Privacy Policy

1. Who is responsible for your data?

The controller for processing on this website is:

ADA Healthcare GmbH
Hangstraße 8
33659 Bielefeld
Germany

Email: info@ada-health.care

The controller is the legal entity that determines the purposes and means of processing personal data on this website.

2. General information

Personal data is any information relating to an identified or identifiable person. We process personal data only where a legal basis permits it and only for the purposes described below.

Depending on the processing activity, the legal basis is your consent (Article 6(1)(a) GDPR), steps taken at your request before entering into a contract or the performance of a contract (Article 6(1)(b) GDPR), compliance with a legal obligation (Article 6(1)(c) GDPR), or our legitimate interests (Article 6(1)(f) GDPR). Where a service stores information on, or accesses information from, your device, Section 25 TDDDG also applies.

Every processing described below states a definite storage period. If the purpose is met sooner, we delete or anonymise sooner. We keep data longer only where a statutory duty requires it — six years for commercial correspondence under Section 257(4) HGB and ten years for accounting records under Section 147(3) AO — or where it is needed to establish, exercise or defend legal claims. In those cases the data is blocked from any further use. Section 8 lists every period in one table. Website delivery, audience measurement and the CRM run on servers in Germany. Data leaves the EU in two cases only: the Cloudflare bot check and email delivery through Resend. Both are named below with purpose, legal basis and transfer safeguard.

3. Website delivery and hosting

Vercel

This website and its form endpoints are hosted by Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, United States. When you request a page or an API endpoint, Vercel processes technical request data such as the IP address, requested URL and path, date and time, HTTP headers, referrer, browser or user-agent information, response status and request identifiers. This is necessary to deliver the website, maintain its security and availability, and diagnose errors.

The site is served from Vercel region fra1— Frankfurt am Main, Germany — and the request logs are held there. We rely on Article 6(1)(f) GDPR; our legitimate interest is the secure and reliable operation of this website. Technical logs are deleted after 30 days. A single record is kept longer only while a specific security incident is being investigated, and is deleted once that is done. As a US company Vercel can access data for support and billing; that transfer rests on the European Commission's 2021 Standard Contractual Clauses, which Vercel enters into under its data-processing addendum.

More information: Vercel Privacy Policy.

4. Contact and distribution-partner forms

The general contact form asks for your first name, last name, email address and message. The distribution-partner form asks for the company, contact person, email address and message, and optionally a telephone number and product or indication. We process these details to review and answer the inquiry, communicate with you and, if appropriate, take steps toward a business relationship.

Processing is based on Article 6(1)(b) GDPR where the inquiry concerns pre-contractual steps or an existing contract. In other cases, it is based on our legitimate interest in answering business and general inquiries efficiently under Article 6(1)(f) GDPR. Fields marked as required are needed for us to attribute and answer the inquiry; the form cannot be sent without them. Optional fields can be left blank.

Submitted inquiries are stored in a Twenty installation that we operate ourselves on a server inside the European Union. It is not the vendor's cloud product: the data does not leave the EU, and nobody outside our hosting provider has access. The inquiry is also sent to our team by email. We delete inquiry and correspondence data six months after the matter is closed. If the inquiry leads to a business relationship, the statutory periods apply instead: six years for commercial correspondence under Section 257(4) HGB and ten years for accounting records under Section 147(3) AO, each running from the end of the calendar year concerned.

Cloudflare Turnstile

We protect both forms against automated abuse with Cloudflare Turnstile. The widget is loaded when you begin interacting with a form. Cloudflare processes security signals including the IP address, TLS and browser characteristics, user agent, the site key and origin, and returns a short-lived verification token. We send that token to Cloudflare for server-side validation. Cloudflare states that Turnstile does not receive the contents of form fields.

The recipient is Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, United States. Processing is based on our legitimate interest in protecting the forms and our systems from spam and abuse under Article 6(1)(f) GDPR. Access to the device is treated as strictly necessary to provide the form security requested with the form under Section 25(2)(2) TDDDG. Cloudflare deletes the bulk of this verification data after 25 hours and applies fixed retention schedules of no more than a few weeks. Cloudflare, Inc. relies on the European Commission's Standard Contractual Clauses for the transfer.

More information: Cloudflare Turnstile Privacy Policy.

Email delivery through Resend

We use Resend to send the inquiry to our team and to send an acknowledgement to the email address you provide. Depending on the form, the email can contain your name, email address, company, optional telephone number, product information and message, as well as technical delivery metadata. The recipient is Plus Five Five, Inc. (Resend), United States.

The legal basis follows the inquiry: Article 6(1)(b) GDPR for contractual or pre-contractual communications and otherwise Article 6(1)(f) GDPR for our legitimate interest in reliable correspondence. Resend describes safeguards for United States processing, including the EU-US Data Privacy Framework and Standard Contractual Clauses. Resend removes the notification and acknowledgement emails from its delivery logs after 30 days and does not retain the message body permanently.

More information: Resend Privacy Policy.

5. Privacy settings and consent

The site stores your privacy selection, its time, a pseudonymous subject identifier and a policy fingerprint in a first-party c15t cookie and a matching localStorage entry. This lets the site respect the selection on later page views. The cookie can remain for up to 365 days; localStorage has no automatic expiry but can be cleared in your browser. In the browser-only configuration, this consent record is not sent to a separate consent database.

This local preference is necessary to provide your chosen privacy settings and is based on Section 25(2)(2) TDDDG and Article 6(1)(f) GDPR. It is not used for advertising.

The language switch stores i18nextLng with the value German or English in localStorage. This first-party preference is not sent to a separate recipient and remains until you change it or clear browser storage.

Audience measurement is optional. Google Analytics and PostHog remain disabled and their scripts are not loaded until you consent to the measurement category. You may refuse without losing access to the website. You can withdraw or change consent at any time through “Privacy settings” in the footer. Withdrawal does not affect the lawfulness of processing before withdrawal.

6. Audience measurement after consent

Google Analytics (Consent Mode Basic)

We use Google Analytics 4 only after you consent. Our implementation uses Google Consent Mode Basic: before consent, the Google tag is not loaded and no denied-consent or “cookieless” measurement ping is sent to Google. Advertising storage and advertising personalisation remain disabled.

After consent, Google Analytics can process page views and events, approximate location, timestamps, referrer and campaign information, browser, device and operating system data, IP-derived information, and client and session identifiers. Google Analytics may store identifiers such as _ga and a property-specific _ga_* value in your browser for up to two years unless they are deleted sooner. We disabled Google Signals and advertising-personalisation signals in the site configuration.

The recipient is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Processing and device storage are based exclusively on your consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG. The property is set so that Google deletes user-level and event-level data after two months — the shortest period Google offers. Aggregated standard reports are unaffected and do not allow any conclusion about an individual. If you withdraw consent we immediately set the Google Analytics opt-out flag and delete the cookies named above. Processing by Google LLC in the United States is possible on the basis of the Standard Contractual Clauses and Google LLC's certification under the EU-US Data Privacy Framework.

More information: Google Analytics privacy information.

PostHog and session replay

After consent, PostHog helps us understand which pages are used and how visits unfold. It can process page URLs and ordinary visible page content, clicks and interactions, timestamps, referrer information, browser, device and operating-system data, IP-derived information, event data and client or session identifiers. Session replay records a visual reconstruction of interactions. The contents of ordinary input fields are masked by the PostHog recorder and never reach PostHog; third-party embedded content is not recorded either. Ordinary page text and URL components are recorded. Surveys are switched off.

PostHog may use browser storage and cookies for identifiers after consent. Its standard identifier cookie can remain for up to 365 days unless deleted sooner. Related localStorage entries have no automatic browser expiry; normal PostHog persistence is removed after withdrawal, while an opt-out marker may remain so the choice is respected. The recipient is PostHog, Inc., 2261 Market Street #4008, San Francisco, CA 94114, United States, but this site uses PostHog Cloud EU exclusively. That instance runs in AWS region eu-central-1 in Frankfurt am Main; your data is processed and stored there and is not transferred to the United States. PostHog deletes session recordings after one month and analytics events after six months.

Processing and device storage are based exclusively on your consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG. More information: PostHog Privacy Notice.

7. Retention at a glance

These periods apply whether or not you ask us to act. Where a statutory retention duty is running, the data is blocked from further use until that duty ends.

Statutory retention duties take precedence: six years for commercial correspondence under Section 257(4) HGB and ten years for accounting records under Section 147(3) AO.

8. Your rights

Subject to the statutory requirements, you have the right to obtain information about your personal data and a copy of it, to have inaccurate data corrected, to request erasure or restriction of processing, and to receive data you provided in a structured, commonly used and machine-readable format. You may also request that data be sent directly to another controller where technically feasible.

Where processing is based on Article 6(1)(f) GDPR, you may object at any time for reasons arising from your particular situation. We will then stop the processing unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed for legal claims. You may withdraw consent at any time with effect for the future.

You also have the right to lodge a complaint with a data-protection supervisory authority. The supervisory authority for our registered office is the State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia (LDI NRW). You can find its current contact details at ldi.nrw.de.

We do not use the website data described here for decisions based solely on automated processing that produce legal or similarly significant effects.

9. German version and updates

You can also read the German privacy policy. We update this policy when the website, service providers or legal requirements change.

Last updated: 3 September 2026