Data Protection

The protection of your privacy and your personal data (within the meaning of Article 4(1) of the General Data Protection Regulation (EU) 2016/679 – “GDPR”) is one of our most important concerns. It is essential to us that our users feel safe and comfortable when using our services.

This Privacy Policy applies to all Evela Health offerings: our website, the web app (after registration) and our mobile apps for iOS and Android. Sections that apply only to a specific offering are marked accordingly.

Note for users in Switzerland

For persons whose habitual residence is in Switzerland, the provisions of the Swiss Data Protection Act (revDSG) apply in addition. Where this Policy refers to the GDPR, the corresponding provisions of the revDSG apply mutatis mutandis; the data subject rights named here are available to you in a comparable manner under the revDSG as well.

A. General

Applies to: Website · Web App · Mobile App

A.1 Controller and Data Protection Officer

The controller within the meaning of Art. 4(7) GDPR is: Evela Health GmbH, Chausseestraße 58d, 10115 Berlin, Germany.

You can reach our Data Protection Officer at datenschutz@evela.health or at our postal address with the addition “the Data Protection Officer”.

A.2 Your rights

You have the following rights regarding your personal data:

•  Right of access (Art. 15 GDPR)

•  Right to rectification (Art. 16 GDPR)

•  Right to erasure (Art. 17 GDPR; “right to be forgotten”)

•  Right to restriction of processing (Art. 18 GDPR)

•  Right to object to processing (Art. 21 GDPR)

•  Right to data portability (Art. 20 GDPR)

You also have the right to lodge a complaint with a data protection supervisory authority in the Member State of your residence, place of work or the place of the alleged infringement. The authority responsible for us is: Berlin Commissioner for Data Protection and Freedom of Information, Alt-Moabit 59-61, 10555 Berlin, tel.: +49 30 13889-0, e-mail: mailbox@datenschutz-berlin.de.

For users habitually resident in Switzerland, the following authority is additionally competent: Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, Switzerland, www.edoeb.admin.ch.

For users habitually resident in Austria, the Austrian Data Protection Authority (DSB), Barichgasse 40-42, 1030 Vienna, www.dsb.gv.at, is a possible point of contact.

Where you have given us consent, you may withdraw it at any time with effect for the future – informally by e-mail to info@evela.health. The lawfulness of processing until withdrawal remains unaffected.

A.3 Additional note on your right to object

Where processing is based on our legitimate interest pursuant to Art. 6(1)(f) GDPR, you have the right to object at any time. This also applies where your data are processed for direct marketing.

A.4 No obligation to provide personal data

You are neither legally nor contractually obliged to provide us with personal data. However, if you wish to use our service, processing the data listed is necessary. If you do not provide it, you cannot use our premium offering.

A.5 No automated decision-making including profiling

When evaluating activity and health data, no decision is made based solely on automated processing – including profiling – that produces legal effects concerning you or similarly significantly affects you.

B. Website only

Applies to: evela.health (public, no login)

B.1 When accessing our website

When you access our website, your browser automatically transmits data to our server, which we store in log files: IP address, date/time of the request, content of the request, access status/HTTP status code, amount of data transferred, referrer URL, browser, operating system, language and version of the browser software.

For reasons of technical security, this data is stored for a maximum of seven days. The legal basis is Art. 6(1)(f) GDPR.

B.2 Symptom check / quiz on our landing page

In the interactive symptom check we process: your answers on complaints and symptoms as well as information on age and health insurance situation, your first name, your e-mail address, the consents given (with timestamp) and technical metadata (timestamp, shortened IP address as proof of consent).

The information on symptoms and age constitutes special categories of personal data within the meaning of Art. 9(1) GDPR (health data). The legal basis is your explicit consent pursuant to Art. 9(2)(a) GDPR via the mandatory checkbox at the end of the quiz; for first name and e-mail address, Art. 6(1)(b) GDPR.

We store your quiz data for twelve months from the last interaction. If you conclude a contract within this period, the data is further processed within the contractual relationship; otherwise it is automatically deleted. Deletion/withdrawal at any time, informally, to datenschutz@evela.health.

This symptom and insurance check also covers the reimbursement check on our sleep course landing page (checking what proportion your insurer reimburses). The same legal bases and storage periods as above apply.

B.3 Newsletter registration

If you have consented, you can subscribe to our newsletter. We process your e-mail address to send you a confirmation e-mail and the newsletter. The legal basis is Art. 6(1)(a) GDPR. You can withdraw at any time via the unsubscribe link in every newsletter.

B.4 Business contact registration

You can register on our website for business contacts. We process first and last name, company name where applicable, e-mail address and website. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in business contacts).

B.5 Cookies

Our website uses cookies – small data packages stored temporarily (session cookies) or permanently on your device. We store technically necessary cookies on the basis of Art. 6(1)(f) GDPR. Where consent has been obtained for cookies and similar recognition technologies, processing takes place exclusively on that basis (Art. 6(1)(a) GDPR and § 25(1) TDDDG); consent can be withdrawn at any time.

B.6 Analysis and marketing tools on the website

Google Analytics

This website uses Google Analytics (Google Inc.). Google Analytics uses cookies; the information collected is generally transferred to a Google server in the USA. IP anonymisation is activated. Google Inc. is certified under the EU-US Data Privacy Framework.

Google Tag Manager

The Google Tag Manager (Google Ireland Ltd.) is an auxiliary service and processes personal data only for technically necessary purposes. It handles the loading of other components but does not access their data.

Meta Pixel (Facebook/Instagram Ads)

We use the Meta Pixel (Meta Platforms Ireland Ltd.). It records actions on our website (events, e.g. page views, start and completion of the Evela quiz, newsletter sign-up) and transmits them to Meta – to measure advertising effectiveness, deliver tailored advertising (Custom/Lookalike Audiences) and optimise delivery. Processed data include IP address, browser/device information, URL and referrer, timestamp and a cookie identifier (“_fbp”). We also use “advanced matching”: certain information (e.g. e-mail address) is transmitted in hashed form already in the browser.

The legal basis is your explicit consent pursuant to Art. 6(1)(a) GDPR and § 25(1) TDDDG via our cookie consent banner. Without consent, the pixel is not loaded. A joint controllership agreement pursuant to Art. 26 GDPR exists for the joint processing of event data.

The events recorded also include purchase completion (e.g. of the sleep course). Only such general events are transmitted – the contents of the symptom and insurance check (your individual answers, symptoms and the reimbursement result) are not transmitted to Meta.

B.7 Amazon PartnerNet (affiliate programme)

We participate in the Amazon EU Associates Programme. Some links on this website may be affiliate links; if you make a purchase, we may receive a commission – at no additional cost to you. Amazon and its partners may use cookies and tracking technologies to recognise that a visit came via our link. The legal basis is your consent (Art. 6(1)(a) GDPR) via our cookie consent banner and, additionally, Art. 6(1)(f) GDPR.

B.8 Evela Health social media pages

We operate company pages on Facebook, Instagram and LinkedIn. Insofar as Meta provides us with statistical evaluations (“Page Insights”), we are joint controllers with Meta within the meaning of Art. 26 GDPR; responsibilities are set out in Meta’s Page Insights addendum. Meta assumes primary responsibility for informing data subjects and handling data subject rights.

We process the content you share on our pages (posts, comments, direct messages) and publicly visible profile data. The legal basis is Art. 6(1)(f) GDPR.

We advise you never to share health data or other sensitive data with us via social media pages.

B.9 Sleep course – purchase via the landing page and automatic storage of e-mail addresses

You can purchase our certified sleep course directly via the associated landing page without first creating a user account. To purchase, you provide your e-mail address and confirm the mandatory checkboxes for the privacy policy and terms & conditions. Payment is processed via our payment service provider Stripe (see E.1); the sleep course is offered as a one-time purchase. Upon confirmation of the mandatory fields (data protection, terms of use and personalisation), an Evela user account is automatically created so that you can access the purchased course and the included services. You then receive a welcome e-mail with a login link; login is via a one-time code (OTP) sent to your e-mail address. The legal basis is Art. 6(1)(b) GDPR (performance of a contract).Applies to: evela.health (public, no login)

C. Web App only

Applies to: after registration / login

C.1 Information transmitted by your browser

Each time you access our web app, we collect the data your browser transmits to our server: IP address, date and time of the request, content of the request, access status/HTTP status code, amount of data transferred, referrer, browser, operating system, language and version. Stored for reasons of technical security for a maximum of seven days. Legal basis: Art. 6(1)(f) GDPR.

C.2 Registration / user account

To use the services, prior registration is required. We use your e-mail address to communicate with you on contract- and appointment-related matters. The legal basis is Art. 6(1)(b) GDPR.

Users with employer-funded access

For verification, you sign up with your company e-mail address and provide a first name and a self-chosen password. We send an individual activation code to the address provided. No information about your registration or use is forwarded to your employer.

DAK Hamburg pilot customers

At www.evela.health/dak, the participation documents of DAK-Gesundheit are provided. Users register there and provide their e-mail and postal address. The postal address serves to verify eligibility, as the offering is a regional pilot for women insured or resident in Hamburg.

C.3 Access data / log files (backend)

When the application is accessed, your device automatically transmits access data to the backend hosting provider: IP address, date/time, time zone, content of the request, access status, amount of data transferred, referrer URL, device operating system, app version. This data is neither merged with other data sources nor used to identify individual users. Legal basis: Art. 6(1)(f) GDPR.

C.4 Questionnaires and data analysis

Intake questionnaire

On your first login, we ask you for voluntary information on age group, menopause status and interests, in order to offer you personalised content. Individual recommendations are provided exclusively within the consultations with our experts. The processing of this data, including your health data, is based on your explicit consent pursuant to Art. 9(2)(a) in conjunction with Art. 6(1)(a) GDPR.

Evela Score

You can document your wellbeing daily. The Evela Score sums up your answers and gives an indication of the status of your symptoms.

If you have given the separate, optional consent to use your health data for research purposes, we use this data for statistical evaluations and scientific research. Storage is pseudonymised; any disclosure to scientific partners takes place – as far as possible – exclusively in anonymised form. Further details in our separate “Information on the optional use of health data for research purposes”.

For premium users, data from the Evela Score is shared with medical experts to prepare the consultation. The legal basis is your explicit consent (Art. 6(1)(a) in conjunction with Art. 9(2)(a) GDPR).

Health Assessment

To prepare the expert consultations, a Health Assessment is carried out. Data and answers are shared with the medical experts. The purpose is to develop an individual wellbeing plan (nutrition, exercise, mental health, sleep). Legal basis: explicit consent.

C.5 Expert consultation

As a premium user, you can book expert consultations; the consultation takes place via video conference. The conversation is not recorded. Your expert may take notes, solely to support you as effectively as possible. Legal basis: Art. 6(1)(b) GDPR; for health data, your explicit consent (Art. 6(1)(a) in conjunction with Art. 9(2)(a) GDPR).

C.6 Analysis tools in the web app

PostHog: We use PostHog to understand how users interact with the web app and how we can improve the user experience. PostHog is operated without cookies; the data is hosted on servers in Germany. The legal basis is our legitimate interest in improving our offering (Art. 6(1)(f) GDPR).

Plausible: Plausible is used to analyse traffic. The tool dispenses entirely with cookies and collects no personally identifiable information. The legal basis is Art. 6(1)(f) GDPR.

C.7 Feedback

You can give us feedback – via a standardised questionnaire, by e-mail or informally. We process the data you provide (first and last name) for continuous improvement. Participation is voluntary; the legal basis is your consent (Art. 6(1)(a) GDPR).

C.8 Support / contacting us

When you contact us, we process the data provided to respond to your request. The legal basis is Art. 6(1)(b) GDPR where a contractual relationship exists or is intended, otherwise Art. 6(1)(f) GDPR.

C.9 Transfer to external treating physicians

If, in the course of an expert consultation, you wish for further medical care, your health data stored with us may be forwarded to a treating physician at your express request. This transfer takes place exclusively for this purpose and only with your explicit consent. Transfer to other third parties is excluded. Legal basis: Art. 6(1)(a) in conjunction with Art. 9(2)(a) GDPR.

C.10 Sleep course – course delivery via Thepalia

The sleep course is technically provided via our partner Thepalia. When you start the course in the web app or mobile app, you reach the course directly via a magic link, without having to register separately with Thepalia; the course is displayed within the Evela interface. For this purpose, we transmit the data required to provide the course (in particular name, e-mail address, course entitlement and course progress) and – upon completion – the completion certificate and accompanying course documents. Thepalia processes this data exclusively on our behalf as a processor on the basis of a contract pursuant to Art. 28 GDPR; the data is hosted on servers within the EU. The legal basis is Art. 6(1)(b) GDPR (performance of a contract).

D. Mobile App only

Applies to: iOS (App Store) · Android (Google Play)

For the mobile app, in addition to sections A and C (registration, questionnaires, expert consultation – these functions are identical), the following specifics apply. Paid subscriptions are concluded via our web app; payment is processed there (see E.1). No billing takes place via the mobile app itself.

D.1 Push notifications

After your consent, the mobile app sends push notifications via Firebase Cloud Messaging (Google Ireland Limited). A device-specific token is collected for this. The legal basis is Art. 6(1)(a) GDPR. You can deactivate push notifications at any time in your device settings. Additional information on processing by Google can be found in Google/Firebase’s data protection notices.

D.2 Privacy information in the app stores

Apple and Google additionally provide their own privacy information in their stores (“App Privacy” or “Data Safety”). This information is the responsibility of the respective store operators and reflects the same data processing described in this Privacy Policy.

E. Applies to all offerings

Applies to: Website · Web App · Mobile App

E.1 Payment processing

For processing paid offerings, we use the payment service provider Stripe (Stripe Payments Europe, Ltd., Ireland). The purchase contract is concluded via our web app in all cases; mobile app users are directed to the web app for this. Stripe processes the payment data you enter. We ourselves do not receive full card details. The legal basis is Art. 6(1)(b) GDPR (performance of a contract).

The sleep course can also be purchased directly via the sleep course landing page (one-time purchase, see B.9); this payment is also processed by Stripe. You receive a purchase confirmation/invoice that you can use to submit to your insurer.

E.2 Use of service providers / categories of recipients

Like any company, we use technical service providers (hosting, video conferencing, appointment scheduling, forms, e-mail dispatch, cloud storage). We have concluded data processing agreements with all service providers, ensuring that they process the data only on our instructions. Legal basis: Art. 6(1)(f) in conjunction with Art. 28 GDPR.

To provide the server infrastructure of our website, we use IONOS Deploy Now (IONOS SE, Montabaur, Germany). For e-mail communication we use Google Workspace (Google Ireland Limited, Dublin); Google stores the data on servers in the EEA.

For the provision and delivery of our sleep course, we use the course platform Thepalia (processor, hosting within the EU); see C.10.

E.3 Data transfers to countries outside the EU/EEA

Some of our processors are established outside the EU/EEA. Before any transfer, we ensure an adequate level of data protection – e.g. through an adequacy decision of the EU Commission (e.g. Canada, Israel) or by concluding the EU Standard Contractual Clauses. For processors in the USA, we additionally check certification under the EU-US Data Privacy Framework.

Addition for Switzerland: For users resident in Switzerland, the disclosure of personal data abroad is governed by the revDSG. Disclosure to states without adequate data protection is based on the Federal Council’s adequacy list (Annex 1 of the Data Protection Ordinance) or on the Standard Contractual Clauses recognised by the FDPIC in the version adapted for Switzerland.

E.4 Storage period and deletion

In principle, we store your data for as long as your user account exists or until you withdraw your consent or request deletion. After that, we delete your data and only retain what we are legally obliged to (e.g. commercial or tax retention obligations). Aggregated and anonymised data that can no longer be attributed to you remains stored.