Privacy policy

The Controller processes and stores personal data only for the time strictly necessary to fulfill the purposes for which the data were collected, or for the period stipulated by relevant legal regulations and in accordance with the principle of minimization under Art. 5 (1) (c) and (e) GDPR.

All processing takes place exclusively within the European Union, or within states ensuring an adequate level of protection according to Art. 45 GDPR.

The retention period varies depending on the legal title for processing your personal data:

i) Fulfillment of legal obligations

If the Controller has a legal obligation to retain personal data (e.g., for accounting, tax, or archiving purposes), they are retained for the period stipulated by relevant regulations. Typically, this is a period of 5 to 10 years, depending on specific legislation (e.g., Accounting Act, tax laws).

ii) Performance of a contract

Data processed by the Controller for the purpose of providing services via the Website (e.g., user registration) are retained for the duration of the contractual relationship.

iii) Consent of the data subject

If the Controller processes personal data based on your consent (e.g., for sending personalized offers or using marketing cookies), processing occurs for the duration of this consent's validity or until its withdrawal. After the withdrawal of consent, data are securely deleted or anonymized unless they are further needed for another lawful purpose.

iv) Concurrence of multiple purposes

In specific cases, personal data may be processed concurrently based on multiple legal titles. In such a case, the data are always retained according to the longest relevant period.

After the respective periods expire, personal data are securely deleted or anonymized, in accordance with the principles of minimization and storage limitation under Art. 5 GDPR.

Backup (optional)

In the event that a user creates a personal account and actively selects the data backup option, the Controller backs up all personal and health data in encrypted form on secure servers located in the European Union.

Backed-up data are protected using modern cryptographic methods that meet the requirements of "bank-level security" and are accessible exclusively to authorized persons of the Controller who are bound by confidentiality.

Data transfer between the user device and the server occurs exclusively via an encrypted connection. The user has the right to cancel the backup at any time, whereby the Controller will ensure the immediate deletion of all data from backup systems unless their further retention is necessary for a legal reason.

Security of personal data

The Controller has adopted appropriate technical and organizational measures under Art. 32 GDPR to ensure the protection of personal data against unauthorized or unlawful processing, accidental loss, destruction, or damage.

These measures include in particular:

• End-to-end encryption of all health and other sensitive data
• User authentication via password, biometric data, or another security mechanism
• Separate storage of identification and health data,
• Regular security audits and penetration tests
• Access rights management according to the "need-to-know" principle
• System monitoring aimed at detecting and preventing unauthorized access

In the event of any incident that could lead to a breach of personal data security, the Controller is obliged to evaluate the risk without undue delay and, if necessary, inform the supervisory authority and affected data subjects in accordance with Articles 33 and 34 GDPR.

The Controller hereby confirms that the highest level of technical and legal protection of personal data is adopted, especially considering the nature of the sensitive data processed within the Website.

Data sharing

You can share data with a specific person only by the user's active decision. All sharing is fully under your control and you can cancel it at any time.