Legal

Privacy Policy

This English translation is provided for your information. Only the German version is legally binding.

Here we explain what data is processed at AVOLYA, for what purposes, on what legal basis, who receives it and how long we store it. For each processing operation, you will find the same information in the same order.

1. Controller and contact

Unless otherwise stated in this policy, the controller within the meaning of the General Data Protection Regulation (GDPR) is:

Represented by the managing directors Philipp Groll and Maximilian Hertwig. Hereinafter “we” or “WiAd UG”. For questions about data protection, select the topic “Data protection” in the contact form.

2. Scope

This policy applies to the website avolya.de, including the questionnaire, customer account, support programme and community, and to the partner portals on the subdomains of avolya.de (doctor portal, pharmacy, coach and administration portals and the shared login at login.avolya.de).

WiAd UG does not provide medical services and is not a pharmacy. Medical services are provided by independent partner doctors on their own responsibility; medicines are dispensed by the partner pharmacy. The partner doctors, the partner pharmacy and Stripe are themselves the controllers for their own processing; here we describe what data they receive via AVOLYA.

AVOLYA is aimed only at adults. The questionnaire therefore asks for your date of birth.

We do not use any analytics, advertising or social media services, do not create advertising profiles and do not send a newsletter. For the AVOLYA app, we will add separate information before it is published (see section 28).

3. Who is responsible for what?

Several parties are involved in treatment via AVOLYA. The table shows who is responsible for which data.

The partner doctors and the partner pharmacy will also inform you themselves about their processing. We will add the name of the partner pharmacy here.

4. Visiting the website and logs

Purpose

Delivering the website, finding errors and protecting the service against attacks and misuse.

Data

In the web server's access log: IP address, time, requested address including parameters (for example search terms from an address search), status code, amount of data transferred, the previously visited page (referrer) and your browser's identifier. We log unsubscribe links from emails without the token they contain.

In system and application logs: technical messages from the server programs, for example errors and reference numbers. We keep these messages as brief as possible.

The connection between your browser or the app and our server is encrypted (HTTPS with TLS).

In the event of misuse, for example many failed login attempts, an automatic protection program (fail2ban) temporarily blocks the IP address, and in the event of repeated misuse for up to one year.

Legal basis

Art. 6(1)(f) GDPR. Our legitimate interest is secure and stable operation. Without logs, we could neither detect nor fend off disruptions and attacks. At the same time, we are obliged under Art. 32 GDPR to ensure appropriate security.

Recipients

Hetzner Online GmbH as hosting provider (processor) and our IT service provider for the operation and maintenance of the server (processor).

Third country

No transfer. The server is located in a data centre in Germany (Falkenstein).

Storage period

Access logs 14 days, system and application logs 14 days. We keep the protection program's log containing the IP addresses of suspicious access attempts for up to 8 weeks. A blocked IP address remains stored for the duration of the block, for a maximum of 1 year.

Provision of data

Without this data, the website cannot be delivered technically.

5. Cookies and browser storage

We only use cookies and browser storage that are strictly necessary for the service you have requested: to keep you logged in and to retain your entries until the next step. We do not need consent for these (Section 25(2) no. 2 TDDDG, German Telecommunications Digital Services Data Protection Act). We do not set any tracking or analytics cookies, which is why there is no cookie banner either.

Purpose

Login, ordering process and features of the support programme.

Data

The entries in the table below. The login cookie avolya_token contains a signed token with account ID, email address, name, role and selected programme, but no health values.

Legal basis

Storing and reading on the device: Section 25(2) no. 2 TDDDG. Further processing: Art. 6(1)(b) GDPR (use of your account); for support programme entries, your consent (see section 14).

Recipients

Only our server, which reads the entries when you make requests.

Third country

No transfer.

Storage period

As in the table. Entries in sessionStorage disappear when you close the tab. When you log out of your account, we delete the login cookie, all avolya_* entries in localStorage and the sessionStorage.

Provision of data

Without these entries, you cannot log in or place orders. You can delete them in your browser at any time.

The partner portal cookies only concern the people who work there (see section 21). On Stripe's payment page, Stripe sets its own cookies; Stripe is responsible for these (see section 11).

6. Questionnaire and automated preliminary check

Purpose

Recording your information so that a partner doctor can check whether treatment is an option for you; confirming your submission and providing evidence of your consents.

Data

• Your motivation, height, weight, target weight and the BMI calculated from these, how long your weight has been a concern for you, a possible trigger (also as free text) and your self-assessment of satiety and eating behaviour, biological sex, previous weight-loss treatments, comorbidities, conditions that may count against treatment, certain medications, other medications and allergies (also as free text), insurance status.
• First name, surname, email address, date of birth.
• Your consents and the six confirmations regarding treatment, with time, version and checksum of the wording, IP address and browser identifier.
• If you request a medical review after a negative preliminary check: your statement (no more than 2,000 characters).

Legal basis

Health information: your explicit consent, Art. 9(2)(a) and Art. 6(1)(a) GDPR. Contact details: Art. 6(1)(b) GDPR (initiating treatment via AVOLYA). Evidence of consent: Art. 6(1)(c) in conjunction with Art. 7(1) GDPR.

Before you submit, we ask you for three declarations. Their wording is shown to you in the questionnaire and stored exactly as shown:

• Consent to the processing of your health data (required): We process your health information from the questionnaire and from later check-ins, transmit it to the partner doctors for review and treatment and, following a medical prescription, forward the prescription to the partner pharmacy. Once a partner doctor takes on your case, only that doctor can see it.
• Release from medical confidentiality (required): Your partner doctor may provide you with the decision, follow-up questions and documents via AVOLYA, we store this data for that purpose, the prescription is transmitted to the partner pharmacy, and the AVOLYA support team may read your messages in the support chat insofar as this is necessary for your care.
• Automated preliminary check (voluntary): see below.

Recipients

The partner doctors (see section 9), Hetzner Online GmbH and our IT service provider as processors. We send the confirmation email via IONOS SE (processor).

Third country

No transfer.

Storage period

After you submit, we temporarily store your submission including your IP address. If you do not yet have an account, we send you an email with a confirmation link. We delete the temporary copy 24 hours after submission, even if you have already confirmed. We clean up every hour; it is deleted after about 25 hours at the latest.

Upon confirmation, your patient record, a treatment case, the saved questionnaire and, in the record, a PDF proof of your consents including IP address are created. The record forms part of the medical documentation that your partner doctor must retain for 10 years after the end of treatment (§ 630f(3) BGB). We keep our own records of consent (time, version, IP address and browser) for as long as the consent is valid and for 3 years thereafter: after a withdrawal, 3 years from the withdrawal, otherwise 3 years from the deletion of your account. This allows us to prove that you had given your consent (Art. 7(1) GDPR) for as long as claims may still arise from it.

Provision of data

We need this information and the two required declarations so that a doctor can review your case. Without them, treatment via AVOLYA is not possible. The automated preliminary check is voluntary.

Automated preliminary check (Art. 22 GDPR)

Only if you explicitly consent to the automated preliminary check (Art. 22(2)(c) and (4) in conjunction with Art. 9(2)(a) GDPR) will our system check your information before a doctor sees it.

• Logic involved: We calculate your BMI from your height and weight and round it to one decimal place, i.e. to the value that the questionnaire shows you. If it is below 27, or if you indicate thyroid cancer (including in your family) or pancreatitis (current or past), we do not forward your questionnaire to a doctor.
• Significance and consequences: You see the result immediately. In that case, no doctor reviews your case and you cannot place an order via this questionnaire. We do not open a record for this.
• Your rights under Art. 22(3) GDPR: Immediately afterwards, you can choose “Have a doctor review it anyway” and express your point of view. A partner doctor, i.e. a human being, then decides on your case and sees your point of view when doing so. You can also resubmit the questionnaire without giving this consent.
• Without consent, no automated decision takes place: a doctor reviews your information directly.

Notes for the doctor: Independently of the preliminary check, the system flags a case in red if certain information suggests that a particularly careful review is needed: exclusion criteria stated, severe side effects reported in the check-in, a BMI below 27, a BMI from 27 to below 30 without a weight-related comorbidity, or a negative result of the preliminary check where the case is nevertheless passed to a doctor. In addition, the system suggests a programme, an active ingredient and a starting dose to the doctor based on your BMI and, later, a follow-up dose based on the information you provide in the check-in; in the case of severe side effects, the suggestion is not to increase the dose. The flag and the suggestion are merely aids to decision-making; the doctor decides whether and how to treat you.

7. Customer account

Purpose

Providing you with a protected area: status of your treatment, documents, orders, invoices, consents, support chat and support programme.

Data

Email address, password (stored only as a hash), name, delivery and billing address, account settings, logged-in devices and sessions, the status of your consents.

Legal basis

Art. 6(1)(b) GDPR. Security data relating to sessions: Art. 6(1)(f) GDPR; our legitimate interest is protecting your account against unauthorised access.

Recipients

Hetzner Online GmbH and our IT service provider as processors.

Third country

No transfer.

Storage period

Until you delete your account. Once you request deletion, we block access immediately and end all sessions; you can still undo the deletion for 30 days. After that, we pseudonymise the login data and delete the remaining data in your account, for example support programme data, community content and the coach chat. The following are retained, blocked, and only until their respective periods expire: the treatment documentation for the statutory retention period (Art. 17(3)(b) GDPR), invoices for 8 years, records of consent for 3 years, the support history without your name and email address, community notices and change logs (see Section 24).

If the administration or a partner portal changes something in your account, for example your address or master data, or sends you a link to reset your password, we log this (Art. 6(1)(f) GDPR; our legitimate interest is being able to trace changes and detect misuse). Retention periods as in Section 21.

You can export your data in your account (Art. 20 GDPR).

Provision of data

You need an account for treatment via AVOLYA.

Administration and billing

Purpose

Customer service, processing of orders, payments and refunds, invoicing and accounting, and handling your requests, for example a change of address or a deletion.

Data

In the administration portal, the WiAd UG administration sees your name, email address, telephone number, patient number, delivery and billing address, and the status of your account and of your orders, payments and invoices. The financial overview also shows the prescribed medication for each order; this allows conclusions to be drawn about your treatment.

Legal basis

Art. 6(1)(b) GDPR (contract); for invoices and accounting, Art. 6(1)(c) GDPR in conjunction with § 147 AO and § 14 UStG (German VAT Act). For stating the medication: Art. 9(2)(h) and (3) GDPR in conjunction with § 22(1) no. 1(b) BDSG (management of health services by persons subject to an obligation of confidentiality).

Recipients

The WiAd UG administration (bound by confidentiality); technically, Hetzner Online GmbH and our IT service provider as processors.

Third country

No transfer.

Storage period

Account data as above; invoices and accounting records for 8 years (see Section 12). We log changes made to your account by the administration as described in Section 21.

Provision of data

Without this data, we cannot process orders.

8. ID verification

Purpose

Your partner doctor checks who you are and that you are of legal age before treating you.

Data

The uploaded copy of your identity document and a verification note (time and verifying doctor).

Legal basis

For the partner doctor: Art. 6(1)(b) GDPR (treatment contract). We store the identity document for this purpose as the doctor's processor.

Recipients

Only the partner doctors. The support team does not see the identity document. Technically: Hetzner Online GmbH and our IT service provider as processors.

Third country

No transfer.

Storage period

We delete the copy as soon as the doctor has checked it. The verification note (who checked it and when) remains stored until 3 years after your account is deleted. If the identity document is not checked, it remains stored until your account is deleted. A copy may still be contained in our backups for up to approximately 4 weeks.

Provision of data

Without ID verification, the partner doctor cannot treat you.

9. Medical review, doctors' portal and support chat

The partner doctors work in a separate portal (doc.avolya.de). Your partner doctor bears their own responsibility for the medical treatment; we operate the portal for them as their processor.

Purpose

Medical review of your information, decision on treatment, follow-up questions, creating the prescription as a PDF and the medical invoice under GOÄ (German scale of medical fees) in the doctor's name, documentation; in the support chat, looking after you.

Data

Patient record with questionnaire, check-ins, identity document (until verified), medical decision and reasons, doctors' notes on the treatment case, follow-up questions and answers, prescription, invoice, messages in the support chat including attachments, as well as the entries in your medication and weight diary (app and account on avolya.de, Section 28).

Legal basis

Partner doctor: Art. 9(2)(h) GDPR, § 22(1) no. 1(b) BDSG, Art. 6(1)(b) GDPR (treatment contract) and Art. 6(1)(c) GDPR in conjunction with § 630f BGB (duty to keep medical records). The disclosure to the doctor and the provision via AVOLYA are based on your consent and your release from medical confidentiality (Section 6).

Support chat: Art. 6(1)(b) GDPR; where you provide health information, your consent under Art. 9(2)(a) GDPR and your release from medical confidentiality.

Recipients

• Partner doctors: see the medical data. An open case is visible to all partner doctors; as soon as a doctor takes it on, only that doctor can see it. The same applies to the support chat: it is read by the partner doctors and, once your case has been taken on, only by your doctor.
• WiAd UG support team: sees only the support chats in the doctors' portal, not the patient record, not the identity document and not the medical decision. If you withdraw your release from medical confidentiality, the support team will no longer see your support chat.
• Demonstration account: a demo account sees only fictitious demo data, no real patients.
• Technically: Hetzner Online GmbH and our IT service provider as processors.

Third country

No transfer.

Storage period

Your partner doctor must retain the medical documentation for 10 years after the end of treatment (§ 630f(3) BGB); this also applies if you withdraw your consent or delete your account. If you confirm “Yes, all sorted” in the support chat, the chat is archived. The support history remains stored as documentation of the support provided to you; if you delete your account, we remove your name and email address from it.

Provision of data

Without this data, no medical review is possible. Using the support chat is voluntary.

Video consultation

You can book a video consultation with your partner doctor. The call runs on our own video server meet.avolya.de (Jitsi Meet software), not on a third-party video service. Nobody records it, neither we nor your doctor.

Purpose

Booking and cancelling appointments and reminding you of them, establishing the video connection between you and your partner doctor, and recording whether an appointment took place.

Data

For the appointment: time, your partner doctor, status (e.g. booked, cancelled, took place) and when you and your doctor joined.

For the connection: your first name as display name, your IP address and technical connection data. Video and audio are encrypted. With two participants, they run directly between your device and your doctor's device where possible. If that does not work, and briefly while the connection is being set up, our video server relays them. For this they are decrypted in the server's memory, but not stored. We do not store the content of the conversation. Anything medically relevant is documented by your doctor in your record (see above).

Legal basis

Partner doctor: as described above for the medical review, in particular Art. 9(2)(h) GDPR and the treatment contract.

WiAd UG: your consent “Video consultation”, Art. 9(2)(a) and Art. 6(1)(a) GDPR; for managing your appointments, Art. 6(1)(b) GDPR.

Recipients

Your partner doctor sees your appointments and talks to you. Technically: IONOS SE (video server), Hetzner Online GmbH (appointments) and our IT service provider as processors.

Third country

No transfer. The video server is located in Germany. It does not load any content from third parties.

Storage period

Appointments 3 years after the appointment, immediately if you delete your account. Video server logs with IP addresses 7 days. An access key for the call room is valid for only 5 minutes and only for your appointment. If you withdraw your consent, we cancel your open appointments.

Provision of data

Voluntary. Without this consent you cannot book a video consultation; your treatment via questionnaire, check-in and support chat remains possible.

10. Prescription and shipping

Purpose

Once a doctor has issued a prescription, transmitting it to the partner pharmacy so that the pharmacy dispenses the medicine and sends it to you.

Data

Name, delivery address, telephone number where applicable, date of birth (shown on the prescription), medication and dose, the prescription, your patient number and, later, the tracking number. Your questionnaire, your BMI and your email address are not transmitted.

Legal basis

For us: your consent and your release from medical confidentiality (Art. 9(2)(a) GDPR) as well as Art. 6(1)(b) GDPR. For the pharmacy: Art. 9(2)(h) GDPR, § 22(1) no. 1(b) BDSG, Art. 6(1)(b) and (c) GDPR.

Recipients

The partner pharmacy as an independent controller. It works in a separate portal (apo.avolya.de) that we operate.

Third country

No transfer.

Storage period

With us, as part of your treatment case (see Section 9). With the pharmacy, in accordance with its statutory retention obligations.

Provision of data

Without this information, the pharmacy cannot supply you with any medicine.

11. Payment via Stripe

Purpose

Payment for your order.

Data

We pass the following to Stripe: email address, name, delivery address, amount and a neutral description of the order (for example “Medical review · Delivery · Digital support”, without the name of the medication), plus, for internal allocation, the case number, the chosen programme and your account ID; for follow-up orders, a neutral identifier of the order type instead of the programme.

You enter your card details directly on Stripe's payment page; we do not receive them.

Process: when you pay, Stripe only reserves the amount. It is not collected until a partner doctor approves the treatment. If the doctor declines, we release the reservation.

Stripe automatically reports payment events (for example “amount reserved”) to our server.

Legal basis

Art. 6(1)(b) GDPR (contract), Art. 6(1)(c) GDPR (obligations under commercial and tax law). Where Stripe pursues its own purposes, such as fraud prevention and its own legal obligations, Stripe itself is responsible for this.

Recipients

Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland; partly as our processor, partly as an independent controller. Stripe sets its own cookies on its payment page. Find out more in Stripe's privacy policy.

Third country

Stripe may transfer data to Stripe, Inc. in the USA. The basis for this is the adequacy decision on the EU-U.S. Data Privacy Framework (Art. 45 GDPR) and, in the alternative, standard contractual clauses adopted by the European Commission (Art. 46(2)(c) GDPR). You can find Stripe's entry in the Data Privacy Framework List.

Storage period

We delete the payment events that Stripe reports to us after 90 days. We keep payment details in your case and on invoices for as long as retention obligations require (see Section 12). For data held by Stripe, Stripe's storage period applies.

Provision of data

Without payment, we cannot carry out your order.

12. Invoices

Purpose

Issuing invoices and complying with statutory retention obligations.

Data

Name, billing address, invoice number and date, neutral description of services, amount, payment status.

Legal basis

Art. 6(1)(b) and (c) GDPR in conjunction with § 147 AO and § 257 HGB. We create medical invoices under GOÄ in the name of your partner doctor as the doctor's processor.

Recipients

Tax authorities, where required by law; technically, Hetzner Online GmbH and our IT service provider as processors.

Third country

No transfer.

Storage period

8 years.

Provision of data

Required by law.

13. Check-in and reminders

Purpose

Before a follow-up prescription, your partner doctor asks you about your progress via a check-in. We remind you when it is due.

Data

Your information in the check-in, in particular weight and side effects; start and end of the pen cycle; the times at which reminders are sent and your opt-out from them.

Legal basis

Check-in: Art. 9(2)(a) GDPR (your consent to the processing of your health data). Reminders: Art. 6(1)(b) GDPR, because they form part of the agreed support.

Recipients

Your partner doctor. We send the reminders by email via IONOS SE (processor).

Third country

No transfer.

Storage period

Check-ins become part of the medical documentation (10 years, see Section 9). You receive reminders 7 and 2 days before your pen runs out. Each reminder contains an unsubscribe link.

Provision of data

Without a check-in, your doctor cannot assess a follow-up prescription. You can unsubscribe from the reminders.

14. Support programme

Purpose

The features of the support programme: food diary (tracker), daily plans, shopping list, favourites, your own dishes and exercises, workouts.

Data

• Your entries in the tracker, daily plans, shopping list, favourites, your own dishes (including with a photo), your own exercises, workouts and calories burned.
• Photos of your own dishes can be accessed via an address that is not publicly linked anywhere. Anyone who knows this address can open the photo.
• Barcode scanner: the camera image is analysed by your device and does not leave it. Only the recognised barcode is sent to our server. The food database is located on our own server; no data is sent to Open Food Facts in the process.
• Your own products: if you cannot find a product, you can create it yourself, including with a photo. This product, together with the photo, is visible to everyone who scans the same barcode. If you delete your account, the product remains, without any link to you and without your photo.

Legal basis

Your explicit consent “Storage of your information in the support programme”, Art. 9(2)(a) and Art. 6(1)(a) GDPR, as this information may allow conclusions to be drawn about your health.

Recipients

Hetzner Online GmbH and our IT service provider as processors; for shared plans, your programme partner (Section 15); for your own products, everyone who scans the same barcode.

Third country

No transfer.

Storage period

Until you withdraw your consent or delete your account. When you withdraw your consent, we delete the programme data. Products you have created yourself remain visible to everyone who scans the same barcode even after you withdraw your consent; when your account is deleted, we remove the photo and any link to you. Your account, your treatment, your documents and support are not affected by the withdrawal.

Provision of data

Voluntary. Without this consent, you cannot use the programme features; you can still use everything else.

15. Programme partner

Purpose

Taking part in the programme together with another person and sharing plans.

Data

Before confirmation, the invited person sees only your name. Only once both sides have confirmed the partnership can you see each other's name, email address, programme variant and the plans that you deliberately share. Your partner does not see any health information from the questionnaire, treatment, check-in or tracker.

Legal basis

Art. 6(1)(b) GDPR (the feature you requested). You decide for yourself what you share; only share plans that you want your partner to see.

Recipients

Your programme partner.

Third country

No transfer.

Storage period

Until the partnership ends or one of the accounts is deleted.

Provision of data

Voluntary.

16. Coach

Purpose

Support from a coach in the Legacy programme, with chat. Coaches are not doctors and do not give medical advice.

Data

Only with your permission does your coach see: your name, age and sex, height, current weight and target weight, BMI, calorie requirement and the calories burned today, as well as the chat messages between you, including photos, videos and voice messages.

Legal basis

Your explicit consent “Sharing with your coach”, Art. 9(2)(a) and Art. 6(1)(a) GDPR.

Recipients

The coach assigned to you, in the coach portal (coach.avolya.de); technically, Hetzner Online GmbH and our IT service provider as processors.

Third country

No transfer.

Storage period

Until you withdraw your consent or delete your account. When you withdraw your consent, the assignment ends and we delete the coach chat including attachments.

Provision of data

Voluntary.

17. Community and notices

Purpose

Interacting with other members: posts, replies, activities, events. Processing notices of illegal content.

Data

• Your posts, replies, activities (type, distance, duration, calories, description), events and event participation, displayed under “First name L.”. Reactions appear only as a count. GPS routes can only be seen by the person who recorded them.
• Even your participation alone may suggest that you are undergoing weight-loss treatment.
• Maps: your browser only loads map tiles when you click on the map. The OpenStreetMap Foundation then receives your IP address and the map section displayed.
• Notices: the reported content, its location, the reasons given, details of the person submitting the notice, our decision.

Legal basis

Participation: your explicit consent, Art. 9(2)(a) and Art. 6(1)(a) GDPR, together with your acceptance of the Community guidelines. Map: Art. 6(1)(a) GDPR through your click. Notices: Art. 6(1)(c) GDPR in conjunction with Arts. 16 and 17 DSA, and Art. 6(1)(f) GDPR; our legitimate interest is a safe community free of illegal content.

Recipients

Logged-in members who have themselves consented to the community; when maps are loaded, the OpenStreetMap Foundation; technically, Hetzner Online GmbH and our IT service provider as processors. Notices are reviewed by humans, not by automated systems. You receive a confirmation of receipt. We only reveal to the reported person who submitted the notice if this is strictly necessary in exceptional cases.

Third country

Map tiles: United Kingdom, adequacy decision of the European Commission (Art. 45 GDPR). Otherwise, no transfer.

Storage period

Until you delete your content or withdraw your consent; when you withdraw your consent, we remove your community content. We delete notices submitted in the community 12 months after the decision, and the name and email address of the person submitting the notice after just 6 months; this also applies if the account is deleted beforehand. We delete notices received via the contact form or by email 12 months after the matter has been closed.

Provision of data

Voluntary.

18. Address verification

Purpose

When you enter your delivery address, we suggest matching addresses so that your delivery arrives.

Data

Only the address details entered. The request is made by our server, not by your browser: the OpenStreetMap Foundation receives neither your IP address nor your name.

Legal basis

Art. 6(1)(b) GDPR (delivery) and Art. 6(1)(f) GDPR; our legitimate interest is avoiding misdeliveries.

Recipients

OpenStreetMap Foundation (“Nominatim” service), United Kingdom.

Third country

United Kingdom, adequacy decision of the European Commission (Art. 45 GDPR), currently valid until 27.12.2031.

Storage period

So that we do not request the same address more than once, our server keeps the request and the result in memory for up to 24 hours. Your search terms remain in the access log for 14 days (Section 4). For the OpenStreetMap Foundation, its privacy policy applies.

Provision of data

Voluntary; you can also enter the address without using a suggestion.

19. Emails

Purpose

Communications about your account and your treatment: confirmation link, status updates, check-in reminders, confirmation, reminder and cancellation of video appointments, password reset, confirmations of receipt.

Data

Email address, name, content of the message. We do not include health values in emails; you can see the details in your account. However, the sender name AVOLYA alone may suggest that you use the service.

Legal basis

Art. 6(1)(b) GDPR.

Recipients

IONOS SE for the mailbox and sending of emails (processor).

Third country

No transfer by us. If your own mailbox is hosted by a provider outside the EU, that provider's terms apply.

Storage period

We do not keep separate copies of emails sent. We store the underlying transactions for as long as stated in the relevant sections. We do not send advertising by email.

Provision of data

Without an email address, we cannot set up an account for you.

20. Contact form and enquiries by email

Purpose

To answer your enquiry; to handle notices of illegal content.

Data

Name, email address, topic, message and your preferred method of reply; for a call-back, your telephone number; for a reply by post, your postal address. For enquiries from companies via avolya.de/b2b, additionally the company, number of employees, industry and preferred date. For notices under the DSA, additionally the location of the content, the explanation of reasons and your statement that you are acting in good faith. To protect against misuse, we limit the number of messages per IP address. Please do not send us any health data via the form; use the support chat in your account for that.

Legal basis

Art. 6(1)(b) GDPR if your enquiry relates to a contract, otherwise Art. 6(1)(f) GDPR; our legitimate interest is to respond to enquiries. Notices: Art. 6(1)(c) GDPR in conjunction with Art. 16 DSA.

Recipients

The message is sent as an email to our mailbox hallo@avolya.de hosted by IONOS SE (processor).

Third country

No transfer.

Storage period

We delete enquiries 12 months after the matter has been concluded, unless a statutory retention obligation prevents this.

Provision of data

Voluntary. Without contact details, we cannot reply to you. For notices concerning child sexual abuse material, name and email address are voluntary.

21. Partner portals

This section concerns people who work in a partner portal: partner doctors, the support team, the partner pharmacy, coaches and the administration team.

Purpose

Login, access protection and traceability of changes.

Data

Login credentials (password stored only as a hash), role, login cookies (see section 5), login logs (time, result, IP address, browser), change logs (who changed what and when, with IP address, browser and the changed content).

Legal basis

Art. 6(1)(b) GDPR (collaboration), Art. 6(1)(f) GDPR and Art. 6(1)(c) in conjunction with Art. 32 GDPR; our legitimate interest is to secure access to health data and to be able to trace such access.

Recipients

WiAd UG's administration team; technically, Hetzner Online GmbH and our IT service provider as processors.

Third country

No transfer.

Storage period

Login logs: 90 days. Change logs: 3 years; we remove the IP address, browser and the changed content from them after 90 days, after which only the record of who changed which fields and when remains.

Provision of data

Without login credentials, it is not possible to work in the portal.

22. Data backup

Purpose

To be able to restore data after an error or outage.

Data

Copies of the database and of uploaded files, i.e. all data mentioned in this policy that is stored on our server.

Legal basis

Art. 6(1)(f) GDPR and Art. 6(1)(c) in conjunction with Art. 32(1)(c) GDPR; our legitimate interest is to prevent data loss. For health data, additionally the legal basis of the original processing in each case.

Recipients

Hetzner Online GmbH with a backup storage (Storage Box); our IT service provider (both processors).

Third country

No transfer. In addition to the copy on our server, a second copy is stored in a Hetzner data centre in Helsinki (Finland, EU).

Storage period

All backups are encrypted with GPG before they leave the server. On the server: database up to approximately 3 months (7 daily, 4 weekly and 3 monthly backups), uploaded files up to approximately 4 weeks. On the backup storage: database up to approximately 3 months, uploaded files up to approximately 8 weeks; deleted backups remain there for up to 10 days in automatic snapshots. Deleted data may still be contained in backups until these periods have expired; we only use the backups to restore data after an error or outage.

Provision of data

Not applicable; backups run automatically.

23. Overview of recipients

Where we only name a category, we will provide you with names and addresses on request.

24. Overview of storage periods

25. Your rights

You have the following rights in relation to us, provided the statutory requirements are met:

• Access to your data (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR); the 10-year retention obligation applies to the medical documentation
• Restriction of processing (Art. 18 GDPR)
• Notification of recipients regarding rectification, erasure or restriction (Art. 19 GDPR)
• Data portability (Art. 20 GDPR); you will find the export in your account
• Objection (Art. 21 GDPR, see box below)
• No decision based solely on automated processing without your consent; in the preliminary check, you can request a review by a doctor and express your point of view (Art. 22 GDPR, see section 6)

To exercise these rights, write to us at datenschutz@avolya.de or use the contact form. If your request concerns medical treatment or the pharmacy, we will forward it to the responsible party.

Withdrawal of consent

You can withdraw any consent at any time with effect for the future (Art. 7(3) GDPR), most easily in your account under “Consents” or by email. Processing carried out before the withdrawal remains lawful. The consequences:

• Health data: we will no longer pass your information on to partner doctors; treatment via AVOLYA will then no longer be possible. Your doctor must nevertheless retain the medical documentation for 10 years.
• Release from medical confidentiality: we will close open requests and approved requests that have not yet been sent; no further prescriptions will go to the partner pharmacy. Documents already provided will remain accessible in your account. The support team will no longer see your support chat; the partner doctors will then reply to you there. In this case, too, treatment via AVOLYA will no longer be possible.
• Automated preliminary check: it only runs when the questionnaire is submitted; a withdrawal takes effect for future questionnaires.
• Support programme: we will delete your programme data; the programme features will then no longer be available to you. Products you have added yourself remain visible until you delete your account (see section 14). Your account, treatment, documents and support remain unaffected.
• Coach: the assignment ends and we delete the coach chat including attachments.
• Community: we remove your community content.

Complaint to a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular with the authority responsible for us:

27. Obligation to provide data

You are not legally obliged to provide us with any data. However, for treatment via AVOLYA we need the information in the questionnaire, the two required declarations, an account with an email address, the ID check, a delivery address and payment; without these, treatment via AVOLYA is not possible. The automated preliminary check, the support programme, the coach, the community, programme partners, the support chat and the contact form are voluntary. What applies in each case is stated above for each processing activity.

28. AVOLYA app

We will add separate information for the AVOLYA app before it is released.

Medication and weight diary

In the app and in your account on avolya.de, you can record your medication doses (date, time, dose in mg, optionally a note), your weight (date, value, optionally a note) and your height. We take the medication and active ingredient from your medical prescription.

Purpose

Documenting the course of your therapy for you and your treating partner doctor.

Legal basis

Your consent to the processing of your health data and your release from medical confidentiality (Art. 9(2)(a) GDPR, Section 6); for the partner doctor, Art. 9(2)(h) GDPR (Section 9).

Recipients

Your treating partner doctor sees these entries in your record in the doctor portal. Other doctors, the support team, coaches and pharmacies do not see them. Technically: Hetzner Online GmbH and our IT service provider as processors.

Third country

No transfer.

Storage period

You can change or delete entries at any time; we delete them at the latest when your account is deleted.

Provision of data

Voluntary.

Reminders

When you record your medication in the app, the app reminds you every week on the day and at the time of your most recent entry. For this, we store the weekday, time and time zone in your account so that the reminder applies on all your devices. Your device generates the notification itself; no data is transmitted to Google or Apple for this. Its text contains no health information, and it does not create an entry. You can switch the reminder off in the app at any time.

29. Changes to this policy

If our processing activities or the legal situation change, we will amend this policy. The version published here applies. If the wording of a consent changes, we will ask you for your consent again in your account.

Last updated: 2 November 2026

Back to top