Privacy Policy

1) Information on the Collection of Personal Data and Contact Details of the Controller

1.1

This Privacy Policy informs you about how we process personal data when you use our website, our online shop, our digital services, and in connection with products, diagnostic services, reports, and consultation services.

Personal data means all information relating to an identified or identifiable natural person. This includes in particular name, address, email address, order and payment data, usage data, and — depending on the service used — health data, laboratory values, genetic or epigenetic data, and consultation data.

This Privacy Policy applies to the online offers and services for which neotes GmbH is responsible, unless separate privacy notices are provided in individual cases.

1.2

The controller for data processing within the meaning of the General Data Protection Regulation (GDPR) is:

neotes GmbH
Ziegelstraße 7c
40468 Düsseldorf
Germany

Email: cs@neotes.care

The controller for the processing of personal data is the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data.

1.3

You can reach our data protection officer at:

neotes GmbH
– Data Protection Officer –
Ziegelstraße 7c
40468 Düsseldorf
Germany

Email: datenschutz@neotes.care

1.4

For security reasons and to protect the transmission of personal data and other confidential content, such as orders, inquiries, or submitted form data, this website uses SSL or TLS encryption. You can recognize an encrypted connection by the string “https://” and the lock symbol in the address bar of your browser.

2) Data Collection When Visiting Our Website

2.1 Server log files

When you use our website for information purposes only, i.e. if you do not register, place an order, or otherwise transmit information to us, we collect the data that your browser automatically transmits to our website server. This data is processed in so-called server log files and is technically necessary in order to display the website to you and to ensure the stability and security of our online offering.

When you access our website, the following data may in particular be processed:

  • visited website or accessed subpage
  • date and time of access
  • amount of data sent in bytes
  • source/referrer from which you reached the page
  • browser used
  • operating system used
  • IP address used
  • requesting provider

Processing is carried out pursuant to Art. 6(1)(f) GDPR on the basis of our legitimate interest in particular in ensuring the stability, security, and functionality of our website and in detecting and defending against unlawful or abusive use.

As a rule, these data are not merged with other data sources. However, we reserve the right to subsequently review server log files if there are concrete indications of unlawful use or an attack on our technical systems.

Server log files are stored only for the period necessary to ensure the technical operation, stability, and security of our website. Any storage beyond this is carried out only to the extent necessary to clarify or defend against security incidents, to enforce legal claims, or to fulfill legal obligations.

2.2 Technical operation of the website

We use technical service providers for the provision, operation, maintenance, securing, and delivery of our website and online shop. These include in particular providers of e-commerce, hosting, content delivery, security, maintenance, and IT services.

These service providers process personal data only to the extent necessary for the secure and functional operation of our website, our online shop, and our digital services. Where they act on our instructions, processing is carried out on the basis of a data processing agreement pursuant to Art. 28 GDPR.

Processing is carried out pursuant to Art. 6(1)(f) GDPR on the basis of our legitimate interest in the secure, stable, and efficient provision of our services. Where processing is necessary for the execution of orders or the provision of contractually agreed functions, it is additionally carried out pursuant to Art. 6(1)(b) GDPR.

2.3 Cookies

Our website uses cookies and similar technologies. Further information on this, in particular regarding type, scope, purposes, legal bases, and settings options, can be found in the section “Cookies and Similar Technologies” of this Privacy Policy.

3) Data Processing in Connection with Customer Account, Orders, and Contract Fulfillment

3.1 Customer account

You can create a customer account on our website or order as a guest. When setting up and using a customer account, we process the personal data required for this purpose, in particular name, email address, address, login data, order history, and other information stored in the customer account.

Processing is carried out pursuant to Art. 6(1)(b) GDPR to the extent necessary for the setup, provision, and administration of the customer account. To the extent it serves technical administration, security, or abuse-free use, it is carried out pursuant to Art. 6(1)(f) GDPR on the basis of our legitimate interest in a secure and user-friendly customer account function.

You may request deletion of your customer account at any time. After deletion, your data will be erased unless outstanding contracts, statutory retention periods, or legitimate storage interests prevent this.

3.2 Orders and contract fulfillment

When you order products or services via our website, we process the personal data required to receive, process, and fulfill your order. This may in particular include the following data:

  • email address,
  • first and last name,
  • delivery address,
  • billing address, if different,
  • phone number, if provided or required for processing,
  • company details, if provided,
  • ordered products or services,
  • order number,
  • payment method and payment status,
  • shipping and delivery status,
  • customer notes or other information provided in connection with the order.

Processing is carried out pursuant to Art. 6(1)(b) GDPR to the extent necessary for the establishment, performance, or processing of the contractual relationship. Where we are legally obliged to process or retain certain data, processing is additionally carried out pursuant to Art. 6(1)(c) GDPR.

For certain diagnostic services, additional information may be required after the order, which is not collected in the regular checkout process but in a separate process. Depending on the diagnostic service, this may in particular include information required for the execution, assignment, or evaluation of the respective diagnostics. Further information can be found in the section “Diagnostic Services, Samples and Test Results”.

3.3 Shipping, logistics, and fulfillment

For the processing and delivery of your order, we transmit the personal data required for this purpose to shipping, logistics, and fulfillment service providers used by us. This may in particular include name, delivery address, email address, phone number, order number, ordered products, and information on delivery, tracking, and returns processing.

Processing is carried out for the purposes of storage, picking, packing, shipping preparation, handover to shipping service providers, delivery, tracking, and returns processing. The legal basis is Art. 6(1)(b) GDPR to the extent processing is necessary for the execution of your order. Where service providers act on our instructions, processing is carried out on the basis of a data processing agreement pursuant to Art. 28 GDPR.

Health, laboratory, or test results are not transmitted to shipping, logistics, or fulfillment service providers.

3.4 Returns, complaints, cancellations, and contract-related communication

If you send us a return, complaint, cancellation, or other contract-related inquiry, we process the personal data required for this purpose. This may in particular include contact data, order data, delivery data, payment information, information about the affected product or service, and the content of your message.

Processing is carried out pursuant to Art. 6(1)(b) GDPR to the extent necessary to handle your return, complaint, cancellation, or other contract-related inquiry. To the extent processing serves documentation, evidence, or the assertion, exercise, or defense of legal claims, it is additionally carried out pursuant to Art. 6(1)(f) GDPR on the basis of our legitimate interest in proper handling and legal protection.

Where separate return, cancellation, withdrawal, or processing conditions apply to individual products or services, in particular for diagnostic services that have already begun or been fully performed, these remain unaffected.

4) Payment Processing

4.1 General information on payment processing

When you purchase products or services via our website, the personal data required for payment processing are processed. This may in particular include name, billing address, delivery address, email address, order number, invoice amount, selected payment method, payment status, transaction data, and other details required for processing the payment.

Processing is carried out pursuant to Art. 6(1)(b) GDPR to the extent necessary for the execution and processing of your order. Where we are required by law to process or retain certain payment or invoicing data, processing is additionally carried out pursuant to Art. 6(1)(c) GDPR.

4.2 Use of payment service providers

We use external payment service providers to process payments. Depending on the selected payment method, the payment and order data required for this purpose are transmitted to the respective payment service provider or collected and processed directly by them.

The payment methods offered on our website may in particular include credit card payments, PayPal, Klarna, Apple Pay, Google Pay, iDEAL, Bancontact, QPay, as well as payments via the shop and payment infrastructure used by us. Credit card payments may in particular be processed via Visa, Mastercard, or American Express.

The payment service providers process personal data to the extent necessary for processing the payment, payment confirmation, fraud prevention, handling refunds, chargebacks or payment disruptions, and fulfilling their own legal obligations.

Complete payment data, in particular complete credit card or account data, are generally not stored by us but are processed by the respective payment service provider. As a rule, we only receive information from the payment service providers that is necessary for assigning and processing the order, in particular payment status, payment method, payment amount, payment time, and transaction identifier.

The specific processing by the respective payment service provider is additionally governed by the privacy notices of the respective payment service provider.

4.3 Identity, risk, and fraud checks

Depending on the selected payment method, the respective payment service provider may carry out identity, risk, or fraud checks. This may in particular be necessary to ensure secure payment processing, avoid payment defaults, or prevent misuse.

To the extent processing is necessary to carry out the selected payment method, it is carried out pursuant to Art. 6(1)(b) GDPR. To the extent processing serves to prevent payment defaults, fraud, or misuse, it is additionally carried out pursuant to Art. 6(1)(f) GDPR on the basis of the legitimate interest in secure payment processing and the avoidance of bad debts.

To the extent payment service providers independently determine the purposes and means of data processing in this context, processing is carried out under their own data protection responsibility.

4.4 Refunds and payment disruptions

In the event of refunds, chargebacks, failed payments, payment disruptions, or other payment-related inquiries, we process the personal data required for this purpose. This may in particular include order data, payment status, transaction data, invoice data, communication content, and internal processing notes.

Processing is carried out pursuant to Art. 6(1)(b) GDPR to the extent necessary for handling the contractual relationship. To the extent processing serves documentation, evidence, or the assertion, exercise, or defense of legal claims, it is additionally carried out pursuant to Art. 6(1)(f) GDPR.

5) Diagnostic Services, Samples and Test Results

5.1 General

We offer diagnostic services in which, depending on the selected product, biological samples are analyzed, health-related data are evaluated, and digital reports are created. These may in particular include epigenetic analyses, genetic analyses, blood and biomarker analyses, microbiome analyses, hormone analyses, metabolic analyses, and other health-related evaluations.

Our diagnostic services include in particular the bioAge Test, the Omega-3 Test or HS-Omega-3 Index, the gut flora or microbiome test, the NAD test, the hormone test, the DNA methylation efficiency test, the DNA Detox test, the ASS-100 genetic test, the metabolome test, the longevity gene test, the skin DNA test, and the hormone DNA test.

The specific diagnostic service, the type of sample, the scope of the analysis, and the information required for this purpose are set out in the respective product description, the ordering process, and the supplementary information on the respective diagnostic service.

5.2 Data processed in connection with diagnostic services

In connection with diagnostic services, we process only those personal data that are necessary for the ordering, execution, assignment, evaluation, provision, and discussion of the respective diagnostic service, or that you voluntarily provide to us.

This may in particular include the following data:

  • contact data, in particular name, address, and email address,
  • order data,
  • sample ID, test kit ID, or other assignment identifiers,
  • health data,
  • laboratory values,
  • genetic data,
  • epigenetic data,
  • microbiome-related data,
  • hormone-related data,
  • metabolic data,
  • information that may be required for evaluation depending on the diagnostic service, in particular date of birth or gender,
  • medical consultation data,
  • digital reports and result documents,
  • other information that you share with us in connection with the respective diagnostic service.

Depending on the diagnostic service, additional information is not necessarily collected in the regular checkout process, but possibly in a separate form, via a laboratory form, as part of the test kit process, in customer communication, or through any other process intended for the respective diagnostic service.

5.3 Legal bases for processing

The processing of personal data in connection with diagnostic services is carried out pursuant to Art. 6(1)(b) GDPR to the extent necessary for the performance of pre-contractual measures or for the fulfillment of the contract concluded with you for the respective diagnostic service.

To the extent special categories of personal data are processed, in particular health data, genetic data, epigenetic data, or comparable sensitive data, processing is additionally carried out only if there is a legal basis under Art. 9 GDPR. This may in particular be your explicit consent pursuant to Art. 9(2)(a) GDPR or, where the conditions are met, processing for the purposes of preventive or occupational medicine, medical diagnosis, or the provision of health or social care pursuant to Art. 9(2)(h) GDPR.

For genetic diagnostic services, processing is carried out in accordance with the applicable legal requirements, in particular after the required medical explanation and consent.

You may withdraw any consent given at any time with effect for the future. The lawfulness of processing carried out until withdrawal remains unaffected. Statutory retention, documentation, and evidence obligations as well as processing for the assertion, exercise, or defense of legal claims remain unaffected.

5.4 Samples, test kits, and laboratory transmission

Depending on the diagnostic service, saliva or oral mucosa samples, blood or dried blood samples, or stool samples may be processed. The specific type of sample depends on the respective diagnostic service.

The samples are analyzed by laboratory and diagnostic partners engaged for this purpose. Depending on the diagnostic service, the sample may be transmitted directly to the respective laboratory or processed in another procedure intended for the respective test.

Where possible, transmission to laboratory and diagnostic partners takes place using a sample ID, test kit ID, or other identifier. For certain diagnostic services, in particular epigenetic analyses, the laboratory generally receives only a test kit ID or a comparable pseudonymized identifier. Assignment to the individual is carried out by us in such cases.

For other diagnostic services, in particular certain genetic analyses, it may be necessary for the respective laboratory or diagnostic partner to also receive personal details, in particular the name, insofar as this is required for the execution, assignment, quality assurance, or provision of the analysis.

We transmit only those data to laboratory and diagnostic partners that are required for the performance of the respective diagnostic service.

5.5 Digital reports and provision of results

Depending on the diagnostic service, we receive raw data, analysis data, evaluations, or already structured result reports from laboratory and diagnostic partners. We further process these data to create a neotes report.

The neotes report is intended to present the results of the respective diagnostic service in a structured form that is understandable to customers. The report may be created using prepared, professionally developed text modules and technical processes. Before being provided to the customer, the report is reviewed by a responsible person.

No exclusively automated decision that produces legal effects concerning you or similarly significantly affects you takes place in the course of report creation.

The report is generally provided digitally, in particular via a download link provided or through another digital delivery method intended for the respective diagnostic service.

As diagnostic reports may contain sensitive personal data, download links, reports, and other result documents should be treated confidentially and not passed on to third parties without authorization.

5.6 Medical supervision and result discussion

Certain diagnostic services, in particular genetic analyses, are medically supervised. This may include medical explanation or a preliminary consultation before the diagnostics are carried out. Once the results are available, a result discussion may also be offered.

As part of the medical supervision, personal data, health data, genetic data, laboratory values, reports, and communication and consultation content may be processed to the extent necessary for the respective explanation, consultation, or result discussion.

Further information on the processing of personal data in connection with medical consultation, medical explanation, and result discussion can be found in the section “Medical Consultation and Medical Supervision”.

5.7 Sample disposal

The disposal of samples is carried out by the respective laboratory in accordance with the professional, technical, and legal requirements applicable there. neotes GmbH does not generally store biological samples itself.

5.8 Retention period and deletion of diagnostic data

We store personal data in connection with diagnostic services only for as long as necessary for the execution, provision, traceability, and documentation of the respective diagnostic service or where statutory retention obligations, legitimate evidentiary interests, or the assertion, exercise, or defense of legal claims prevent deletion.

Where diagnostic data, reports, or other result documents are made available in a customer account or via a digital delivery path, storage takes place for the period necessary to provide and use the respective service. Once the purpose of processing no longer applies, the data are deleted or their processing is restricted, unless statutory retention obligations or legitimate interests prevent complete deletion.

Invoice and order data may, irrespective of the above, be stored for the statutory periods due to commercial and tax law retention obligations.

5.9 Research and internal scientific evaluation

We may use analysis data and results from diagnostic services for research purposes, scientific evaluations, or to further develop our diagnostic and health-related offerings.

Such use takes place only in anonymized form. In doing so, personal identifying and assignment features are removed so that assignment to your person is no longer possible for us. Anonymized data do not allow any conclusions to be drawn about a specific or identifiable natural person.

Personal contact data, names, addresses, or directly personal reports are not used for research purposes unless there is a separate legal basis for this.

6) Medical Consultation and Medical Supervision

6.1 General

Certain diagnostic services, in particular genetic diagnostic services, are medically supervised. The medical supervision serves in particular to provide explanation before the respective diagnostic service is carried out, answer questions, and, where предусмотрено or desired, discuss the results.

The medical supervision may take place in particular by telephone, video call, or email. Telephone calls or video calls are not recorded.

6.2 Medical explanation before genetic diagnostic services

For genetic diagnostic services, medical explanation is provided by responsible medical professionals before the test is carried out. The test is only carried out once the required explanation has been provided and the necessary consents are in place.

As part of the medical explanation, in particular the nature and purpose of the test, its significance and limitations, possible results, possible incidental findings, the right not to know, the use of the sample and data, withdrawal options, and other aspects relevant to the respective test may be discussed.

The implementation and documentation of the medical explanation and the required consents are carried out in accordance with the applicable legal requirements, in particular the Genetic Diagnostics Act.

6.3 Result discussion

Once the results are available, a result discussion may be offered. As part of the result discussion, in particular the respective report, individual findings, interpretation of the results, customer questions, as well as general recommendations or possible next steps may be discussed.

The result discussion serves to explain and contextualize the results. It does not replace emergency care and does not constitute therapy or diagnosis in the strict sense, unless expressly agreed otherwise in individual cases or provided for by law.

6.4 Data processed in the context of medical supervision

As part of medical explanation, medical supervision, and result discussion, the following personal data may in particular be processed:

  • name and contact data,
  • information for identifying and assigning the diagnostic service,
  • information about the respective examination or test,
  • sample ID, test kit ID, or other assignment identifiers,
  • health data,
  • genetic data,
  • epigenetic data,
  • laboratory values,
  • digital reports and result documents,
  • information from explanation, consent, or consultation forms,
  • information about incidental findings, where applicable,
  • communication and consultation content,
  • documentation data relating to medical explanation, consent, and result discussion.

Processing takes place only to the extent necessary for the respective medical explanation, medical supervision, performance of the diagnostic service, result discussion, documentation, or fulfillment of legal requirements.

6.5 Legal bases for processing

The processing of personal data in connection with medical consultation and medical supervision is carried out pursuant to Art. 6(1)(b) GDPR to the extent necessary for the performance of pre-contractual measures or for the fulfillment of the contract concluded with you.

To the extent special categories of personal data are processed, in particular health data or genetic data, processing is carried out only if there is additionally a legal basis under Art. 9 GDPR. This may in particular be your explicit consent pursuant to Art. 9(2)(a) GDPR or, where applicable, processing for the purposes of preventive medicine, medical diagnosis, care, or treatment in the health sector pursuant to Art. 9(2)(h) GDPR.

Where statutory documentation, explanation, or retention obligations exist, processing is additionally carried out pursuant to Art. 6(1)(c) GDPR. To the extent processing serves documentation, evidence, or the assertion, exercise, or defense of legal claims, it is also carried out pursuant to Art. 6(1)(f) GDPR.

6.6 Involved medical professionals and documentation

Medical explanation, medical supervision, and result discussion are carried out by medical professionals engaged for this purpose who work within neotes GmbH. neotes GmbH is the controller for the processing of personal data in connection with the organization, execution, and documentation of the diagnostic and consultation services it offers.

In the context of medical activity, personal data, health data, genetic data, laboratory values, reports, and explanation, consent, and consultation content may be processed to the extent necessary for the respective explanation, consultation, result discussion, documentation, or fulfillment of legal requirements.

Medical records and documentation are maintained and retained in accordance with the applicable legal and professional regulations. Access to medical or healthcare content within neotes GmbH is restricted to those persons who require this information to perform their respective tasks.

6.7 No disclosure to health insurers, insurance companies, or employers

Health data, genetic data, reports, or consultation content are not disclosed to health insurers, insurance companies, employers, or comparable third parties unless there is a legal obligation or you have expressly consented to such disclosure.

7) Newsletter, Electronic Notifications, and Existing Customer Advertising

7.1 Subscription to our email newsletter

If you subscribe to our email newsletter, we process the personal data required for this purpose in order to send you information about our products, services, offers, and health-related content by email.

The mandatory information for sending the newsletter is your email address. Additional information, such as in particular name, language, country, or interests, may be provided voluntarily and used for personal address or to tailor the content of the communication.

For newsletter registration, we generally use the so-called double opt-in procedure. This means that after registration we send you an email asking you to confirm your registration. Only after this confirmation will your email address be added to the newsletter mailing list.

As part of the registration process, in particular the time of registration, time of confirmation, IP address, email address, and the respective registration status may be processed. This processing serves to document your consent and to prove proper registration.

Processing is carried out pursuant to Art. 6(1)(a) GDPR on the basis of your consent. You may withdraw your consent at any time with effect for the future, in particular via the unsubscribe link in each newsletter email or by sending us a message.

7.2 Use of newsletter and CRM service providers

We use external newsletter and CRM service providers for the sending, management, and technical provision of our email communications. These service providers process personal data only to the extent necessary for sending, administration, documentation of consent, handling unsubscribes, and the technical operation of the communication.

Where service providers act on our instructions, processing is carried out on the basis of a data processing agreement pursuant to Art. 28 GDPR.

To the extent personal data are transmitted to countries outside the European Economic Area or recipients in such countries are granted access to personal data, this only takes place in compliance with the applicable data protection requirements. Further information can be found in the section “Data Transfers to Third Countries”.

7.3 Performance measurement and evaluation of email communication

Our email communications may contain technical functions that make it possible to determine whether an email has been delivered, opened, or whether links contained therein have been clicked. In this context, in particular technical information, time of access, open and click information, and interactions with the content sent may be processed.

Such performance measurement and evaluation takes place only where there is an appropriate legal basis, in particular consent pursuant to Art. 6(1)(a) GDPR and, where required, consent pursuant to Section 25 TDDDG.

You may withdraw any consent given at any time with effect for the future. If no corresponding consent exists, no personal evaluation of your open or click behavior takes place, to the extent such consent is legally required.

7.4 Email communication with existing customers

If you purchase products or services from us and provide us with your email address in the process, we may send you information about our own similar products or services by email under the statutory conditions, provided you have not objected to this.

Such use takes place only where the statutory requirements for advertising to existing customers are met. You may object to the use of your email address for this purpose at any time with effect for the future without incurring costs other than transmission costs according to the basic tariffs. We will inform you of the right to object when the email address is collected and in each corresponding email.

Processing is carried out pursuant to Art. 6(1)(f) GDPR on the basis of our legitimate interest in addressing existing customers with advertising for our own similar products and services. Where consent is required, processing is carried out exclusively on the basis of your consent pursuant to Art. 6(1)(a) GDPR.

7.5 Product availability notifications

If you sign up to be notified when a currently unavailable product becomes available, we process the personal data required for this purpose, in particular your email address and information about the respective product.

Processing is carried out for the purpose of one-time or, if selected by you, repeated notification of the availability of the respective product. The legal basis is Art. 6(1)(a) GDPR, insofar as the notification is based on your consent. You may withdraw any consent given at any time with effect for the future.

7.6 No use of health and diagnostic data for marketing segmentation

Health data, genetic data, laboratory values, test results, or diagnostic reports are not used for advertising marketing segmentation. No advertising outreach is based on individual health or diagnostic results.

This does not affect medical recommendations, healthcare information, or product-related information provided in the context of a diagnostic service, consultation, or contractual service provision.

8) Cookies and Similar Technologies

8.1 General

Our website uses cookies and similar technologies. Cookies are small text files stored on your device. Similar technologies may in particular include pixels, tags, local storage technologies, or other methods by which information is stored on or read from your device.

Cookies and similar technologies may be necessary to technically provide our website and online shop. In addition, they may be used to analyze the use of our website, personalize content, improve the functionality of our online shop, evaluate marketing measures, or display interest-based advertising.

8.2 Categories of cookies and similar technologies

We use in particular the following categories of cookies and similar technologies:

  • Technically necessary cookies
    These cookies are required for our website and online shop to function properly. They enable basic functions such as page navigation, login, use of the shopping cart, completion of the ordering process, saving your cookie settings, and ensuring the security and stability of the website.
  • Personalization
    These cookies and similar technologies may be used to store information about your settings or actions and to personalize your next visit to our website.
  • Analytics
    These cookies and similar technologies help us understand how visitors interact with our website. They may in particular be used to statistically evaluate website usage, identify technical or content-related improvement opportunities, and make our offering more user-friendly.
  • Marketing
    These cookies and similar technologies may be used by us and our partners to evaluate and optimize marketing measures and to display interest-based advertising to you on other websites, platforms, or social networks.

8.3 Analysis, marketing, and tracking technologies

Our website may in particular use analysis, tag management, conversion tracking, remarketing, pixel, shop analytics, and newsletter or CRM tracking technologies.

These technologies may serve to

  • statistically evaluate the use of our website and online shop,
  • improve the functionality and user-friendliness of our services,
  • measure the effectiveness of advertising measures,
  • evaluate marketing campaigns,
  • display interest-based advertising,
  • evaluate interactions with emails, newsletter content, or website content,
  • technically or statistically track shopping cart, order, and product interactions.

Personalized evaluation for analysis, marketing, or tracking purposes takes place only where there is a valid legal basis, in particular consent.

8.4 Legal bases

The use of technically necessary cookies and similar technologies, to the extent these are necessary for the provision of our website, our online shop, or expressly requested functions, is based on Section 25(2) TDDDG. To the extent personal data are processed in this context, processing is carried out pursuant to Art. 6(1)(f) GDPR on the basis of our legitimate interest in the secure, stable, and functional provision of our website and online shop. Where processing is necessary for the performance of a contract or pre-contractual measures, it is additionally carried out pursuant to Art. 6(1)(b) GDPR.

The use of non-technically necessary cookies and similar technologies, in particular for analysis, personalization, or marketing purposes, takes place only on the basis of your consent pursuant to Section 25(1) TDDDG. To the extent personal data are processed in this context, processing is carried out pursuant to Art. 6(1)(a) GDPR.

You may withdraw or change any consent given at any time with effect for the future.

8.5 Cookie consent tool

We use a cookie consent tool to obtain, manage, and document consents. Through this tool, when visiting our website you can decide whether you wish to consent to the use of certain categories of cookies and similar technologies or reject them.

Cookies and similar technologies requiring consent are generally set or activated only after you have given your consent. Technically necessary cookies may also be used without consent to the extent they are required for the operation of the website, the online shop, or the provision of expressly requested functions.

You may change or withdraw your selection at any time with effect for the future. The option to change your cookie settings can be found via the function provided on our website for this purpose.

8.6 External providers and third-country transfers

When cookies and similar technologies are used, personal data may be transmitted to external providers. Depending on the service, these providers may process the data on our behalf or under their own data protection responsibility.

To the extent personal data are transferred to countries outside the European Economic Area or providers in such countries gain access to personal data, this only takes place in compliance with the applicable data protection requirements. Further information can be found in the section “Data Transfers to Third Countries”.

8.7 External content and embedded services

External content or services may be embedded on our website, in particular videos, maps, fonts, security services, or other external content. When such content or services are accessed, personal data, in particular technical information such as IP address, browser information, and usage data, may be transmitted to the respective provider.

To the extent the use of such external content or services is not technically necessary, it takes place only on the basis of your consent. You may withdraw or change any consent given at any time with effect for the future.

8.8 No use of diagnostic data for cookie or advertising tracking

Health data, genetic data, laboratory values, test results, or diagnostic reports are not used for cookie-based advertising tracking or advertising marketing segmentation.

9) Contact, Customer Service, and Support

9.1 Contact

If you contact us, for example by email, contact form, telephone, post, or via other contact channels provided by us, we process the personal data you provide to handle and respond to your request.

This may in particular include the following data:

  • name,
  • email address,
  • phone number,
  • address,
  • subject,
  • content of your message,
  • order number,
  • information about the affected product or concern,
  • attachments or documents sent by you,
  • time and course of the communication.

Processing is carried out pursuant to Art. 6(1)(b) GDPR to the extent your inquiry is related to the performance of a contract or pre-contractual measures. In all other cases, processing is carried out pursuant to Art. 6(1)(f) GDPR on the basis of our legitimate interest in handling and responding to your inquiry.

9.2 Contact form and sensitive information

Through our contact form you can send us general inquiries. Please do not submit health data, genetic data, laboratory values, diagnostic reports, or other particularly sensitive information via the general contact form unless this is absolutely necessary for your request.

If you nevertheless communicate health data, genetic data, or other special categories of personal data to us in the context of an inquiry, we process them only to the extent necessary to handle your request and where an appropriate legal basis exists. If necessary, your inquiry may be forwarded internally to responsible medical or other competent contacts.

9.3 Customer service and support systems

To handle customer inquiries, support cases, complaints, organizational matters, and contract-related communication, we may use external communication, support, CRM, appointment management, and IT service providers.

These service providers process personal data only to the extent necessary to handle, manage, document, and respond to the respective concern. Where service providers act on our instructions, processing is carried out on the basis of a data processing agreement pursuant to Art. 28 GDPR.

Within our company, only those departments involved in handling the respective concern have access to your personal data.

9.4 Chat and live chat functions

To the extent we offer chat or live chat functions on our website, we process the data you provide in the course of the chat communication to handle and respond to your request. This may in particular include contact data, technical connection data, communication content, information about orders or products, and the course of the chat communication.

Processing is carried out pursuant to Art. 6(1)(b) GDPR to the extent the chat is used for the performance of a contract or the handling of contract-related matters. Otherwise, processing is carried out pursuant to Art. 6(1)(f) GDPR on the basis of our legitimate interest in efficient and user-friendly handling of customer inquiries.

If special categories of personal data, in particular health data or genetic data, are communicated via the chat, processing takes place only to the extent necessary to handle the respective matter and where an appropriate legal basis exists.

9.5 Appointment scheduling

To the extent you schedule an appointment via our website or other contact channels, in particular for a consultation, explanation, or result discussion, we process the personal data required for this purpose. This may in particular include name, contact details, appointment request, appointment confirmation, communication data, information about the reason for the appointment, and technical information required to carry out the appointment.

We may use external appointment management and IT service providers for appointment administration. These process personal data only to the extent necessary for scheduling, managing, reminding, or carrying out the respective appointment.

Processing is carried out pursuant to Art. 6(1)(b) GDPR to the extent the appointment is connected with a contractual or pre-contractual service. Otherwise, processing is carried out pursuant to Art. 6(1)(f) GDPR on the basis of our legitimate interest in efficient appointment management.

9.6 Medical or diagnostic inquiries

If your inquiry concerns medical or diagnostic content, in particular questions about diagnostic services, test results, reports, or result discussions, it may be handled by or with the involvement of medical professionals or other competent contacts.

Our general customer service primarily answers organizational and administrative questions. Medical or diagnostic questions may be forwarded to responsible medical contacts or referred to a consultation or result discussion provided for this purpose.

9.7 Social media communication

If you contact us via social networks or platforms, we process the personal data you provide there to handle and respond to your inquiry. The data protection provisions of the respective platform provider apply additionally to the processing of personal data by that provider.

Please do not send us health data, genetic data, laboratory values, diagnostic reports, or other particularly sensitive information via social networks. For medical, diagnostic, or contract-related matters, please use the contact channels we provide for this purpose.

9.8 Retention period

We store personal data from contact, support, and communication processes only for as long as necessary to handle the respective matter, document the communication, comply with legal obligations, or assert, exercise, or defend legal claims.

Where an inquiry is connected with a contract, an order, a diagnostic service, or a medical consultation, longer storage may be necessary. In such cases, the retention period is determined by the applicable statutory retention, documentation, or evidence periods.

10) Recipients and Service Providers

10.1 General

Personal data are disclosed only to the extent necessary to fulfill the purposes stated in this Privacy Policy, a legal obligation exists, you have given your consent, or another legal basis under data protection law applies.

Within neotes GmbH, only those departments that need the personal data to perform their respective tasks have access to it.

10.2 Categories of recipients

Depending on the service used, communication channel, or service provided, personal data may in particular be transmitted to or made available to the following categories of recipients:

  • e-commerce, hosting, content delivery, cloud, security, maintenance, and IT service providers,
  • technical service providers, system administrators, external developers, and agencies,
  • shipping, logistics, fulfillment, and returns service providers,
  • payment service providers, banks, credit card providers, and payment infrastructure providers,
  • laboratory and diagnostic partners,
  • medical professionals, medical contacts, and competent internal departments,
  • newsletter, CRM, communication, support, and appointment management service providers,
  • analysis, marketing, tag management, tracking, and advertising service providers,
  • tax advisors, accounting service providers, and other commercial service providers,
  • lawyers, courts, authorities, or other public bodies, to the extent necessary in individual cases or required by law.

Transmission is carried out only to the extent necessary for the respective purpose.

10.3 Laboratory and diagnostic partners

For the performance of diagnostic services, we use specialized laboratory and diagnostic partners. Our current partners include in particular Age Labs, Oslo, Norway, for epigenetic analyses in connection with the bioAge Test, BIOMES for gut flora and microbiome analyses, Omegametrix for the Omega-3 Test or determination of the HS-Omega-3 Index, the Hormonzentrum an der Oper in Munich for hormone-related analyses, and NADMED, Helsinki, Finland, for analyses in connection with the NAD test.

Which laboratory or diagnostic partners are involved in a given case also follows from the respective product description, the ordering or test process, the information enclosed with the test kit, laboratory forms, or other notices relating to the respective diagnostic service.

We transmit to laboratory and diagnostic partners only those personal data, samples, test kit IDs, sample IDs, health data, genetic data, epigenetic data, laboratory values, or other information that are required for the performance, assignment, quality assurance, evaluation, or provision of the respective diagnostic service. Where possible, transmission takes place using a test kit ID, sample ID, or other identifier. For certain diagnostic services, it may be necessary for the respective partner to also receive personal details where this is required for performance or assignment.

10.4 Medical and healthcare recipients

Where a diagnostic service is medically supervised or medical explanation, consultation, or result discussion takes place, personal data, health data, genetic data, laboratory values, reports, and consultation content may be made available to the responsible medical or healthcare contacts.

Processing takes place only to the extent necessary for the respective explanation, consultation, result discussion, documentation, or legally required medical activity.

10.5 Data processing on behalf and own responsibility of recipients

Where service providers process personal data on our behalf and according to our instructions, this is done on the basis of a data processing agreement pursuant to Art. 28 GDPR.

Where recipients independently determine the purposes and means of processing, they process personal data under their own data protection responsibility. This may in particular apply to certain payment service providers, banks, authorities, courts, or lawyers.

10.6 No disclosure to health insurers, insurance companies, or employers

Health data, genetic data, laboratory values, diagnostic reports, or consultation content are not disclosed to health insurers, insurance companies, employers, or comparable third parties unless there is a legal obligation or you have expressly consented to such disclosure.

10.7 Data transfers to third countries

To the extent personal data are transferred to recipients outside the European Economic Area or recipients in such countries gain access to personal data, this only takes place in compliance with the applicable data protection requirements. Further information can be found in the section “Data Transfers to Third Countries”.

10.8 Information on specific recipients

Where recipient categories are named in this Privacy Policy, you may request further information from us about the recipients or service providers used in individual cases. Please direct your request to datenschutz@neotes.care or to the contact details stated in this Privacy Policy.

We will provide you with the relevant information unless legal obligations, the rights of third parties, or overriding legitimate interests prevent this.

11) Data Transfers to Third Countries

Personal data may also be processed in countries outside the European Union and the European Economic Area or by recipients located, operating, or having access in such countries. This may in particular be the case when using e-commerce, payment, newsletter, CRM, support, analysis, marketing, IT, or other technical service providers.

Such transfer or access takes place only where the data protection requirements are met. These include in particular an adequacy decision by the European Commission pursuant to Art. 45 GDPR, appropriate safeguards pursuant to Art. 46 GDPR, in particular the European Commission’s Standard Contractual Clauses, or another legally provided basis for transfer.

For recipients in the USA, transfer or access may in particular take place on the basis of the EU-US Data Privacy Framework, provided the respective recipient is certified for it. Otherwise, transfer takes place, where necessary, on the basis of appropriate safeguards, in particular the European Commission’s Standard Contractual Clauses and, where applicable, additional protective measures.

To the extent health data, genetic data, epigenetic data, laboratory values, sample information, or diagnostic reports are transferred to or accessible by laboratory or diagnostic partners outside the European Union or the European Economic Area in the course of individual diagnostic services, this takes place only to the extent necessary for the performance, assignment, quality assurance, evaluation, or provision of the respective diagnostic service. Where possible, transmission takes place using a test kit ID, sample ID, or other identifier. The laboratory or diagnostic partner used in each case is set out in this Privacy Policy, the respective product description, the ordering or test process, the information enclosed with the test kit, laboratory forms, or other notices relating to the respective diagnostic service.

Health data, genetic data, laboratory values, test results, or diagnostic reports are not transferred to analysis or marketing service providers in third countries for advertising or marketing segmentation purposes.

You may request further information from us about the recipients in third countries used in individual cases and the respective safeguards applicable. Please direct your request to datenschutz@neotes.care or to the contact details stated in this Privacy Policy. We will provide you with the relevant information unless legal obligations, the rights of third parties, or overriding legitimate interests prevent this.

12) Retention Period

Unless a more specific retention period is stated in this Privacy Policy, we store personal data only for as long as necessary for the respective processing purposes.

The specific retention period depends in particular on the type of data, the respective processing purpose, the service used, statutory retention and documentation obligations, medical or professional documentation requirements, and possible evidentiary and defense interests.

Order, invoice, and payment data may be stored for the statutory periods due to commercial and tax law requirements. Data in connection with diagnostic services, medical explanation, consents, reports, or result discussions are stored to the extent necessary for the performance, traceability, documentation, or legal protection of the respective service.

After the respective processing purpose no longer applies and the relevant retention, documentation, or evidence periods have expired, personal data are deleted or their processing is restricted, unless complete deletion is temporarily impossible or not legally permitted.

Where personal data are processed on the basis of consent, we generally store this data until the consent is withdrawn, unless another legal basis, legal obligation, or overriding legitimate interests justify further storage.

Where data have been effectively anonymized, they are no longer considered personal data.

13) Your Rights and Options

13.1 Rights of the data subject

The applicable data protection law grants you various rights vis-à-vis us as controller regarding the processing of your personal data. Where the respective statutory requirements are met, you have in particular the following rights:

  • right of access pursuant to Art. 15 GDPR,
  • right to rectification pursuant to Art. 16 GDPR,
  • right to erasure pursuant to Art. 17 GDPR,
  • right to restriction of processing pursuant to Art. 18 GDPR,
  • right to data portability pursuant to Art. 20 GDPR,
  • right to withdraw consent given pursuant to Art. 7(3) GDPR,
  • right to object pursuant to Art. 21 GDPR,
  • right to lodge a complaint with a supervisory authority pursuant to Art. 77 GDPR.

To exercise your rights, you may contact us or our data protection officer at any time. The contact details can be found at the beginning of this Privacy Policy.

13.2 Withdrawal of consent

If you have given us consent to process personal data, you may withdraw this consent at any time with effect for the future. The lawfulness of processing carried out on the basis of consent up to the time of withdrawal remains unaffected.

The withdrawal may in particular be made via the function provided for this purpose, for example via the unsubscribe link in a newsletter email, via the cookie settings, or by sending us a message.

13.3 Right to object

Where we process personal data on the basis of Art. 6(1)(f) GDPR, you have the right to object at any time to such processing on grounds relating to your particular situation.

Where personal data are processed for direct advertising, you have the right to object at any time to the processing for the purpose of such advertising. In the event of your objection, we will no longer process your personal data for the purposes of direct advertising.

13.4 Right to lodge a complaint with a supervisory authority

If you believe that the processing of your personal data infringes data protection law, you have the right to lodge a complaint with a data protection supervisory authority.

You may in particular contact the supervisory authority in the Member State of your habitual residence, place of work, or the place of the alleged infringement.

13.5 Right not to know in genetic testing

Where genetic tests are carried out, special rights may additionally exist under the applicable legal requirements. This includes in particular the right not to be informed of certain genetic test results or parts thereof, to the extent provided for by law.

Details on this are explained in the context of the medical explanation and consent for the respective genetic test.

14) Obligation to Provide Data, Automated Decision-Making, and Changes

14.1 Obligation to provide personal data

You are generally not obliged to provide us with personal data. However, the provision of certain data may be necessary for the use of our website, the setup of a customer account, the execution of an order, payment processing, shipping, the provision of diagnostic services, the creation of digital reports, medical explanation or consultation, and the handling of inquiries.

To the extent certain personal data are necessary for the performance of a contract, compliance with legal obligations, or the provision of a service requested by you, the respective service cannot be provided without this data or cannot be provided in full.

This applies in particular to contact data, order data, payment and shipping information, and, in the case of diagnostic services, the respective required samples, test kit or sample identifiers, health data, laboratory values, genetic or epigenetic data, and other information required for the respective analysis.

14.2 Automated decision-making and profiling

No exclusively automated decision-making within the meaning of Art. 22 GDPR that produces legal effects concerning you or similarly significantly affects you takes place.

In connection with diagnostic services, technical processes may be used to structure, evaluate, or convert laboratory, analysis, or result data into digital reports. The creation of neotes reports may take place using prepared, professionally developed text modules and technical processes. Before being provided to the customer, the report is reviewed by a responsible person.

Health data, genetic data, laboratory values, test results, or diagnostic reports are not used for automated advertising profiling or marketing segmentation.

14.3 Changes to this Privacy Policy

We reserve the right to adapt this Privacy Policy if this becomes necessary due to legal, technical, or organizational changes. The current version published on our website applies in each case.

15) Use of Artificial Intelligence (AI)

15.1 Use of AI for content creation

Some content on this website (in particular images and graphics) is created or edited using artificial intelligence systems.

As of: July 2026