Privacy notice

Last updated: 2026-09-19

Who is responsible for your data

The controller of the personal data described in this notice is Dominik Myszkowski (HerbaPortal). You can reach me at contact@herbaportal.com or through the contact form. The notice covers this site, the HerbaPortal demo at demo.herbaportal.com, and the businesses I contact on my own initiative.

What is processed, and why

The contact form collects your name, email address and message. I process them to answer your inquiry and to take steps prior to entering into a contract at your request (Art. 6(1)(b) GDPR), and on the basis of my legitimate interest in responding to correspondence (Art. 6(1)(f) GDPR).

For abuse protection, the site processes the IP address of form submissions briefly in server memory (rate limiting) and in server logs — on the basis of my legitimate interest in keeping the service secure (Art. 6(1)(f) GDPR).

Newsletter

If you subscribe to the newsletter, I process your email address to send it, on the basis of your consent (Art. 6(1)(a) GDPR). Signup is single opt-in: subscribing takes effect immediately, and every message carries a one-click unsubscribe link. The subscriber list is kept with my email delivery provider (Plunk) and your address is deleted from it when you unsubscribe. Withdrawing consent does not affect the lawfulness of processing before the withdrawal.

Requesting access to the demo

The form at demo.herbaportal.com, where you ask for access to the HerbaPortal demo, collects your name, email address, country, preferred language and the name of your practice or business, and — if you give them — your phone number, tax ID and a message. It also stores the password you choose, only as a one-way hash, so that you can sign in once the request is approved, and a short code naming the page or letter that sent you to the form. Your IP address is not stored with the request.

I use these details to confirm your email address, decide on your request, give you access to the demo and write to you about it — steps taken at your request before any contract (Art. 6(1)(b) GDPR).

A request whose email address is never confirmed is deleted automatically after 24 hours. A confirmed request is deleted automatically 12 months after confirmation, whether it was approved or not.

If I approve it, you get a practitioner account on the demo with a few invented sample patients, and what you enter there is stored in the demo. The demo is a showcase, not a place to work: please enter invented details only, never real patient records. I delete the account when you ask, and in any case 12 months after approval.

The demo runs on OVHcloud servers in the European Union — in France, with backups in Poland. Its emails are sent through Plunk, which also keeps a record of the addresses it delivers to.

If I contacted your business first

If I wrote to your business before you wrote to me, I process the business contact details I found: the company name, the name and role of the person I address, the business postal and email address, the phone number, and notes on our correspondence. They come from public sources — your company's website, a public business register, a trade directory or a trade fair — and every first message names the source it used.

I process them to present HerbaPortal to your business, on the basis of my legitimate interest in direct marketing to businesses (Art. 6(1)(f) GDPR). I collect only details connected with a person's business role, and I do not buy contact lists. Where the law of your country requires prior consent to business email or phone contact, my first contact is by letter.

I keep them until you object, and if you do not reply, for at most 12 months after my last message; if you do reply, the correspondence is kept as described under “How long I keep it”. After an objection I keep only the company name, the address I used and the date of the objection, on a do-not-contact list, so that you are never contacted again — for that single purpose (Art. 6(1)(f) GDPR).

You can object at any time, without giving a reason — reply “STOP” or write to contact@herbaportal.com — and I will not contact you again (Art. 21(2)–(3) GDPR).

The contact list and my correspondence are kept in my Google Workspace account (Google Ireland Limited). Google may process data outside the European Economic Area; such transfers are covered by the EU–US Data Privacy Framework and the European Commission's standard contractual clauses. Emails to people who have asked to hear from me may also be sent through Plunk.

Cookies

This site sets no cookies of its own. Your color-theme preference is stored only in your own browser (localStorage) and is never transmitted.

The anti-spam check on the contact and newsletter forms (Cloudflare Turnstile) may store a cookie or a local-storage entry in your browser to tell a person from a bot. It is used for that check only — not to build a profile of you and not to track you across sites.

Who receives the data

Contact messages are delivered to my inbox through an email delivery provider (Plunk). The site is hosted on infrastructure in the European Union.

When you submit either form, an anti-spam check runs through Cloudflare Turnstile: your browser contacts Cloudflare and my server asks Cloudflare to confirm the result, passing your IP address. That happens on the basis of my legitimate interest in protecting the forms from automated abuse (Art. 6(1)(f) GDPR). Cloudflare states that Turnstile data is not used to build advertising profiles.

How long I keep it

Correspondence is kept as long as needed for the exchange and any resulting pre-contractual discussions, at most 3 years, then deleted.

Your rights

You have the right to access, rectify and erase your data, to restrict or object to its processing, and to data portability. You can also lodge a complaint with a supervisory authority — in Poland, the President of the Personal Data Protection Office (UODO).

No automated decision-making or profiling takes place.

You can object at any time to processing based on legitimate interest. An objection to direct marketing is always honoured, with no weighing of interests (Art. 21 GDPR).