Privacy Policy

1) Information on the Collection of Personal Data and the Controller’s Contact Details

1.1

This Privacy Policy informs you about how we process personal data when you use our website, online shop and digital services, as well as in connection with products, diagnostic services, reports and consultation services.

Personal data means any information relating to an identified or identifiable natural person. This includes, in particular, names, addresses, email addresses, order and payment data, usage data and, depending on the service used, health data, laboratory values, genetic or epigenetic data and consultation data.

This Privacy Policy applies to the online services and other services for which neotes GmbH is responsible, unless separate privacy information is provided in an individual case.

1.2

The controller responsible for data processing within the meaning of the General Data Protection Regulation (GDPR) is:

neotes GmbH
Ziegelstraße 7c
40468 Düsseldorf
Germany

Email: cs@neotes.care

The controller responsible for processing personal data is the natural or legal person who, alone or jointly with others, determines the purposes and means of processing personal data.

1.3

You can contact our Data Protection Officer at:

neotes GmbH
– Data Protection Officer –
Ziegelstraße 7c
40468 Düsseldorf
Germany

Email: datenschutz@neotes.care

1.4

For security reasons and to protect the transmission of personal data and other confidential content, such as orders, enquiries or submitted form data, this website uses SSL or TLS encryption. You can identify an encrypted connection by the character sequence “https://” and the padlock symbol in your browser’s address bar.

2) Data Collection When Visiting Our Website

2.1 Server Log Files

When you use our website for informational purposes only, meaning that you do not register, place an order or otherwise provide us with information, we collect data that your browser automatically transmits to our website server. This data is processed in server log files and is technically necessary to display the website and ensure the stability and security of our online services.

When you access our website, the following data in particular may be processed:

  • the website or subpage visited,
  • the date and time of access,
  • the amount of data transmitted in bytes,
  • the source or referring page from which you accessed the page,
  • the browser used,
  • the operating system used,
  • the IP address used,
  • the requesting provider.

Processing is carried out in accordance with Art. 6(1)(f) GDPR on the basis of our legitimate interests, in particular in ensuring the stability, security and functionality of our website and in detecting and preventing unlawful or abusive use.

As a general rule, this data is not combined with other data sources. However, we reserve the right to review server log files retrospectively if there are specific indications of unlawful use or an attack on our technical systems.

Server log files are stored only for the period necessary to ensure the technical operation, stability and security of our website. They are stored for longer only where this is necessary to investigate or prevent security incidents, enforce legal claims or comply with statutory obligations.

2.2 Technical Operation of the Website

We use technical service providers for the provision, operation, maintenance, security and delivery of our website and online shop. These include, in particular, providers of e-commerce, hosting, content delivery, security, maintenance and IT services.

These service providers process personal data only to the extent necessary for the secure and functional operation of our website, online shop and digital services. Where they act on our instructions, processing is carried out on the basis of a data processing agreement pursuant to Art. 28 GDPR.

Processing is carried out in accordance with Art. 6(1)(f) GDPR on the basis of our legitimate interest in providing our services securely, reliably and efficiently. Where processing is necessary to perform orders or provide contractually agreed functions, it is additionally carried out in accordance with Art. 6(1)(b) GDPR.

2.3 Cookies

Our website uses cookies and comparable technologies. Further information, particularly regarding their type, scope, purposes, legal bases and settings options, can be found in the section “Cookies and Comparable Technologies” of this Privacy Policy.

3) Data Processing for Customer Accounts, Orders and Contract Performance

3.1 Customer Account

You can create a customer account on our website or place an order as a guest. When a customer account is created and used, we process the personal data required for this purpose, in particular your name, email address, postal address, login details, order history and other information stored in the customer account.

Processing is carried out in accordance with Art. 6(1)(b) GDPR where it is necessary to create, provide and manage the customer account. Where processing serves technical administration, security or the prevention of misuse, it is carried out in accordance with Art. 6(1)(f) GDPR on the basis of our legitimate interest in providing a secure and user-friendly customer-account function.

You may request the deletion of your customer account at any time. Following deletion, your data will be erased unless outstanding contracts, statutory retention obligations or legitimate interests in continued storage prevent this.

3.2 Orders and Contract Performance

When you order products or services through our website, we process the personal data required to receive, process and fulfil your order. This may include, in particular:

  • email address,
  • first name and surname,
  • delivery address,
  • billing address, if different,
  • telephone number, if provided or necessary for fulfilment,
  • company or business details, if provided,
  • products or services ordered,
  • order number,
  • payment method and payment status,
  • shipping and delivery status,
  • customer notes or other information provided during the ordering process.

Processing is carried out in accordance with Art. 6(1)(b) GDPR where it is necessary to establish, perform or fulfil the contractual relationship. Where we are legally obliged to process or retain certain data, processing is additionally carried out in accordance with Art. 6(1)(c) GDPR.

For certain diagnostic services, additional information may be required after the order has been placed. This information is not necessarily collected during the regular checkout process, but may instead be collected in a separate process. Depending on the diagnostic service, this may include information required to perform, allocate or evaluate the relevant diagnostic service. Further information can be found in the section “Diagnostic Services, Samples and Test Results”.

3.3 Shipping, Logistics and Fulfilment

To process and deliver your order, we transmit the necessary personal data to the shipping, logistics and fulfilment service providers engaged by us. This may include, in particular, your name, delivery address, email address, telephone number, order number, products ordered and information relating to delivery, shipment tracking and returns.

Processing is carried out for the purposes of storage, order picking, packaging, shipment preparation, handover to shipping providers, delivery, shipment tracking and returns processing. The legal basis is Art. 6(1)(b) GDPR where processing is necessary to fulfil your order. Where service providers act on our instructions, processing is carried out on the basis of a data processing agreement pursuant to Art. 28 GDPR.

Health data, laboratory data and test results are not transmitted to shipping, logistics or fulfilment service providers.

3.4 Returns, Complaints, Cancellations and Contract-Related Communication

If you contact us regarding a return, complaint, cancellation or other contract-related matter, we process the personal data required for this purpose. This may include, in particular, contact details, order data, delivery data, payment information, information about the affected product or service and the content of your message.

Processing is carried out in accordance with Art. 6(1)(b) GDPR where it is necessary to process your return, complaint, cancellation or other contract-related enquiry. Where processing serves documentation, evidence or the establishment, exercise or defence of legal claims, it is additionally carried out in accordance with Art. 6(1)(f) GDPR on the basis of our legitimate interest in proper processing and legal protection.

Any separate return, withdrawal, cancellation or processing conditions applicable to individual products or services, particularly diagnostic services that have already commenced or been fully performed, remain unaffected.

4) Payment Processing

4.1 General Information on Payment Processing

When you purchase products or services through our website, personal data required for payment processing is processed. This may include, in particular, your name, billing address, delivery address, email address, order number, invoice amount, selected payment method, payment status, transaction data and other information required to process the payment.

Processing is carried out in accordance with Art. 6(1)(b) GDPR where it is necessary to perform and process your order. Where statutory requirements oblige us to process or retain certain payment or invoice data, processing is additionally carried out in accordance with Art. 6(1)(c) GDPR.

4.2 Use of Payment Service Providers

We use external payment service providers to process payments. Depending on the payment method selected, the necessary payment and order data is transmitted to the relevant payment service provider or collected and processed directly by that provider.

The payment methods offered on our website may include, in particular, credit card payments, PayPal, Klarna, Apple Pay, Google Pay, iDEAL, Bancontact, QPay and payments processed through the shop and payment infrastructure used by us. Credit card payments may be processed using Visa, Mastercard or American Express.

Payment service providers process personal data where this is necessary to carry out the payment, confirm payment, prevent fraud, process refunds, chargebacks or payment disruptions and comply with their own statutory obligations.

As a general rule, we do not store complete payment details, particularly complete credit card or bank-account information. These details are processed by the relevant payment service provider. We generally receive only the information required to allocate and process the order, particularly the payment status, payment method, payment amount, payment time and transaction identifier.

The specific processing carried out by the relevant payment service provider is additionally governed by that provider’s privacy information.

4.3 Identity, Risk and Fraud Checks

Depending on the payment method selected, the relevant payment service provider may carry out identity, risk or fraud checks. This may be necessary, in particular, to ensure secure payment processing, prevent payment defaults or prevent misuse.

Where processing is necessary to carry out the selected payment method, it is based on Art. 6(1)(b) GDPR. Where processing serves to prevent payment defaults, fraud or misuse, it is additionally carried out in accordance with Art. 6(1)(f) GDPR on the basis of the legitimate interest in secure payment processing and the prevention of payment defaults.

Where payment service providers independently determine the purposes and means of data processing, they process the data under their own responsibility in accordance with data protection law.

4.4 Refunds and Payment Disruptions

In the event of refunds, chargebacks, failed payments, payment disruptions or other payment-related enquiries, we process the personal data required for this purpose. This may include, in particular, order data, payment status, transaction data, invoice data, communication content and internal processing notes.

Processing is carried out in accordance with Art. 6(1)(b) GDPR where it is necessary to perform the contractual relationship. Where processing serves documentation, evidence or the establishment, exercise or defence of legal claims, it is additionally carried out in accordance with Art. 6(1)(f) GDPR.

5) Diagnostic Services, Samples and Test Results

5.1 General Information

We offer diagnostic services in which, depending on the selected product, biological samples are analysed, health-related data is evaluated and digital reports are created. These services may include, in particular, epigenetic analyses, genetic analyses, blood and biomarker analyses, microbiome analyses, hormone analyses, metabolic analyses and other health-related evaluations.

The diagnostic services offered by us include, in particular, the bioAge Test, the Omega-3 Test or HS-Omega-3 Index, the Gut Microbiome Test, the NAD Test, the Hormone Test, the DNA Methylation Efficiency Test, the DNA Detox Test, the ASS-100 Genetic Test, the Metabolome Test, the Longevity Gene Test, the Skin DNA Test and the Hormone DNA Test.

The specific diagnostic service, type of sample, scope of analysis and information required are described in the relevant product description, ordering process and supplementary information concerning the respective diagnostic service.

5.2 Data Processed in Connection With Diagnostic Services

In connection with diagnostic services, we process only the personal data necessary to order, perform, allocate, evaluate, provide and discuss the respective diagnostic service, or data that you provide to us voluntarily.

This may include, in particular:

  • contact details, particularly name, postal address and email address,
  • order data,
  • sample ID, test-kit ID or other allocation identifiers,
  • health data,
  • laboratory values,
  • genetic data,
  • epigenetic data,
  • microbiome-related data,
  • hormone-related data,
  • metabolic data,
  • information that may be required for evaluation depending on the diagnostic service, particularly date of birth or sex,
  • medical consultation data,
  • digital reports and result documents,
  • other information that you provide to us in connection with the relevant diagnostic service.

Depending on the diagnostic service, additional information is not necessarily collected during the regular checkout process. It may instead be collected through a separate form, a laboratory form, the test-kit process, customer communication or another process intended for the relevant diagnostic service.

5.3 Legal Bases for Processing

Personal data in connection with diagnostic services is processed in accordance with Art. 6(1)(b) GDPR where it is necessary to take steps prior to entering into a contract or to perform the contract concluded with you for the relevant diagnostic service.

Where special categories of personal data are processed, particularly health data, genetic data, epigenetic data or comparable sensitive data, processing additionally takes place only where a legal basis under Art. 9 GDPR applies. This may, in particular, be your explicit consent pursuant to Art. 9(2)(a) GDPR or, where the requirements are met, processing for the purposes of preventive or occupational medicine, medical diagnosis or the provision of health or social care pursuant to Art. 9(2)(h) GDPR.

For genetic diagnostic services, processing is carried out in accordance with the applicable statutory requirements, particularly following any required medical information and consent.

You may withdraw consent at any time with effect for the future. The lawfulness of processing carried out before the withdrawal remains unaffected. Statutory retention, documentation and evidentiary obligations, as well as processing for the establishment, exercise or defence of legal claims, remain unaffected.

5.4 Samples, Test Kits and Transmission to Laboratories

Depending on the diagnostic service, saliva or buccal-swab samples, blood or dried-blood samples or stool samples may be processed. The specific sample type depends on the relevant diagnostic service.

Samples are analysed by the laboratory and diagnostic partners engaged for this purpose. Depending on the diagnostic service, the sample may be transmitted directly to the relevant laboratory or processed through another procedure intended for the relevant test.

Where possible, samples are transmitted to laboratory and diagnostic partners using a sample ID, test-kit ID or another identifier. For certain diagnostic services, particularly epigenetic analyses, the laboratory generally receives only a test-kit ID or comparable pseudonymised identifier. In these cases, allocation to the individual is performed by us.

For other diagnostic services, particularly certain genetic analyses, it may be necessary for the respective laboratory or diagnostic partner to receive personal information, particularly the individual’s name, where this is required to perform, allocate, quality-assure or provide the analysis.

We transmit to laboratory and diagnostic partners only the data required to perform the respective diagnostic service.

5.5 Digital Reports and Provision of Results

Depending on the diagnostic service, we receive raw data, analysis data, evaluations or pre-structured result reports from laboratory and diagnostic partners. We process this data further to create a neotes Report.

The neotes Report is intended to present the results of the respective diagnostic service in a structured form that is understandable to customers. The report may be created using prepared, professionally developed text modules and technical processes. Before being provided to the customer, the report is reviewed by a responsible person.

No decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you takes place as part of report creation.

The report is generally provided digitally, particularly through a download link or another digital delivery method intended for the relevant diagnostic service.

As diagnostic reports may contain sensitive personal data, download links, reports and other result documents should be treated confidentially and not disclosed to unauthorised third parties.

5.6 Medical Support and Discussion of Findings

Certain diagnostic services, particularly genetic analyses, are medically supervised. This may include medical information or a preliminary consultation before the diagnostic service is performed. Once the results are available, a discussion of the findings may also be offered.

As part of medical support, personal data, health data, genetic data, laboratory values, reports and communication or consultation content may be processed where this is necessary for the relevant information, consultation or discussion of findings.

Further information on the processing of personal data in connection with medical consultation, medical information and discussions of findings can be found in the section “Medical Consultation and Medical Support”.

5.7 Disposal of Samples

Samples are disposed of by the relevant laboratory in accordance with the professional, technical and legal requirements applicable there. As a general rule, neotes GmbH does not itself store biological samples.

5.8 Retention Period and Deletion of Diagnostic Data

We retain personal data in connection with diagnostic services only for as long as is necessary to perform, provide, verify and document the respective diagnostic service, or for as long as statutory retention obligations, legitimate evidentiary interests or the establishment, exercise or defence of legal claims prevent deletion.

Where diagnostic data, reports or other result documents are made available through a customer account or digital delivery method, they are retained for the period required to provide and use the relevant service. Once the processing purpose no longer applies, the data will be deleted or its processing restricted, unless statutory retention obligations or legitimate interests prevent complete deletion.

Invoice and order data may be retained independently of this for the periods prescribed by commercial and tax law.

5.9 Research and Internal Scientific Evaluation

We may use analysis data and results from diagnostic services for research purposes, scientific evaluations or the further development of our diagnostic and health-related services.

Such use takes place only in anonymised form. Personal identifying and allocation characteristics are removed so that we can no longer associate the data with you. Anonymised data does not permit conclusions to be drawn about a specific or identifiable natural person.

Personal contact details, names, addresses and directly identifiable reports are not used for research purposes unless a separate legal basis applies.

6) Medical Consultation and Medical Support

6.1 General Information

Certain diagnostic services, particularly genetic diagnostic services, are medically supervised. The medical support serves, in particular, to provide information before the relevant diagnostic service is performed, answer questions and, where intended or requested, discuss the results.

Medical support may be provided by telephone, video call or email. Telephone and video calls are not recorded.

6.2 Medical Information Before Genetic Diagnostic Services

Before a genetic diagnostic service is performed, medical information is provided by the responsible medical professionals. The examination is carried out only after the required information has been provided and the necessary consent has been obtained.

The medical information may cover, in particular, the type and purpose of the examination, its significance and limitations, possible results, incidental findings, the right not to know, use of the sample and data, withdrawal options and other aspects relevant to the respective examination.

The medical information and required consent are provided and documented in accordance with the applicable statutory requirements, particularly the German Genetic Diagnostics Act.

6.3 Discussion of Findings

Once the results are available, a discussion of the findings may be offered. This may cover, in particular, the relevant report, individual findings, interpretation of the results, customer questions and general recommendations or possible next steps.

The discussion of findings serves to explain and contextualise the results. It does not replace emergency care and does not constitute therapy or a diagnosis in the narrower sense unless expressly agreed or legally required in the individual case.

6.4 Data Processed as Part of Medical Support

The following personal data in particular may be processed in connection with medical information, medical support and discussions of findings:

  • name and contact details,
  • information used to identify and allocate the diagnostic service,
  • information about the relevant examination or test,
  • sample ID, test-kit ID or other allocation identifiers,
  • health data,
  • genetic data,
  • epigenetic data,
  • laboratory values,
  • digital reports and result documents,
  • information from information, consent or consultation forms,
  • information relating to incidental findings, where applicable,
  • communication and consultation content,
  • documentation data relating to medical information, consent and discussions of findings.

Processing takes place only to the extent necessary for the relevant medical information, medical support, performance of the diagnostic service, discussion of findings, documentation or compliance with statutory requirements.

6.5 Legal Bases for Processing

Personal data in connection with medical consultation and medical support is processed in accordance with Art. 6(1)(b) GDPR where it is necessary to take steps prior to entering into a contract or to perform the contract concluded with you.

Where special categories of personal data are processed, particularly health data or genetic data, processing takes place only where an additional legal basis under Art. 9 GDPR applies. This may, in particular, be your explicit consent pursuant to Art. 9(2)(a) GDPR or, where applicable, processing for the purposes of preventive medicine, medical diagnosis, the provision of health care or treatment pursuant to Art. 9(2)(h) GDPR.

Where statutory documentation, information or retention obligations apply, processing is additionally carried out pursuant to Art. 6(1)(c) GDPR. Where processing serves documentation, evidence or the establishment, exercise or defence of legal claims, it is additionally carried out pursuant to Art. 6(1)(f) GDPR.

6.6 Medical Professionals Involved and Documentation

Medical information, medical support and discussions of findings are provided by medical professionals engaged for this purpose who work within neotes GmbH. neotes GmbH is the controller responsible for processing personal data in connection with organising, performing and documenting the diagnostic and consultation services it offers.

As part of medical activities, personal data, health data, genetic data, laboratory values, reports and information, consent and consultation content may be processed where this is necessary for the relevant information, consultation, discussion of findings, documentation or compliance with statutory requirements.

Medical records and documentation are maintained and retained in accordance with the applicable statutory and professional requirements. Access to medical content within neotes GmbH is restricted to those persons who require the information to perform their respective duties.

6.7 No Disclosure to Health Insurance Providers, Insurers or Employers

Health data, genetic data, reports and consultation content are not disclosed to health insurance providers, insurers, employers or comparable third parties unless a statutory obligation applies or you have expressly consented to such disclosure.

7) Newsletter, Electronic Notifications and Existing-Customer Advertising

7.1 Subscription to Our Email Newsletter

If you subscribe to our email newsletter, we process the personal data required to send you information about our products, services, offers and health-related content by email.

Your email address is required to receive the newsletter. Further information, particularly your name, language, country or interests, may be provided voluntarily and used for personalisation or to tailor the content of the communication.

As a general rule, we use the double opt-in procedure for newsletter subscriptions. This means that, after registering, you receive an email asking you to confirm your subscription. Your email address is added to the newsletter distribution list only after confirmation.

During registration, the time of registration, confirmation time, IP address, email address and subscription status may be processed. This serves to document your consent and demonstrate that registration was completed properly.

Processing is carried out in accordance with Art. 6(1)(a) GDPR on the basis of your consent. You may withdraw your consent at any time with effect for the future, particularly by using the unsubscribe link in each newsletter email or by contacting us.

7.2 Use of Newsletter and CRM Service Providers

We use external newsletter and CRM service providers to send, manage and technically provide our email communication. These providers process personal data only to the extent necessary for sending, administration, documenting consent, processing unsubscribe requests and technically operating the communication.

Where service providers act on our instructions, processing is carried out on the basis of a data processing agreement pursuant to Art. 28 GDPR.

Where personal data is transferred to countries outside the European Economic Area or recipients in such countries obtain access to personal data, this takes place only in compliance with the applicable data protection requirements. Further information can be found in the section “International Data Transfers”.

7.3 Performance Measurement and Evaluation of Email Communication

Our email communication may contain technical functions that allow us to determine whether an email has been delivered or opened or whether links contained in it have been clicked. This may involve processing technical information, time of access, opening and click information and interactions with the content sent.

Such performance measurement and evaluation takes place only where an appropriate legal basis applies, particularly consent pursuant to Art. 6(1)(a) GDPR and, where required, consent pursuant to Section 25 TDDDG.

You may withdraw consent at any time with effect for the future. Where no relevant consent has been provided, your opening or click behaviour will not be evaluated on a personal basis where such consent is legally required.

7.4 Email Communication With Existing Customers

If you purchase products or services from us and provide your email address, we may, subject to the statutory requirements, send you information by email about our own similar products or services unless you have objected.

Such use takes place only where the legal requirements for advertising to existing customers are met. You may object at any time with effect for the future without incurring costs other than transmission costs at the basic rate. We inform you of your right to object when collecting your email address and in each relevant email.

Processing is carried out in accordance with Art. 6(1)(f) GDPR on the basis of our legitimate interest in advertising our own similar products and services to existing customers. Where consent is required, processing takes place exclusively on the basis of your consent pursuant to Art. 6(1)(a) GDPR.

7.5 Product Availability Notifications

If you register to receive a notification when a currently unavailable product becomes available, we process the personal data required for this purpose, particularly your email address and information about the relevant product.

Processing takes place for the purpose of providing a one-time notification or, where selected by you, repeated notifications concerning the availability of the relevant product. The legal basis is Art. 6(1)(a) GDPR where the notification is based on your consent. You may withdraw consent at any time with effect for the future.

7.6 No Use of Health and Diagnostic Data for Marketing Segmentation

Health data, genetic data, laboratory values, test results and diagnostic reports are not used for advertising or marketing segmentation. We do not target advertising on the basis of individual health or diagnostic results.

This does not affect medical recommendations, medical information or product-related information provided as part of a diagnostic service, consultation or contractual service.

8) Cookies and Comparable Technologies

8.1 General Information

Our website uses cookies and comparable technologies. Cookies are small text files stored on your device. Comparable technologies may include pixels, tags, local-storage technologies or other processes through which information is stored on or read from your device.

Cookies and comparable technologies may be necessary to provide our website and online shop technically. They may also be used to analyse use of our website, personalise content, improve online-shop functionality, evaluate marketing activities or display interest-based advertising.

8.2 Categories of Cookies and Comparable Technologies

We use the following categories of cookies and comparable technologies in particular:

  • Strictly Necessary Cookies
    These cookies are required for our website and online shop to function properly. They enable basic functions such as page navigation, login, use of the shopping cart, completion of the ordering process, storage of your cookie settings and ensuring the security and stability of the website.
  • Personalisation
    These cookies and comparable technologies may be used to store information about your settings or actions and personalise your next visit to our website.
  • Analytics
    These cookies and comparable technologies help us understand how visitors interact with our website. They may be used, in particular, to evaluate website use statistically, identify technical or content-related areas for improvement and make our services more user-friendly.
  • Marketing
    These cookies and comparable technologies may be used by us and our partners to evaluate and optimise marketing activities and display interest-based advertising to you on other websites, platforms or social networks.

8.3 Analytics, Marketing and Tracking Technologies

Our website may use analytics, tag-management, conversion-tracking, remarketing, pixel, shop-analytics and newsletter or CRM-tracking technologies.

These technologies may serve to:

  • statistically evaluate use of our website and online shop,
  • improve the functionality and user-friendliness of our services,
  • measure the effectiveness of advertising activities,
  • evaluate marketing campaigns,
  • display interest-based advertising,
  • evaluate interactions with emails, newsletter content or website content,
  • technically or statistically track shopping-cart, order and product interactions.

Personal evaluation for analytics, marketing or tracking purposes takes place only where a valid legal basis exists, particularly consent.

8.4 Legal Bases

Strictly necessary cookies and comparable technologies are used, where required to provide our website, online shop or expressly requested functions, on the basis of Section 25(2) TDDDG. Where personal data is processed in this context, processing is carried out pursuant to Art. 6(1)(f) GDPR on the basis of our legitimate interest in providing our website and online shop securely, reliably and functionally. Where processing is necessary to perform a contract or take steps prior to entering into a contract, it is additionally carried out pursuant to Art. 6(1)(b) GDPR.

Non-essential cookies and comparable technologies, particularly those used for analytics, personalisation or marketing purposes, are used only on the basis of your consent pursuant to Section 25(1) TDDDG. Where personal data is processed, processing is carried out pursuant to Art. 6(1)(a) GDPR.

You may withdraw or change consent at any time with effect for the future.

8.5 Cookie Consent Tool

We use a cookie consent tool to obtain, manage and document consent. Through this tool, you can decide when visiting our website whether to consent to or reject the use of certain categories of cookies and comparable technologies.

Cookies and comparable technologies requiring consent are generally set or activated only after you have given your consent. Strictly necessary cookies may also be used without consent where required to operate the website or online shop or provide expressly requested functions.

You may change or withdraw your selection at any time with effect for the future. The option for changing your cookie settings is available through the relevant function provided on our website.

8.6 External Providers and International Data Transfers

When cookies and comparable technologies are used, personal data may be transmitted to external providers. Depending on the service, these providers may process data on our behalf or under their own responsibility in accordance with data protection law.

Where personal data is transferred to countries outside the European Economic Area or providers in such countries obtain access to personal data, this takes place only in compliance with the applicable data protection requirements. Further information can be found in the section “International Data Transfers”.

8.7 External Content and Embedded Services

External content or services may be embedded in our website, particularly videos, maps, fonts, security services or other content from external providers. When such content or services are accessed, personal data, particularly technical information such as IP address, browser information and usage data, may be transmitted to the relevant provider.

Where the use of such external content or services is not technically necessary, it takes place only on the basis of your consent. You may withdraw or change consent at any time with effect for the future.

8.8 No Use of Diagnostic Data for Cookie-Based or Advertising Tracking

Health data, genetic data, laboratory values, test results and diagnostic reports are not used for cookie-based advertising tracking or marketing segmentation.

9) Contact, Customer Service and Support

9.1 Contact

If you contact us, for example by email, contact form, telephone, post or another contact channel provided by us, we process the personal data you provide to handle and respond to your enquiry.

This may include, in particular:

  • name,
  • email address,
  • telephone number,
  • postal address,
  • subject,
  • content of your message,
  • order number,
  • information about the relevant product or matter,
  • attachments or documents transmitted by you,
  • time and history of the communication.

Processing is carried out pursuant to Art. 6(1)(b) GDPR where your enquiry relates to performing a contract or taking steps prior to entering into a contract. In all other cases, processing is carried out pursuant to Art. 6(1)(f) GDPR on the basis of our legitimate interest in handling and responding to your enquiry.

9.2 Contact Form and Sensitive Information

You can submit general enquiries through our contact form. Please do not transmit health data, genetic data, laboratory values, diagnostic reports or other particularly sensitive information through the general contact form unless this is strictly necessary for your enquiry.

If you nevertheless provide health data, genetic data or other special categories of personal data as part of an enquiry, we process it only where necessary to handle your matter and where an appropriate legal basis applies. Where necessary, your enquiry may be forwarded internally to the responsible medical, clinical or specialist contact persons.

9.3 Customer Service and Support Systems

We may use external communication, support, CRM, appointment-management and IT service providers to process customer enquiries, support cases, complaints, organisational matters and contract-related communication.

These providers process personal data only to the extent necessary to handle, manage, document and respond to the relevant matter. Where they act on our instructions, processing is carried out on the basis of a data processing agreement pursuant to Art. 28 GDPR.

Within our company, access to your personal data is limited to the departments involved in handling the relevant matter.

9.4 Chat and Live-Chat Functions

Where we offer chat or live-chat functions on our website, we process the data you provide during chat communication to handle and respond to your enquiry. This may include, in particular, contact details, technical connection data, communication content, information about orders or products and the history of the chat communication.

Processing is carried out pursuant to Art. 6(1)(b) GDPR where the chat is used to perform a contract or handle contract-related matters. Otherwise, processing is carried out pursuant to Art. 6(1)(f) GDPR on the basis of our legitimate interest in handling customer enquiries efficiently and in a user-friendly manner.

Where special categories of personal data, particularly health or genetic data, are provided through the chat, they are processed only to the extent necessary to handle the relevant matter and where an appropriate legal basis applies.

9.5 Appointment Scheduling

Where you schedule an appointment through our website or another contact channel, particularly for a consultation, medical information or discussion of findings, we process the personal data required for this purpose. This may include, in particular, your name, contact details, requested appointment time, appointment confirmation, communication data, information about the reason for the appointment and technical information required to conduct the appointment.

We may use external appointment-management and IT service providers to manage appointments. These providers process personal data only to the extent necessary to schedule, manage, remind you of or conduct the relevant appointment.

Processing is carried out pursuant to Art. 6(1)(b) GDPR where appointment scheduling relates to a contractual or pre-contractual service. Otherwise, processing is carried out pursuant to Art. 6(1)(f) GDPR on the basis of our legitimate interest in efficient appointment management.

9.6 Medical or Diagnostic Enquiries

If your enquiry concerns medical or diagnostic matters, particularly questions about diagnostic services, test results, reports or discussions of findings, it may be handled by or with the involvement of medical or specialist contact persons.

Our general customer service team responds primarily to organisational and administrative questions. Medical or diagnostic questions may be forwarded to the responsible medical contact persons or referred to an appropriate consultation or discussion of findings.

9.7 Social-Media Communication

If you contact us through social networks or platforms, we process the personal data you provide there to handle and respond to your enquiry. The relevant platform provider’s privacy terms also apply to its processing of personal data.

Please do not send us health data, genetic data, laboratory values, diagnostic reports or other particularly sensitive information through social networks. For medical, diagnostic or contract-related matters, please use the contact channels provided by us for these purposes.

9.8 Retention Period

We retain personal data from contact, support and communication processes only for as long as is necessary to handle the relevant matter, document the communication, comply with statutory obligations or establish, exercise or defend legal claims.

Where an enquiry relates to a contract, order, diagnostic service or medical consultation, a longer retention period may be required. In this case, the retention period is determined by the applicable statutory retention, documentation or evidentiary periods.

10) Recipients and Service Providers

10.1 General Information

Personal data is disclosed only where this is necessary to fulfil the purposes stated in this Privacy Policy, a statutory obligation applies, you have provided consent or another legal basis under data protection law exists.

Within neotes GmbH, access to personal data is limited to the departments that require it to perform their respective duties.

10.2 Categories of Recipients

Depending on the service used, communication channel or relevant service, personal data may be transmitted or made accessible to the following categories of recipients in particular:

  • e-commerce, hosting, content-delivery, cloud, security, maintenance and IT service providers,
  • technical service providers, system administrators, external developers and agencies,
  • shipping, logistics, fulfilment and returns service providers,
  • payment service providers, banks, credit-card providers and payment-infrastructure providers,
  • laboratory and diagnostic partners,
  • medical professionals, medical contact persons and responsible internal departments,
  • newsletter, CRM, communication, support and appointment-management service providers,
  • analytics, marketing, tag-management, tracking and advertising service providers,
  • tax advisers, accounting service providers and other commercial service providers,
  • lawyers, courts, authorities and other public bodies where required in an individual case or prescribed by law.

Data is transmitted only to the extent necessary for the relevant purpose.

10.3 Laboratory and Diagnostic Partners

We use specialised laboratory and diagnostic partners to perform diagnostic services. Our current partners include, in particular, Age Labs in Oslo, Norway, for epigenetic analyses relating to the bioAge Test; BIOMES for gut-microbiome analyses; Omegametrix for the Omega-3 Test and determination of the HS-Omega-3 Index; Hormonzentrum an der Oper in Munich for hormone-related analyses; and NADMED in Helsinki, Finland, for analyses relating to the NAD Test.

The laboratory or diagnostic partners involved in an individual case are also identified in the relevant product description, ordering or test process, information enclosed with the test kit, laboratory forms or other information concerning the relevant diagnostic service.

We transmit to laboratory and diagnostic partners only the personal data, samples, test-kit IDs, sample IDs, health data, genetic data, epigenetic data, laboratory values and other information required to perform, allocate, quality-assure, evaluate or provide the relevant diagnostic service. Where possible, data is transmitted using a test-kit ID, sample ID or another identifier. For certain diagnostic services, the relevant partner may also need to receive personal information where this is required for performance or allocation.

10.4 Medical Recipients

Where a diagnostic service is medically supervised or medical information, consultation or a discussion of findings is provided, personal data, health data, genetic data, laboratory values, reports and consultation content may be made accessible to the responsible medical contact persons.

Processing takes place only to the extent necessary for the relevant information, consultation, discussion of findings, documentation or legally required medical activity.

10.5 Data Processing on Our Behalf and Recipients Acting as Independent Controllers

Where service providers process personal data on our behalf and in accordance with our instructions, this takes place on the basis of a data processing agreement pursuant to Art. 28 GDPR.

Where recipients independently determine the purposes and means of processing, they process personal data under their own responsibility in accordance with data protection law. This may apply, in particular, to certain payment service providers, banks, authorities, courts or lawyers.

10.6 No Disclosure to Health Insurance Providers, Insurers or Employers

Health data, genetic data, laboratory values, diagnostic reports and consultation content are not disclosed to health insurance providers, insurers, employers or comparable third parties unless a statutory obligation applies or you have expressly consented to such disclosure.

10.7 International Data Transfers

Where personal data is transferred to recipients outside the European Economic Area or recipients in such countries obtain access to personal data, this takes place only in compliance with the applicable data protection requirements. Further information can be found in the section “International Data Transfers”.

10.8 Information About Specific Recipients

Where categories of recipients are specified in this Privacy Policy, you may request further information about the specific recipients or service providers used in an individual case. Please send your request to datenschutz@neotes.care or use the contact details provided in this Privacy Policy.

We will provide the relevant information unless statutory obligations, third-party rights or overriding legitimate interests prevent us from doing so.

11) International Data Transfers

Personal data may also be processed in countries outside the European Union and European Economic Area or by recipients established, operating or able to access data in such countries. This may apply, in particular, when using e-commerce, payment, newsletter, CRM, support, analytics, marketing, IT or other technical service providers.

Such transfers or access take place only where the applicable data protection requirements are met. These may include an adequacy decision by the European Commission pursuant to Art. 45 GDPR, appropriate safeguards pursuant to Art. 46 GDPR, particularly the European Commission’s Standard Contractual Clauses, or another legally recognised transfer mechanism.

For recipients in the United States, a transfer or access may be based on the EU-US Data Privacy Framework where the relevant recipient is certified under that framework. Otherwise, where required, transfers take place on the basis of appropriate safeguards, particularly the European Commission’s Standard Contractual Clauses and, where appropriate, supplementary protective measures.

Where health data, genetic data, epigenetic data, laboratory values, sample information or diagnostic reports are transmitted or made accessible to laboratory or diagnostic partners outside the European Union or European Economic Area as part of individual diagnostic services, this takes place only where necessary to perform, allocate, quality-assure, evaluate or provide the relevant diagnostic service. Where possible, data is transmitted using a test-kit ID, sample ID or another identifier. The laboratory or diagnostic partner used is identified in this Privacy Policy, the relevant product description, ordering or test process, information enclosed with the test kit, laboratory forms or other information concerning the relevant diagnostic service.

Health data, genetic data, laboratory values, test results and diagnostic reports are not transmitted to analytics or marketing service providers in third countries for advertising or marketing-segmentation purposes.

You may request further information about the specific recipients in third countries and the safeguards applicable in each case. Please send your request to datenschutz@neotes.care or use the contact details provided in this Privacy Policy. We will provide the relevant information unless statutory obligations, third-party rights or overriding legitimate interests prevent us from doing so.

12) Retention Period

Unless a more specific retention period is stated in this Privacy Policy, we retain personal data only for as long as is necessary for the relevant processing purposes.

The specific retention period depends, in particular, on the type of data, the relevant processing purpose, the service used, statutory retention and documentation obligations, medical or professional documentation requirements and possible evidentiary or defence interests.

Order, invoice and payment data may be retained for the periods prescribed by commercial and tax law. Data relating to diagnostic services, medical information, consent, reports or discussions of findings is retained where necessary to perform, verify, document or legally safeguard the relevant service.

Once the relevant processing purpose no longer applies and the applicable retention, documentation or evidentiary periods have expired, personal data will be deleted or its processing restricted where complete deletion is temporarily impossible or legally impermissible.

Where personal data is processed on the basis of consent, we generally retain the data until consent is withdrawn unless another legal basis, statutory obligation or overriding legitimate interest justifies further retention.

Where data has been effectively anonymised, it is no longer considered personal data.

13) Your Rights and Options

13.1 Data Subject Rights

Applicable data protection law grants you various rights against us as the controller regarding the processing of your personal data. Where the relevant statutory requirements are met, you have the following rights in particular:

  • the right of access pursuant to Art. 15 GDPR,
  • the right to rectification pursuant to Art. 16 GDPR,
  • the right to erasure pursuant to Art. 17 GDPR,
  • the right to restriction of processing pursuant to Art. 18 GDPR,
  • the right to data portability pursuant to Art. 20 GDPR,
  • the right to withdraw consent pursuant to Art. 7(3) GDPR,
  • the right to object pursuant to Art. 21 GDPR,
  • the right to lodge a complaint with a supervisory authority pursuant to Art. 77 GDPR.

To exercise your rights, you may contact us or our Data Protection Officer at any time. The contact details are provided at the beginning of this Privacy Policy.

13.2 Withdrawal of Consent

If you have consented to the processing of personal data, you may withdraw that consent at any time with effect for the future. The lawfulness of processing carried out on the basis of consent before its withdrawal remains unaffected.

Consent may be withdrawn using the relevant function provided for this purpose, for example through the unsubscribe link in a newsletter email, through the cookie settings or by contacting us.

13.3 Right to Object

Where we process personal data on the basis of Art. 6(1)(f) GDPR, you have the right to object at any time on grounds relating to your particular situation.

Where personal data is processed for direct-marketing purposes, you have the right to object at any time to processing for such marketing. If you object, we will no longer process your personal data for direct-marketing purposes.

13.4 Right to Lodge a Complaint With a Supervisory Authority

If you believe that the processing of your personal data infringes data protection law, you have the right to lodge a complaint with a data protection supervisory authority.

You may contact, in particular, the supervisory authority responsible for your habitual residence, place of work or the place of the alleged infringement.

13.5 Right Not to Know in Genetic Examinations

Where genetic examinations are carried out, additional rights may exist under the applicable statutory requirements. These include, in particular, the right not to receive certain genetic examination results or parts thereof where provided by law.

Further details are explained during the medical information and consent process for the relevant genetic examination.

14) Obligation to Provide Data, Automated Decision-Making and Amendments

14.1 Obligation to Provide Personal Data

As a general rule, you are not obliged to provide us with personal data. However, certain data may be required to use our website, create a customer account, place an order, process a payment, arrange shipping, provide diagnostic services, create digital reports, provide medical information or consultation or process enquiries.

Where certain personal data is required to perform a contract, comply with statutory obligations or provide a service requested by you, the relevant service cannot be provided, or cannot be provided in full, without that data.

This applies, in particular, to contact details, order data, payment and shipping information and, for diagnostic services, the required samples, test-kit or sample identifiers, health data, laboratory values, genetic or epigenetic data and other information required for the relevant analysis.

14.2 Automated Decision-Making and Profiling

No decision based solely on automated processing within the meaning of Art. 22 GDPR that produces legal effects concerning you or similarly significantly affects you takes place.

In connection with diagnostic services, technical processes may be used to structure, evaluate or transfer laboratory, analysis or result data into digital reports. neotes Reports may be created using prepared, professionally developed text modules and technical processes. Before being provided to the customer, the report is reviewed by a responsible person.

Health data, genetic data, laboratory values, test results and diagnostic reports are not used for automated advertising profiles or marketing segmentation.

14.3 Amendments to This Privacy Policy

We reserve the right to amend this Privacy Policy where this becomes necessary due to legal, technical or organisational changes. The version currently published on our website applies.

15) Use of Artificial Intelligence (AI)

15.1 Use of AI for Content Creation

Some content on this website, particularly images and graphics, is created or edited using artificial-intelligence systems.

Last updated: July 2026