Data Privacy Policy

The protection of your personal data is especially important to us. Health and fitness data are at the heart of our program - and we know they are among the most sensitive information you can share. That's why data protection has been a priority at CHIRAYOU from the very beginning: your health data is processed under medical responsibility on servers within the EU and protected in line with the highest security standards.

What CHIRAYOU is about

CHIRAYOU is a physician-led preventive health program. We regularly collect relevant health data, evaluate it, and discuss it with you - digitally, personally, and preventively. The goal: to understand changes early, gain clarity about your health, and strengthen it in a targeted way. To ensure you can share this data with confidence, we have embedded data protection deeply into our system - technically, organizationally, and medically.

Controllers within the meaning of the GDPR

CHIRAYOU works with licensed physicians who provide medical consultations within the program. CHIRAYOU and the respective physicians are joint controllers within the meaning of Art. 26 GDPR. They jointly determine the purposes and means of processing personal data.

Primary data protection responsibility lies with CHIRAYOU GmbH, Hauptstraße 457, 53639 Königswinter, Germany, Email: support@chirayou.com.

Our partner physicians are additionally bound by medical confidentiality (Section 203 of the German Criminal Code, StGB). A summary of the key contents of the joint controller arrangement under Art. 26 GDPR is available from us upon request.

Data we collect

• Personal information: name, date of birth, gender, contact details.
• Health and fitness data: heart rate, sleep quality, activity and stress data, vital signs, blood and laboratory values.
• Data relating to health-relevant behavior: information on nutrition, sleep, activity, tobacco and alcohol consumption.
• Communication data and conversation content: With your prior explicit consent, video consultations may be recorded for quality assurance or training purposes. Such recordings are used exclusively for the stated purpose and subsequently anonymized.
• Technical data: IP address, device information, browser type, app usage behavior, cookies (if you consent).

Providing your health and contact data is necessary to carry out our physician-led program; without this data we cannot provide the services. Our offering is intended exclusively for persons aged 18 and over.

Purpose of processing

We process your data solely to provide you with physician-led preventive services and to operate our systems securely and in a user-friendly manner.

This includes in particular:

• Creation and medical evaluation of your health data,
• Provision of individual reports and recommendations,
• Organization and conduct of medical consultations,
• Anonymized evaluation for quality assurance and further development of our services,
• Communication about technical matters, appointments, and user feedback.

The legal bases for processing are:

• Art. 6(1)(b) GDPR (performance of a contract),
• Art. 9(2)(h) GDPR (health care by medical professionals),
• Art. 6(1)(a) GDPR (consent, e.g., for recordings, the newsletter, and non-essential cookies),
• Art. 6(1)(f) GDPR (legitimate interests, e.g., ensuring IT security, preventing misuse, and the stable operation of our systems),
• Art. 6(1)(c) GDPR (compliance with legal obligations, e.g., commercial and tax retention requirements).

Joint controllership (Art. 26 GDPR)

CHIRAYOU and the participating physicians jointly determine the purposes and scope of processing personal data.

Responsibilities are clearly allocated:

• CHIRAYOU is responsible for IT security, data hosting, technical administration, fulfillment of data subject rights, and communication with supervisory authorities.
• The physicians are responsible for the substantive medical consultation, medical assessment, and documentation of the consultations.
• Both parties commit to high data protection standards, confidentiality, and secure technical procedures.

Requests regarding data protection rights can be addressed to CHIRAYOU; we will coordinate a response together with the respective physician.

Data sharing

Your data is not sold.

Data is only shared where necessary and lawful:

• with physicians acting as part of the joint controllership with CHIRAYOU,
• with laboratories for analysis of blood and biomarker samples,
• with technical service providers (hosting, video services) who are strictly bound by contract to confidentiality,
• with our cookie-consent provider (Cookiebot/Usercentrics A/S, Denmark),
• - only with your consent - with analytics, chat, and marketing services (including Google, Meta, and Intercom),
• with authorities where we are legally obliged to do so.

Some of the analytics, chat, and marketing services we use (in particular Google, Meta, and Intercom) process data in the USA. Such transfers only take place if you have first consented to the relevant cookies (Art. 6(1)(a) GDPR) and are safeguarded by the European Commission's adequacy decision on the EU-US Data Privacy Framework, supplemented by EU Standard Contractual Clauses.

Retention and deletion

Data is stored only for as long as necessary to provide our services or to fulfill statutory retention obligations. Medical documentation is generally retained for ten years (Section 630f German Civil Code, BGB; longer in certain cases); commercial and tax records are retained for six to ten years (Section 257 Commercial Code, HGB; Section 147 Fiscal Code, AO). After your membership ends or you withdraw consent, your data will be deleted or anonymized as soon as it is no longer required for these purposes and no statutory retention obligations apply. You can view your data or request deletion at any time via your user account.

Data security

CHIRAYOU protects your data through modern technical and organizational measures:

• SSL/TLS encryption for data transmissions,
• Two-factor authentication for physicians,
• Access logging,
• Secure storage within the EU,
• Regular security and data protection training.

The systems on which your health data is stored are operated on servers within the European Union. Where you consent to analytics or marketing cookies, technical data may be transferred to service providers in the USA (see the "Data sharing" section).

Your rights

You have the following rights at any time:

• Access to the personal data we hold about you,
• Rectification of inaccurate data,
• Erasure ("right to be forgotten"),
• Restriction of processing,
• Objection to certain processing activities,
• Data portability,
• Withdrawal of consent with effect for the future,
• Lodging a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW), which is responsible for us.

To exercise your rights, simply email support@chirayou.com.

No automated decision-making

We do not make decisions based solely on automated processing - including profiling - within the meaning of Art. 22 GDPR. Analyses of your health data serve as preparation; the medical assessment and all recommendations are the responsibility of licensed physicians.

Recordings

Recordings of teleconsultations are made only with your prior consent. The data is used solely for quality assurance and training purposes and anonymized once the purpose ceases to apply. No personal evaluation is performed.

Newsletter, health guides, and email marketing

When you sign up for our newsletter or request free content (e.g., our health guides), we process the email address you provide and - where given - your first name in order to send you the requested content as well as information about prevention, health, and our offerings.

The legal basis is your consent (Art. 6(1)(a) GDPR). Sign-up uses a double opt-in procedure: after registering, you receive an email asking you to confirm your subscription. You can withdraw your consent at any time with effect for the future, e.g., via the unsubscribe link in every email or by message to support@chirayou.com. The lawfulness of processing carried out before withdrawal remains unaffected.

To send these emails we use the service ActiveCampaign (ActiveCampaign, LLC, USA), which processes the data as a processor on our behalf; data may be transferred to the USA. Such transfers are safeguarded by EU Standard Contractual Clauses (Art. 46 GDPR) and - where certified - the adequacy decision on the EU-US Data Privacy Framework. Your data is stored for this purpose until you unsubscribe or withdraw your consent.

Changes to this Privacy Policy

We reserve the right to update this Privacy Policy, e.g., due to legal changes or new features on our platform. We will inform you in good time by email or within the app about any material changes.

Responsible contact

CHIRAYOU GmbH
Hauptstraße 457,
53639 Königswinter,
Germany
Email: support@chirayou.com

Data protection coordination (Art. 26 GDPR): Coordination of joint data protection requests is handled by CHIRAYOU. Requests are processed in accordance with the joint controllership arrangement.

Cookie declaration

We use cookies and similar technologies on the basis of Section 25 TDDDG. Technically necessary cookies are set without consent; all other cookies (e.g., for statistics/analytics and marketing) are set only with your consent (Art. 6(1)(a) GDPR). You can withdraw or adjust your consent at any time with effect for the future via the "Cookie settings" link in the footer. The declaration below lists the cookies used, their purpose, and their storage duration: