How we handle personal data, and the rights you have over it.
Privacy notice
What we collect, why, who processes it for us, how long we keep it, and how to exercise your rights.
Last updated: 28 October 2026
1. Who we are
Mangold Consultants ("we", "us") is the controller for the personal data processed through venitara.com. Mangold Consultants is the practice of Niko Mangold, a freelance professional established in Germany, operating the Venitara brand while Venitara GmbH is in formation. Section 19 explains what happens to your data when that company is registered.
Mangold ConsultantsKirchbergstraße 2064625 BensheimGermanyEmail: privacy@venitara.com
Our supervisory authority is the Hessian Commissioner for Data Protection and Freedom of Information.
This notice covers venitara.com. It does not cover the Venitara portal at portal.venitara.com.
2. What this notice covers
This notice applies to visitors to venitara.com, to people who completed the MedTech Compass on this website before 2 October 2026, to people who use the chat assistant, and to people who contact us, book a call with us, or apply to our partnership programme, and people who run programmes we contact about a partnership.
Since 2 October 2026 the MedTech Compass runs in the Venitara portal at portal.venitara.com, and the Start buttons on this website take you there. Answers you give in the portal are processed by the portal, and this notice does not describe them.
It does not cover personal data we process on a customer's behalf under a services agreement. Section 11 explains how that works.
3. The personal data we collect
When you visit the website. Our hosting provider processes the technical data needed to serve the site securely, including your IP address, browser and device type, the page requested, and the time of the request. Our hosting provider keeps these request logs for one day.
When the site talks to our servers. Opening a Compass result, using the chat assistant, or sending a form makes a request to our server functions. Our database provider's infrastructure logs each request, including your IP address, your browser's user agent, and an approximate location derived from the IP address (city, region, and postcode), together with technical security signals used to detect automated traffic. These logs are created by the platform, not by our own code, and we use them only to operate and secure the service. These logs are kept for seven days.
If you completed the MedTech Compass on this website. Until 2 October 2026 the Compass ran on this website. It asked about a product, not about you. For each Compass completed here, we store the answers given, the result the Compass produced, and the email address entered to see the result. Where the box asking us to email you about your results was ticked, we store that choice too. Each result has a random private link so you can return to it. The answers can include a free-text description of a product.
When you use the chat assistant. Your messages are sent to our AI provider to produce an answer (see section 6). We store the text of each question you ask, the Venitara pages the answer drew on, whether the assistant declined to answer, whether you asked to speak to a person, and technical usage figures. We do not store the assistant's replies, and we do not link stored questions to you or to one another. To limit abuse, we store a keyed cryptographic hash of your IP address together with a count of recent requests. The IP address itself is never stored, and the key is held separately from the records.
When you contact us. Through the contact form or the chat assistant's hand-off form, we process your name, company, email address, the markets you are interested in, your message, and any Compass link you choose to include.
When you book a call. Our booking pages are provided by Calendly. To book, you give your name and email address, choose a time, and answer a few questions about your company, your role, your product, your target markets, and what you want from the call. If you add guests, we also receive their email addresses. The booking records which Venitara page you came from and any campaign tag on the link you followed. The confirmation and calendar invitation reach the Venitara person you are meeting through our email and calendar provider. Please keep confidential technical detail out of the booking form; we can cover it on the call.
When you apply to the partnership programme. We process your organisation, website, contact person, email address, phone number, comments, and the programme you apply for.
When we contact you about a partnership. We write to people who run accelerators, incubators, hackathons, and similar programmes to propose a partnership with Venitara. We use the business contact details the organisation publishes on its own website: your name, role, organisation, and work email address, and the page we found them on. In our customer relationship system we record when we wrote to you, whether you replied, and anything you asked us to do, including a request not to hear from us again.
When you ask for a guide as a PDF. We process your name and email address, your company website if you give it, whether you ticked the boxes to receive our guides and updates or to talk to a regulatory expert, the guide you asked for, the page you asked from, and any campaign tags in the link that brought you to it.
When you subscribe to Regulatory Matters. We process your name, your company if you give it, and your email address, the wording of the consent you gave, when you confirmed your address, the page you subscribed from, and any campaign tags in the link that brought you to it.
Anonymous usage measurement. When you open a Compass result, use the contact form, or use the chat assistant's hand-off form, we record anonymous events such as a result being viewed. Section 8 explains what is recorded and why no consent banner is needed.
How we keep track of enquiries. We record enquiries, partnership applications, call bookings, and our partnership emails to programme organisers in our customer relationship system, provided by Attio, so the right person follows up and you are not asked for the same information twice. The record holds your name, company, email address, what you contacted us about, and our notes of the conversation. We also record newsletter subscribers and people who asked for guide updates there, together with the consent wording they agreed to, when they agreed, and whether they confirmed their address.
We do not seek health data or other special category data through this website.
4. Why we process personal data, and our legal bases
| Purpose | Legal basis under the GDPR |
|---|---|
| Operating, securing, and maintaining the website | Article 6(1)(f), our legitimate interest in a functioning and secure service |
| Limiting abuse of the chat assistant | Article 6(1)(f), our legitimate interest in protecting the service |
| Storing Compass results produced on this website | Article 6(1)(b), steps taken at your request before a contract, and Article 6(1)(f) |
| Answering your chat questions | Article 6(1)(b) and Article 6(1)(f) |
| Improving the chat assistant from stored questions | Article 6(1)(f), our legitimate interest in accurate answers |
| Responding to an enquiry or a partnership application | Article 6(1)(b) and Article 6(1)(f) |
| Arranging, preparing for, and holding a call you book | Article 6(1)(b), steps taken at your request before a contract, and Article 6(1)(f) for guests you add |
| Keeping a record of our contact with you so we can follow up | Article 6(1)(f), our legitimate interest in managing enquiries and business relationships |
| Contacting people who run programmes about a partnership with Venitara, and recording the outcome | Article 6(1)(f), our legitimate interest in building partnerships with programmes that support medical device and digital health companies. You can object at any time, and we will stop |
| Sending you a guide you asked for, and passing on your request to talk to an expert | Article 6(1)(b), steps taken at your request, and Article 6(1)(f) |
| Sending you our guides and regulatory updates, where you ticked the box when asking for a guide | Article 6(1)(a), consent, withdrawable at any time |
| Sending you Regulatory Matters, our newsletter, where you subscribed and confirmed your email address | Article 6(1)(a), consent, withdrawable at any time |
| Emailing you about your Compass results, where you ticked the box on this website | Article 6(1)(a), consent, withdrawable at any time |
| Anonymous usage measurement and visit statistics | Article 6(1)(f), our legitimate interest in understanding how the site is used |
| Meeting legal, tax, and accounting obligations | Article 6(1)(c) |
| Establishing, exercising, or defending legal claims | Article 6(1)(f) |
Withdrawing consent does not affect processing carried out before you withdrew it. Where we rely on legitimate interests, you can ask us for the balancing assessment behind that decision.
5. Marketing emails
If you ticked the box in a Compass completed on this website, we recorded that you agree to hear from us about your results and how we can help. If you ticked the box when asking for a guide, we recorded that you agree to receive our guides and regulatory updates, together with the wording you agreed to. If you subscribed to Regulatory Matters, our newsletter, we recorded that you agree to receive it every two weeks, together with the wording you agreed to. We send marketing emails, including Regulatory Matters, only to people who have confirmed their email address through the link we send after they sign up. Every marketing email carries a one-click unsubscribe link.
You can withdraw your consent at any time by writing to privacy@venitara.com.
Partnership emails to programme organisers are separate from the marketing emails above. They are business emails proposing a partnership, sent to the work address an organisation publishes. We send no more than two unless you reply, and we stop as soon as you ask us to. Each one tells you how to opt out.
6. The MedTech Compass and the chat assistant
The MedTech Compass on this website did not use artificial intelligence. A result produced on this website was calculated by fixed rules applied to the answers, and those rules ran in the browser. The answers, the result, and the email address were then stored so that you can return to your result through its private link. The result is an indicative view that no regulatory expert has reviewed. It is not a determination of your product's classification and not regulatory advice.
The chat assistant does use artificial intelligence. To answer a question, we send your messages in the current conversation, together with extracts from Venitara's own published pages, to Anthropic, which processes them on servers in the United States. Section 10 explains the safeguards for that transfer. Anthropic may not use your messages to train its models. It deletes them within 30 days, except where its automated safety systems flag a conversation for a breach of its usage policy, in which case it may keep it for up to two years, or where the law requires it to keep them longer.
The assistant's answers are generated automatically and have not been reviewed by a regulatory expert. They are general information, not advice about your product.
Automated decision-making. Neither the Compass results held by this website nor the chat assistant makes decisions about you that produce legal effects or similarly significantly affect you within the meaning of Article 22 of the GDPR. The decisions that follow are yours. Where you want a regulatory judgement rather than an indication, a named senior expert reviews the work, as a paid service.
7. Confidentiality of your product information
Product information given to Venitara is commercially sensitive, and much of it is not personal data at all. We treat it as confidential either way. Access is limited to the people who need it, and the data held for this website is stored in the European Union, in Ireland.
8. Storage on your device, and anonymous measurement
We set no cookies, and we store nothing on your device for tracking or measurement. The site uses your browser's own storage only for functions you ask for, which § 25(2) TDDDG permits without consent.
| Stored item | Where | What it does | How long |
|---|---|---|---|
| Chat conversation | Session storage | Keeps the conversation while you use the assistant | Until you close the tab or reset the chat |
| Chat session identifier | Session storage | Keeps one chat session per tab. Never stored by us. | Until you close the tab |
| Dismissed notices | Local storage | Remembers that you closed an announcement or the chat prompt | Until you clear your browser data |
Booking a call. A booking button takes you through a short redirect on venitara.com to our booking page on calendly.com. The redirect stores nothing on your device. Calendly's page runs under Calendly's own cookie notice and shows its own cookie banner, and we receive no information from cookies set there.
Anonymous usage measurement. When you open a Compass result, use the contact form, or use the chat assistant's hand-off form, the site sends us a small anonymous record of what happened, for example that a result was viewed or a form was sent. Each record carries the name of the event, the time, the page where your visit began, the website you arrived from (the site name only, never the full address), a campaign tag if the link you followed carried one, and a random identifier that exists only in the open page and is discarded when you leave or reload it. Compass records also carry how a result was opened. Records made before 2 October 2026, while the Compass ran on this website, may also carry which Compass question had been reached. Contact records carry which form you used and the page you sent it from. The records contain no email address, no answers, no message text, and no IP address, and nothing is stored on your device to produce them. We keep them for 180 days. Like every request to our servers, the request that carries the record is also logged by our database provider's infrastructure, as section 3 explains.
Visit statistics from our hosting provider. Our hosting provider, Vercel, counts visits to this site for us with its Web Analytics service. It sets no cookies and stores nothing on your device. For each page you view it records the time, the page address, the website you arrived from, an approximate location derived from your IP address (country, region, and city), and your device type, operating system, and browser. It also records, in the same way, a click on a link that starts the MedTech Compass, a click through to our contact page, and a request for a guide as a PDF. Each of these carries only its name, the page and the part of the page it came from, and, for a guide, which guide was requested. The page address is sent without its query string, apart from any campaign tag, so the private link to a Compass result is never included. To tell one visitor from another without identifying anyone, Vercel forms a hash from the incoming request and discards it after 24 hours. We see aggregated figures only.
9. Who processes personal data for us
We do not sell personal data, and we do not share it for advertising.
These providers process personal data on our instructions, under a written data processing agreement:
| Provider | Role | Location |
|---|---|---|
| Vercel Inc. | Website hosting and delivery, and visit statistics | United States, with a global delivery network |
| Supabase Pte. Ltd. | Database and server functions | Singapore entity. Data stored in Ireland (EU). |
| Sendinblue SAS, trading as Brevo | Delivers form submissions to our inbox, sends the guides you ask for, and sends Regulatory Matters to subscribers | France (EU) |
| Google Cloud EMEA Limited (Google Workspace) | Email, including the inbox that receives form submissions | Ireland entity. Data may be processed in the United States and elsewhere. |
| Anthropic Ireland, Limited | AI processing for the chat assistant, carried out by Anthropic PBC | United States |
| Calendly LLC | Booking pages and scheduling for calls | United States |
| Attio Ltd | Customer relationship system for enquiries, applications, bookings, and partnership outreach | United Kingdom, hosted on Google Cloud |
Where it helps us answer an enquiry or deliver an engagement, we share what is necessary with Venitara personnel and with named specialists working under a confidentiality agreement.
We disclose personal data to professional advisers, authorities, or courts where the law requires it, or where it is necessary to establish or defend a legal claim.
HealthSeed AG, co-owner of the Venitara business, does not receive personal data from this website as a matter of course. Where an enquiry would be better handled by HealthSeed AG, we ask you first.
10. International transfers
The database behind this website stores its data in the European Union, in Ireland. Some of our providers are based outside the European Economic Area, or process data there:
| Provider | Where | Safeguard |
|---|---|---|
| Vercel Inc. | United States | EU-US Data Privacy Framework, under which Vercel is certified, and the Standard Contractual Clauses in its data processing agreement |
| Google (Google Workspace) | United States and elsewhere | EU-US Data Privacy Framework, under which Google LLC is certified, and the Standard Contractual Clauses |
| Anthropic | United States | Standard Contractual Clauses |
| Supabase Pte. Ltd. | Singapore, for support and operations; data stored in Ireland | Standard Contractual Clauses |
| Calendly LLC | United States and elsewhere | EU-US Data Privacy Framework, under which Calendly LLC is certified, with the Standard Contractual Clauses in its data processing agreement as a fallback |
| Attio Ltd | United Kingdom, with some sub-processors in the United States | The European Commission's adequacy decision for the United Kingdom, and the Standard Contractual Clauses in Attio's data processing agreement for onward transfers |
Where we rely on the Standard Contractual Clauses, we have assessed the transfer. You can ask us for a copy of the relevant safeguards at privacy@venitara.com.
11. When we act as a processor
Under a services agreement, most of what a customer sends us is company and product information. Where it contains personal data, for example staff names in a quality record, the customer remains the controller and Venitara acts as a processor under Article 28 of the GDPR, on the terms of our data processing agreement. If your data reached us through a customer, contact that customer to exercise your rights, and we will pass on any request we receive.
12. How long we keep personal data
| Data | Retention |
|---|---|
| Hosting request logs | One day |
| Server function logs, including IP address, user agent, and approximate location | Seven days |
| Compass answers, result, and email | 12 months after submission, then deleted |
| Chat questions | 180 days |
| Chat rate-limit records | 180 days |
| Contact form and hand-off messages, including the copy delivered to our inbox | 24 months after submission. If an enquiry leads to an engagement, the correspondence becomes part of the client record and is kept for the engagement and the statutory periods. |
| Call bookings and booking answers, held by Calendly and in our calendars | 24 months after the call. If the call leads to an engagement, the record becomes part of the client record and is kept for the engagement and the statutory periods. |
| Booking copies in our website database | One month, then deleted. They are passed to our customer relationship system within minutes of booking. |
| Enquiry, application, and booking records in our customer relationship system | 24 months after our last contact with you. If you become a client, the record is kept for the engagement and the statutory periods. |
| Partnership outreach records | 24 months after our last contact with you. If you ask us not to contact you again, we keep your email address and the date of your request on a suppression list for as long as we contact programmes, so that we do not write to you again |
| Partnership applications, including the copy delivered to our inbox | 24 months after submission |
| Guide requests | 24 months after submission. If you confirmed that you want our guides and regulatory updates, we keep the record of your consent and its confirmation while you are subscribed and for 24 months after you unsubscribe, so that we can show you agreed. |
| Regulatory Matters sign-ups | 24 months after sign-up if you do not confirm your address. If you confirm, we keep the record of your consent and its confirmation while you are subscribed and for 24 months after you unsubscribe, so that we can show you agreed. |
| Anonymous usage records | 180 days |
| Records we must keep by law, including tax and accounting | The statutory period, in Germany generally up to ten years |
13. Your rights
You can ask us to give you access to your personal data, correct it, delete it, restrict how we use it, or provide it in a portable form. You can object to processing we base on legitimate interests, and you can withdraw consent at any time where we rely on it. If you object to our partnership emails, we stop, and we keep only what we need to make sure we do not contact you again.
Write to privacy@venitara.com. We answer within one month, and we tell you if we need longer. Because the chat questions we store are not linked to you, we may be unable to find your questions unless you tell us their exact wording and approximate time.
You can complain to a supervisory authority. Ours is:
Der Hessische Beauftragte für Datenschutz und InformationsfreiheitPostfach 316365021 WiesbadenGermanypoststelle@datenschutz.hessen.de
If you are elsewhere in the European Economic Area, you can complain to the authority where you live or work instead.
14. Data protection governance
We have assessed whether we are required to appoint a Data Protection Officer under Article 37 of the GDPR and § 38 of the German Federal Data Protection Act, and we are not. Data protection is owned by Niko Mangold, reachable at privacy@venitara.com.
15. Security
We protect personal data with access controls, encryption in transit and at rest, database-level access rules that block public access to every table holding personal data, and written commitments from our providers. No system is perfectly secure. If a breach is likely to result in a risk to you, we notify the supervisory authority and, where the law requires it, you.
16. Children
This website is for professional use. It is not directed at children, and we do not knowingly collect personal data from them.
17. Changes
We update this notice when our processing changes. The current version is always on this page with the date of the last update, and we keep previous versions.
18. Contact
privacy@venitara.com, or Mangold Consultants, Kirchbergstraße 20, 64625 Bensheim, Germany.
19. Change of controller when Venitara GmbH is registered
Venitara GmbH is a German company in formation, a joint venture of HealthSeed AG and Mangold Consultants. Until it is entered in the Handelsregister, Mangold Consultants operates this website and is the controller for everything described in this notice.
When Venitara GmbH is registered, the Venitara business, including the personal data held for it, transfers to Venitara GmbH, which becomes the controller. The purposes in section 4 and the retention periods in section 12 do not change. We rely on our legitimate interest in the continuity of the business for the transfer, under Article 6(1)(f) of the GDPR. Before it happens we update this notice, publish the date of the change, and tell anyone who has given us marketing consent. You can object to the transfer of your data, or ask us to delete it, at any time.
Annex A. European Union, EEA, and United Kingdom
Germany. Access to information on your device is governed by § 25 TDDDG. We store and read only what is strictly necessary for a function you have asked for, as section 8 sets out.
United Kingdom. Where we process personal data of people in the United Kingdom, the UK GDPR and the Data Protection Act 2018 apply alongside this notice, with the same rights. You can complain to the Information Commissioner's Office at ico.org.uk. We are not required to appoint a representative in the United Kingdom because our processing of UK personal data is occasional and low-risk.
Switzerland. Where the Swiss Federal Act on Data Protection applies, the rights in section 13 apply in the same way, and you can contact the Federal Data Protection and Information Commissioner.
Annex B. United States
Whether these laws apply to us. Most US state privacy statutes apply above volume thresholds Venitara is unlikely to reach, and several exclude business-to-business data. We have not assumed we are out of scope, and the rights below are offered to residents of any US state.
Sale and sharing. We do not sell personal information, we do not share it for cross-context behavioural advertising, and we have not done so in the preceding twelve months.
Your rights. You may request access to the personal information we hold, a portable copy, correction, and deletion. We do not carry out targeted advertising, sale, or profiling that produces legal or similarly significant effects. We do not discriminate against anyone who exercises a right.
Universal opt-out signals. We honour the Global Privacy Control and equivalent machine-readable signals.
Exercising a right. Write to privacy@venitara.com with the state you live in and the right you are exercising. You may use an authorised agent, and you may appeal a refusal by replying to our decision.
Annex C. Gulf Cooperation Council states
Saudi Arabia. The Personal Data Protection Law (Royal Decree M/19, as amended), its Implementing Regulations, and the Regulation on Personal Data Transfer Outside the Kingdom apply to the processing of personal data of individuals in the Kingdom. Where they apply to us, you have the rights to be informed, to access your personal data, to receive a copy, to have it corrected, and to have it destroyed. The Saudi Data and Artificial Intelligence Authority supervises the law.
United Arab Emirates. Federal Decree-Law No. 45 of 2021 applies to the processing of personal data of individuals in the UAE. Where we deal with a counterparty in the Dubai International Financial Centre or Abu Dhabi Global Market, the data protection law of that centre applies.
Qatar, Bahrain, Oman, and Kuwait. Where a local data protection law applies to our processing, we meet its transparency, lawful basis, security, and data subject rights obligations.
Where your data goes. The database behind this website stores its data in the European Union. Chat conversations are processed in the United States, as section 6 explains, and form submissions also reach our email inbox, which our email provider may process outside the European Union. Call bookings are processed in the United States by Calendly, and our records of enquiries, applications, and bookings are held by Attio in the United Kingdom. Section 10 sets out the safeguards for each.