Data Privacy Policy

CHIRAYOU is a physician-led preventive health program. We regularly collect relevant health data, evaluate it, and discuss it with you - digitally, personally, and preventively. The goal: to understand changes early, gain clarity about your health, and strengthen it in a targeted way. To ensure you can share this data with confidence, we have embedded data protection deeply into our system - technically, organizationally, and medically.

CHIRAYOU works with licensed physicians who provide medical consultations within the program. CHIRAYOU and the respective physicians are joint controllers within the meaning of Art. 26 GDPR. They jointly determine the purposes and means of processing personal data.

Primary data protection responsibility lies with CHIRAYOU GmbH, Hauptstraße 457, 53639 Königswinter, Germany, Email: support@chirayou.com.

Our partner physicians are additionally bound by medical confidentiality (Section 203 of the German Criminal Code, StGB). A summary of the key contents of the joint controller arrangement under Art. 26 GDPR is available from us upon request.

• Personal information: name, date of birth, gender, contact details.
• Health and fitness data: heart rate, sleep quality, activity and stress data, vital signs, blood and laboratory values.
• Data relating to health-relevant behavior: information on nutrition, sleep, activity, tobacco and alcohol consumption.
• Chat messages: what you write in the AI chat in the app.
• Communication data and conversation content: With your prior explicit consent, video consultations may be recorded for quality assurance or training purposes. Such recordings are used exclusively for the stated purpose and subsequently anonymized.
• Technical data when you visit our website: IP address, device and browser details, pages viewed; cookies and similar technologies only where strictly necessary or where you have consented (details in the section “Our website”).

Providing your health and contact data is necessary to carry out our physician-led program; without this data we cannot provide the services. Our offering is intended exclusively for persons aged 18 and over.

We process your data solely to provide you with physician-led preventive services and to operate our systems securely and in a user-friendly manner.

This includes in particular:

• Creation and medical evaluation of your health data,
• Provision of individual reports and recommendations, including AI-written Report texts and answers in the AI chat,
• Organization and conduct of medical consultations,
• Anonymized evaluation for quality assurance and further development of our services,
• Communication about technical matters, appointments, and user feedback.

The legal bases for processing are:

• Art. 6(1)(b) GDPR (performance of a contract),
• Art. 9(2)(h) GDPR in conjunction with Section 22(1) no. 1(b) BDSG (medical consultations and medical documentation, including its retention),
• Art. 9(2)(a) GDPR (explicit consent to the processing of your health data, including lab analysis, the AI-written Report and the AI chat),
• Art. 6(1)(a) GDPR (consent, e.g. for recordings, the newsletter, statistics and advertising on our website) and Section 25(1) TDDDG (consent to storing and reading information on your device),
• Art. 9(2)(a) GDPR (explicit consent, where conclusions about your health can be drawn from advertising measurement data),
• Art. 6(1)(f) GDPR (legitimate interests, e.g. hosting, IT security, preventing misuse and our identifier-free count of page views),
• Art. 6(1)(c) GDPR (compliance with legal obligations, e.g. commercial and tax retention requirements and demonstrating consent under Art. 7(1) GDPR).

CHIRAYOU and the participating physicians jointly determine the purposes and scope of processing personal data.

Responsibilities are clearly allocated:

• CHIRAYOU is responsible for IT security, data hosting, technical administration, fulfillment of data subject rights, and communication with supervisory authorities.
• The physicians are responsible for the substantive medical consultation, medical assessment, and documentation of the consultations.
• Both parties commit to high data protection standards, confidentiality, and secure technical procedures.

Requests regarding data protection rights can be addressed to CHIRAYOU; we will coordinate a response together with the respective physician.

Your data is not sold.

Data is only shared where necessary and lawful:

• with physicians acting as part of the joint controllership with CHIRAYOU,
• with laboratories for analysis of blood and biomarker samples,
• with technical service providers (hosting and delivery of the website via Cloudflare, video services) bound by contract as processors,
• with our cloud provider, which operates AI language models for us within the EU as a processor bound by contract, to create your Report and answer your questions in the chat,
• - only with your consent - with analytics and advertising services (Google, Meta),
• with payment and shipping providers where necessary for your order,
• with authorities where we are legally obliged to do so.

Some service providers process data in the USA (see “Transfers to the USA” in the section “Our website”). Transfers for statistics and advertising take place only if you have consented beforehand. They are based on the European Commission's adequacy decision on the EU-US Data Privacy Framework (Art. 45 GDPR), under which the recipients are certified; EU Standard Contractual Clauses apply in addition.

When you connect a wearable or health app to CHIRAYOU (e.g. Garmin, Oura, WHOOP, Fitbit or Apple Health), we use this data only to provide CHIRAYOU features to you: we show it in your app and use it for your Report and to answer your questions in the chat. For the Report and the chat, it is processed with AI (see “AI processing of your health data”). We do not use it to train AI models, do not sell it and do not pass it on to third parties for their own purposes. It is processed only by our hosting, database and cloud providers, who act as processors bound by our instructions.

CHIRAYOU uses artificial intelligence (AI) to write the texts of your Report (explanations of your markers, summaries and your plan) and to answer your questions in the in-app chat. Before the chat answers, each message is checked automatically for safety.

For this, the AI processes your lab results, your questionnaire answers (including free text), data from connected devices and from the app, your chat messages, and your age, sex, height and weight.

The legal basis is the performance of your contract (Art. 6(1)(b) GDPR) and your explicit consent (Art. 9(2)(a) GDPR), which we ask for when you order or set up the app. AI processing is part of the CHIRAYOU service. Without this consent, we cannot provide the service to you.

The AI language models are operated for us by our cloud provider in data centres within the European Union, as a processor bound by our instructions (Art. 28 GDPR). Your data is not used to train AI models.

The chat tells you that you are communicating with an AI. Report texts and chat answers are created automatically and are not reviewed by a doctor before you see them. They are not medical advice and do not replace a consultation with a doctor. If you have a medical consultation, your results are discussed with you there and your plan is approved by a doctor. The AI texts have no legal effect on you and do not decide anything about your contract. They are not automated decisions within the meaning of Art. 22 GDPR.

We store your chat history and Report texts for as long as you are a member. When your membership ends, we delete them, except data we are required by law to keep (see “Retention and deletion”).

You can withdraw your consent at any time, in the app under Profile › Data & legal › Delete account, or by email to support@chirayou.com. Withdrawal does not affect the lawfulness of processing carried out before it. Because we cannot provide CHIRAYOU without AI processing, your membership then ends and we delete your data, except data we are required by law to keep.

Data is stored only for as long as necessary to provide our services or to fulfill statutory retention obligations. Medical documentation is generally retained for ten years (Section 630f German Civil Code, BGB; longer in certain cases); commercial and tax records are retained for six to ten years (Section 257 Commercial Code, HGB; Section 147 Fiscal Code, AO). After your membership ends or you withdraw consent, your data will be deleted or anonymized as soon as it is no longer required for these purposes and no statutory retention obligations apply. You can export your data or delete your account at any time in the app under Profile › Data & legal. We keep proof of your consent and of its withdrawal for as long as claims can be raised. How long data from visiting our website are kept (cookies, page-view count, proof of consent, analytics) is stated for each service in the section “Our website”.

CHIRAYOU protects your data through modern technical and organizational measures:

• SSL/TLS encryption for data transmissions,
• Two-factor authentication for physicians,
• Access logging,
• Secure storage within the EU,
• Regular security and data protection training.

The systems storing your health data are operated on servers within the European Union, and the AI processing of your health data also takes place within the European Union. Where you consent to statistics or advertising on our website, usage data are also transferred to service providers in the USA (see “Transfers to the USA”).

You have the following rights at any time:

• Access to the personal data we hold about you,
• Rectification of inaccurate data,
• Erasure ("right to be forgotten"),
• Restriction of processing,
• Objection to certain processing activities,
• Data portability,
• Withdrawal of consent with effect for the future,
• Lodging a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW), which is responsible for us.

To exercise your rights, simply email support@chirayou.com.

Where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), for example for hosting, bot detection and our count of page views, you have the right to object at any time on grounds relating to your particular situation. We will then stop processing the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims. You can send an objection informally to support@chirayou.com. You can withdraw consents (e.g. for statistics and advertising) at any time without giving reasons via “Cookie settings”.

We do not make decisions based solely on automated processing - including profiling - within the meaning of Art. 22 GDPR. Report texts and chat answers created with AI are not reviewed by a physician and are not a medical assessment. Medical assessments and recommendations are given by licensed physicians in a medical consultation.

Recordings of teleconsultations are made only with your prior consent. The data is used solely for quality assurance and training purposes and anonymized once the purpose ceases to apply. No personal evaluation is performed.

When you sign up for our newsletter or request free content (e.g., our health guides), we process the email address you provide and - where given - your first name in order to send you the requested content as well as information about prevention, health, and our offerings.

The legal basis is your consent (Art. 6(1)(a) GDPR). Sign-up uses a double opt-in procedure: after registering, you receive an email asking you to confirm your subscription. You can withdraw your consent at any time with effect for the future, e.g., via the unsubscribe link in every email or by message to support@chirayou.com. The lawfulness of processing carried out before withdrawal remains unaffected.

To send these emails we use the service ActiveCampaign (ActiveCampaign, LLC, USA), which processes the data as a processor on our behalf; data may be transferred to the USA. Such transfers are safeguarded by EU Standard Contractual Clauses (Art. 46 GDPR) and the adequacy decision on the EU-US Data Privacy Framework, under which ActiveCampaign, LLC is certified. Your data is stored for this purpose until you unsubscribe or withdraw your consent.

This section describes what is processed when you visit www.chirayou.com (including the checkout at www.chirayou.com/blood-test/checkout). The controller is CHIRAYOU GmbH (contact details below). What happens without consent is limited to what is technically necessary and to a count that does not identify anyone. Statistics and advertising run only if you have consented in the cookie banner. You can change your choice at any time via “Cookie settings” in the footer.

Hosting and delivery (Cloudflare)

Our website and the checkout are delivered via Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. For every request Cloudflare processes your IP address, the address requested, the time, the referrer URL and the browser and device details your browser sends. Cloudflare acts as our processor (Art. 28 GDPR). The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is fast, stable and secure delivery of the website. We do not store access logs containing IP addresses ourselves. Cloudflare security events (e.g. blocked requests) are deleted after the retention period of our Cloudflare plan, after 30 days at the latest. Cloudflare, Inc. is certified under the EU-US Data Privacy Framework (Art. 45 GDPR); the EU Standard Contractual Clauses in Cloudflare's data processing agreement apply in addition.

Protection against attacks and bots

To protect our website and the ordering process against attacks, spam and automated access, Cloudflare runs bot detection. Cloudflare may set the cookie “__cf_bm” (30 minutes). Only when Cloudflare shows a security check does a short script check characteristics of your browser and set the cookie “cf_clearance” (30 minutes). This storage and reading is strictly necessary to provide the website you requested securely (Section 25(2) no. 2 TDDDG); the subsequent processing is based on Art. 6(1)(f) GDPR (legitimate interest: IT security and preventing misuse). The results are not used for advertising or statistics.

Managing your consent (cookie banner)

Our cookie banner comes from our own tool (Lightrise) and runs on our website; no external consent-management provider is involved. We store your choice in the cookie “lr_consent” on your device. It contains only the banner version, your choice per purpose and the time, and no identifier; it is deleted after 6 months. This cookie is strictly necessary to respect your decision (Section 25(2) no. 2 TDDDG). We ask again after 6 months or when purposes or providers change.

So that we can demonstrate that and how consent was given or withdrawn (Art. 7(1) GDPR), we store one entry per decision containing the time, banner version, action (e.g. “accepted all”, “rejected all”, “saved selection”, “withdrawn”), the setting per purpose, language and the page path, but no IP address, no browser identifier and no other identifier. We also keep every version of the banner. The legal basis is Art. 6(1)(c) in conjunction with Art. 7(1) GDPR. The entries are stored on Cloudflare servers (processor) in the EU and deleted at the end of the third calendar year after the decision.

Our own count of page views (no cookies, no identifier)

To know how many visitors actually arrive on our pages from an ad and start an order, our server at Cloudflare counts every request for a landing page and every start of an order. Nothing is stored on or read from your device, and no script runs in your browser. For each request we store only:

• the type of event (landing page or order start) and the page path without parameters;
• the device class (smartphone, tablet, desktop, bot), derived from the browser identifier, which itself is not stored;
• only whether an ad click identifier was present (e.g. “gclid”), not the identifier itself;
• the campaign and ad group label from the address (utm_campaign, utm_content), where it is a label;
• the country (derived from the IP address; the IP address itself is not stored);
• whether the request came from another website (Sec-Fetch-Site) and whether the page was reloaded;
• for an order start, the path of the page the order was started from.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is to measure the effect of our advertising, detect measurement gaps and technical errors, and avoid wasting advertising budget. The count is necessary for this because otherwise we would have no figures at all about visitors who have not consented; there is no less intrusive means using fewer data. Your interests do not override ours: the stored details do not allow us to recognise you or to attribute visits to a person over time; no profile is created; the data are not combined with other data and not disclosed to third parties (Cloudflare processes them only as our processor); and a website operator counting page views matches visitors' reasonable expectations. Without any link to a person, a page path (e.g. of a page about a particular blood marker) reveals nothing about your health.

Entries are deleted automatically after 3 months; we use only aggregated figures. The IP address is processed only at the moment of the request. You can object to the count (see “Right to object”).

On our blood-test landing page we also test two versions against each other. If you open the page from outside our website and the address does not yet name a version, our server at Cloudflare picks at random which version you see; the version then stays in the address (e.g. “arm=d”) so that reloading shows the same page. Nothing is stored on or read from your device for this, and no identifier is created. Through the count described above we evaluate how often each version was served and how often an order was started from it, and – only if you have allowed “Statistics” – through Google Analytics how the versions are used. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is finding out which version of a page works better.

Statistics (only with consent): Google Analytics and A/B tests

If you allow “Statistics”, we use Google Analytics 4 to measure which pages are visited and which buttons are used, and we test variants of our pages (A/B tests). Measurement data go directly to Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, acting as our processor; your browser loads the script this needs (Google Tag Manager) from Google's servers only after you have consented. We process your IP address, device and browser details, pages viewed and events (e.g. clicks, starting an order) and a random identifier. The cookies “_ga” and “_ga_N543GR4LNC” (6 months) are stored. For A/B tests our server assigns you to a test group and stores it in the cookies “ch_abid” and “ch_ab_…” (6 months); we only count which variant was shown and clicked.

The legal basis is your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). Google keeps the analytics data for 14 months. We have switched off “Google signals”, the feature that lets Google link analytics data to signed-in Google accounts. Google may transfer data to Google LLC in the USA; Google LLC is certified under the EU-US Data Privacy Framework (Art. 45 GDPR). You can withdraw your consent at any time via “Cookie settings” in the footer.

Advertising (only with consent): Google Ads

If you allow “Marketing: Google Ads”, we use Google Ads to measure whether an order follows a click on one of our ads, and Google uses this to serve, optimise and personalise ads. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, which acts as an independent controller for this. Google receives the pages viewed (with their address), your IP address, device details, events such as starting and completing an order (with order value and order number) and the ad click identifier; it combines these with other data about you, for example from your Google account and from other websites, and builds advertising profiles. In doing so Google learns that you are interested in a blood test or have ordered one. The cookies “_gcl_au”, “_gcl_aw”, “_gcl_gb” and “_gcl_gs” (90 days each) and “_gcl_ls” in local storage are stored; Google may also set its own cookies on google.com and doubleclick.net (e.g. “IDE”, up to 13 months). The legal basis is your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR) and, where conclusions about your health can be drawn from the data, your explicit consent (Art. 9(2)(a) GDPR). Google transfers data to Google LLC in the USA; Google LLC is certified under the EU-US Data Privacy Framework (Art. 45 GDPR). How long Google keeps the data is set out in Google's privacy policy (https://policies.google.com/privacy). You can withdraw at any time via “Cookie settings”.

Advertising (only with consent): Meta Pixel

If you allow “Marketing: Meta”, we use the Meta Pixel of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. Meta uses it to measure which of our pages and offers are viewed (including after a click on one of our ads), how intensively they are used and whether someone signs up for our newsletter or sends a request through one of our forms, and uses this to serve, optimise and personalise ads, including for people with similar characteristics. Meta receives the pages viewed (with their address), your IP address, device and browser details and these events, directly and also via the Meta Conversions API Gateway, which Meta runs on Amazon Web Services servers in the USA. Meta links the data to your Facebook or Instagram account and to data from other websites and builds advertising profiles; in doing so Meta learns that you are interested in a blood test. On our checkout pages – including the confirmation page after an order – and on the page where you activate your account after an order, the Meta Pixel is not active: Meta receives neither page views nor events from them, and we do not tell Meta whether you have placed an order. The cookies “_fbp” and “_fbc” (90 days each) are stored, and in local storage “lastExternalReferrer” and “lastExternalReferrerTime” (the last external website that referred you and when; we delete them if you withdraw); Meta may also set its own cookies on facebook.com (e.g. “fr”, 90 days). The legal basis is your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR) and, where conclusions about your health can be drawn from the data, your explicit consent (Art. 9(2)(a) GDPR). Meta transfers data to Meta Platforms, Inc. in the USA; Meta Platforms, Inc. is certified under the EU-US Data Privacy Framework (Art. 45 GDPR).

We and Meta are joint controllers (Art. 26 GDPR) for collecting the data on our website and transmitting it to Meta. The essence of our arrangement (Meta “Controller Addendum”, https://www.facebook.com/legal/controller_addendum): Meta provides the information about its own processing and handles data subject rights for the data stored by Meta; we are responsible for obtaining consent on our website. You can exercise your rights against us and against Meta. Meta alone is responsible for any further processing; details and retention: https://www.facebook.com/privacy/policy. You can withdraw at any time via “Cookie settings”.

YouTube videos

Preview images of our videos are served from our own server. Only when you click a video is it loaded from YouTube (Google Ireland Limited, Ireland) in privacy-enhanced mode (youtube-nocookie.com). Google then receives your IP address, the page the video is embedded on and browser details, and YouTube may store information on your device. The legal basis is your consent given by clicking the video (Section 25(1) TDDDG, Art. 6(1)(a) GDPR), which we point out before loading. Google may transfer data to Google LLC in the USA (EU-US Data Privacy Framework, Art. 45 GDPR).

Payment in the checkout (Stripe)

Payments are processed by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland. As soon as you open the checkout, Stripe loads a script that checks device and browser details to prevent fraud and sets the cookies “__stripe_mid” (1 year) and “__stripe_sid” (30 minutes); on its own domain m.stripe.com Stripe also sets the cookie “m” for this (up to 2 years). This is strictly necessary for the order you requested (Section 25(2) no. 2 TDDDG); the processing is based on Art. 6(1)(b) and (f) GDPR (performing the contract, preventing fraud). Stripe may transfer data to Stripe, LLC in the USA; Stripe, LLC is certified under the EU-US Data Privacy Framework.

Transfers to the USA

Some of the providers named process data in the USA. We base these transfers on the European Commission's adequacy decision on the EU-US Data Privacy Framework of 10 July 2023 (Art. 45 GDPR); the recipients are certified under it (as checked on: 29 September 2026). The EU Standard Contractual Clauses in the respective contracts apply in addition. We do not base regular transfers on consent under Art. 49 GDPR.

• Cloudflare, Inc. (hosting, security, counting, proof of consent): always;
• Google LLC (Google Analytics, Google Ads, YouTube): only with consent;
• Meta Platforms, Inc. (Meta Pixel, Conversions API Gateway via Amazon Web Services): only with consent;
• Stripe, LLC (payment): when you order;
• ActiveCampaign, LLC (newsletter): when you sign up.

Overview: cookies and local storage

The list below names everything our website stores on or reads from your device. You can change your current choice here:

Open cookie settings

• Necessary: “lr_consent” (CHIRAYOU; your cookie choice; 6 months)
• Necessary: “chirayou-lang-choice” (CHIRAYOU; your language choice, only once you choose a language; local storage, until you delete it)
• Necessary: “i18nextLng” (CHIRAYOU; saves the display language; local storage, until you delete it)
• Necessary: “chirayou_journal_unlock” (CHIRAYOU; remembers that you unlocked journal articles; set only once you have signed up for the newsletter to do so; local storage, until you delete it)
• Necessary: “chirayou-checkout” (CHIRAYOU; the state of your order in the checkout; session storage, until the tab is closed) and “chirayou-activation-params” (activation link; session storage, until the tab is closed)
• Necessary: “chirayou_checkout_variant” (CHIRAYOU; the checkout variant you see), “chirayou_purchase_tx_…” (CHIRAYOU; prevents a completed order from being counted twice) and “chirayou_payment_attempt_in_flight” (CHIRAYOU; notes that a payment is in progress); session storage, until the tab is closed
• Necessary: “__stripe_mid” (Stripe; fraud prevention in the checkout; 1 year), “__stripe_sid” (Stripe; 30 minutes) and “m” (Stripe, on m.stripe.com; fraud prevention; up to 2 years)
• Necessary: “__cf_bm” (Cloudflare; bot detection; 30 minutes) and “cf_clearance” (Cloudflare; result of the bot check, only when Cloudflare shows a security check; 30 minutes)
• Statistics: “_ga”, “_ga_N543GR4LNC” (Google Analytics; 6 months), “ch_abid”, “ch_ab_…” (CHIRAYOU; A/B tests; 6 months); after consent also “chirayou.checkoutAttribution.v1” and “chirayou_landing_checkout_variant” (CHIRAYOU; page of origin and checkout variant; session storage, at most 30 minutes or until the tab is closed)
• Marketing: Google Ads: “_gcl_au”, “_gcl_aw”, “_gcl_gb”, “_gcl_gs” (90 days), “_gcl_ls” (local storage); Google's own cookies such as “IDE” (doubleclick.net, up to 13 months)
• Marketing: Meta: “_fbp”, “_fbc” (90 days); “lastExternalReferrer”, “lastExternalReferrerTime” (local storage); Meta's own cookies such as “fr” (facebook.com, 90 days)
• YouTube (after a click): local-storage entries and cookies set by YouTube on youtube-nocookie.com / youtube.com

We reserve the right to update this Privacy Policy, e.g., due to legal changes or new features on our platform. We will inform you in good time by email or within the app about any material changes.

CHIRAYOU GmbH
Hauptstraße 457,
53639 Königswinter,
Germany
Email: support@chirayou.com

Data protection coordination (Art. 26 GDPR): Coordination of joint data protection requests is handled by CHIRAYOU. Requests are processed in accordance with the joint controllership arrangement.

Data protection officer: stefan@chirayou.com