Data protection
Privacy Policy
What this site collects, and what it does not do with it. This page describes the medelu.lu website, form by form: what is asked for, what is kept, where it lives and for how long.
For the Medelu app
The policy that applies to the patient app, and therefore to your orders, is section 8 of the terms and conditions, “Privacy and Data Protection”. It says what is shared with the pharmacy you choose, who answers for the processing, and the rule on consent for health data. The full text is in the Trust Centre.
Who answers for what
For this website, the controller is YMA Media Luxembourg S.à r.l.-S, 83 rue Emile Metz, L-2149 Luxembourg. For the health data processed in the patient app, the controller is the pharmacy that dispenses the product to you: Medelu hosts that data and acts on its instructions. The terms say so in section 8.
The contact form
It asks for your name, your e-mail address, a subject and your message; pharmacy, organisation and telephone are optional. Nothing is written to any database. The message leaves by e-mail to the mailbox matching the subject, through Resend, our sending provider, and then lives in that mailbox like any other e-mail. Your address serves as the reply address, nothing else.
The newsletter
It records your e-mail address, the language of the site, the page you subscribed from, the date, and a truncated network fingerprint. You unsubscribe at any time by writing to [email protected]; the row is then deleted.
The pharmacy joining file
It concerns pharmacies, not patients: company identity, authorisation, addresses, responsible pharmacist, billing details and supporting documents. The file is kept for the duration of the partnership and then ten years, the Luxembourg commercial retention period. No identity document is requested. Every consultation of a document is attributed, justified and logged.
What we never keep
No full IP address. Where a network fingerprint is needed, to limit the number of sends per hour and for the log, it is truncated before being written: the first three octets of an IPv4 address, the first three groups of an IPv6 one. What remains points at a network, not at a device or a person.
Trackers and storage
This site sets no measurement cookie, keeps nothing in your browser storage and carries no analytics. The only third-party requests serve the typefaces. One technical cookie exists, and only in the space reserved for pharmacies: set after the code is entered, it lasts two hours and serves only to hold the door open.
Where this data lives
In the European Union, in Frankfurt (Germany). Two providers are involved, and only those two: Cloudflare for hosting the site, the database and the documents filed, and Resend for delivering the contact form's e-mails. The data does not leave the European Union and is never monetised.
Your rights
Access, rectification, erasure, portability, objection: write to [email protected]. Deleting a patient account has its own page: delete your account. You may at any time, and without going through us, refer the matter to the National Commission for Data Protection, 15 boulevard du Jazz, L-4370 Belvaux, +352 26 10 60 -1, www.cnpd.lu.
The patient app
What the app processes, it processes for the pharmacy. The health questionnaire, the order history and the exchanges with the pharmacist belong to it; consent for health data is collected separately in your account, at the moment of the order. The full terms are in the trust centre.
LAST UPDATED: SEPTEMBER 2026 · YMA MEDIA LUXEMBOURG SARL-S · [email protected]