Home / Legal / Privacy policy
Last updated: 21 October 2026
brite health GmbH (“brite health”, “we”, “us”, “our”) protects your privacy and your private data. In this Privacy Policy we inform you how, when you visit our website (brite.health) and app (brite), which are connected with the use of our brite Platform (hereinafter “brite Platform” or “Platform”), we handle data that can be related to you personally, e.g. name, email address (hereinafter also “personal data”), but also information about your visit to and your use of the Platform as well as data about your health, e.g. data on medical products used, your therapies, illnesses, etc. (hereinafter also “health data”).
The controller responsible for the collection and processing of your personal data within the meaning of Art. 4(7) of the EU General Data Protection Regulation (Regulation (EU) 2016/
Further information about us can be found in the Imprint.
For processing within the scope of the brite Platform, specifically within the general area brite and the product- and therapy-specific areas (see section 3 in this regard), we are in part so-called joint controllers within the meaning of Art. 26 GDPR with the Provider of the medicinal product, medical device, food supplement, cosmetic product or other medical product (hereinafter “Product”) or of the therapy or the illness for which the respective product and therapy area has been set up. “Providers” in this sense are, for example, pharmaceutical companies, medical device manufacturers or distributors, other companies in the healthcare and life sciences industry, members of the medical professions including the organisations in which they are employed, self-help groups or research institutions. Who the Provider is can be found in the respective product and therapy area.
As joint controllers pursuant to Art. 26 GDPR, we are jointly responsible for the processing of your data for the processing operations referred to in section 3. In order to safeguard your rights and taking into account the requirements of the GDPR, we have concluded an agreement with the respective Provider which sets out rules on our joint processing of your personal data. We have agreed on how we ensure your rights and have determined how we jointly fulfil our obligations under the GDPR. brite health GmbH is available to you as the point of contact, in particular for asserting your rights under section 8 of this Privacy Policy. However, you may contact any of the joint controllers.
If you have any questions about the processing of personal data by brite health, you can contact our data protection officer:
brite health GmbH Data Protection Kronstadter Str. 4 81677 München Email: datenschutz@brite.healthOn the brite Platform you can add and use various areas. We provide you with a general area under the name “brite”. You can add further areas that are suitable and relevant for you depending on the products you use or your therapies or illnesses. These include product- and therapy-specific areas that have been set up at the instigation of a Provider for a specific product or a specific therapy or illness. As a user of the product or as a recipient of the therapy or in the case of the relevant illness, you have the option of adding and using the corresponding product and therapy area in the brite Platform. If you state during or after registration which products you use or which therapy you are receiving or which illness you suffer from, the matching product- and therapy-specific areas are automatically added to the User account.
In order to provide our Platform and ensure its functionality, the web server automatically records data in so-called server log files during your visit to the Platform. The following data are processed: browser type and version, app version, the operating system used by the end device, the IP address of the requesting end device, date and time of access of the server request, the duration of the stay on the Platform, the amount of data transferred, the location from which the User retrieves data from the Platform, connection data and sources and the website from which access takes place.
Less data are processed in the brite Platform than in the web server, namely the following data: browser type and version, app version, the operating system used by the end device, the IP address of the requesting end device in anonymised form (192.168.1.1 becomes 192.168.1.x), the date and time of access of the server request and the amount of data transferred. Anonymised log files are not deleted.
Purpose
These data are processed for the purpose of providing our Platform and for statistical evaluations as well as for the purposes of identifying and tracing unauthorised access to the Platform and any criminal offences.
Legal basis and legitimate interest
The legal basis for the data processing is Art. 6(1) sentence 1(f) GDPR. Our legitimate interests lie in ensuring IT security and operation as well as in the statistical evaluation of our internet presence.
Recipients
The recipients of the data are our hosting service providers.
Storage period
Log file information is stored for a maximum period of one month from the end of your respective visit to the Platform and is then deleted.
Option to object
The data processing is necessary for securing and operating the Platform. You exercise your objection to further, future data processing in practice by no longer accessing our Platform.
Obligation to provide the data
The provision of the aforementioned personal data is neither required by law nor by contract. Without their provision, however, the service and the functionality of our Platform cannot be guaranteed. In addition, individual Services may be unavailable or restricted.
Cookies are small text files that enable the storage of individual user data, in particular the identification of the User’s end device. When the Platform is used, cookies are stored on your end device. Cookies can transfer information from our server or third-party servers to the User’s web browsers or apps, where it is stored for later retrieval. A cookie usually contains the name of the domain from which the cookie data were sent, as well as information about the age of the cookie and an alphanumeric identifier.
Purpose
We use cookies to ensure the proper functioning of the Platform and to optimise your user experience.
Legal bases and legitimate interest
The legal basis for the data processing is Art. 6(1) sentence 1(f) GDPR. Our legitimate interests lie in the technical provision and in ensuring the operation of our internet presence and IT security, as well as in optimising the presentation of our offering and direct marketing measures.
No processing of personal data in connection with analysis or tracking for which we require your consent pursuant to Art. 6(1) sentence 1(a) GDPR takes place on our Platform.
Recipients
Apart from the transfers described below, we pass on your data strictly for the specified purpose – if necessary at all – and only to the extent required to our IT and hosting service providers.
Storage period
We store the data for as long as they are needed to fulfil the aforementioned purpose or until you delete the cookies.
Option to object
Insofar as the data processing is based on the legal basis of Art. 6(1) sentence 1(f) GDPR, you can object to the data processing. You can exercise your right to object by configuring your browser according to your wishes, for example so that no cookies from third-party providers (so-called third-party cookies) or no cookies at all are stored, or so that a notice always appears before a new cookie is created. In addition, cookies that have already been stored can be deleted at any time via the browser settings.
You can find out how to configure cookies for the common browsers via the following links:
Firefox: https://
Chrome: https://
Safari: https://
Opera: https://
Obligation to provide the data
The provision of your personal data is neither required by law nor by contract. Without their provision, however, the service and the functionality of our Platform cannot be guaranteed. In addition, individual Services may be unavailable or restricted.
On our website we use Usercentrics, a cookie banner solution of Usercentrics GmbH; Sendlinger Straße 7, 80331 München, Germany (hereinafter Usercentrics). Among other things, Usercentrics offers us the possibility of providing you with a comprehensive and data-protection-compliant cookie notice so that you can decide for yourself which cookies you allow and which you do not. Through the use of this software, data from you are sent to and stored by Usercentrics. Usercentrics is software that scans our website and identifies and categorises all existing cookies. In addition, as a website visitor you are informed about the use of cookies via a cookie notice script and decide for yourself which cookies you allow and which you do not.
Purpose
We want to offer you maximum transparency in the area of data protection. To ensure this, we must first know exactly which cookies have ended up on our website over time. Because the Usercentrics Consent Manager regularly scans our website and locates all cookies, we have full control over these cookies and can thus act in compliance with the GDPR. This enables us to inform you precisely about the use of cookies on our website. Furthermore, you always receive an up-to-date and data-protection-compliant cookie notice and decide for yourself by means of a checkbox system which cookies you accept or block.
Legal basis
If you consent to cookies, personal data about you are processed and stored via these cookies. If we are permitted to use cookies on the basis of your consent (Article 6(1)(a) GDPR), this consent is at the same time the legal basis for the use of cookies or the processing of your data. Usercentrics is used in order to be able to manage consent to cookies and to enable you to give your consent. The use of this software enables us to operate the website efficiently and in compliance with the law, which constitutes a legitimate interest (Article 6(1)(f) GDPR).
Storage period
All data collected by usercentrics are transferred and stored exclusively within the European Union. The data collected are stored on the servers of usercentrics at Hetzner GmbH in Germany. Only usercentrics has access to these data.
Option to object
You have the right to access your personal data and also to delete them at any time. You can prevent the collection and storage of data, for example, by rejecting the use of cookies via the cookie settings dialogue. Your browser offers a further option for preventing data processing or managing it according to your wishes. Cookie management works slightly differently depending on the browser. You can find out more about the data processed through the use of Usercentrics in the data protection agreement of Usercentrics.
For our website we use Google Tag Manager of the company Google Inc. For the European area, the company Google Ireland Limited (Gordon House, Barrow Street Dublin 4, Ireland) is responsible for all Google services. This Tag Manager is one of many helpful marketing products from Google. Via Google Tag Manager we can centrally integrate and manage code sections of various tracking tools that we use on our website.
Purpose
Google Tag Manager is an organisational tool with which we can integrate and manage website tags centrally and via a user interface. Tags are small code sections which, for example, record (track) your activities on our website. For this purpose, JavaScript code sections are inserted into the source code of our page. The tags often originate from Google’s own products such as Google Ads or Google Analytics, but tags from other companies can also be integrated and managed via the Manager. Such tags perform different tasks. They can collect browser data, feed marketing tools with data, integrate buttons, set cookies and also track users across several websites. We use Google Tag Manager exclusively for marketing purposes and only after your prior consent.
Legal basis
The use of Google Tag Manager requires your consent, which we must have obtained via our cookie settings dialogue before your data are processed. If you consent to the cookies, personal data about you are processed and stored via these cookies. If we are permitted to use cookies on the basis of your consent (Article 6(1)(a) GDPR), this consent is at the same time the legal basis for the use of cookies or the processing of your data. In addition to consent, we have a legitimate interest in analysing the behaviour of website visitors and thus improving our offering technically and in terms of content. With the help of Google Tag Manager we can improve our economic efficiency. The legal basis for this is Article 6(1)(f) GDPR.
Storage period
Google Tag Manager stores cookies in your web browser for a period of two years from your last visit. These cookies contain a randomly generated user ID with which you can be recognised on future visits to the website. The recorded data are stored together with the randomly generated user ID, which enables the evaluation of pseudonymous user profiles. These user-related data are automatically deleted after 14 months. Other data remain stored indefinitely in aggregated form. You can find out more about this in Google’s privacy policy.
Option to object
If you do not agree to the collection, you can prevent it by a one-time installation of the browser add-on for deactivating Google Analytics or by rejecting the cookies via our cookie settings dialogue. You therefore have the right to access your personal data and also to delete them at any time. Your browser offers a further option for preventing data processing or managing it according to your wishes. Cookie management works slightly differently depending on the browser. In the section “Cookies” you will find the corresponding links to the respective instructions for the best-known browsers.
On our website we use the Meta Conversion API (also “Conversions API” or “CAPI”) of Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (“Meta”). Meta Platforms, Inc., 1601 Willow Road, Menlo Park, CA 94025, USA, is jointly responsible for processing outside the European Economic Area. The Meta Conversion API supplements the Meta Pixel and makes it possible to transmit marketing and conversion events to Meta on the server side – i.e. via our server instead of solely via your browser. It is integrated via Google Tag Manager (see section 3.4). In the process, your IP address, information about the browser you use and the device you use, as well as the URL parameters and browser identifiers read from cookies, are transmitted to Meta.
We use both Google Tag Manager (section 3.4) and the Meta Conversion API exclusively for marketing purposes and only after your consent.
Purpose
We use the Meta Conversion API for marketing purposes, in particular to measure the effectiveness of our advertisements (conversion tracking), to steer and optimise our advertising and to address relevant target groups. Server-side transmission enables more reliable and at the same time more data-economical measurement than purely browser-based tracking.
Legal basis
The use of the Meta Conversion API requires your consent, which we obtain via our cookie settings dialogue before your data are processed. The legal basis is your consent pursuant to Art. 6(1) sentence 1(a) GDPR and Section 25(1) TDDDG. Without your consent, no processing takes place via the Meta Conversion API.
Recipients / transfer to a third country
The recipient of the data is Meta Platforms Ireland Limited. A transfer of your data to Meta Platforms, Inc. in the USA cannot be ruled out in this context. Meta is certified under the EU-US Data Privacy Framework; in addition, we have concluded the standard contractual clauses of the EU Commission with Meta in order to ensure an adequate level of data protection. Further information can be found in Meta’s privacy policy: https://
Storage period
The data are deleted as soon as they are no longer required for the stated purposes. The specific storage period at Meta is governed by Meta’s requirements; further information can be found in Meta’s privacy policy.
Option to object
You can withdraw your consent at any time with effect for the future by rejecting the use of the corresponding cookies or marketing services via our cookie settings dialogue or by adjusting it within your profile in the brite app.
Obligation to provide the data
The provision of your data is voluntary and based solely on your consent. You will not suffer any disadvantages if you do not give your consent; use of our Platform is also possible without the use of the Meta Conversion API.
We use the tool Sentry of Functional Software, Inc., 132 Hawthorne Street, San Francisco, California 94107, USA (“Sentry”) in order to improve the technical stability of our offering by monitoring system stability and identifying code errors. By means of Sentry, information about crashes and malfunctions of our Services on your end device is collected. In this process, your IP address is collected only in shortened form and is transmitted to Sentry’s servers together with technical data of the end device (such as operating system version, screen resolution, device ID). Sentry is an active participant in the EU-US Data Privacy Framework, which governs the correct and secure transfer of personal data from the member states of the EU to the USA. Sentry has certified to the US Department of Commerce that it complies with the principles of the EU-US Data Privacy Framework with regard to the processing of personal data. Sentry thereby undertakes to comply with the European level of data protection when processing personal data, even if the data are stored, processed and managed in the USA.
Purpose
With the help of Sentry, we are able to monitor system stability and identify code errors.
Legal basis and legitimate interest
The data processing is carried out on the basis of our legitimate interest pursuant to Art. 6(1) sentence 1(f) GDPR. Our legitimate interest lies in creating a website that works as error-free as possible and in maintaining the security and stability of our website. The anonymisation of the IP address takes sufficient account of the User’s interest in the protection of his or her personal data.
Recipients / transfer to a third country
In the event of an error report, your data may be transferred to and stored on Sentry servers outside the EU, in particular in the USA. The transfer is safeguarded by a data processing agreement. Information on data protection at Sentry can be found here: https://
Storage period
Data are retained only for as long as is necessary for the (error) analysis of your specific access.
Option to object
The data processing is necessary for securing and operating the Platform. You exercise your objection to further, future data processing in practice by no longer accessing our Platform.
Obligation to provide the data
The provision of your data is voluntary. However, it is not possible to visit our website without us carrying out error analysis.
We host our website with Webflow. The provider is Webflow, Inc., 398 11th Street, 2nd Floor, San Francisco, CA 94103, USA (hereinafter Webflow). When you visit our website, Webflow collects various log files including your IP addresses.
Purpose
Webflow is a tool for creating and hosting websites. Webflow stores cookies or other recognition technologies that are necessary for displaying the page, providing certain website functions and ensuring security (necessary cookies).
Storage of data
Webflow does not collect any further cookies without your consent. This is entirely your decision and can be determined by you yourself via the cookie settings on the website. Details of Webflow’s cookies can be found in Webflow’s privacy policy: EU & Swiss Privacy Policy (Webflow).
Legal basis
Webflow is used on the basis of Art. 6(1) sentence 1(f) GDPR. We have a legitimate interest in the most reliable possible presentation of our website. If corresponding consent has been requested, the processing is carried out exclusively on the basis of Art. 6(1) sentence 1(f) GDPR and Section 25(1) TTDSG, insofar as the consent covers the storage of cookies or access to information in the User’s end device (e.g. device fingerprinting) within the meaning of the TTDSG. Consent can be withdrawn at any time. A transfer to the USA is protected by the contractual clauses of the EU Commission in compliance with the GDPR. Details can be found here: EU & Swiss Privacy Policy in (Webflow).
Processing on behalf
We have concluded a data processing agreement (AVV) with the above-mentioned provider. This is a contract required under data protection law which ensures that it processes these personal data of our website only in accordance with our instructions and in compliance with the GDPR.
We use the open-source software Matomo of InnoCraft Ltd., 150 Willis St, 6011 Wellington, New Zealand, for the analysis and statistical evaluation of the use of the Platform (“Matomo”). Matomo sets a cookie on the User’s end device. This records three bytes of the IP address, the page accessed, the so-called referrer URL (the website from which the User reached the page accessed), subpages accessed, and the duration and frequency of the visit to the Platform. During your visit, Matomo records a so-called device fingerprint: information about your browser, the operating system you use and any Do Not Track settings is retrieved. In addition, location, time and audio settings, screen resolution or installed browser plug-ins may be recorded. The device fingerprint data are anonymised. Matomo runs exclusively on the servers of our Platform. The information collected is stored only there. We have configured Matomo so that the IP address is not stored in full and the last byte is masked (e.g. 192.168.1.x). It is no longer possible to attribute the shortened IP address to you or your end device.
Purpose
The information is used to evaluate the use of the Platform and to enable our offerings to be designed in line with requirements and to optimise them.
Legal basis
The legal basis for this processing is Art. 6(1) sentence 1(f) GDPR. Our legitimate interest lies in analysing your activities on the Platform in order to be able to optimise our offering. The anonymisation of the IP address gives sufficient consideration to the User's interest in the protection of their personal data.
Recipients
Our Platform, including Matomo, is provided by our hosting service providers within the scope of processing on our behalf. The information is not passed on to third parties, as we store the data locally.
Storage period
The cookies are stored for up to one year.
Option to object
You can prevent the collection of the data generated by the cookie and relating to your use, as well as the processing of this data by Matomo, by configuring your browser or your device accordingly.
Obligation to provide your data
The provision of your data is voluntary. Please note that, if you object to the use of Matomo, you may not be able to use the website, or may not be able to use it in full.
We use Google Analytics to analyse website usage. The data obtained from this is used to optimise our website and our advertising measures. Google Analytics is provided to us by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). Google processes the website usage data on our behalf and contractually undertakes to implement measures to ensure the security and confidentiality of the data processed.
During your visit to the website, the following data, among other things, is transmitted to Google:
No personal data such as name, address or contact details is transmitted to Google Analytics. This data is transmitted to Google servers in the USA. Please note that the same level of data protection as within the EU cannot be guaranteed in the USA. Google Analytics stores cookies in your web browser for a period of two years from your last visit. These cookies contain a randomly generated user ID with which you can be recognised on future visits to the website. The recorded data is stored together with the randomly generated user ID, which enables the analysis of pseudonymous user profiles. This user-related data is automatically deleted after 14 months. Other data remains stored indefinitely in aggregated form. You can find out more about this in Google's privacy policy. If you do not agree to the collection, you can prevent it by installing, once, the browser add-on for deactivating Google Analytics, or by rejecting the cookies via our cookie settings dialogue.
To send push notifications in our brite app, we use the technology of the Provider OneSignal, 201 San Antonio Circle Suite #140, Mountain View, CA, USA. OneSignal is an active participant in the EU-US Data Privacy Framework, which governs the correct and secure transfer of personal data from the EU Member States to the USA. OneSignal has certified to the US Department of Commerce that it complies with the principles of the EU-US Data Privacy Framework with regard to the processing of personal data. OneSignal thereby undertakes to comply with the European level of data protection when processing personal data, even if the data is stored, processed and managed in the USA. We do not send any personal data to OneSignal. The IP address of the device/
In order to be able to send you push notifications, it is necessary for non-personal data, such as a message, to be transmitted to OneSignal's servers. The data collected by the OneSignal Software Development Kits (SDK) is as follows: First Session Time, Last Session Time, the operating system of the device/
Purpose
After you first log in to your account, we ask you for your consent to receive push notifications on your smartphone. The push notifications are sent to draw your attention to our offerings or news. Consent is given per device. If you consent, you will regularly receive push notifications from our app.
Legal basis
The legal basis for the use of push notifications is your consent (Art. 6(1) sentence 1(a) GDPR).
Recipients
The data referred to above, which relates to the creation of segments for sending push notifications, is sent to OneSignal in the form of a tag.
Storage period
Records of notifications sent via OneSignal's API are deleted approximately 30 days after delivery.
Option to withdraw
You may deactivate the push notifications again at any time if you no longer wish to receive them. You can deactivate the push notifications in your smartphone settings.
Obligation to provide your data
The provision of your data is voluntary. Please note that, if you object to the use of push notifications, you may not be able to use some features, or may not be able to use them in full. One example of this is the reminder function for taking tablets (also known as the "Pill Reminder").
In order to use the brite Platform, you must register as a User with a User account. Registration takes place via the brite area or a product and therapy area. A User account enables the use of the entire brite Platform, including all further areas that you (optionally) add over time. For registration, we process your email address and the password you set. In the further course of use, you can add information to your User account. This includes demographic data (e.g. sex, age, weight, height) and data on the products you use or your therapies or illnesses, insofar as you provide information on these.
Purpose
The data is processed in order to create your User account on the brite Platform in accordance with the user agreement with you.
Legal basis
The legal basis for the data processing is Art. 6(1) sentence 1(b) GDPR, as we require the data for the purpose of performing the user agreement with you. Insofar as we process health data within the meaning of Art. 4(15) GDPR from you, in particular, for example, data on the products you use, your therapies or illnesses, the legal basis for this is your explicit consent pursuant to Art. 9(2)(a) GDPR.
Recipients
Your data is passed on to our IT service providers within the scope of processing on our behalf, insofar as this is necessary.
Storage period
We process your data until you withdraw your consent by deleting your User account.
Option to withdraw
You may freely withdraw your consent at any time by deleting your entire User account.
Obligation to provide your data
There is no legal obligation to provide your data. However, if you do not provide us with your data, it will not be possible to create your User account.
As a registered User, you may use the various functions of the brite Platform. You can provide information on the products and medicines you use or on your therapies or illnesses. You can add product and therapy areas, unless the areas have already been added to your User account automatically on the basis of your information, track various data (such as symptoms, vital signs, laboratory results) and integrate wearable data. You can also upload photos or documents (such as doctors' letters) and keep a diary and a chat history via an AI chat. Based on your information, suitable questionnaires (so-called scientifically standardised or individual question sets) that you can answer are suggested to you in the brite area and in the product and therapy areas. Learning content is also suggested to you. In addition, you see statistics, trends and AI-generated insights based on the data (such as symptoms, vital signs, laboratory results, wearable data) and information (such as photos or doctors' letters) you have recorded. You also have the option of reporting side effects of the medicine you are taking. In addition, you receive information and content that is relevant or of interest to you, among other things on product and therapy areas, on the products you use or your therapies or illnesses, as well as on your health interests and on interactions between different products ("interaction check"), by means of notifications (e.g. push notification or email). Finally, you have the option of communicating with us and with Providers and of receiving medical support from Providers, for example in the form of chats, call-backs, telemedicine or similar functions, by making use of existing interaction functions.
Purpose
We process your data in order to enable you to use the various functions of the brite Platform.
Legal basis
Insofar as we process health data within the meaning of Art. 4(15) GDPR from you, the legal basis for this is your explicit consent pursuant to Art. 9(2)(a) GDPR or the fact that you have manifestly made the data public within the meaning of Art. 9(2)(e) GDPR. For all other data, the legal basis for the data processing is Art. 6(1) sentence 1(b) GDPR, as we process the data for the purpose of performing the user agreement with you.
Recipients
Your data is passed on to our IT service providers within the scope of processing on our behalf, insofar as this is necessary. If you use the interaction functions, persons to whom you send messages can view the data transmitted in the message.
Storage period
We process your data until you withdraw your consent by deleting your User account.
Option to withdraw
You may freely withdraw your consent at any time by deleting your entire User account.
Obligation to provide your data
There is no legal obligation to provide your data. However, if you do not provide us with your data, not all functions of the brite Platform may be available to you. Without the provision of your health data, in particular the functions for monitoring the course of your health and for the personalised display of medical and health-related content are not available.
We pseudonymise and anonymise your personal health data from your User account and the health data that you have provided when answering questionnaires (see section 3.7).
Pseudonymisation is the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data is not attributed to an identified or identifiable natural person.
In anonymisation, your data is altered in such a way that it can no longer be attributed to you as a person, or can only be attributed to you with a disproportionately large technical effort.
However, the pseudonymisation and also the anonymisation of your data can never completely rule out a later attribution of information to you as a person via other sources, e.g. information that you provide on social media. A residual risk of traceability to you as a person therefore remains. This is particularly the case if you publish genetic or other health data yourself, e.g. for genealogical research on the internet. Should your data fall into unauthorised hands despite extensive technical and organisational protective measures and a link to you as a person then be established despite the absence of names, a use of the data that is discriminatory or otherwise harmful to you and, where applicable, also to close relatives cannot be ruled out.
Purpose
We anonymise your data for our own statistical purposes, in particular for product improvement, and in order to provide Providers with anonymised overviews (see section 3.9).
We pseudonymise your data, likewise in order to be able to analyse it for our own statistical purposes, in particular for product improvement, and to make it available to the Providers relevant to you (see section 3.9).
Legal basis
The legal basis for the pseudonymisation and anonymisation and analysis of your health data within the meaning of Art. 4(15) GDPR for the stated purposes is your explicit consent pursuant to Art. 9(2)(a) GDPR.
Recipients
Your data is passed on to our IT service providers within the scope of processing on our behalf, insofar as this is necessary.
Storage period
We process your data only until you withdraw your consent by deleting your User account. We cannot delete anonymised data, as it can no longer be attributed to you.
Option to withdraw
You may freely withdraw your consent at any time by deleting your entire User account.
Obligation to provide your data
There is no legal obligation to provide your health data. However, if you do not provide us with your data, not all functions of the brite Platform may be available to you. Without the provision of your health data, in particular the functions for monitoring the course of your health and for the personalised display of medical and health-related content are not available.
As a User of the brite Platform, you are a user of a product or a recipient of a therapy, or you suffer from a specific illness. Providers have an interest in the (health) data you provide in the course of using the brite Platform, in particular when answering questions (see section 3.7), e.g. in order to conduct market research, to carry out or validate product safety reviews, or for scientific research purposes. In order to be able to offer you the free functions of the brite Platform, we therefore pass on your data, including side-effect reports, to Providers exclusively in pseudonymised and anonymised form (see section 3.8). In doing so, we ensure that Providers cannot identify you and cannot attribute the transmitted data to you personally.
Your data is combined before transfer in order to be able to give Providers a more comprehensive picture of the use of their products or therapies and thereby to increase User safety. Providers are still not able to identify you. You will not share in any commercial benefit that may arise from the processing of your data.
Purpose
We process your pseudonymised and anonymised (health) data in order to transfer it to Providers.
Legal basis
The legal basis for the processing of your health data within the meaning of Art. 4(15) GDPR for this purpose is your explicit consent pursuant to Art. 9(2)(a) GDPR.
Recipients
The recipients of your data are our IT service providers, within the scope of processing on our behalf, and the Providers for whom your data is relevant, in states of the European Union or the European Economic Area or in other countries for which the European Commission has determined an adequate level of data protection.
Storage period
We transfer your data only until you withdraw your consent by deleting your User account. We cannot delete anonymised data, as it can no longer be attributed to you.
Option to withdraw
You may freely withdraw your consent at any time by deleting your entire User account.
Obligation to provide your data
There is no legal obligation to provide your data. However, if you do not provide us with your data, not all functions of the brite Platform may be available to you. Without the provision of your health data, in particular the functions for monitoring the course of your health and for the personalised display of medical and health-related content are not available.
In certain circumstances, we send you emails with which we wish to present our products and services or new offerings and functions of the Platform that may be of interest to you, possibly give you a small treat in the form of a voucher, or ascertain your satisfaction with the brite Platform. You receive these marketing emails without your consent being required if we have received your email address from you in connection with the registration of a User account and you have not objected to marketing emails. In this case, we may send you communications about our services that are similar to the services you have used or that relate to these services. If you give your consent in your system or device settings, we also send you communications by means of push and browser notifications in the brite Platform. If you have given your consent to the processing of your health data for marketing purposes, we may send you communications tailored to your needs, e.g. about new product and therapy areas.
Purpose
We send you communications for the purpose of direct marketing in order to inform you about our offerings and services.
Legal basis and legitimate interest
The legal basis for the processing of your data for sending the emails for which we do not require consent is Art. 6(1)(f) GDPR. Our legitimate interests lie in sending you advertising in the form of direct marketing. Your interests are safeguarded by the contractual relationship existing between you and us, the information provided by us in this Privacy Policy, and your option to unsubscribe from the email notifications again at any time, if you are no longer interested, with a simple click at the end of the emails.
The legal basis for communications by means of push and browser notifications is your consent pursuant to Art. 6(1)(a) GDPR.
The legal basis for the processing of your health data is your consent pursuant to Art. 9(2)(a) GDPR.
Recipients
We pass on your data to our IT service providers strictly for the specified purpose, if at all necessary and only to the extent required, within the scope of processing on our behalf.
Storage period
Your data is stored for sending communications for as long as it is required for this purpose or until you object to the processing of your data for this purpose or withdraw your consent.
Option to object
You can unsubscribe from our emails at any time. For this purpose, every advertising email contains a corresponding opt-out link. You can deactivate push and browser notifications in your device or system settings.
Obligation to provide your data
We receive your email data within the scope of the contractual relationship existing between you and us. Without the provision of this data, it is not possible to create a User account. However, you may object to the processing of your data for the purpose of sending emails at any time in accordance with the information above. Consent to receiving push and browser notifications is voluntary.
We use the services of Recombee, a third-party provider, to improve the personalisation and recommendation functions of our application with regard to the delivery of content. Recombee processes user data in order to deliver tailored content and improve the user experience. The data processed in pseudonymised form includes interactions within the app, preferences and other usage metrics. Recombee has committed itself to complying with the GDPR and ensures the protection of personal data as set out in its data processing policies.
Purpose
We use Recombee to provide personalised content recommendations and to improve the experience of Users within our application.
Legal basis and legitimate interest
The data processing is carried out on the basis of our legitimate interest pursuant to Art. 6(1) sentence 1(f) GDPR. Our legitimate interest lies in improving user experience and user retention through personalised content. Recombee's commitment to complying with the GDPR ensures that Users' interests in the protection of their personal data are safeguarded.
Recipients
The user data processed by Recombee may be transferred to and stored on Recombee's servers. Recombee complies with the requirements of the GDPR and ensures adequate protection of personal data during transfer and storage. Information on data protection at Recombee can be found here: Recombee GDPR Compliance.
Storage period
The data is stored only for as long as is necessary to provide personalised recommendations and improve the user experience.
Option to object
The data processing is essential for the personalisation functions of the application. You can exercise your right to object to further data processing for the future by ceasing to use our application.
Obligation to provide your data
The provision of your data is voluntary. However, without the processing of your data, we cannot offer personalised recommendations and improved user experiences.
We use Google Cloud as a third-party provider for the brite assistant function, with which Users can ask treatment-related questions and receive answers based on generative AI. The data transferred to Google Cloud is the language settings from the user profile (e.g. German or English). The reason for transferring this data is to enable the assistant to respond in the correct language. In addition, the texts from the chat input are transferred to Google Cloud. This is necessary so that the AI can provide a response to the input submitted.
Purpose
We send the language settings of a user profile and the Users' text input to Google Cloud. No further personal data is transferred. The purpose of this transfer is to offer the brite assistant in the User's language and to provide a response from the AI to the question or text sent.
Legal basis and legitimate interest
The data processing is carried out on the basis of our legitimate interest pursuant to Art. 6(1) sentence 1(f) GDPR. Our legitimate interest lies in improving user experience and engagement.
Recipients
Google Cloud has committed itself to complying with the GDPR and ensures the protection of personal data as set out in the Google Cloud privacy notice.
Storage period
The data is stored only for as long as the User interacts with the brite assistant function within a session.
Option to object
You may exercise your right to object to further data processing in the future by ceasing to use the brite Assistant function.
Obligation to provide your data
There is no legal obligation to provide your data. Without the processing of your language information, however, we are unable to offer the brite Assistant function.
We use the services of Social+, a third-party provider, to provide the community function of our application. Social+ processes user data in order to enable social interactions such as group discussions, messages and community engagement. The data processed comprise pseudonymised interaction data such as messages, posts and reactions, as well as technical metadata. Social+ undertakes to comply with the GDPR and ensures the protection of personal data in accordance with the standards set out in its data processing policies.
Purpose
We use Social+ to provide the community function, which enables Users to interact with others, share experiences and take part in discussions within our application.
Legal basis and legitimate interest
The data processing is carried out on the basis of our legitimate interest pursuant to Art. 6(1) sentence 1(f) GDPR. Our legitimate interest lies in providing a functional and engaging community function. In cases where health-related data are processed, the legal basis is your explicit consent pursuant to Art. 9(2)(a) GDPR. Social+'s commitment to compliance with the GDPR ensures that the interests of Users in the protection of personal data are safeguarded. Information on GDPR compliance can be found here: GDPR commitment.
Recipients
User data processed by Social+ may be transferred to and stored on servers of Social+. Social+ meets the requirements of the GDPR and ensures an adequate level of protection of personal data during transfer and storage. Information on data protection at Social+ can be found here: Social+ privacy policy.
Storage period
Data are stored only for as long as is necessary to provide the community function and to improve the user experience. Users have the right to request the erasure of their personal data at any time by contacting Social+ at legal@social.plus. As soon as a User deletes their account or withdraws their consent, their data will no longer be processed for the community function. Anonymised data that cannot be linked to the User may be retained for statistical or security purposes in accordance with the GDPR.
Option to object
The data processing is essential for the community function of the application. You may exercise your right to object to future data processing by ceasing to use the community function or by deleting your User account.
Obligation to provide your data
The provision of your data is voluntary. Without the processing of your data, however, we are unable to offer the community function or its associated benefits.
We use the services of AppsFlyer, a third-party provider, to analyse the effectiveness of our registration process and to optimise our application. The only user data that we transmit to AppsFlyer is the completion of registration in our app. These data are pseudonymised and processed in accordance with AppsFlyer's data protection provisions, which comply with the requirements of the GDPR.
Purpose
We use AppsFlyer exclusively to analyse the completion of registrations. This helps us to improve the onboarding process for our Users.
Legal basis and legitimate interest
The data processing is carried out on the basis of your explicit consent pursuant to Art. 6(1)(a) GDPR. You may withdraw this consent at any time in the profile settings of your account.
Recipients
The data processed by AppsFlyer may be transferred to and stored on AppsFlyer's servers. AppsFlyer complies with the requirements of the GDPR and ensures an adequate level of protection of your personal data during transfer and storage. Further information on data protection at AppsFlyer can be found here: AppsFlyer GDPR.
Storage period
The data are stored only for as long as is necessary to analyse completed registrations and to optimise the onboarding process.
Option to object
You may withdraw your consent to data processing by AppsFlyer at any time in the profile settings of your account. Following withdrawal, no further data will be transmitted to AppsFlyer.
Obligation to provide your data
The provision of your data to AppsFlyer is voluntary. If you do not give your consent, your registration process will not be transmitted to AppsFlyer. This has no effect on your use of our application.
In the course of using the brite Platform, the following additional functions are provided and the associated personal data are processed:
In the context of these functions, we process the following data:
Purpose
The processing is carried out in order to provide the Platform functions, to carry out appointment organisation and communication, to provide personalised content and evaluations, to carry out marketing measures including retargeting, to ensure the security and functionality of the Platform, to provide medical support services and to carry out analyses, research and product improvement.
Legal basis
Depending on the purpose, your personal data are processed on the basis of
Health data are processed exclusively on the basis of your explicit consent pursuant to Art. 9(2)(a) GDPR.
Recipients
Recipients of the data are our IT and hosting service providers in the context of processing on our behalf, Providers of the respective product and therapy areas in the context of joint controllership, as well as external medical service providers and other technical service providers, insofar as this is necessary to carry out the respective function. In the context of the doctor's appointment booking function, we transmit the data required for this purpose to the selected medical practice or institution. These are your first name and surname, your contact data (email address, mobile number), your birth date, your type of health insurance (private or public), your appointment details and the results of your self-quiz or your answers to questionnaires, insofar as these are necessary for the preparation of the appointment. This information enables the practice to classify and prepare for your appointment. The practice processes the data as an independent controller; its privacy policy applies. Your health data are transmitted on the basis of your explicit consent pursuant to Art. 9(2)(a) GDPR, which you give before submitting the appointment request.
Storage period
We process your personal data only for as long as is necessary to achieve the aforementioned purposes or until you withdraw any consent given. Data processed for the performance of the user agreement are stored for the duration of your User account. We process health data until you withdraw your consent. Pseudonymised data may, in addition, be further processed for analysis and research purposes. Anonymised data cannot be erased, as they can no longer be attributed to you personally.
Option to withdraw
Insofar as the data processing is based on Art. 6(1) sentence 1(f) GDPR, you may object to the processing of your personal data. Insofar as your data are processed for marketing and retargeting purposes, you may adjust your settings at any time via the cookie settings or withdraw your consent.
Insofar as the processing is based on your consent, you may withdraw it at any time with effect for the future. The lawfulness of the processing carried out until the withdrawal remains unaffected. For tracking and marketing measures, you may in particular manage or withdraw your consent via the cookie settings.
Obligation to provide your data
There is no legal obligation to provide your data. If you do not provide us with your data, however, even contacting us will not be possible, or not possible via every means of communication.
You have the option of uploading doctor's reports, laboratory reports or other documents relating to your products, your health or your therapies to the brite Platform and storing them in your User account. The use of this upload function is voluntary and optional. The documents you upload may contain personal data relating to you yourself (in particular health data such as diagnoses, laboratory findings, medications or courses of therapy), but also personal data of third parties identified in the documents (e.g. the name and professional title of your doctor). By uploading the documents, the data contained in the documents are transferred to and stored on our servers. The documents are processed in order to assign them to your User account and to make them available to you within the Platform. We pass on the personal data contained in uploaded documents – if at all – exclusively in pseudonymised form to third parties, such as Providers (cf. sections 3.13 and 3.14).
Purpose
The processing is carried out in order to give you the option of storing health-related documents in your User account, accessing them and using them in connection with the other functions of the brite Platform.
Legal basis
Insofar as the uploaded documents contain your own health data within the meaning of Art. 4(15) GDPR, the legal basis for the processing is your explicit consent pursuant to Art. 9(2)(a) GDPR, which you give by uploading the documents. For other personal data of third parties contained in the documents, in particular identification data (e.g. name and professional title) of members of the medical professions who are identified in the documents in their professional capacity as issuers, the legal basis is Art. 6(1) sentence 1(f) GDPR. Our legitimate interest, and yours, consists in storing and managing your medical documents in your User account. The data of third parties contained in the documents are processed solely as ancillary information; they are not used for purposes that concern the third party as such and are passed on to third parties outside the Platform, if at all, only in pseudonymised form.
Recipients
Your data are passed on to our IT service providers in the context of processing on our behalf, insofar as this is necessary. Any further disclosure of the personal data contained in the documents to third parties, in particular to Providers, takes place exclusively in pseudonymised form (cf. sections 3.13 and 3.14).
Storage period
We store your uploaded documents until you delete them manually or delete your User account. When the User account is deleted, the uploaded documents are also deleted.
Option to withdraw
You can delete uploaded documents at any time via your User account. Insofar as the processing is based on your consent, you may withdraw it at any time with effect for the future by deleting the relevant documents or deleting your User account.
Obligation to provide your data
The provision of the documents is voluntary. Uploading documents is an optional function. The other functions of the brite Platform can be used without restriction without using this function.
We use the product analysis service “Amplitude” of Amplitude, Inc., San Francisco, USA (“Amplitude”), in order to understand how our app and Platform are used. We only use Amplitude if you have given your consent in the privacy settings. Without your consent, no data are transmitted to Amplitude.
Amplitude records the screens and pages accessed, the functions used, the duration and frequency of use, and technical information about your device, e.g. app version, operating system, device type and language. These data are linked to a pseudonymous user ID and a device ID that is stored on your device. We do not transmit your name, your email address or other information that identifies you directly to Amplitude. If a usage event concerns your health (e.g. an entered illness or a medication), we transmit only a code word, never the plain text. Amplitude cannot decrypt these codes, because only we hold the key.
Amplitude also records sessions (Session Replay). This reproduces how the app is displayed and operated during a visit, e.g. tapping, scrolling and screen changes. All texts and input fields are masked, so their content is not recorded. Screens containing health information are not recorded at all.
We have configured Amplitude in such a way that your IP address is not stored and is not used to determine your location. Amplitude stores the data in its EU data centre in Frankfurt am Main.
Purpose
We use the data to evaluate how the app and Platform are used, in order to improve our offering and tailor it to your needs.
Legal basis
We process the data on the basis of your consent (Art. 6(1)(a) GDPR). As usage data of a health app may allow conclusions to be drawn about your health, your consent at the same time constitutes explicit consent under Art. 9(2)(a) GDPR. The storage and reading of the IDs on your device is based on your consent under Section 25(1) TDDDG.
Recipients
Amplitude processes the data on our behalf as a processor on the basis of a data processing agreement (Art. 28 GDPR). For this purpose, Amplitude engages further service providers (sub-processors), e.g. Amazon Web Services for hosting in Frankfurt. We do not sell your data and do not pass them on to other third parties.
Your data are stored in the EU. However, as Amplitude, Inc. has its registered office in the USA, individual employees and sub-processors may access data from outside the EU, e.g. for support, security or troubleshooting. Amplitude is certified under the EU-U.S. Data Privacy Framework, for which an adequacy decision of the EU Commission exists (Art. 45 GDPR). In addition, we have agreed EU standard contractual clauses with Amplitude (Art. 46(2)(c) GDPR).
Storage period
Usage data are erased after 12 months at the latest, and session recordings after 30 days.
Option to withdraw
You may withdraw your consent at any time with effect for the future in the privacy settings. Thereafter, no further data will be transmitted to Amplitude. The lawfulness of the processing until the withdrawal remains unaffected.
Obligation to provide your data
The provision of your data is voluntary. If you do not give your consent, you can nevertheless use the app and Platform without restriction.
If you use our app on an iPhone, you can connect it to Apple Health via Apple HealthKit. Apple Health collects health and fitness data from your iPhone, your Apple Watch and other wearables or apps that you have connected to Apple Health. With your permission, our app reads selected data from Apple Health. We only read data. We do not write, modify or delete any data in Apple Health.
You decide for yourself which of the following data types our app may read:
We only read the data types that you have authorised. You can change your selection at any time in Apple Health.
Purpose
We use the data read from Apple Health exclusively to provide you with the functions of our app. This includes displaying your values and histories in the app and taking them into account in the personalised information on your health. We do not use data from Apple Health for advertising, marketing or data mining. We do not sell them and do not pass them on to advertisers, data brokers or other third parties.
Legal basis
Data from Apple Health are health data and therefore a special category of personal data. We process them on the basis of your explicit consent pursuant to Art. 6(1) sentence 1(a) GDPR in conjunction with Art. 9(2)(a) GDPR. You give your consent when you connect our app to Apple Health and allow access to the individual data types.
Recipients
Apple makes the data available to our app on your device. From there, they are transferred to our servers and stored there in encrypted form. Hosting takes place as described in section 3.1 Logfiles. Apple and the manufacturers of wearables that you have connected to Apple Health process your data under their own responsibility. Information on data protection at Apple can be found here: https://
Storage period
We store the data read from Apple Health for as long as you have an account with us. If you delete your account, we will also delete all data read from Apple Health, unless statutory retention obligations apply.
Option to withdraw
You may withdraw your consent at any time with effect for the future. You can do this in your iPhone's settings under Settings → Apps → Health → Data Access & Devices → brite. Following your withdrawal, synchronisation stops and no further data are read from Apple Health. Data synchronised up to your withdrawal remain stored in your account until you delete it. The lawfulness of the processing until the withdrawal remains unaffected.
Obligation to provide your data
Connecting to Apple Health is voluntary. If you do not give your consent, our app will not read any data from Apple Health. You can nevertheless use our app without restriction and enter your values manually.
If you use our app on an Android device, you can connect it to Health Connect. Health Connect is a platform from Google that collects health and fitness data from your smartphone as well as from wearables and apps that you have connected to Health Connect. The data are stored locally on your device. With your permission, our app reads selected data from Health Connect. We only read data. We do not write, modify or delete any data in Health Connect.
You decide for yourself which of the following data types our app may read:
We only read the data types that you have authorised. You can change your selection at any time in Health Connect.
Purpose
We use the data read from Health Connect exclusively to provide you with the functions of our app. This includes displaying your values and histories in the app and taking them into account in the personalised information on your health.
Our use of data from Health Connect complies with Google's policies for Health Connect permissions, including the limited use requirements (“Limited Use”). This means:
Legal basis
Data from Health Connect constitutes health data and therefore a special category of personal data. We process it on the basis of your explicit consent pursuant to Art. 6(1) sentence 1(a) GDPR in conjunction with Art. 9(2)(a) GDPR. You give your consent when you connect our app to Health Connect and allow access to the individual data types.
Recipients
Health Connect makes the data available to our app on your device. From there, it is transferred to our servers and stored there in encrypted form. Hosting takes place as described in section 3.1 Logfiles. Google and the manufacturers of wearables or apps that you have connected to Health Connect process your data under their own responsibility. Information on data protection at Google can be found here: https://
Storage period
We store the data read from Health Connect for as long as you have an account with us. If you delete your account, we also delete all data read from Health Connect, unless statutory retention obligations apply.
Option to withdraw consent
You can withdraw your consent at any time with effect for the future. You can do this in our app under Settings → Connected apps or directly in Health Connect under App permissions → brite. Depending on your Android version, you will find Health Connect as a separate app or in your device's settings. After you withdraw your consent, synchronisation stops and no further data is read from Health Connect. Data synchronised up until your withdrawal remains stored in your account until you delete it. The lawfulness of the processing carried out up until the withdrawal remains unaffected.
Obligation to provide your data
Connecting to Health Connect is voluntary. If you do not give your consent, our app does not read any data from Health Connect. You can nevertheless use our app without restriction and enter your values manually.
You can contact us via the email addresses and telephone numbers we provide. If you make use of this option, the personal data you transmit with the email or by means of the telephone call will be processed.
Purpose
We process your data for the purpose of handling your enquiry.
Legal basis and legitimate interest
If the contact is aimed at concluding a contract or if your contact concerns an existing contract, Art. 6(1)(b) GDPR is the legal basis for the processing. In all other cases, the legal basis for the processing of your data is Art. 6(1) sentence 1(f) GDPR. In these cases, the legitimate interest arises from the fact that only by processing your data accordingly can we carry out the action you have requested (e.g. responding to enquiries).
Recipients
In the course of handling your enquiry, your data is transmitted, within the framework of data processing on our behalf, to our IT service providers and to those of our employees who handle your enquiry.
Storage period
We generally store your data until your enquiry has been answered in full.
Option to object
The data processing is necessary for handling your enquiry. You can prevent us from collecting your data by not sending us an enquiry.
Obligation to provide your data
There is no legal obligation to provide your data. However, if you do not provide us with your data, it will not be possible to contact us at all, or not via every means of communication.
During your visit to our Platform (section 3), we use the widespread TLS (Transport Layer Security) protocol in conjunction with the highest level of encryption supported by your browser or operating system. We use HTTP Strict Transport Security (HSTS) and automatic redirection to ensure that all communication on and via our Platform is transmitted in encrypted form. You can recognise this by the closed key or padlock symbol in the lower status bar of your browser. Where data is stored, it is protected on the storage medium using state-of-the-art encryption methods. In addition, we use appropriate technical and organisational security measures to protect your data against accidental or intentional manipulation, partial or complete loss, destruction and unauthorised access by third parties. Our security measures are continuously improved in line with technological developments.
In particular, in connection with the processing of your data on the brite Platform (section 3.11 et seq.), we maintain the highest security standards. In addition to the pseudonymisation and anonymisation of the data (section 3.13), our servers are provided in ISO 27001-certified data centres in Germany.
Despite the high data security standards we have put in place, a residual risk to the security of your personal data unfortunately cannot be completely ruled out.
Unless otherwise stated in this Privacy Policy, we do not transfer your data to countries outside the European Economic Area.
Unless a shorter storage period results from the other provisions of this Privacy Policy, we store your personal data only for as long as is necessary to fulfil the respective purposes and thereafter only if and to the extent that we are required to do so by mandatory statutory retention obligations. Where we no longer need your data for the purposes described in this Privacy Policy, it will merely be stored for the duration of the respective statutory retention period and will not be processed for any other purposes.
If we process your personal data, you have the following rights vis-à-vis us:
You may request confirmation from us as to whether personal data concerning you is being processed by us. If such processing takes place, you may request information from us about the information listed in Art. 15 GDPR. If you exercise your right without telling us which specific information you require, you will receive from us all information pursuant to Art. 15 GDPR.
You have the right vis-à-vis us to the rectification or completion of your personal data if the processed personal data concerning you is inaccurate or incomplete.
You may request the restriction of the processing of personal data concerning you under the following conditions:
If the processing has been restricted in accordance with the above conditions, you will be informed by us before the restriction is lifted.
You may request that we erase the personal data concerning you without undue delay. We are obliged to erase this data without undue delay if one of the grounds listed in Art. 17 GDPR applies. Anonymised data cannot be erased.
If, in an individual case, we have made the personal data concerning you public and are obliged to erase it pursuant to Art. 17(1) GDPR, we will, taking into account the available technology and the cost of implementation, take reasonable measures, including technical measures, to inform the controllers processing the personal data that you, as the data subject, have requested that they erase all links to, or copies or replications of, this personal data. As a general rule, however, we do not make your personal data public.
The right to erasure does not exist insofar as the processing of the personal data concerning you is necessary
If you have asserted the right to rectification, erasure or restriction of the processing of your personal data vis-à-vis us, we are obliged to communicate this rectification or erasure of the data or restriction of processing to all recipients to whom your personal data has been disclosed. This does not apply if such communication proves impossible or would involve disproportionate effort. You have the right vis-à-vis us to be informed about these recipients.
You have the right to receive the personal data concerning you which you have provided to us in a structured, commonly used and machine-readable format. You also have the right to transmit this data to another controller, provided that:
The right to data portability does not apply to processing of personal data that is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us.
You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is based on Art. 6(1)(e) or (f) GDPR; this also applies to profiling based on these provisions.
Following your objection, we will no longer process the personal data concerning you unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.
Where personal data concerning you is processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such marketing; this also applies to profiling to the extent that it is related to such direct marketing.
If certain decisions on our part are based solely on automated processing – including profiling – you have the right not to be subject to such a decision which produces legal effects concerning you or similarly significantly affects you. However, this does not apply if
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement, if you consider that the processing of personal data concerning you infringes data protection provisions, including those of the GDPR.
If you have given declarations of consent under data protection law, you have the right to freely withdraw this consent at any time. The withdrawal of consent does not affect the lawfulness of processing carried out on the basis of the consent before its withdrawal. If you have given several declarations of consent under data protection law, please let us know which of these consents you are withdrawing. If we do not receive such specification even upon request, we will assume that your withdrawal applies to all consents given up to that point. We will then cease all data processing activities based on your consents.
Please note that our Platforms may contain links to content of other providers to which this Privacy Policy does not apply. We have no influence over these websites, nor over whether they comply with the applicable data protection provisions.
Ongoing developments in technology and the internet make it necessary to adapt our Privacy Policy from time to time. We reserve the right to amend this Privacy Policy at any time with effect for the future. The current version is available on our Platform. Please visit the Platform regularly and familiarise yourself with the current Privacy Policy.
Contents
Notwendige Cookies halten brite.health am Laufen. Mit deiner Einwilligung
nutzen wir auch Analyse- und Marketing-Cookies, um die Website zu verbessern
und unsere Werbung zu messen.
Wähle aus, welche Cookies wir nutzen dürfen. Du kannst das jederzeit unten auf jeder Seite ändern.
Halten die Website am Laufen und sicher und merken sich deine Cookie-Auswahl.
Usercentrics, Webflow, Sentry
Zeigen uns, wie die Website genutzt wird, damit wir sie verbessern können.
Google Analytics
Messen, wie gut unsere Werbung wirkt, und zeigen sie den passenden Menschen.
Google Tag Manager,
Meta Conversion API
Necessary cookies keep brite.health running. With your consent, we also use analytics and marketing cookies to improve the site and measure our ads.
Choose which cookies we may use.
You can change this anytime at the
bottom of every page.
Keep the site running and secure, and remember your cookie choice.
Usercentrics, Webflow, Sentry
Show us how people use the site, so we can improve it.
Google Analytics
Measure how well our ads work and show them to the right people.
Google Tag Manager,
Meta Conversion API