Privacy Policy
Last updated: 27 May 2026
1. Who is responsible for your data
Mercuriosity is part of Medical Industries Group B.V., registered in the Netherlands under Dutch Chamber of Commerce (KvK) number 24278021. Nancy Lamerigts is the controller for personal data processed through mercuriosity.eu. For questions about this policy or about data we hold on you, contact nancy@mercuriosity.eu.
2. What we collect
We try to collect as little as possible. There are three points where data enters our systems.
2.1 Email address (newsletter and lead magnets)
When you sign up for The Operating Table or one of the lead magnets (Congruence Gap Scan, Early-Data Pitch Bank), you provide your email address. The form is delivered through Substack; your email is stored in the Substack list and used to send you the newsletter and the lead magnet you signed up for.
2.2 Evidence Chain Translator submissions
When you use the Evidence Chain Translator, the six fields you enter (device description, stage, tier, route, indication, claim) are sent anonymously to a database hosted on Supabase. We do not record your email, your IP address, or any account identifier. We use these submissions to understand which device profiles are common, and to improve the tool.
2.3 Direct contact
If you email nancy@mercuriosity.eu directly (for example, to request a Founder Clarity Call), your email address, name, and the content of your message are received and kept in the mailbox for as long as needed to handle the conversation and follow up.
2.4 Server logs (Vercel hosting)
Our hosting provider, Vercel, automatically receives basic technical information when you visit the site (IP address, user agent, request path, timestamp). This is standard for any website on the internet. Vercel uses it for security, abuse prevention, and performance. We do not use these logs to identify or profile individual visitors.
3. Why we process it (lawful basis)
| Data | Purpose | Lawful basis |
|---|---|---|
| Email address | Deliver newsletter and lead magnets | Consent (you opted in) |
| Evidence Chain submissions (anonymous) | Improve the tool | Legitimate interest; no personal data involved |
| Direct emails to us | Respond to your request | Legitimate interest; sometimes consent |
| Server logs | Security, hosting operations | Legitimate interest |
4. Who we share it with (sub-processors)
We do not sell your data. We do not share it with advertisers. The only third parties who see your data are the providers we use to run the site:
- Substack — newsletter list and lead magnet delivery. substack.com/privacy
- Supabase — anonymous storage of Evidence Chain Translator submissions (EU region, eu-central-1). supabase.com/privacy
- Vercel — hosting and server logs. vercel.com/legal/privacy-policy
Substack and Vercel are headquartered in the United States and may process data there under their standard contractual clauses. Supabase data for our project is held in the EU.
5. How long we keep your data
- Email on the newsletter list: until you unsubscribe (one click in any edition).
- Direct emails to us: as long as the conversation is active, plus a reasonable archival period.
- Evidence Chain submissions: retained anonymously; no link back to you exists.
- Server logs: per Vercel's retention policy (typically short).
6. Your rights (GDPR)
If you are in the EU, EEA, or the UK, you have the right to:
- Access the personal data we hold on you
- Correct it if it is wrong
- Have it deleted (the right to be forgotten)
- Receive a copy of it in a portable format
- Object to specific processing
- Withdraw consent at any time (for newsletter signup, unsubscribe is the fastest path)
- Lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl)
To exercise any of these rights, email nancy@mercuriosity.eu. We respond within 30 days.
7. Cookies
This site uses no analytics cookies, no advertising cookies, and no third-party tracking. The only browser storage we use is a single record of your cookie consent choice, stored in localStorage. Full details on the Cookies page.
8. Children
This site is intended for professionals in MedTech, not for children. We do not knowingly collect data from anyone under 16.
9. Changes to this policy
If we change this policy, we update the "Last updated" date at the top. For material changes that affect how we handle existing newsletter subscribers, we notify the list directly.
10. Contact
Mercuriosity, part of Medical Industries Group B.V.
KvK 24278021 · The Netherlands
Nancy Lamerigts, data controller
mercuriosity.eu · nancy@mercuriosity.eu