DE
Contact
Products for your practice
Overview for physicians →
Patient Navigator
All care data in one place.
Document Assistant
Letters and reports drafted from your existing records.
Trial Navigator
Eligible trial candidates, found automatically.
Care Assistant
Care gaps, coding and billing checks.
Clinical Validation
Nothing leaves without a physician’s release.
Also relevant:
Study CentersReferral PracticesPricing
Your contact
Drive innovation in medicine.

Let’s talk about saving valuable time in your practice.

Sabine Kramp
Head of Medical Partnerships
Let’s Talk
Sabine Kramp, Head of Medical Partnerships bei MPIRIQ
Physicians
Patient Navigator
All care data in one place.
Document Assistant
Letters and reports drafted from your existing records.
Trial Navigator
Eligible trial candidates, found automatically.
Care Assistant
Care gaps, coding and billing checks.
Clinical Validation
Nothing leaves without a physician’s release.
OverviewStudy CentersReferral PracticesPricing
Your contact
Sabine Kramp
Head of Medical Partnerships
→
PharmaAbout usThe TeamCareer
Talk to us
Data protection for patients

Your trust is the foundationof our work.

MPIRIQ uses artificial intelligence to match patients with suitable clinical trials. For this to happen responsibly, data protection is not a box-ticking exercise for us. It is the architecture our product is built on.

The foundation

A secure collaboration.

Before we talk about encryption, audits or certificates, we start with the foundation: structural decisions we have made deliberately.

De-identified from the start

Your identity never leaves your doctor’s practice. What reaches MPIRIQ is exclusively de-identified medical data, without name, address or date of birth.

Data in Germany

Patient data is processed exclusively in Germany, on certified servers in German data centres. No transfer to third countries takes place.

Concrete and verifiable

What we see, and what we don’t.

An overview of the data categories we work with, and of those that never reach our systems.

What MPIRIQ processes

  • Medical data on diagnoses
  • Data on prior treatment history
  • General medical characteristics

What MPIRIQ never receives

  • Your first or last name
  • Address or postal code
  • Insurance or social security number
  • Phone number, email or other contact details
  • A key for re-identification
Legal basis

On what basis do we process your data?

Health data is subject to special protection under Art. 9 GDPR. We base our processing on clearly defined legal grounds, depending on the purpose.

Art. 9 (2) (j) GDPR in conjunction with § 27 BDSG
Art. 9(2)(j) GDPR in conjunction with Section 27 BDSG

Scientific research

Matching patient data with clinical trials is a recognised scientific research purpose. The research clause permits this processing under the strict safeguards of the BDSG, the German Federal Data Protection Act, which we implement without exception.

§ 6 Health Data Use Act (GDNG)
Section 6 GDNG

Secondary use of healthcare data

The GDNG permits the further processing of lawfully stored health data for the purposes of research, quality assurance and statistics. MPIRIQ acts as the data-processing institution within the meaning of the act.

Art. 9 (2) (a) GDPR
Art. 9(2)(a) GDPR

Explicit consent

As soon as your concrete participation in an interventional clinical trial is concerned, the practice staff will reach out to you. You will be informed about the nature and scope of the trial, and your written consent will be obtained.

Deliberately excluded

What is excluded at MPIRIQ.

Data protection is shaped not only by what happens, but also by what deliberately does not happen. Three statements that clearly delineate our business model and our architecture.

Advertising and marketing

Advertising, marketing or commercial profiling are not among the purposes of our processing.

AI model training

Patient data is not used for the training of external third-party AI models.

Disclosure of personal data to third parties

Disclosure of your personal data without your written consent is excluded.

Technical and organisational measures

What happens behind the scenes.

Beyond the architecture, concrete technical and organisational measures are in place, in line with the requirements of the GDPR and the BDSG.

Encryption

Transmission via TLS 1.2 or higher, storage with AES-256. No unencrypted data traffic leaves our systems.

Multi-factor authentication

Mandatory multi-factor authentication for all employees with data access.

Access control

Need-to-know principle: employees only see the data required for their specific task. Roles and permissions are reviewed regularly.

Comprehensive logging

Every access to patient data and every processing operation is logged in an auditable manner and protected against manipulation.

Contractual safeguards

With our close partners who process personal data, we conclude data processing agreements pursuant to Art. 28 GDPR.

Security audits

Our infrastructure and processes are regularly reviewed through internal and external audits.

Incident response

In the event of an incident, a documented procedure takes effect, with clear reporting channels, a 72-hour notification obligation to supervisory authorities, and transparent information for those affected.

Backup and availability

Encrypted backups, geo-redundant storage and regular restore tests ensure the availability of your data.