Privacy policy for the EVER platform and app

1Controller

2Data protection officer

If you have questions about data protection or wish to exercise your rights, you can contact our data protection officer:

3General information on data processing

We process personal data exclusively in accordance with the applicable data protection legislation, in particular the General Data Protection Regulation (GDPR) and the German Telecommunications Digital Services Data Protection Act (TDDDG).

Personal data means any information relating to an identified or identifiable natural person. This includes in particular master data, contact data, usage data, contract data, communication data and health-related data.

Processing takes place only insofar as it is necessary for the provision of our services, serves to fulfil contractual or statutory obligations, is based on your consent or is justified by our legitimate interests, provided that your overriding interests do not conflict with this.

4Categories of data processed

Depending on how you use our platform, app and supplementary services, we process in particular the following categories of data:

• Master data, e.g. first name, surname, date of birth
• Contact data, e.g. email address, telephone number, postal address
• Registration and account data
• Contract and order data
• Payment and billing data
• Communication data
• technical usage data, e.g. IP address, device information, browser type, operating system, times of access
• Content data that you enter or upload yourself
• health-related data, e.g. information from questionnaires, lab values, biomarkers, protocol data
• genetic data, insofar as it is processed as part of EVER Precision
• Shipping and fulfilment data for physical products or test kits

5Purposes of processing

We process personal data in particular for the following purposes:

• Providing and operating the platform and app
• Setting up and administering user accounts
• Carrying out pre-contractual measures and performing the contract
• Communicating with users
• Support and handling of enquiries
• Processing orders and payments
• Creating, managing and providing personalised protocols
• Processing biomarkers, health information and other health-related information within the functions you use
• Dispatching and providing test kits or products
• Carrying out and coordinating EVER Precision
• IT security, error analysis and prevention of misuse
• Fulfilling statutory retention and documentation obligations

6Legal bases for processing

Unless stated otherwise, we base the processing on the following legal grounds:

• Art. 6 (1) (a) GDPR – consent
• Art. 6 (1) (b) GDPR – performance of a contract or carrying out pre-contractual measures
• Art. 6 (1) (c) GDPR – compliance with legal obligations
• Art. 6 (1) (f) GDPR – legitimate interests

Insofar as special categories of personal data are processed, in particular health data or genetic data, this additionally takes place only on a relevant basis under Art. 9 GDPR, in particular on the basis of your explicit consent pursuant to Art. 9 (2) (a) GDPR or insofar as the processing is necessary for the service you have explicitly requested and is permissible under data protection law.

7Registration and use of the platform / app

When you create a user account or use our platform or app, we process the data required for this in order to provide you with the respective functions. This includes in particular:

• Account data
• Login data
• technical usage data
• content you enter or upload
• health-related information, insofar as you use the corresponding functions

The processing takes place in order to provide our contractual services and is based on Art. 6 (1) (b) GDPR. Insofar as health data is processed, this additionally takes place on the basis of a relevant exception under Art. 9 GDPR.

8Health data within the platform

If you use functions that involve the processing of health data, e.g. for managing biomarkers, protocols, interventions or other health-related content, we process this data exclusively to the extent necessary for providing the respective function and the service you have requested. Depending on the function, this may in particular include:

• Information on symptoms, goals or lifestyle
• Lab values and biomarkers
• Intake plans and protocols
• Uploaded documents or reports
• Information provided during onboarding or in a questionnaire

Where consent is required, we obtain it separately. Without the necessary information, individual functions or services cannot be used in whole or in part.

9EVER Precision

As part of EVER Precision we offer supplementary services, in particular the coordination and performance of health-related analyses, the evaluation of the results, personal consultation and the creation of individual protocols within EVER.

9.1 Subject matter of the processing

As part of EVER Precision, the following data in particular may be processed:

• Master data and contact data
• Shipping data for the delivery of test kits
• Order and payment data
• Information from onboarding and health questionnaires
• Lab values and analysis results
• genetic data from DNA analyses
• health-related data from further tests
• Consultation notes
• Contents of the individual protocol created in EVER
• Data on optionally ordered personalised supplement packs

9.2 Purposes of processing

Processing within EVER Precision takes place in particular for the following purposes:

• Handling your booking
• Dispatch and organisational handling of test kits
• Coordination with analysis and laboratory service providers
• Receipt and processing of analysis results
• internal professional evaluation by authorised EVER staff
• personal discussion of the results
• Creation of an individual protocol in EVER
• Provision of the results and content in your user account
• optional handling of personalised packs or supplementary orders
• Support, documentation and quality assurance

9.3 Internal professional handling

Insofar as results are discussed or evaluated as part of EVER Precision, this takes place within EVER by appropriately authorised staff.

9.4 Legal bases

The processing of your order, shipping, contract and organisational data takes place in order to perform the contract concluded with you pursuant to Art. 6 (1) (b) GDPR. Insofar as health data and genetic data are processed as part of EVER Precision, this additionally takes place on the basis of your explicit consent pursuant to Art. 9 (2) (a) GDPR.

9.5 Recipients within EVER Precision

In order to carry out EVER Precision, data may be transmitted to carefully selected service providers and partners, insofar as this is necessary for providing the service. This may in particular include:

• Shipping and logistics service providers
• Laboratory and analysis service providers
• Payment service providers
• IT and hosting service providers
• Fulfilment and shop service providers for optional product orders

These recipients only receive data insofar as this is necessary for the respective purpose. Insofar as they act on our behalf, they are engaged as processors on the basis of Art. 28 GDPR.

10Contacting us

If you contact us by email, contact form or by any other means, we process the data you provide in order to handle and respond to your enquiry. This concerns in particular:

• Name
• Email address
• Content of your message
• where applicable, further information provided voluntarily

Depending on the occasion, the legal basis is Art. 6 (1) (b) GDPR or Art. 6 (1) (f) GDPR.

11App download via app stores

When you download our app via the Apple App Store or Google Play Store, certain data is processed by the respective store provider. We have no influence over this. The privacy provisions of the respective store operator apply in this respect.

12Cookies and comparable technologies

Insofar as cookies or similar technologies are used in our app or platform, this takes place either on the basis of section 25 (2) TDDDG, where technically necessary, or on the basis of your consent pursuant to section 25 (1) TDDDG in conjunction with Art. 6 (1) (a) GDPR. We only use non-essential cookies or tracking technologies if you have given your prior consent.

13Recipients and categories of recipients

The following recipients or categories of recipients in particular may be given access to personal data:

• internal authorised EVER staff
• IT and hosting service providers
• Payment service providers
• Logistics and shipping service providers
• Laboratory and analysis service providers
• Support and communication service providers
• Legal advisers, tax advisers, banks, auditors and insurers
• Authorities and public bodies, insofar as there is a statutory obligation

Data is only passed on insofar as this is necessary for the specific purpose and permissible under data protection law.

14Transfers to third countries

If we transfer personal data to recipients in countries outside the European Union or the European Economic Area, or use service providers located there, this only takes place in compliance with the statutory requirements of Art. 44 et seq. GDPR. Where no adequacy decision exists, a transfer takes place in particular on the basis of appropriate safeguards, such as the EU standard contractual clauses.

15Retention periods

We store personal data only for as long as this is necessary for the respective purposes or as long as statutory retention obligations exist. The following principles apply in particular:

• We store account data for the duration of the user relationship
• We store contract, order and billing data in accordance with statutory retention obligations
• We store communication data for as long as this is necessary to handle the enquiry
• We store health-related data and results from EVER Precision for as long as this is necessary to provide the service, for documentation, for provision in your user account or on the basis of statutory requirements
• Data is deleted as soon as the respective purpose no longer applies and no statutory retention periods conflict with this

16Obligation to provide data

The provision of personal data is in part necessary for the use of our services. Without the data required for the respective purpose, we cannot provide certain services, in particular the use of the platform, the performance of EVER Precision or the handling of orders, either at all or in full.

17Data security

We take appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access, unauthorised disclosure, alteration or destruction. Our security measures are continuously adapted in line with technological developments.

18Your rights

In accordance with the statutory provisions, you have in particular the following rights:

• Right of access pursuant to Art. 15 GDPR
• Right to rectification pursuant to Art. 16 GDPR
• Right to erasure pursuant to Art. 17 GDPR
• Right to restriction of processing pursuant to Art. 18 GDPR
• Right to data portability pursuant to Art. 20 GDPR
• Right to object pursuant to Art. 21 GDPR
• Right to withdraw consent given, with effect for the future
• Right to lodge a complaint with a data protection supervisory authority

To exercise your rights you can contact us or our data protection officer at any time, or please contact us by email at: support@everhealth.ai

19Withdrawal of consent

You can withdraw consent once given at any time with effect for the future. The lawfulness of the processing carried out up to the withdrawal remains unaffected.

20Changes to this privacy policy

We reserve the right to amend this privacy policy if this becomes necessary due to technical, legal or organisational changes. The version accessible at the time of your visit or use applies in each case.