Transparency & Data Security

• Health-related data is designed to stay on-device by default whenever features allow.
• We only request permissions needed for specific product functions.
• We avoid background data access that is not directly tied to user actions.

For website workflows such as waitlist and support, we may process:

• Contact data you submit (for example email address and optional name).
• Operational metadata required for abuse prevention and service stability.
• Consent signals required for lawful communication and cookie preferences.

We do not sell personal data or use health data for advertising.

• Data in transit is protected via HTTPS/TLS.
• Access to service dashboards is restricted to authorized personnel only.
• Provider accounts are secured with least-privilege access and periodic credential review.

We use vetted processors to deliver core services:

• Brevo: waitlist and transactional email communication.
• FormSubmit.co: handling website contact form delivery.
• Cookiebot/Klaro: consent management preferences.
• Hosting infrastructure (depending on deployment): secure application delivery and logs.

Data Processing Agreements (DPAs) are used where required.

• Waitlist data can be removed at any time through unsubscribe requests.
• Support/contact data is retained only as long as needed for response and legal obligations.
• Operational logs are retained for limited periods and automatically rotated.

• Suspicious events are reviewed and triaged with priority based on impact and scope.
• Impacted systems can be isolated and credentials rotated when needed.
• Where legally required, authorities and affected users are informed within applicable timelines.

You can request access, correction, deletion, or restriction of your data.

Contact: support@priohealth.de