Last updated: 25 August 2026 · version 1.3
BeatLab is an online training environment where healthcare professionals learn to interpret ECGs. This policy explains what personal data we process, why, for how long, and what rights you have.
BeatLab is built and operated by:
AcuteLabs, sole proprietorship of Dennis Sagel
Aalscholver 17
9728 XK Groningen, the Netherlands
Dutch Chamber of Commerce (KvK) number: 42058852
Email: hello@acutelabs.nl
AcuteLabs is the data controller — the party that decides what data is collected and why. Payment is the exception; see "Payment".
We have not appointed a Data Protection Officer.
The practice ECGs in BeatLab are generated by a simulator built from physiology; no real patient recordings are used. Where a future AcuteLabs training product does use real recordings — the forthcoming 1000 ECG training — they come from PTB-XL, a public research dataset (PhysioNet, CC BY 4.0; Wagner et al., Scientific Data 2020). Those recordings carry only an age band in ten-year steps and a sex — no names, dates of birth, recording dates or anything else that could identify a patient.
| Data | Why | Legal basis |
|---|---|---|
| Email address | To link your licence to you and let you sign in | Performance of the contract (Art. 6(1)(b) GDPR) |
| Licence status and expiry date | To determine whether you have access | Performance of the contract |
| Order reference from Link | To connect your purchase to your licence and to process a refund or cancellation | Performance of the contract |
| Your sign-in code, stored hashed | To check the code you enter against the one we emailed. We never store the code itself, only an irreversible hash | Performance of the contract |
Session cookie bl_session | To keep you signed in so you do not need a new code every visit | Strictly necessary for the service you requested |
| Requested page, browser type and language in the server log | To diagnose faults and to see which pages are used. Your IP address and cookies are removed before the line is written | Legitimate interest: security and availability (Art. 6(1)(f) GDPR) |
| Number of sign-in attempts per email and per IP address | To stop anyone flooding your inbox or guessing codes. Held in memory only, for at most 15 minutes, and never written to disk | Legitimate interest: security |
We never ask for your name, phone number, employer, job title or professional registration number.
Your lesson progress, exam status and signed-off exercises are stored in your browser's local storage. That data is never sent to us and we cannot see it. Clear your browser data and your progress is gone. Use a different computer and you start fresh there.
BeatLab costs € 34.99 per year, including VAT. Payment and sale run through Link, acting as Merchant of Record for Stripe’s Managed Payments. This means Link is legally the selling party, collects the payment, handles sales tax and VAT, and is independently responsible for the data you enter on their checkout page. From them, AcuteLabs receives only your email address and an order reference — enough to grant you access, nothing more. We do not receive or issue licence keys; you sign in with your email address.
For anything about your payment, invoice, tax or refund, please refer to Link and their own privacy policy, linked from the checkout page you used.
We use a small number of providers that process data on our behalf (processors: they may only use the data as we instruct them).
| Provider | What they do | Where the data sits |
|---|---|---|
| Hetzner Online GmbH | Provides the server that runs BeatLab and holds the licence records | Germany (EU) |
| Resend (sending via Amazon SES) | Sends your sign-in email | Processed in the EU region (Ireland). Resend is a US company; access from the US cannot be fully excluded. |
| Link (Stripe Managed Payments) | Processes the payment. As Merchant of Record they are an independent controller, not our processor | Their own privacy policy applies to your payment data |
Some practice pages load their 3D rendering library and typeface from external services: Cloudflare (cdnjs), jsDelivr and Google Fonts. Your browser connects to those services directly, so they can see your IP address and which file you requested. We send them no data ourselves. We are moving these files onto our own server so that these connections disappear.
Our server and our email sending are in the EU. Where any of the providers above processes data outside the EEA, this takes place under the European Commission's Standard Contractual Clauses or an equivalent safeguard.
| Data | Retention |
|---|---|
| Email address, licence status, order ID | For as long as your licence is valid, plus 12 months afterwards so renewal and support remain possible. We then delete it |
| Hashed sign-in code | 15 minutes; the code then expires and is purged |
| IDs of used sign-in links | 15 minutes after use; then purged |
Session cookie bl_session | 30 days, or until you sign out |
| Server log (which page, when) | The IP address and cookies are stripped before the line is written, so the log holds no personal data. Files rotate automatically |
| Records relating to your purchase | The statutory tax retention obligation sits with Link as Merchant of Record. For our own bookkeeping: 7 years, the statutory retention period for business records in the Netherlands |
BeatLab uses no advertising, analytics or tracking cookies. There is therefore no cookie banner.
| Type | Name | Purpose | Duration |
|---|---|---|---|
| Cookie | bl_session | Keeps you signed in. Readable only by the server (HttpOnly), sent only over a secure connection (Secure), and not sent to other sites (SameSite=Lax) | 30 days |
| Local storage | progress, exam status, sign-offs, display preference | Stores your progress on your own device. Never sent to us | Until you clear your browser data |
No measure is perfect. If you notice something insecure, email us at hello@acutelabs.nl; we respond within 5 working days.
You have the right to:
Send your request to hello@acutelabs.nl from the email address you use for BeatLab. We respond within one month. If you ask for deletion while your licence is still running, your access to BeatLab ends with it.
If you disagree with how we handle your data, please tell us first — we would rather fix it. You always have the right to complain to the Dutch supervisory authority:
Autoriteit Persoonsgegevens, PO Box 93374, 2509 AJ The Hague, the Netherlands — autoriteitpersoonsgegevens.nl
If you live in another EU country, you may also complain to your own national supervisory authority.
If something goes wrong with your data, we report it to the Dutch Data Protection Authority within 72 hours where the law requires it, and we notify you directly where the breach poses a high risk to you.
BeatLab is intended for healthcare professionals and is not directed at anyone under 16. We do not knowingly collect data from minors.
We may update this policy. The date at the top shows when it last changed. For any material change we notify active users by email.
AcuteLabs is a registered trade name of Gezondheidszorg, Wetenschap en Verpleegkunde, a sole proprietorship registered in the Netherlands.
KVK 42058852 · Aalscholver 17, 9728 XK Groningen · hello@acutelabs.nl