Privacy Policy

nextself health GmbH ("nextself", "we", "us") develops digital health apps. This privacy policy explains, in plain language, how we handle personal data when you visit our website, request an invite, create an account, contact us, or use a nextself app. Health-related data is especially sensitive, so we only process it where there is a clear purpose and a legal basis under the EU General Data Protection Regulation (GDPR).

1. Who is responsible

The controller is nextself health GmbH, Nowackanlage 13, 76137 Karlsruhe, Germany. You can contact us about privacy matters at info@nextself.health.

2. Data we may process

• Website and device data, such as browser type, device information, IP address, log data, security events, cookie choices, and pages viewed.
• Invite and account data, such as name, email address, chosen app, login credentials, language preference, and basic account settings.
• App and programme data, such as goals, check-ins, answers, progress, reminders, notes, and app interactions.
• Health-related data, where you actively provide it or where it is necessary for a health programme. This can be special-category data under Article 9 GDPR.
• Support and communication data, such as messages, feedback, survey answers, and information needed to respond to requests.
• Billing, future prescription, or insurer data, where a paid, future prescription, activation-code, or reimbursement process applies.

3. Purposes and legal bases

• Providing the website, account, and app, usually to perform a contract or take steps before a contract (Art. 6(1)(b) GDPR).
• Health-related processing, usually with your explicit consent or, where applicable, because it is necessary for healthcare-related purposes under applicable law (Art. 9 GDPR).
• Security, fraud prevention, troubleshooting, and service improvement, based on our legitimate interests (Art. 6(1)(f) GDPR).
• Invite, beta, support, and product communications, based on contract steps, consent, or legitimate interests depending on the message.
• Legal, accounting, reimbursement, medical-device, or DiGA-related obligations, where we are required to keep or process data by law (Art. 6(1)(c) GDPR).

4. Consent and withdrawal

Where processing depends on consent, you can withdraw that consent at any time with effect for the future. Withdrawing consent may mean that certain health features, optional analytics, or communications can no longer be provided. It does not affect processing that was lawful before withdrawal or processing that we must keep for legal reasons.

5. Cookies and similar technologies

We use technologies that are necessary to provide the website, remember language and privacy choices, keep sessions secure, receive beta invite requests, and prevent misuse. On the landing page, the cookie notice stores a local acknowledgement so we do not show the same notice on every visit. Optional analytics, marketing, or similar technologies are used only where the required consent has been given. You can change browser settings or delete local website data at any time.

6. Service providers and recipients

We may use carefully selected service providers, for example for hosting, email, analytics, customer support, security, or payment and reimbursement handling. They process data under appropriate agreements and instructions. We may also share data with health insurers, healthcare professionals, app-store providers, payment providers, authorities, or courts where this is necessary, requested by you, or legally required. We do not sell personal data.

7. International transfers

Where possible, we choose providers in the EU or EEA. If data is processed outside the EU or EEA, we use appropriate safeguards such as adequacy decisions, EU standard contractual clauses, and additional protective measures where required.

8. Security and retention

We use technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse, and alteration. We keep data only as long as needed for the purposes described above, for your account, for consent records, for limitation periods, or for statutory retention duties. Afterwards, data is deleted or anonymised where possible.

9. Your rights

You may have the right to access, rectification, deletion, restriction, data portability, objection, and withdrawal of consent. You may also lodge a complaint with a data protection supervisory authority, for example the authority responsible for Baden-Württemberg. To exercise your rights, contact info@nextself.health.

10. Children and young people

Our apps are generally intended for people aged 16 and over, unless a specific app states otherwise or use is arranged with the required consent of a parent or legal guardian.

11. Changes and contact

We may update this policy when our services, legal requirements, or processing practices change. The current version is published here. Questions? Write to info@nextself.health.