Privacy policy for the EVER platform and app

1Responsible

2Data Protection Officer

If you have any questions about data protection or how to exercise your rights, you can contact our data protection officer:

3General information on data processing

We process personal data exclusively in accordance with applicable data protection regulations, in particular the General Data Protection Regulation (GDPR) and the Telecommunications Digital Services Data Protection Act (TDDDG).

Personal data is any information relating to an identified or identifiable natural person. This includes, in particular, master data, contact details, usage data, contract data, communication data, and health-related data.

The processing only takes place insofar as it is necessary for the provision of our services, serves to fulfill contractual or legal obligations, is based on your consent or is justified by our legitimate interests, provided that your overriding interests do not conflict with this.

4Categories of processed data

Depending on the use of our platform, app and supplementary services, we process the following data categories in particular:

• Master data, e.g. first name, last name, date of birth
• Contact details, e.g. email address, telephone number, address
• Registration and account details
• Contract and order data
• Payment and billing data
• Communication data
• Technical usage data, e.g. IP address, device information, browser type, operating system, access times
• Content data that you enter or upload yourself
• Health-related data, e.g., information from questionnaires, laboratory values, biomarkers, protocol data
• genetic data, insofar as it is processed within the framework of EVER Precision
• Shipping and fulfillment data for physical products or test kits

5Purposes of processing

We process personal data in particular for the following purposes:

• Provision and operation of the platform and app
• Setting up and managing user accounts
• Implementation of pre-contractual measures and contract fulfillment
• Communication with users
• Support and handling of requests
• Processing of orders and payments
• Creation, management and provision of personalized protocols
• Processing of biomarkers, health data and other health-related information within the functions you use
• Shipping and provision of test kits or products
• Implementation and coordination of EVER Precision
• IT security, error analysis and abuse prevention
• Compliance with legal retention and documentation obligations

6Legal basis for processing

Unless otherwise stated, we base the processing on the following legal grounds:

• Article 6 paragraph 1 letter a GDPR – Consent
• Article 6 paragraph 1 letter b GDPR – Contract performance or implementation of pre-contractual measures
• Article 6(1)(c) GDPR – Fulfillment of legal obligations
• Article 6 paragraph 1 letter f GDPR – legitimate interests

Insofar as special categories of personal data are processed, in particular health data or genetic data, this will only be done on a relevant basis in accordance with Art. 9 GDPR, in particular on the basis of your explicit consent pursuant to Art. 9 para. 2 lit. a GDPR or insofar as the processing is necessary for the service you have expressly requested and is permissible under data protection law.

7Registration and use of the platform / app

When you create a user account or use our platform or app, we process the necessary data to provide you with the respective functions. This includes, in particular:

• Account details
• Login details
• technical usage data
• Content you have entered or uploaded
• Health-related information, insofar as you use corresponding functions

The processing is carried out for the provision of our contractual services and on the basis of Art. 6 para. 1 lit. b GDPR. Insofar as health data is processed, this is additionally done on the basis of a relevant exception pursuant to Art. 9 GDPR.

8Health data within the platform

When you use features that process health data, such as for managing biomarkers, protocols, interventions, or other health-related content, we process this data only to the extent necessary to provide the respective feature and the service you have requested. Depending on the feature, this may include, in particular:

• Information about complaints, goals or lifestyle
• Laboratory values ​​and biomarkers
• Income plans and logs
• uploaded documents or reports
• Information provided as part of an onboarding process or questionnaire

Where consent is required, we will obtain it separately. Without the necessary information, certain functions or services may not be available, either wholly or partially.

9EVER Precision

Within the framework of EVER Precision, we offer complementary services, in particular the coordination and execution of health-related analyses, the evaluation of the results, personal consultation and the creation of individual protocols within EVER.

9.1 Subject of processing

Within the framework of EVER Precision, the following data in particular can be processed:

• Master data and contact details
• Shipping information for the delivery of test kits
• Order and payment details
• Information from onboarding and health questionnaires
• Laboratory values ​​and analysis results
• genetic data from DNA analyses
• health-related data from further tests
• Consultation notes
• Contents of the individual protocol created in EVER
• Data on optionally ordered personalized supplement packs

9.2 Purposes of processing

The processing within EVER Precision is carried out in particular for the following purposes:

• Processing your booking
• Shipping and organizational handling of test kits
• Coordination with analysis and laboratory service providers
• Receiving and processing analysis results
• Internal technical evaluation by authorized EVER employees
• personal discussion of the results
• Creating an individual protocol in EVER
• Delivery of results and content to your user account
• Optional processing of personalized packs or additional orders
• Support, documentation and quality assurance

9.3 Internal technical processing

Insofar as results are discussed or evaluated within the framework of EVER Precision, this is done within EVER by appropriately authorized employees.

9.4 Legal basis

Your order, shipping, contract, and organizational data is processed for the performance of the contract concluded with you in accordance with Article 6(1)(b) GDPR. Insofar as health and genetic data are processed within the scope of EVER Precision, this is additionally done on the basis of your explicit consent in accordance with Article 9(2)(a) GDPR.

9.5 Receivers within the EVER Precision framework

To implement EVER Precision, data may be transferred to carefully selected service providers and partners, insofar as this is necessary for the provision of the service. These may include, in particular:

• Shipping and logistics service providers
• Laboratory and analysis service providers
• Payment service provider
• IT and hosting service providers
• Fulfillment and shop service providers for optional product orders

These recipients only receive data to the extent necessary for the respective purpose. Insofar as they act on our behalf, they are engaged as data processors on the basis of Article 28 GDPR.

10Contact

When you contact us by email, contact form or other means, we process the data you provide to handle and respond to your inquiry. This applies in particular to:

• name
• E-mail address
• Content of your message
• possibly other voluntarily submitted information

The legal basis is Art. 6 para. 1 lit. b GDPR or Art. 6 para. 1 lit. f GDPR, depending on the occasion.

11App download via app stores

When you download our app from the Apple App Store or Google Play Store, certain data is processed by the respective store provider. We have no control over this. The privacy policies of the respective store operator apply in this respect.

12Cookies and similar technologies

To the extent that our app or platform uses cookies or similar technologies, this is done either on the basis of Section 25 Paragraph 2 of the German Telemedia Act (TMG), if technically necessary, or on the basis of your consent pursuant to Section 25 Paragraph 1 of the TMG in conjunction with Article 6 Paragraph 1 Letter a of the GDPR. We only use non-essential cookies or tracking technologies if you have given your prior consent.

13Recipients and categories of recipients

Access to personal data may be granted in particular to the following recipients or categories of recipients:

• internal authorized employees of EVER
• IT and hosting service providers
• Payment service provider
• Logistics and shipping service providers
• Laboratory and analysis service providers
• Support and communication service provider
• Legal advisors, tax advisors, banks, auditors and insurance companies
• Authorities and public bodies, insofar as a legal obligation exists

Data is only shared to the extent that it is necessary for the specific purpose and permissible under data protection law.

14Third-country transfers

If we transfer personal data to recipients in countries outside the European Union or the European Economic Area, or use service providers there, this is done only in compliance with the legal requirements of Articles 44 et seq. of the GDPR. In the absence of an adequacy decision, transfers are made in particular on the basis of suitable safeguards, such as the EU Standard Contractual Clauses.

15Storage duration

We only store personal data for as long as is necessary for the respective purposes or as required by law. The following principles apply in particular:

• We store account data for the duration of the user relationship
• We store contract, order and billing data in accordance with legal retention requirements
• We store communication data for as long as is necessary to process the request
• We store health-related data and results from EVER Precision for as long as necessary to provide the service, for documentation, to make it available in your user account, or due to legal requirements
• Data will be deleted as soon as the respective purpose ceases to apply and no statutory retention periods apply

16Obligation to provide data

Providing personal data is sometimes necessary for using our services. Without the data required for the respective purpose, we cannot provide certain services, in particular the use of the platform, the execution of EVER Precision, or the processing of orders, or cannot provide them fully.

17Data security

We take appropriate technical and organizational measures to protect personal data from loss, misuse, unauthorized access, unauthorized disclosure, alteration, or destruction. Our security measures are continuously adapted in line with technological developments.

18Your rights

In accordance with the statutory provisions, you have in particular the following rights:

• Right to information pursuant to Article 15 GDPR
• Right to rectification pursuant to Article 16 GDPR
• Right to erasure pursuant to Article 17 GDPR
• Right to restriction of processing pursuant to Article 18 GDPR
• Right to data portability pursuant to Article 20 GDPR
• Right to object pursuant to Article 21 GDPR
• Right to revoke consents given with effect for the future
• Right to lodge a complaint with a data protection supervisory authority

To exercise your rights, you can contact us or our data protection officer at any time, or please contact us by email at: info@everhealth.ai

19Revocation of consent

You can withdraw your consent at any time with effect for the future. The lawfulness of the processing carried out until the withdrawal remains unaffected.

20Changes to this privacy policy

We reserve the right to amend this privacy policy if necessary due to technical, legal, or organizational changes. The version available at the time of your visit or use of our website will apply.