ECR App Privacy Policy
Privacy information for the ECR App
Last updated: 5 November 2026
This Privacy Policy explains how the European Society of Radiology (ESR) processes personal data when you use the ECR App. It applies to the mobile ECR App only.
1. Controller and contact
The controller responsible for the processing described in this Privacy Policy is:
European Society of Radiology (ESR)
Am Gestade 1
1010 Vienna
Austria
Email: [email protected]
Privacy enquiries and data-subject requests can be sent to the contact address above.
2. How the ECR App can be used
The ECR App can be used without logging in for basic functions such as the congress programme, general information and floorplans. Logged-in functions, including protected live/on-demand content and Art Explorer, require authentication through the ESR Portal/OAuth system.
The App does not use GPS for navigation or continuous location tracking, does not collect photos or videos, and does not use an advertising ID. The native App may request camera, Bluetooth and, on older Android versions, location permissions for the specific functions described below. Standard HTML5 LocalStorage is used only for technical App state, cached data and user preferences.
Camera access is used in real time for functions such as scanning QR codes, including Art Explorer and attendee badge codes, and for supported light-show torch/flash effects. The App does not record, store or upload photos or video frames for these purposes.
Bluetooth Low Energy (BLE) is used for synchronized arena light-show functionality. On older Android versions, the operating system requires fine/coarse location permission for BLE scanning. These permissions are not used to obtain GPS coordinates or to track the user’s location.
3. Technical operation of the App and server logs
| Item | Information |
|---|---|
| Data processed | IP address in server logs, timestamp, HTTP request method, request URI, HTTP status, response size, referrer, user agent, device type, operating system, App version and technical performance/usage information. |
| Purpose | Operate a stable, secure and technically functional App and troubleshoot technical problems. |
| Legal basis | Art. 6(1)(f) GDPR – ESR’s legitimate interests in secure, stable and reliable App operation. |
| Recipients | ESR, ESR IT, authorised development/maintenance personnel and the hosting provider used for ESR Connect/ECR App infrastructure. |
| Location / transfers | Core backend and database hosting is in Frankfurt, Germany / EU. |
| Retention | Server logs and rolling backups are normally retained for 14–30 days. |
4. Login, account authentication and access checks
If you log in, authentication is handled through the ESR Portal/OAuth system. The ECR App receives the personal data required by the current App integration.
| Item | Information |
|---|---|
| Data processed | Name, email address, ESR user ID, membership status, date of birth, gender and authentication/session token. |
| Purpose | Authenticate users, provide personalised or restricted App functions and associate user-specific functions with the correct ESR account. |
| Legal basis | Art. 6(1)(b) GDPR – performance of the congress/App services requested by the user. |
| Recipients | ESR Portal/OAuth, ESR Connect/ECR App backend and authorised technical service providers. |
| Retention | Authentication sessions are dynamic. Standard sessions are generally 24 hours; where congress access is time-limited, session validity follows the relevant access period, with a minimum session duration of one hour. Account-linked App data is retained while the ESR account remains active, subject to applicable erasure or anonymisation requirements. |
Optional biometric login: If supported by the device, users can enable Face ID, Touch ID or Android biometric authentication for passwordless re-authentication. When enabled, the credentials required for re-authentication are stored in encrypted device storage using the security mechanisms provided by iOS or Android, such as Keychain or Android Keystore. ESR does not receive or store fingerprints, facial templates or other biometric authentication data. Biometric verification is performed by the device operating system, and the App receives only the authentication result. A local preference records whether biometric login is enabled.
For access-controlled services, the App also processes the participant’s registration/ticket type and access status in order to determine entitlement to protected content and Art Explorer. These records are retained for seven years for audit, CME-compliance and historical participation purposes. The registration/access status is not displayed to other users.
5. Live and on-demand content
Login is required for protected live and on-demand content. ESR uses ESR Connect together with Dacast, Metafusion and related streaming/CDN infrastructure to deliver live and on-demand video content.
| Item | Information |
|---|---|
| Data processed for delivery | Access status, programme/video/session identifiers and technical connection information required to deliver the stream. |
| Purpose | Provide the protected live or on-demand congress content requested by eligible participants. |
| Legal basis | Art. 6(1)(b) GDPR – performance of the requested congress service. |
| Recipients | ESR Connect, Dacast, Metafusion and related streaming/CDN infrastructure. |
| International processing | ESR does not intentionally transmit ESR account identifiers to the external streaming providers. Stream delivery nevertheless involves technical connection and audience data required to deliver the content. Depending on the provider and CDN used, this processing may involve infrastructure outside the EEA. |
5.1 Viewing and watch-time records
For logged-in viewers, ESR records individual viewing activity. These records are used in particular for CME/attendance verification and to maintain a record of watched educational content.
| Item | Information |
|---|---|
| Data processed | ESR user ID, course/session ID, type of content (live/on-demand/congress), playback events including load, ready, play, pause, ended, unload and app-play, video/lecture ID, timestamps and whether the activity occurred in the App or on the web. |
| Purpose | Document participation for CME/attendance verification; maintain watched-event information; generate statistics on the use of ECR educational content. |
| Legal basis | Art. 6(1)(b) GDPR for CME/participation verification. Art. 6(1)(f) GDPR for additional programme evaluation, with aggregated reporting used where possible. |
| Recipients | Authorised ESR staff responsible for congress operations, education and CME administration. |
| Retention | Up to seven years, reflecting the confirmed 5–7 year operational retention period for CME verification and accreditation audits. |
6. App analytics
ESR uses two analytics systems with different legal bases.
Matomo provides basic, privacy-minimised statistics about how the App is used. It operates independently of login status and your Google Analytics consent choice, including when Google Analytics is declined. ESR relies on its legitimate interests in understanding App usage and improving the App and congress services.
Google Analytics 4 (GA4) is optional. Google Tag Manager (GTM) and GA4 are loaded only after you give Google Analytics consent through the App’s consent banner. Before consent, or if you decline, neither is loaded and no requests, including cookieless measurement pings, are sent to Google through these analytics services. The banner is displayed independently of whether you are logged in. You can change or withdraw your consent under Settings → Privacy & Analytics. Firebase Analytics is not used.
| Item | Information |
|---|---|
| Data processed | Matomo: predefined screen, navigation and general click categories, timestamps and technical request metadata. Full navigation URLs, URL parameters, search terms and link text are not included in Matomo event payloads. GA4: App page/screen-view and screen-duration events, including page or screen title, path, URL/route, view/leave reason and screen duration. ESR does not send names, email addresses, ESR user IDs or login tokens to either analytics system. |
| Purpose | Understand which App functions are used, evaluate overall usage and improve the App and congress services. Matomo reports are used for aggregate evaluation rather than individual behavioural analysis. |
| Legal basis | Matomo: Article 6(1)(f) GDPR – ESR’s legitimate interests in obtaining basic, privacy-minimised usage statistics to evaluate and improve the App and congress services. GA4: Article 6(1)(a) GDPR – consent. |
| Matomo safeguards | Matomo uses no analytics cookies or persistent visitor identifiers. Its technical configuration identifier (config_ID) is randomised for each request. IP addresses are fully masked before storage in Matomo. Matomo events are not linked to ESR accounts, authentication records or identified Art Explorer records. Matomo is not used for advertising, cross-site tracking, profiling or recognition of returning users. |
| Recipients / hosting | Matomo: self-hosted on ESR infrastructure in Frankfurt, Germany / EU. Access is restricted to authorised ESR personnel and contracted hosting and technical maintenance providers acting on ESR’s behalf. GA4: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. |
| International transfers | Matomo: analytics data is hosted in Frankfurt, Germany / EU and does not create an additional Matomo-specific third-country transfer. GA4: Google may process data on global infrastructure, including outside the EEA. The applicable international transfer safeguards are described in Section 15. |
| Retention | Matomo: detailed analytics records are automatically deleted after 14 months. Aggregated statistical reports may be retained for longer to compare App usage across congress editions, provided those reports do not enable identification of individual users. GA4: user- and event-level data is subject to the configured 14-month retention period. This setting does not apply to standard aggregated reports. |
| User controls | Matomo: processing does not depend on GA4 consent. You may object to processing based on legitimate interests as described in Section 17. Where exposed by the browser or App WebView, enabled Do Not Track and Global Privacy Control signals are respected by the App’s Matomo integration. GA4: you can accept, decline or subsequently withdraw consent under Settings → Privacy & Analytics. Withdrawal stops future GA4 collection. |
The receiving infrastructure necessarily processes the source IP address and standard HTTP connection information when a Matomo request is delivered. IP masking in Matomo does not itself remove infrastructure access logs; technical server logs are handled separately as described in Section 3.
Google advertising features, retargeting and third-party advertising tracking are not used in the ECR App. Identified Art Explorer scan records are not sent to GA4 or Matomo.
7. Crash reports and diagnostics
The native App uses platform diagnostic services to identify and resolve crashes and stability problems. The confirmed diagnostic services are Google Play Vitals and Apple MetricKit.
| Item | Information |
|---|---|
| Data processed | Technical crash and diagnostic information such as stack trace, exception message, device model, operating-system version, App version and memory state. Platform diagnostic identifiers may be processed by the relevant provider. |
| Purpose | Troubleshooting, App stability and technical security. |
| Legal basis | Art. 6(1)(f) GDPR – ESR’s legitimate interests in secure and stable App operation. |
| Recipients | Google Play Vitals and Apple MetricKit. |
| International transfers | Google and Apple platform services may involve processing outside the EEA under their applicable transfer frameworks. |
| Retention | Diagnostic data is retained according to the retention rules of Google Play Vitals and Apple MetricKit. |
ESR does not intentionally include names or email addresses in crash reports.
8. Push notifications
If you enable push notifications, ESR processes the technical information required to send ECR App and congress-related notifications to your device.
| Item | Information |
|---|---|
| Data processed | Push token, ESR user ID in the ESR database, device manufacturer/model, SDK version, platform, UUID, event ID, timestamps, notification title/body/action URL and delivery/open information. |
| Purpose | Send congress and App notifications requested by the user. |
| Legal basis | Art. 6(1)(a) GDPR – consent. |
| Recipients | Firebase Cloud Messaging (Google) and, for iOS, Apple Push Notification Service. |
| International transfers | Google and Apple may process push-notification data on global infrastructure under their applicable transfer safeguards. |
| Retention | Push tokens are kept while active and are invalidated or purged when reported stale/invalid by Firebase, on logout or when the token is refreshed. |
You can disable notifications through your device settings. If notifications are disabled, you will no longer receive them.
9. Sponsor content
The App may display sponsor content such as built-in banners or images. This content is integrated directly into the App and is not delivered through an external advertising network.
Where you have consented to Google Analytics, sponsor-content views and clicks may be measured through Google Tag Manager / GA4 to produce aggregated sponsor-performance reports.
| Item | Information |
|---|---|
| Data processed | Sponsor-content view and click events measured through Google Tag Manager / GA4 after analytics consent. ESR does not send names, ESR user IDs, email addresses or login tokens with these events. |
| Purpose | Measure sponsor-content performance and provide aggregated performance reports to relevant sponsors. |
| Legal basis | Article 6(1)(a) GDPR – consent, using the same Google Analytics consent choice described in Section 6. |
| Recipients | ESR and Google for analytics processing. Relevant sponsors receive aggregated statistics only. |
| Retention | GA4 user- and event-level data is subject to the configured 14-month retention period. Standard aggregated reports are not subject to this setting. ESR does not maintain a separate sponsor-click backend log. |
| User controls | Sponsor-specific GA4 measurement remains disabled unless you consent to Google Analytics. Consent can be changed or withdrawn under Settings → Privacy & Analytics. |
Independently of GA4 consent, the basic Matomo statistics described in Section 6 may include general clicks on App controls and links, including links within sponsor content. These Matomo events do not identify the individual sponsor, banner or campaign and are not used to produce sponsor-specific performance reports.
Sponsors do not receive names, ESR user IDs or individual click histories. Sponsor content is not used for retargeting or individual behavioural advertising.
10. Synchronized arena light show (CrowdGlow)
The native ECR App integrates the CrowdGlow SDK to enable synchronized audience light effects during selected congress events. The feature uses Bluetooth Low Energy to receive a numeric venue-transmitter identifier and may control the device flashlight/torch. On older Android versions, location permission is required by the operating system for BLE scanning; CrowdGlow does not receive GPS coordinates and the ECR App does not use this permission for navigation or continuous location tracking.
| Item | Information |
|---|---|
| Data processed | Application bundle/package identifier (org.myesr.ecr2027), numeric venue-transmitter ID received over Bluetooth, IP address, request timestamp and standard user-agent / HTTP connection metadata. |
| Purpose | Provide and synchronize the arena light-show feature, verify venue-transmitter licensing and produce basic aggregate technical/attendance telemetry. |
| Legal basis | Art. 6(1)(f) GDPR – ESR’s legitimate interests in providing and technically operating the synchronized event light-show feature. Device permissions can be declined; the rest of the App remains available. |
| Recipients | CrowdGlow Ltd and the Google Cloud infrastructure used by CrowdGlow for the telemetry endpoint. |
| Not transmitted | CrowdGlow does not receive ESR account data, names, email addresses, ESR user IDs or login tokens. It does not receive GPS coordinates, advertising IDs, MAC addresses, photos or video frames. |
| International processing | CrowdGlow’s telemetry endpoint is hosted on Google Cloud Run in the United States (us-central1). CrowdGlow states that appropriate safeguards are used for international processing, including adequacy decisions or approved contractual protections where applicable. |
| Retention | ESR does not maintain a separate CrowdGlow telemetry database. CrowdGlow retains technical logs only for as long as reasonably necessary for service operation, security, investigation or support, in accordance with its privacy information. |
11. Art Explorer
Art Explorer is an optional feature for registered, logged-in ECR participants. It allows participants to scan QR codes placed next to artworks, save artworks to a personal collection, track collection progress and unlock digital achievements. Art Explorer has no prizes, financial rewards, public leaderboard or competition between participants.
11.1 Collection and scan data
| Item | Information |
|---|---|
| Data processed | ESR user ID, artwork identifier, QR-code identifier, scan timestamp, collection/progress record and achievement status. The participant’s name is not duplicated in the scan table and is retrieved through the ESR user ID only when operationally necessary. |
| Purpose | Operate Art Explorer; maintain the participant’s personal collection and progress; prevent duplicate collection; provide artwork information; support participants; generate aggregated participation statistics. |
| Legal basis | Art. 6(1)(b) GDPR – performance of the Art Explorer service requested by the participant. |
| Recipients | ESR/ECR App backend, the role-restricted ESR App team and authorised backend developer. |
| Location / transfers | Art Explorer operational data is stored on ESR Connect infrastructure in Germany / EU. |
| Retention | Identified Art Explorer scan, progress and achievement data is retained for 12 months after ECR 2027 and is then deleted or irreversibly anonymised. |
Art Explorer does not use GPS or continuous location tracking. The QR code itself identifies the artwork. Repeated scans of the same artwork do not create additional collection progress.
11.2 Internal access to named Art Explorer records
Authorised members of the ESR App team and the authorised backend developer may access identified Art Explorer scan records where necessary to operate the feature, provide support, correct scan attribution or perform exceptional troubleshooting. Access is role-restricted and administrative actions are logged.
Named Art Explorer scan histories are not used for routine behavioural analysis, marketing or participant contact and are not disclosed to sponsors, artists or other external parties.
11.3 Aggregated Art Explorer evaluation
ESR uses Art Explorer source data to create aggregated statistics such as participant numbers, total collections, collections per artwork, average collection size, completion rate, collection-level distribution and activity by congress day/time where timestamps are used.
| Item | Information |
|---|---|
| Legal basis | Art. 6(1)(f) GDPR – ESR’s legitimate interest in evaluating Art Explorer and improving future congress experiences during the aggregation step. |
| Safeguards | Reporting output removes names and ESR user IDs. The minimum reporting group size is five. Art Explorer reports are not shared externally. |
| Retention | Underlying identified data follows the 12-month Art Explorer retention period. Genuinely anonymous aggregate statistics may be retained long-term for historical comparison. |
11.4 QR fallback webpage
If an Art Explorer QR code is scanned on a device without the ECR App installed, the code may open a lightweight web fallback page on connect.myesr.org. The fallback page does not count as an Art Explorer collection and does not use GA4, Matomo App analytics or analytics cookies. Standard web server access logs are retained for 14–30 days. Processing on that fallback webpage is covered by the ESR website privacy information rather than this App Privacy Policy.
Website privacy information: https://www.myesr.org/privacy-policy/
12. App support
| Item | Information |
|---|---|
| Data processed | Contact details provided by the user, support request/correspondence and relevant technical information. |
| Purpose | Respond to support requests and resolve App/service problems. |
| Legal basis | Art. 6(1)(b) GDPR where processing is necessary to provide requested support; otherwise Art. 6(1)(f) GDPR – legitimate interests in resolving service issues. |
| Recipients | ESR support staff; support information is stored on ESR Connect. No external ticketing system is used. |
| Retention | 1 year. |
13. Apple App Store and Google Play services
The ECR App is distributed through the Apple App Store and Google Play. ESR accesses developer-facing platform statistics such as device type and download numbers. Apple and Google may process additional device, account and platform information under their own terms and privacy notices.
The App Store / Google Play privacy and permission declarations reflect the data categories and device permissions used by the final App, including account identifiers, device-level identifiers, product interaction/usage information, crash diagnostics, camera access, Bluetooth/Nearby Devices, location permission on older Android versions where required for BLE scanning, optional biometric authentication handled by the operating system, and the technical data practices of the integrated CrowdGlow SDK. Art Explorer does not introduce an additional privacy-label category beyond the existing User ID and Product Interaction/Usage Data declarations.
14. Recipients and service providers
Personal data is disclosed only where necessary for the purposes described above. Depending on the function used, recipients include:
- ESR staff and ESR IT personnel who require access for congress, education, support or technical operations;
- the authorised development and maintenance partner (Support_IT) and the hosting provider used for ESR Connect/ECR App infrastructure;
- Google Ireland Limited / Google services for GA4 analytics and Firebase Cloud Messaging;
- Apple for App Store services, iOS push routing and platform diagnostics;
- Dacast, Metafusion and their related streaming/CDN infrastructure for live and on-demand video delivery;
- CrowdGlow Ltd, together with its Google Cloud infrastructure, for synchronized arena light-show licensing and technical telemetry;
- sponsors only in relation to aggregated, non-identifiable sponsor-content performance statistics.
ESR does not sell App users’ personal data and does not provide named Art Explorer scan histories to sponsors, artists or other external parties.
15. International data transfers
Core ESR Connect/ECR App backend, Art Explorer data and the self-hosted Matomo analytics installation are hosted in Frankfurt, Germany / EU. Matomo therefore does not introduce an additional analytics-related third-country transfer.
Some external providers use global infrastructure and may process technical or analytics data outside the European Economic Area:
- Google: Google Analytics and Firebase Cloud Messaging may involve global processing. Google documents the EU-US Data Privacy Framework and Standard Contractual Clauses, as applicable, for restricted international transfers. Google Analytics is activated only after consent, as described in Section 6. Firebase Cloud Messaging is used for push notifications as described in Section 8.
- Apple: Apple may process EEA data through Apple Distribution International in Ireland and Apple affiliates globally. Apple states that applicable international transfers are protected through mechanisms including Standard Contractual Clauses.
- Streaming providers / CDN infrastructure: Dacast and Metafusion are used for live and/or on-demand streaming. Their streaming and CDN infrastructure may process technical connection and audience data required to deliver video content. ESR does not intentionally transmit ESR account identifiers to these providers. Where processing takes place outside the EEA, the applicable provider transfer safeguards are used.
- CrowdGlow: CrowdGlow Ltd is based in the United Kingdom. For the integrated SDK, technical telemetry consisting of the App package identifier, venue-transmitter ID, IP address, timestamp and user-agent is sent to CrowdGlow infrastructure hosted on Google Cloud Run in the United States (
us-central1). No ESR account data, GPS coordinates, advertising/device IDs or camera media are sent. CrowdGlow states that it applies appropriate safeguards for international processing.
Where an international transfer requires safeguards under applicable data-protection law, ESR uses the contractual or adequacy mechanisms applicable to the relevant provider and service.
16. Retention periods
ESR retains personal data only for as long as required for the stated purpose, applicable audit/CME requirements or legal obligations. The main App retention periods are summarised below.
| Data / processing | Retention |
|---|---|
| Server logs and rolling backups | 14–30 days |
| Authentication/session tokens | Dynamic; generally 24 hours, or linked to the relevant access period |
| Registration/access status | 7 years |
| Named viewing/watch-time data | Up to 7 years |
| GA4 user- and event-level data | Configured retention period of 14 months. This setting does not apply to standard aggregated reports. |
| Matomo detailed analytics records | Automatically deleted after 14 months. |
| Matomo aggregated statistical reports | May be retained for longer to compare App usage across congress editions. Reports retained for this purpose must not enable identification of individual users. |
| Crash diagnostics | Provider-specific retention for Google Play Vitals and Apple MetricKit. |
| Push tokens | While active; removed or invalidated when stale or invalid, on logout or when the token is refreshed. |
| Sponsor interaction analytics through GA4 | GA4 user- and event-level data follows the configured 14-month retention period. Standard aggregated reports are not subject to this setting. No separate sponsor-click backend log is maintained. |
| Art Explorer identified scans, progress and achievements | 12 months after ECR 2027, then deleted or irreversibly anonymised. |
| Anonymous Art Explorer aggregate statistics | May be retained long-term. |
| Support requests | 1 year. |
| QR fallback web logs | 14–30 days. |
| CrowdGlow technical telemetry | Provider-specific; retained only as reasonably necessary for service operation, security, investigation or support. |
17. Your data-protection rights
Subject to the conditions of applicable data-protection law, you may have the right to request:
- access to your personal data and a copy of it;
- rectification of inaccurate or incomplete personal data;
- erasure of personal data;
- restriction of processing;
- data portability where applicable;
- objection to processing based on legitimate interests; and
- withdrawal of consent at any time where processing is based on consent.
Withdrawal of Google Analytics consent
You can change or withdraw your Google Analytics consent at any time under Settings → Privacy & Analytics. Withdrawal stops future GA4 collection, including sponsor-specific GA4 interaction measurement. It does not affect the lawfulness of processing carried out before withdrawal.
Declining or withdrawing Google Analytics consent does not disable the separate Matomo processing described in Section 6.
Objection to processing based on legitimate interests
You have the right to object, on grounds relating to your particular situation, to the processing of your personal data based on ESR’s legitimate interests, including the Matomo processing described in Section 6. To exercise this right, contact [email protected].
ESR will assess your objection and cease the relevant processing unless it demonstrates compelling legitimate grounds that override your interests, rights and freedoms, or the processing is necessary for the establishment, exercise or defence of legal claims.
Matomo events are not linked to ESR accounts and do not contain persistent visitor identifiers. ESR may therefore be unable to locate individual Matomo records using your name, email address or ESR user ID. ESR does not collect additional identifying information solely to identify users within these statistics. This does not prevent you from contacting ESR to exercise your rights.
Requests concerning account-linked App data
Requests can be sent to [email protected] using the contact details in Section 1. ESR can retrieve account-linked App data by ESR user ID.
Art Explorer scan and progress records can be manually extracted for an access request, corrected if incorrectly attributed and deleted independently of the ESR account. Viewing/watch-time information can also be deleted independently where applicable.
Where erasure is required, the relevant live record is deleted or anonymised. If a copy remains in encrypted rolling backups, it is overwritten within the normal 14–30 day backup cycle. If a backup is restored before expiry, outstanding erasure actions are re-applied.
18. Minors
Persons under 18 may use basic logged-out App functions. ESR Portal accounts cannot be created by persons under 18, so logged-in functions such as Art Explorer are not available to them. The privacy-minimised Matomo analytics described in Section 6 may operate from App start, including for logged-out use. GA4 is activated only if consent is given through the App-start consent banner. Technical diagnostic processing may also occur for logged-out App use as described in this Privacy Policy.
19. Security
ESR applies technical and organisational measures appropriate to the risks of the processing, including access restrictions, role-based permissions, administrative logging, encrypted backups and controlled technical access. No electronic service can be guaranteed to be completely secure, but ESR takes reasonable measures to protect App data against unauthorised access, loss, alteration or disclosure.
20. Complaints
You have the right to lodge a complaint with a data-protection supervisory authority. In Austria, complaints may be submitted to:
Austrian Data Protection Authority (Österreichische Datenschutzbehörde)
Barichgasse 40–42
1030 Vienna
Austria
Email: [email protected]
Further information: https://dsb.gv.at/
21. Changes to this Privacy Policy
ESR may update this Privacy Policy where the ECR App, its service providers or applicable legal requirements change. The current version and its effective date will be published with the App privacy information.