1. Scope
This notice explains how personal data is processed on the new pheal website, including its contact, OEM/CDMO and pilot enquiry forms. An app, separate online shop, study or subsequent pilot test may be subject to additional information specific to that processing.
2. Controller and contact
pheal GmbH
Albert-Einstein-Straße 1, 49076 Osnabrück, Germany
Phone: +49 (0) 5772 20093 40
Email, including privacy requests: info@pheal.care
3. Website access and Webflow hosting
We use Webflow, Inc., 398 11th Street, 2nd Floor, San Francisco, CA 94103, USA, to provide this website and its forms. Access involves processing, in particular, your IP address, access time, requested address, technical connection data, browser/device information and, where transmitted, the referring page. Files and content are delivered through the provider’s hosting and content delivery infrastructure.
The purposes are website delivery, reliable operation, abuse prevention and troubleshooting. The legal basis is Article 6(1)(f) GDPR; our legitimate interests are the secure and reliable provision of this website. Technical data is needed only for as long as required for operation, troubleshooting or dealing with a security incident. Technical storage takes place within Webflow’s hosting processes.
4. Contact, product and OEM/CDMO enquiries
We process the contact information and content you send, such as name, email, company, optional telephone number, project stage, requested services and project description. Required fields are marked in the relevant form. We may be unable to address an enquiry meaningfully without the necessary details. Further information is voluntary.
The purposes are responding, discussing your requirements and, where relevant, preparing a contract. Article 6(1)(b) GDPR applies where the enquiry concerns a contract with you. General enquiries and communication with a company’s contact persons are processed under Article 6(1)(f) GDPR; our legitimate interests are handling incoming correspondence and maintaining business contacts. Making an enquiry does not subscribe you to marketing emails.
5. Pilot enquiries and voluntary feedback
For pilot enquiries we process your name, email, role/background, optional organisation and description of your intended use and desired insights. Please do not submit diagnoses, medical reports, raw measurements or other sensitive health data through these forms. Participation, its data scope and any additional consents will be agreed separately before testing.
Consent to internal evaluation of experience reports and feedback is requested separately from consent to anonymised publication. Each relies on Article 6(1)(a) GDPR. Both are optional; declining does not prevent us from processing your enquiry. Neither checkbox covers health data or identifiable publication.
With the relevant consent, only fully anonymised experiences and derived findings are published on the pheal website, in product presentations and specialist articles. Names, personal images and identifiable quotations are excluded. You may withdraw either consent for the future at info@pheal.care. Withdrawal does not affect the lawfulness of prior processing. Once results are fully anonymised, they can no longer be linked to you or individually withdrawn.
6. Recipients and international transfers
Access is provided to the people handling your request at pheal and necessary processors for hosting, forms, communications and IT support. Other recipients are involved only with consent, where necessary for a contract or on another legal basis. Webflow also uses subprocessors.
Webflow processing may take place in the United States. Webflow states that it is certified under the EU–US Data Privacy Framework and provides a data processing agreement including EU Standard Contractual Clauses. Transfers take place under the applicable conditions of Articles 44 et seq. GDPR, in particular a valid adequacy decision or appropriate safeguards. See Webflow’s Privacy FAQs, Data Processing Addendum and subprocessor list. You may request information or copies of applicable safeguards from us.
7. Retention
Enquiry data is kept for as long as necessary to address the enquiry and relevant follow-up questions. It is then deleted unless another lawful purpose applies. If a contract is concluded, necessary data is processed for its performance. Statutory retention duties, for example for business correspondence and accounting records, and necessary retention to establish or defend legal claims remain applicable; processing is then restricted to those purposes.
Feedback processed on consent is retained until its purpose ends or consent is withdrawn. Where necessary, evidence of consent and withdrawal may be retained for accountability and legal defence, based on Article 6(1)(c) or (f) GDPR. Fully anonymised findings are no longer personal data.
9. Your rights
Subject to the applicable legal conditions, you have rights of access (Article 15), rectification (Article 16), erasure (Article 17), restriction (Article 18) and data portability (Article 20 GDPR). You may withdraw consent at any time for the future under Article 7(3) GDPR.
Right to object: You may object to processing based on legitimate interests on grounds relating to your particular situation under Article 21 GDPR. You may object to direct marketing at any time without giving reasons.
You can complain to a data protection authority, particularly where you live or work or where you believe an infringement occurred. The authority for our registered office is the State Commissioner for Data Protection of Lower Saxony, Postfach 221, 30002 Hannover, Germany; complaint form. You do not need to contact us first.
10. Provision of data, security and updates
There is no general legal obligation to submit personal data through this website. Information needed for a requested enquiry is marked accordingly. We do not make solely automated decisions with legal or similarly significant effects within the meaning of Article 22 GDPR through this website.
Data is transmitted via HTTPS. We update this notice when features, processing activities or legal requirements change.