Privacy policy

Last updated: 2 October 2026

This policy covers open-fhir.com, the website of openFHIR. It explains what the site collects, why, who receives it, and how to opt out.

The site is operated by Syntaric d.o.o., Parižlje 117, 3314 Braslovče, Slovenia, which is the controller of the personal data described here. For anything in this policy, write to info@open-fhir.com.

What we collect, and why

When you request access

The access form asks for your email address, whether you want a trial licence or sandbox access, and whether you are interested in commercial options. We use this to issue the licence or create your sandbox credentials and send them to you. Sandbox credentials are stored together with your email address in the identity service of sandbox.open-fhir.com.

As the form says, we may also write to you about openFHIR. Every such email can be stopped: reply to it, or write to info@open-fhir.com, and we will remove you.

When you send an enquiry

The form on the EHDS page asks for your email address, your organisation and a message. We use them to answer you.

Which campaign brought you here

If you arrive through one of our ads or posts, the link carries campaign parameters (utm_source, utm_medium, utm_campaign, utm_content, utm_term) and sometimes a click ID from Google (gclid) or LinkedIn (li_fat_id). The site keeps these, together with the first page you opened and the page you came from, in your browser's session storage. They stay in that browser tab and are gone when you close it.

They are sent to us only if you submit one of the two forms. We store them with your request, so that we know which campaigns lead to requests. This does not depend on the cookie choice below, because nothing is sent unless you send a form.

Spam protection

Both forms are protected by Google reCAPTCHA, which is loaded on the pages that have a form. To tell people from bots, reCAPTCHA sends Google information about your browser and how you interact with the page, and may set its own cookies.

Visit statistics, only with your consent

If you agree in the cookie banner, Google Analytics records which pages you open, which links to our demo, sandbox and documentation you click, and whether a form was sent. It sets cookies to recognise your browser on later visits.

If you decline, no analytics cookies are set. Google Analytics then still receives a notice that a page was opened, without any identifier stored on your device, which Google uses to estimate visitor numbers.

Campaign measurement, only with your consent

If you agree, Google Ads and the LinkedIn Insight Tag learn that a visit which started from one of our ads led to a request. Google and LinkedIn can use this for ad measurement and for building audiences. The LinkedIn script is not loaded at all unless you agree.

Cookies

You can change your choice at any time: open the cookie settings.

Who receives your data

• Google (Google Ireland Limited): reCAPTCHA, and with your consent Google Analytics and Google Ads. Google's privacy policy
• LinkedIn (LinkedIn Ireland Unlimited Company): the Insight Tag, with your consent. LinkedIn's privacy policy
• Zoho: our email provider. The emails we send you, and the notifications we receive about requests, pass through Zoho Mail. Zoho's privacy policy
• Amazon CloudFront and Webflow: a script library and the font used by the site are loaded from their content delivery networks, which see your IP address when the files are fetched.

Google and LinkedIn may process data outside the European Union. We do not sell your data, and we do not share it with anyone else.

Legal basis

• Issuing a licence or sandbox access and answering your enquiry: taking the steps you asked for (GDPR Article 6(1)(b)).
• Analytics and campaign measurement cookies: your consent (Article 6(1)(a)), which you can withdraw at any time in the cookie settings.
• Spam protection, and recording which campaign led to a request: our legitimate interest in keeping the forms usable and in knowing whether our campaigns work (Article 6(1)(f)).

How long we keep it

We keep access requests and enquiries, with the campaign information attached to them, for as long as we are in contact with you about openFHIR, and delete them when you ask. Google Analytics deletes visit data after 14 months.

Your rights

You can ask us for a copy of the data we hold about you, have it corrected or deleted, restrict or object to its use, and receive it in a portable format. You can withdraw a consent at any time. Write to info@open-fhir.com and we will act on it. You also have the right to complain to the data protection authority of your country.