Cortrium Apex

GDPR overview

GDPR implementation is documented in concrete terms. The privacy policy is version 12, last updated 13.02.2026 09:05, and a data processing agreement built on the Article 28 standard clauses is published in English, German and French on the legal hub. The legal bases cited are Article 6(1)(a) consent, 6(1)(b) contract, 6(1)(c) legal obligation and 6(1)(f) legitimate interest. Data subject rights are listed in full: access, rectification, erasure, restriction, objection, the right not to be subject to automated decision-making, portability, withdrawal of consent and complaint to the supervisory authority. Sub-processors are named in Annex B, with 30 days' notice and a right to object for any change. The compliance contact is compliance@cortrium.com, and cookies run through Cookiebot. As a company based in the EU, Cortrium ApS falls outside the scope of Article 27, so no EU representative is designated.

Who owns the data?

Under the published DPA, the customer is the data controller for patient data and Cortrium ApS acts as its data processor; for website and prospect data, Cortrium is itself the controller. The customer can download the EDF recordings and the PDF analysis reports. Intellectual property in the software and in the analyses stays with Cortrium or its licensors, and the terms state that the Device(s) at all times remain the exclusive property of Cortrium. Cortrium further reserves the right to the anonymised ECG recordings, namely age, birth year, gender and accelerometer data, together with the analysis reports, for research and development purposes.

Reuse rights

The material documents what is processed rather than granting a broad reuse licence. Apex handles patient identity (title, first and last name, date of birth, gender, pacemaker information), the ECG recording and the resulting Holter report, plus customer user data (email, login, password, name, IP address, device, address and telephone). The stated purposes are patient setup, ECG transfer and storage, and the ordering and return of the analysis report. Customers can export their own material, EDF for the recording and PDF for the report, with encapsulated DICOM as an option, and no further authorisation step for that export is described. In the other direction, Cortrium keeps anonymised ECG recordings and analysis reports for research and development until its management decides to erase them, while the EULA restricts what licensees may do with the software itself. Azure Application Insights telemetry is declared in the IFU, and the privacy policy states that personal data is not transferred outside the EU/EEA unless it is necessary on the data subject's specific request.

Data retention & training

Hosting summary

Cortrium ApS states in the Apex IFU that the software is deployed on Microsoft Azure. Recordings are stored in Germany West Central by default, and the customer can instead select UK South, France Central or Australia East; the DPA phrases this as Germany Central West data centres or as decided by customer for recordings. The named sub-processors sit in Europe: Auth0 runs primary in Frankfurt (Germany) with Dublin (Ireland) as secondary; Hetzner Online GmbH holds non-identifying raw ECG data in Falkenstein (Germany) and Helsinki (Finland); Microsoft Ireland Operations Limited hosts Cortrium's systems; and CPR-administrationen, in Copenhagen (Denmark), is involved only where Danish CPR lookup is enabled. One tension is worth raising with the vendor: the privacy policy announces that personal data is not transferred outside the EU/EEA unless necessary on a specific request, while the storage regions offered to customers include the United Kingdom and Australia, both outside the EEA. Nothing in the published material resolves that point, so a customer choosing a non-EEA region should confirm the applicable transfer safeguards.