Privacy Policy

Updated 3 October 2026

1. Who we are

This policy explains which personal data we process when you visit www.postmodel.ai or contact us, why we do it and what rights you have. Postmodel is a brand of OmniMed Global B.V.

Controller

OmniMed Global B.V., Krom Boomssloot 5, 1011 GP Amsterdam, Netherlands. Dutch Chamber of Commerce (KvK): 98643908.

Privacy contact

info@postmodel.ai. We reply within one month.

Scope

This policy covers this website and enquiries made through it. When we build systems for clients and handle their data on their behalf, we do so as a processor under a separate data processing agreement with that client, and this policy does not apply to that data.

2. Visiting this website

Our website is hosted by Framer B.V., Rozengracht 207B, 1016 LZ Amsterdam, Netherlands, which processes data on our behalf. When you open a page, your browser sends technical data that is needed to deliver the page and keep the service secure: your IP address, the page requested, the time, and your browser and device type. We do not use this data to identify you. Legal basis: our legitimate interest in a secure, working website (Art. 6(1)(f) GDPR).

3. Analytics without cookies

We use the analytics built into our website platform to see how the site is used in aggregate: which pages are visited, from which websites people arrive, and on which devices and in which countries. This analytics sets no cookies and stores no data that identifies a person. IP addresses are combined with a secret that changes and is deleted every day, so visits cannot be traced back to you. We do not use advertising or tracking cookies, so we do not show a cookie banner. Legal basis: our legitimate interest in understanding and improving the website (Art. 6(1)(f) GDPR).

4. Fonts from Google

To display the site correctly, your browser loads some fonts from Google Fonts (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Your browser sends your IP address to Google when it requests the font files. Google may process data in the United States (see section 8). Legal basis: our legitimate interest in a consistent display of the website (Art. 6(1)(f) GDPR).

5. Project enquiries and the Workflow Brief

When you use our contact form, we receive your name, work email, company and the project description you write. We use this to reply to you, to understand whether we can help and to prepare a possible proposal. Form submissions are sent by our website provider to our company email address and recorded in our CRM system, where we manage follow-up. We do not use the content of your enquiry to train AI models.

Legal basis: steps you ask us to take before a possible contract (Art. 6(1)(b) GDPR) and our legitimate interest in responding to business enquiries (Art. 6(1)(f) GDPR). Providing data is voluntary; without an email address we cannot reply.

Please do not send patient data, other health data or client-confidential documents through the form. If a project needs such information, we will agree a secure way to share it.

The Workflow Brief: when you use the brief tool on our website, you answer five questions about one workflow and give your work email and, if you wish, your company. We first send you a confirmation email. Only after you confirm do we write the brief, send it to you by email and record your request in our CRM system. The brief is written automatically from your answers by an AI language model, operated by a provider that acts on our instructions; a person does not check the brief before it is sent, and your answers are not used to train AI models. If you do not confirm, we do not contact you and your answers are deleted (see section 9).

Legal basis for the Workflow Brief: your consent (Art. 6(1)(a) GDPR), which you give by confirming your email address. It covers sending the brief and contacting you by email about it and related content. You can withdraw it at any time by replying to one of our emails or by writing to us; this does not affect what happened before. We keep a record of your consent: the text you agreed to, the time, and a keyed hash of your IP address, which does not let us read the address back. Please do not enter personal data of other people, patient data or confidential information in your answers.

6. Email and calls

If you write to us by email or we speak by video call, we process your contact details and what you tell us in order to communicate with you and to prepare or carry out a project. We use Google Workspace from Google Ireland Limited for email, calendar and video calls (Google Meet). Legal basis: Art. 6(1)(b) and (f) GDPR, as in section 5.

7. Who receives your data

Inside Postmodel, only the people who handle enquiries and projects see your data. Outside Postmodel, we use these service providers, which process data only on our instructions under data processing agreements (Art. 28 GDPR):

  • Framer B.V.: website hosting, contact form and analytics

  • Google Ireland Limited: email, calendar, video calls and fonts

  • Our CRM provider: managing enquiries and follow-up, and running the brief tool

  • A provider of AI language models, used through our CRM provider: writing the Workflow Brief you ask for

We do not sell personal data and do not share it for advertising.

8. Transfers outside the European Economic Area

Some of our providers, or the companies they use, may process data outside the European Economic Area, in particular in the United States. In that case the transfer relies on an adequacy decision of the European Commission, such as the EU–US Data Privacy Framework for certified companies, or on the European Commission’s standard contractual clauses (Art. 46 GDPR). You can ask us for a copy of the relevant safeguards.

9. How long we keep data

  • Enquiries that do not lead to a project, including the copy in our CRM system: deleted 12 months after our last contact.

  • Workflow Brief requests you do not confirm: the confirmation link expires after 48 hours and the request is deleted within seven days after that.

  • Confirmed Workflow Brief requests, the brief and the record of your consent: kept like an enquiry, so deleted 12 months after our last contact, or earlier if you withdraw your consent and ask us to delete them.

  • Enquiries that lead to a project: kept for the duration of the business relationship. After that we keep the records the law requires, such as invoices and contracts, for the statutory period, in the Netherlands generally seven years.

  • Analytics: aggregate figures only, with no data that identifies you.

  • Technical data from section 2: kept by our website provider only as long as needed to deliver and secure the service.

10. Your rights, complaints and changes

You have the right to access your personal data, to have it corrected or deleted, to restrict its processing, to receive it in a portable format and to object to processing based on our legitimate interest (Art. 21 GDPR). Where we rely on your consent, you can withdraw it at any time. To use these rights, write to info@postmodel.ai.

You can also complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or to the data protection authority in the country where you live or work.

We do not make decisions about you based solely on automated processing. We update this policy when our website or providers change; the date at the top shows the current version.