Legal

Privacy Policy

1. Who is responsible for your data?

The controller for processing on this website is:

ADA Healthcare GmbH
Hangstraße 8
33659 Bielefeld
Germany

The controller is the legal entity that determines the purposes and means of processing personal data on this website.

2. General information

Personal data is any information relating to an identified or identifiable person. We process personal data only where a legal basis permits it and only for the purposes described below.

Depending on the processing activity, the legal basis is your consent (Article 6(1)(a) GDPR), steps taken at your request before entering into a contract or the performance of a contract (Article 6(1)(b) GDPR), compliance with a legal obligation (Article 6(1)(c) GDPR), or our legitimate interests (Article 6(1)(f) GDPR). Where a service stores information on, or accesses information from, your device, Section 25 TDDDG also applies.

We keep personal data only for as long as the relevant purpose continues, a legal retention duty applies, or legal claims may need to be established, exercised or defended. When none of those grounds remains, the data is deleted or anonymised. Provider-specific periods are described below where they are determined by the service.

3. Website delivery and hosting

Vercel

This website and its form endpoints are hosted by Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, United States. When you request a page or an API endpoint, Vercel processes technical request data such as the IP address, requested URL and path, date and time, HTTP headers, referrer, browser or user-agent information, response status and request identifiers. This is necessary to deliver the website, maintain its security and availability, and diagnose errors.

We rely on Article 6(1)(f) GDPR. Our legitimate interests are the secure, reliable and efficient operation of this website. Vercel may process data in the United States. Where required, international transfers are protected by the safeguards described in Vercel's data-processing terms. Technical logs are retained according to the hosting configuration and are deleted when they are no longer needed for operations, security or legal claims.

More information: Vercel Privacy Policy.

4. Contact and distribution-partner forms

The general contact form asks for your first name, last name, email address and message. The distribution-partner form asks for the company, contact person, email address and message, and optionally a telephone number and product or indication. We process these details to review and answer the inquiry, communicate with you and, if appropriate, take steps toward a business relationship.

Processing is based on Article 6(1)(b) GDPR where the inquiry concerns pre-contractual steps or an existing contract. In other cases, it is based on our legitimate interest in answering business and general inquiries efficiently under Article 6(1)(f) GDPR. Fields marked as required are needed for us to attribute and answer the inquiry; the form cannot be sent without them. Optional fields can be left blank.

Submitted inquiries are stored in our Twenty CRM environment and are also sent to our team by email. We retain them while the inquiry is active and afterwards only for as long as needed for the business relationship, statutory retention duties or legal claims. The production CRM hosting arrangement and the operational deletion schedule determine the exact period.

Cloudflare Turnstile

We protect both forms against automated abuse with Cloudflare Turnstile. The widget is loaded when you begin interacting with a form. Cloudflare processes security signals including the IP address, TLS and browser characteristics, user agent, the site key and origin, and returns a short-lived verification token. We send that token to Cloudflare for server-side validation. Cloudflare states that Turnstile does not receive the contents of form fields.

The recipient is Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, United States. Processing is based on our legitimate interest in protecting the forms and our systems from spam and abuse under Article 6(1)(f) GDPR. Access to the device is treated as strictly necessary to provide the form security requested with the form under Section 25(2)(2) TDDDG.

More information: Cloudflare Turnstile Privacy Policy.

Email delivery through Resend

We use Resend to send the inquiry to our team and to send an acknowledgement to the email address you provide. Depending on the form, the email can contain your name, email address, company, optional telephone number, product information and message, as well as technical delivery metadata. The recipient is Plus Five Five, Inc. (Resend), United States.

The legal basis follows the inquiry: Article 6(1)(b) GDPR for contractual or pre-contractual communications and otherwise Article 6(1)(f) GDPR for our legitimate interest in reliable correspondence. Resend describes safeguards for United States processing, including the EU-US Data Privacy Framework and Standard Contractual Clauses. Email and delivery logs are deleted under the retention applying to our Resend service plan and any statutory retention duties.

More information: Resend Privacy Policy.

5. Privacy settings and consent

The site stores your privacy selection, its time, a pseudonymous subject identifier and a policy fingerprint in a first-party c15t cookie and a matching localStorage entry. This lets the site respect the selection on later page views. The cookie can remain for up to 365 days; localStorage has no automatic expiry but can be cleared in your browser. In the browser-only configuration, this consent record is not sent to a separate consent database.

This local preference is necessary to provide your chosen privacy settings and is based on Section 25(2)(2) TDDDG and Article 6(1)(f) GDPR. It is not used for advertising.

The language switch stores i18nextLng with the value German or English in localStorage. This first-party preference is not sent to a separate recipient and remains until you change it or clear browser storage.

Audience measurement is optional. Google Analytics and PostHog remain disabled and their scripts are not loaded until you consent to the measurement category. You may refuse without losing access to the website. You can withdraw or change consent at any time through “Privacy settings” in the footer. Withdrawal does not affect the lawfulness of processing before withdrawal.

6. Audience measurement after consent

Google Analytics (Consent Mode Basic)

We use Google Analytics 4 only after you consent. Our implementation uses Google Consent Mode Basic: before consent, the Google tag is not loaded and no denied-consent or “cookieless” measurement ping is sent to Google. Advertising storage and advertising personalisation remain disabled.

After consent, Google Analytics can process page views and events, approximate location, timestamps, referrer and campaign information, browser, device and operating system data, IP-derived information, and client and session identifiers. Google Analytics may store identifiers such as _ga and a property-specific _ga_* value in your browser for up to two years unless they are deleted sooner. We disabled Google Signals and advertising-personalisation signals in the site configuration.

The recipient is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Affiliated Google entities may process data outside the EEA. Processing and device storage are based exclusively on your consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG. User and event data in the Analytics property is deleted according to the retention period configured for that property.

More information: Google Analytics privacy information.

PostHog and session replay

After consent, PostHog helps us understand which pages are used and how visits unfold. It can process page URLs and ordinary visible page content, clicks and interactions, timestamps, referrer information, browser, device and operating-system data, IP-derived information, event data and client or session identifiers. Session replay records a visual reconstruction of interactions. The contents of ordinary input fields are masked by the PostHog recorder; page text and URLs are not necessarily masked.

PostHog may use browser storage and cookies for identifiers after consent. Its standard identifier cookie can remain for up to 365 days unless deleted sooner. Related localStorage entries have no automatic browser expiry; normal PostHog persistence is removed after withdrawal, while an opt-out marker may remain so the choice is respected. The recipient is PostHog, Inc., United States. This site is configured to use PostHog's European ingestion endpoint, while the PostHog account configuration determines the final storage location and retention for events and recordings.

Processing and device storage are based exclusively on your consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG. More information: PostHog Privacy Notice.

7. Your rights

Subject to the statutory requirements, you have the right to obtain information about your personal data and a copy of it, to have inaccurate data corrected, to request erasure or restriction of processing, and to receive data you provided in a structured, commonly used and machine-readable format. You may also request that data be sent directly to another controller where technically feasible.

Where processing is based on Article 6(1)(f) GDPR, you may object at any time for reasons arising from your particular situation. We will then stop the processing unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed for legal claims. You may withdraw consent at any time with effect for the future.

You also have the right to lodge a complaint with a data-protection supervisory authority. The supervisory authority for our registered office is the State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia (LDI NRW). You can find its current contact details at ldi.nrw.de.

We do not use the website data described here for decisions based solely on automated processing that produce legal or similarly significant effects.

8. German version and updates

You can also read the German privacy policy. We update this policy when the website, service providers or legal requirements change.

Last updated: 3 September 2026