for the data processing described in this Privacy Policy and may commission them to perform certain services. These include the following IT services:
- Software for booking interview appointments with participants
- CRM systems for contacting participants
- Video conferencing software for conducting and recording interviews
- Analytics software for evaluating participant input
- Software and tools for online surveys and for obtaining data protection consent
- Software for data storage
- Software for providing rewards as a thank you for participation
3.2. Personal data will only be disclosed to third parties on the basis of legal permissions and within the framework of legal requirements. If we commission service providers to process data within the framework of a so-called "Data Processing Agreement", this is done on the basis of Article 28 GDPR.
3.3. Personal data may also be transferred to servers outside the EU or to trusted third parties located outside the EU. If the EU Commission has not issued an adequacy decision for the country in question, the transfer will be based on so-called EU Standard Contractual Clauses, which aim to ensure that your rights and freedoms are adequately protected. You should be aware that many countries do not offer the same level of legal protection for personal data as the EU. While your personal data is located in another country, courts, law enforcement agencies, and national security authorities of that country may be able to access it in accordance with its laws.
4. Technologies used
We use various third-party technologies on our website, in the registered area, in our apps, and in our interactions with survey participants to conduct surveys. These technologies are listed below. Further information, particularly regarding the legal basis, the storage duration of cookies, and the personal data obtained through them, can be found in the privacy settings in the footer of this website. There, you also have the option to revoke any consent you may have given for these technologies with effect for the future. Further general information on consent management can be found in our general privacy policy.
4.1 Required Technologies
Alchemist
We use Alchemer , a service of Alchemer LLC, 168 Centennial Parkway Unit #250 Louisville, CO 80027, USA, to create online forms for customer surveys. The provider processes meta/communication data (e.g., device information, IP addresses) and the information provided by participants in the survey form on our behalf.
Data is transferred to third countries (United States of America).
Further information can be found in the provider's privacy policy at Alchemer privacy policy.
Calendly
We use Calendly from the company of the same name, Calendly LLC, 115 E Main St Ste A1B Buford, GA. We use a service for easy, quick, and straightforward appointment scheduling with survey participants. The provider processes contact data (e.g., email addresses, phone numbers) and meta/communication data (e.g., device information, IP addresses) on our behalf for this purpose.
Data is transferred to third countries (United States of America).
Further information can be found in the provider's privacy policy at Calendly privacy notice.
Google Forms
We use the survey management software Google Form from Google LLC, 1600 Amphitheatre Pkwy Mountain View, CA, 94043-1351 United States, to obtain consent for participation in surveys. The provider processes, on our behalf, the name, email address, declaration of consent, and meta/communication data (e.g., device information, IP addresses) for these purposes.
Data is transferred to third countries (United States of America).
Further information can be found in the provider's privacy policy at Google privacy policy.
Hubspot
We use HubSpot from the company of the same name, HubSpot , Inc., 25 1st Street, Cambridge, MA 0214, USA. The provider processes contact data (e.g., email addresses, telephone numbers) and meta/communication data (e.g., device information, IP addresses) on our behalf.
We use HubSpot as follows
- Integration of contact forms that allow you to get in touch with us or use our services;
- Participant relationship management;
- Hosting our website and providing content;
- Email communication based on consent to participate in surveys.
Data is transferred to third countries (United States of America).
Further information can be found in the provider's privacy policy at HubSpot privacy policy.
4.2 Consent-based technologies
Unless explicitly stated below, the third-party providers listed in this section also use the data they process from you for their own purposes. Details can be found in the providers' privacy policies.
Hotjar
We use the web analytics service Hotjar from Hotjar Ltd., Level 2, St Julian's Business Centre, 3, Elia Zammit Street, St Julian's STJ 1000, Malta (“Hotjar”).
The provider processes, on our behalf and not for its own purposes, the activity of the website visitor (e.g., which pages they visited and which elements they clicked on), device and browser information (especially the IP address and operating system), and a tracking code in the form of a pseudonymized user ID. The information collected in this way is transmitted by Hotjar to a server in Ireland and stored there anonymously.
Further information can be found in the provider's privacy policy at Hotjar privacy policy.
4.3 Integration of third-party content and services
Based on our legitimate interests pursuant to Art. 6(1) (f) GDPR (interest in conducting and evaluating surveys and providing rewards for participation), we also use various third-party content or services that do not access your device or set cookies. However, this means that the providers of this content and these services will receive
your contact details (name and email address), as they cannot provide the requested service without this data.
- Amazon.de Marketplace of the company Amazon EU S.à rl . (Société à responsabilité limitée ), 38 avenue John F. Kennedy, L-1855 Luxembourg. Data protection declaration: Amazon privacy notice.
- Doctors Without Borders (Ärzte ohne Grenzen e.V.), Schwedenstraße 9,
13359 Berlin . Privacy policy: Doctors Without Borders privacy policy. - Dovetail is a service of Dovetail Research Pty Ltd., 276 Devonshire St, Surry Hills NSW 2010, Australia. Privacy Policy: Dovetail privacy policy.
- Google Shared Drive of Google LLC, 1600 Amphitheatre Mountain View , CA 94043-135, USA. Privacy Policy: Google privacy policy.
- Tremendous of the company of the same name, Tremendous LLC, 228 Park Ave S PMB 62949, New York, NY 10003-1502, USA. Privacy policy: Tremendous privacy policy.
- Wunschgutschein ( gift voucher ) is offered by Wunschgutschein GmbH, 228 Park Ave S PMB 62949, New York, NY 10003-1502, USA. Privacy policy: Wunschgutschein privacy policy
5. Provision obligations / automated decision-making
You only need to provide the personal data that is necessary for participation in the survey or whose provision is required by law or contract. Without this data, we will generally not be able to conduct the survey.
We generally do not use fully automated decision-making in accordance with Article 22 GDPR. Should we use these procedures in individual cases, we will provide separate notification.
6. Rights of data subjects
You have the right:
- In accordance with Article 7(3) GDPR, you have the right to withdraw your consent to us with effect for the future;
- In accordance with Article 15 GDPR, you have the right to request information free of charge about your personal data processed by us;
- In accordance with Article 16 GDPR, you have the right to request the immediate rectification of inaccurate or incomplete personal data concerning you that we hold;
- In accordance with Article 17 GDPR, you have the right to request the erasure of your personal data stored by us, unless processing is necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation, for reasons of public interest or for the establishment, exercise or defense of legal claims;
- to request the restriction of the processing of your personal data in accordance with Article 18 GDPR;
- pursuant to Art. 20 GDPR, to receive your personal data that you have provided to us in a structured, common and machine-readable format or to request that it be transmitted to another controller;
- According to Article 77 of the GDPR, you have the right to lodge a complaint with a supervisory authority. Generally, you can contact the supervisory authority of your habitual residence, your place of work, or our registered office.
7. Right of objection
7.1. If your personal data is processed on the basis of legitimate interests pursuant to Article 6(1) (f) GDPR, you have the right to object to the processing of your personal data pursuant to Article 21 GDPR, provided there are grounds relating to your particular situation or the objection is directed against direct marketing. In the latter case, you have a general right to object, which we will implement without requiring you to specify a particular situation.
7.2 . If you wish to exercise your right of withdrawal or objection, simply send an email to our email address mentioned above.
8. Changes to the Privacy Policy
We reserve the right to amend this privacy policy from time to time to reflect changes in legislation or the expansion of our services. You should therefore review the privacy policy regularly to stay informed about how we protect your data.
In addition, you can find information about data processing on our website in our general privacy policy. You can find it in our general privacy policy.
Last updated: October 2025