ECR App Privacy Policy

Last updated: August 27, 2026

This Privacy Policy explains how the European Society of Radiology (“ESR”, “we”, “us” or “our”) collects, uses, stores and protects personal information when you use the ECR App.

This Privacy Policy applies only to the ECR App, including the current ECR 2027 version of the app. It does not cover ESR Connect, myESR.org, the ESR membership portal, third-party websites or external services that may be linked from the app. Those services may have their own privacy notices.

If you have any questions about this Privacy Policy or about how we process your personal information, please contact us at [email protected].

1. Summary

The ECR App can be used without logging in, but some content and functions are limited. Live streaming and certain protected content require login with an ESR account.

When you use the ECR App, we may process account information, app usage data, technical device information, push notification data, analytics data, diagnostics data and information related to content access, such as live stream or on-demand viewing activity.

We do not use the ECR App to collect precise GPS location data. We do not collect photos or videos through the ECR App.

We use your information to provide and secure the app, enable account login and access to protected content, provide congress-related app functions, send app-related push notifications if enabled, measure and improve app performance, analyse app usage and troubleshoot technical issues.

We do not use app data for Google advertising, retargeting or third-party tracking. Sponsor content in the app is displayed as built-in app content. We may measure views and clicks on sponsor content for reporting purposes.

2. Who is responsible for your personal information?

The controller responsible for the processing of personal information described in this Privacy Policy is:

European Society of Radiology
Am Gestade 1
1010 Vienna
Austria

Email: [email protected]
Phone: +43 1 53340640

3. What information do we collect?

The information we process depends on how you use the ECR App, whether you log in and which app functions you use.

3.1 Information processed when you use the app without login

If you use the ECR App without logging in, access to certain content and functions is limited. We may process technical and usage information necessary to provide the app, maintain security, analyse general usage and troubleshoot errors. This may include:

app version
operating system
device type
app usage events
product interaction data
diagnostics and crash information
performance data

3.2 Information processed when you log in

If you log in, authentication is handled through the ESR portal / OAuth system. After login, the ECR App may process account-related information needed to provide app functionality and access to protected content. This may include:

name
email address, where required for account-related app functionality or App Store privacy declarations
ESR user ID or user identifier
device identifier or device information, where required for app functionality, analytics or platform declarations
access status for restricted app content, such as whether you are entitled to access live streaming or on-demand content

The app may check ticket or registration-related access via the ESR portal. This access check is used to determine whether certain content is available to you. It is not displayed to other users.

3.3 Content access and viewing activity

For live streaming and on-demand content, we may process information about your interaction with the content. This may include whether you accessed live or on-demand content and how long you watched it. This information is used to provide the service, manage access, analyse usage and improve congress services.

3.4 Push notification data

If you allow push notifications, we may process a push notification token and related technical information so that congress-related app notifications can be sent to your device. Push notifications are used for ECR App and congress-related purposes. You can enable or disable push notifications in your device settings.

3.5 Analytics and diagnostics data

We use analytics and diagnostics to understand how the app is used, improve app performance, identify technical issues and support future app development. This may include product interaction data, usage events, performance data and crash data.

The analytics and app platform tools used may include Google Analytics / GA4, Firebase Analytics, and analytics provided by Apple App Store and Google Play.

We do not use Google Analytics Advertising Features for the ECR App, and we do not use app data for advertising, retargeting or third-party tracking.

3.6 Sponsor content interaction data

The ECR App may contain sponsor content, such as built-in images or banners. These are integrated into the app and are not delivered by third-party advertising networks. We may measure views and clicks on sponsor content for reporting purposes. This is not used for targeted advertising or retargeting.

3.7 Information we do not collect through the ECR App

The ECR App does not collect or process:

precise GPS location data
photos or videos
user-generated photo or video content
sensitive personal information, unless explicitly stated elsewhere and required for a specific service
Google advertising data for retargeting or third-party advertising purposes

4. How do we use your information?

We process personal information for the following purposes:

to provide and operate the ECR App
to allow account login and authentication through the ESR portal / OAuth system
to provide access to protected app content, including live streaming and on-demand content
to manage app functionality and congress-related services
to send congress-related push notifications if you have enabled them
to analyse app usage and content interaction
to measure views and clicks on sponsor content
to monitor app performance and troubleshoot technical issues
to collect crash and diagnostics information
to maintain app security and prevent misuse
to respond to support requests or user enquiries
to comply with legal obligations and enforce applicable terms

5. What legal bases do we rely on?

Where the General Data Protection Regulation (GDPR) or similar data protection laws apply, we rely on one or more of the following legal bases:

Performance of a contract or provision of a requested service: when processing is necessary to provide the ECR App, account login, protected content, live streaming, on-demand services or other app functions requested by you.
Legitimate interests: when processing is necessary to operate, secure, troubleshoot, analyse and improve the app, measure app performance, prevent misuse and report aggregated app usage, provided that your interests and fundamental rights do not override those interests.
Consent: when we ask for your permission, for example for push notifications or other optional app functions where consent is required.
Legal obligations: when processing is necessary to comply with applicable laws, respond to lawful requests or establish, exercise or defend legal claims.

You may withdraw consent at any time where processing is based on consent. Withdrawal does not affect the lawfulness of processing before withdrawal.

6. When and with whom do we share your information?

We may share personal information only where necessary and only in the situations described below.

6.1 Service providers and processors

We may use trusted service providers to support the operation of the ECR App, including analytics, push notifications, app platform services and technical support. These providers process information on our behalf and under appropriate contractual arrangements.

Tools and services used in connection with the ECR App may include:

Google Analytics / GA4
Firebase Analytics
Firebase push notification services
Apple App Store analytics
Google Play analytics

6.2 Sponsor reporting

Where sponsor content is displayed in the app, we may report views and clicks on sponsor content. Such reporting should be limited to aggregated statistics wherever possible and should not be used for targeted advertising or retargeting.

6.3 Legal or organisational reasons

We may disclose information if required by law, court order, public authority request or if necessary to protect our rights, users, systems or services. We may also share information in connection with organisational changes, where permitted by law.

7. International data transfers

The ESR is based in Austria. Where personal information is processed by service providers outside the European Economic Area, we will ensure that appropriate safeguards are in place as required by applicable data protection law. These safeguards may include data processing agreements, standard contractual clauses or other legally recognised transfer mechanisms.

8. Cookies and tracking technologies

The ECR App does not use cookies or tracking technologies inside app webviews for the purposes of this Privacy Policy.

Analytics and diagnostics may be collected through app analytics tools and platform services as described above. We do not use app data for third-party tracking, retargeting or Google advertising.

9. How long do we keep your information?

We keep personal information only for as long as necessary for the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law.

The following retention logic applies:

Data type	Retention logic
ESR account-related app data	Kept for as long as the user has an ESR account or until erasure is requested, unless further retention is required or permitted by law.
App usage events and logs	Kept for as long as necessary to operate, analyse, secure and improve the app, or until erasure is requested where applicable.
Live stream and on-demand viewing activity	Kept for as long as necessary to provide the service, manage access, analyse usage and improve congress services, or until erasure is requested where applicable.
Crash reports and diagnostics	Kept for as long as necessary to investigate and resolve technical issues, or until erasure is requested where applicable.
Push notification token	Kept as long as notifications are enabled or as long as needed to provide push notification functionality.
Support and contact requests	Kept for up to one year, unless a longer period is required or permitted by law.
Aggregated statistics	May be kept for longer where they no longer identify individual users.

When we no longer need personal information, we will delete it, anonymise it or securely isolate it from further processing until deletion is possible.

10. How do we keep your information safe?

We use appropriate technical and organisational measures to protect personal information against unauthorised access, loss, misuse, alteration or disclosure. These measures are designed to protect the security of the personal information we process.

However, no electronic transmission or storage system can be guaranteed to be completely secure. You should access the app only in a secure environment and keep your account credentials confidential.

11. Do we collect information from minors?

The ECR App may be available for download in app stores by users below the age of 18. However, an ESR portal account is not available to users under 18. Account-based app features, including access to protected content, are therefore intended only for users aged 18 or older.

We do not knowingly collect or process account-based personal information from users under 18 through the ECR App. If we become aware that account-based personal information from a user under 18 has been processed, we will take reasonable steps to delete such data.

If you believe that we may have processed personal information of a user under 18, please contact us at [email protected].

12. What are your privacy rights?

Depending on where you are located and which data protection laws apply, you may have rights regarding your personal information. These may include the right to:

request access to your personal information
request correction of inaccurate or incomplete information
request deletion of your personal information
request restriction of processing
object to certain processing activities
request data portability, where applicable
withdraw consent where processing is based on consent
lodge a complaint with a data protection authority

You can review or update certain account information by logging in to your ESR account. To request access, correction or deletion of personal information, please visit https://portal.myesr.org/esr/membership/login or contact us at [email protected].

If you request deletion of account-related app data, this may require deletion or deactivation of the underlying ESR account where app data cannot be separated from account data.

We will consider and respond to privacy rights requests in accordance with applicable data protection laws.

If you are located in the European Economic Area and believe that we are processing your personal information unlawfully, you may have the right to lodge a complaint with your local data protection authority. In Austria, the competent authority is the Austrian Data Protection Authority (Österreichische Datenschutzbehörde).

13. App Store privacy information

The following section summarises the app privacy information reflected in the App Store product page information.

Data linked to you

The following data may be collected and linked to your identity:

Category	Data types	Purpose
Contact Information	Name, email address	App functionality
Identifiers	Device ID, user ID	App functionality, analytics
Usage Data	Product interaction, sponsor / advertising interaction data	App functionality, analytics, sponsor content reporting

Data not linked to you

The following data may be collected but is not linked to your identity:

Category	Data types	Purpose
Diagnostics	Performance data, crash data	App functionality, diagnostics, troubleshooting

We do not use the ECR App for third-party tracking, retargeting or Google advertising. Product personalisation is not used.

14. Additional information for residents of the United States

Some US state privacy laws may give residents additional rights regarding personal information. Depending on the applicable law and your place of residence, these rights may include the right to know whether we process your personal information, access your personal information, correct inaccurate information, request deletion, obtain a copy of information you provided to us, and opt out of certain processing activities such as targeted advertising, sale of personal information or profiling where applicable.

We do not sell personal information. We do not use the ECR App for targeted advertising or retargeting.

The categories of personal information that may be processed through the ECR App include:

Category	Examples	Processed
Identifiers	Name, email address, user ID, device ID	Yes
Internet or other electronic network activity	Product interaction, app usage events, content access and viewing activity	Yes
Commercial or event-related information	Access status for protected congress content where applicable	Yes
Geolocation data	Precise GPS location	No
Audio, visual or similar information	Photos and videos collected through the app	No
Sensitive personal information	Sensitive personal information through the app	No
Diagnostics	Crash data and performance data	Yes

To exercise rights that may apply to you, please contact us at [email protected], visit https://portal.myesr.org/esr/membership/login, or use the ECR contact form at https://connect.myesr.org/ecr-2026/contact-form/

We may need to verify your identity before responding to a request. If we decline a request where an appeal right applies, you may contact us at [email protected] to appeal the decision.

15. Additional information for residents of Canada

If you are located in Canada, you may have rights to access, correct or withdraw consent regarding your personal information, subject to applicable law. Where processing is based on consent, you may withdraw consent at any time, although this will not affect processing that took place before withdrawal or processing that is permitted on another legal basis.

To exercise these rights, please contact us at [email protected].

16. Do-Not-Track signals

Some browsers and mobile operating systems include a Do-Not-Track feature. At this stage, there is no uniform standard for recognising and responding to Do-Not-Track signals. The ECR App does not use cookies or webview tracking technologies for the purposes of this Privacy Policy.

17. Updates to this Privacy Policy

We may update this Privacy Policy from time to time. The updated version will be indicated by the updated date at the top of this page and will be effective once it is published.

If we make material changes, we may notify users by posting a notice in the app, on the relevant website or by another appropriate method.

18. Contact

If you have questions or comments about this Privacy Policy, please contact us at:

European Society of Radiology
Am Gestade 1
1010 Vienna
Austria

Email: [email protected]
Phone: +43 1 53340640

Useful links: