Datenschutz

1. What data we process

Identification and sign-in data: e-mail address (encrypted), technical session data.

Special categories of personal data (Art. 9 GDPR) that you upload or connect: blood markers, genetic data, microbiome data, continuous glucose (CGM), body composition and measurements (e.g. InBody), wearable data (sleep, heart rate, HRV, stress). This data is particularly sensitive and you upload it voluntarily.

2. Legal basis and explicit consent

Running the account and providing the service: processing necessary for performance of the contract under Art. 6(1)(b) GDPR.

Health and genetic data (special category): processed solely on the basis of your explicit consent under Art. 9(2)(a) GDPR. You give consent at registration and may withdraw it at any time. Withdrawal does not affect processing carried out before withdrawal.

A detailed matrix of purposes (data categories, legal basis, recipients, retention, whether provision is mandatory and the consequence of not providing the data) is in section 3.

3. Matrix of processing purposes

For each purpose we state: the data categories, the legal basis under Art. 6 and, where relevant, Art. 9 GDPR, the recipients, the retention period, whether provision is mandatory or voluntary, and the consequence of not providing the data.

Account and sign-in. Data categories: e-mail address, technical session data and sign-in security metadata. Legal basis: Art. 6(1)(b) GDPR (performance of the contract); Art. 9 does not apply. Recipients: the hosting processor, the SMTP provider for sign-in e-mails. Retention: for the duration of the account; sessions last at most 7 days. Provision: required to run the account. Consequence of not providing: you cannot sign in or use the service.

Health features (storage, display, trends and simple indicators). Data categories: health and genetic data entered into the application by you or your authorised representative. Legal basis: Art. 6(1)(a) and Art. 9(2)(a) GDPR (explicit consent). Recipients: the hosting processor, expressly authorised persons under the regime described in section 6, and users with whom you share your profile yourself. Retention: until consent is withdrawn or the data is erased, with the limited exceptions described in section 7. Provision: voluntary. Consequence of not providing: health features cannot be used.

Optional OCR and AI processing. Data categories: the document you select and relevant health or genetic data. Legal basis: a separate consent under Art. 6(1)(a) and Art. 9(2)(a) GDPR. Recipients: Anthropic as a contractual processor and its subprocessors as per section 4. Retention: on our side under section 7, at Anthropic under section 4. Provision: optional. Consequence of not providing: only local features without OCR and AI are available.

Security and audit records. Data categories: IP address, browser identification, time, actor and target IDs, event type. Legal basis: Art. 6(1)(f) GDPR, a legitimate interest in securing the service and the traceability of interventions; if a record exceptionally contained health data, we would assess the Art. 9 conditions separately. Recipients: the hosting processor, expressly authorised persons. Retention: 12 months after the event. Provision: arises automatically when the service is used. Consequence: without these records the service cannot be operated securely.

Garmin and Oura integrations. Data categories: access tokens and data from the chosen service (for example sleep, heart rate, HRV, steps). Legal basis: Art. 6(1)(a) and Art. 9(2)(a) GDPR; you activate the integration yourself. Recipients: Garmin or Oura as the data source under their own terms, the hosting processor. Retention: tokens until the integration is disconnected, imported data like other health data. Provision: optional. Consequence of not providing: the integration does not work, other features do.

4. Artificial intelligence processing (Anthropic)

We use the Claude API to extract data from documents and generate an educational summary only on the basis of your separate explicit consent. Our contractual processor is Anthropic Ireland, Limited, together with its authorised subprocessors. We send the selected document and relevant health or genetic data only when you use a feature for which you have given this consent.

When the Claude API is used, requests may be processed in the USA and, depending on the service configuration, also in other countries in Europe, Asia or Australia. Anthropic currently states that it stores customer data in the USA and that limited internal processing may also take place in countries where Anthropic or its affiliates operate. The exact scope is governed by our agreement, the current list of subprocessors and the account configuration. We base transfers outside the EEA on the applicable data processing agreement and Standard Contractual Clauses, supplemented by a transfer impact assessment and further measures described on request. You may request a copy of or information about these safeguards at info@jouhealth.com.

The AES-256-GCM encryption that protects data in our database does not protect the content at the moment Anthropic receives it in decrypted form for processing.

Anthropic's commercial terms state that it does not train its models on customer content from paid services. The exceptions are content the customer submits as feedback on a response, and cases where the customer explicitly opts in. The operator does neither: we do not submit feedback from your documents and we have not opted in.

Under the standard Claude API retention mode, Anthropic deletes inputs and outputs from its backends within 30 days. Exceptions may apply where content is flagged by systems enforcing the Usage Policy, longer retention is required by law, or a different period has been agreed by contract. Under Anthropic's current public rules, flagged inputs and outputs may be retained for up to 2 years and related trust and safety classification scores for up to 7 years. If an approved zero data retention arrangement becomes applicable to our account, we will update this wording to reflect the actual agreement.

A further recipient is the hosting provider on whose server the application and database run. Hosting is provided by Hetzner Online GmbH, with servers in a data centre in Falkenstein, Germany. The application and database therefore run within the European Union; the AI processing described above may, however, take place outside the European Economic Area.

5. Categories of recipients

We disclose personal data to the following categories of recipients:

Hetzner Online GmbH as the hosting processor, on whose servers the application and database run.

Anthropic Ireland, Limited and its authorised subprocessors, only as part of the optional OCR and AI processing described in section 4.

The SMTP provider used to send sign-in e-mails and invitations.

Garmin and Oura, if you activate the integration yourself.

Other registered users with whom the owner deliberately shares a profile.

Professional advisers or public authorities where required by law.

6. Security

We store data encrypted (AES-256-GCM). Sign-in is passwordless, via a one-time link. Access to data is bound to your signed-in session.

Account content may exceptionally be accessed only by expressly authorised persons, where necessary to resolve a specific security or support request. Access is time-limited, based on the least privilege necessary and recorded in an audit log (including IP address). Where the situation allows, we ask for the user's confirmation in advance. We do not use the content of health data for general staff training or for development without a separate legal basis.

7. Retention and deletion

We retain the account and active profile for the duration of the account. Following self-service deletion, we remove the active account, profile and registered files without undue delay. Copies in rotating backups are deleted within 30 days unless a legal obligation or the handling of a security incident requires temporary longer retention. In that case, the data is isolated and is not used in ordinary operations.

We retain security and audit records for 12 months after the event. We retain evidence of consent and withdrawal for 3 years after account closure or withdrawal to demonstrate compliance and protect legal claims. If a dispute is pending, the record may be kept until the matter is finally resolved. Sessions have a maximum lifetime of 7 days. Anthropic retention periods are described in the AI processing section.

When you delete your account, your data (profile and uploaded files) is deleted, together with family member profiles without their own sign-in that you manage. Profiles of promoted members with their own sign-in are not deleted; their management passes to that member. When an administrator cancels an account, a health profile kept by another manager remains with that manager. You may also request export or erasure individually.

8. Family profiles, children and sharing access

An account can also hold profiles of family members or people in your care. Their health data is entered and managed by an adult profile manager, who is responsible for the accuracy and legitimacy of the entered data.

You may create a profile for another person only if you are their legal guardian or hold other verifiable authority. For a person aged 15 or older, health and genetic data cannot be entered or made accessible until that person obtains their own sign-in, receives the processing information and gives their own valid explicit consent, unless JOUGROUP s.r.o. has verified other legal representation in advance. A profile manager's declaration does not by itself replace the data subject's consent.

For minors, we verify who is entitled under applicable law to act and to give consent, taking into account the child's age and maturity, the nature of the processing and parental responsibility. Under Czech law, the threshold of 15 years applies to consent in connection with the direct offer of an information society service to a child. For health and genetic data, we may require the legal guardian's consent, the child's own consent or both before activation, and we may proportionately verify the guardian's authority.

If your profile was created or populated by another person, we obtained identification, contact and health data from the profile manager, who declared that they were authorised to provide it. JOUGROUP s.r.o. remains the controller for processing carried out by the JOuHealth platform. These Privacy Policy terms explain the data categories, purposes, recipients, retention periods and your rights.

The date of birth on a managed profile is set exclusively by the manager or an administrator and serves to protect minors. For the profile of a person under 18, immediate self-service deletion in the application may be restricted so that an irreversible action does not happen without verification of an authorised person. This does not limit the right of the child or their legal guardian to request erasure, restriction or rectification, or to withdraw consent, at info@jouhealth.com. We assess every request without undue delay in accordance with the GDPR, after proportionate verification of identity and authority and with regard to the best interests of the child.

When a profile is shared with another registered account, the recipient sees the profile data read-only; they cannot change or delete it. A sharing recipient is a user of the application, not a third party outside it; you hand the data over by your own decision and can revoke access at any time with immediate effect.

9. Your rights

You have the right to access, rectification, erasure, restriction of processing, portability, to object, and to withdraw consent at any time. You have the right to lodge a complaint with the Czech Office for Personal Data Protection (uoou.gov.cz).

You may withdraw each consent at any time in Settings for the relevant purpose. Withdrawal takes effect immediately for future processing and does not affect the lawfulness of processing before withdrawal. Withdrawing AI consent disables OCR and AI features. Withdrawing consent to health and genetic data processing stops the relevant features and offers you export and erasure of that data. You may also withdraw consent by contacting info@jouhealth.com.

You may submit a request to info@jouhealth.com. We will respond without undue delay, normally within one month. For a complex request, the period may be extended where the GDPR permits. We may take proportionate steps to verify your identity. You are not required to provide health or genetic data, but features that require such data cannot operate without it. JOuHealth generates automated educational outputs, but it does not make decisions within Article 22 GDPR that produce legal or similarly significant effects. Outputs should not be relied on without independent verification.

A data protection officer had not been appointed as of the date of this version. We receive questions and requests concerning personal data protection at info@jouhealth.com. We regularly reassess the obligation to appoint a data protection officer with regard to the scale of processing.

10. Cookies

In the application we use four cookies: two necessary ones (the sign-in session and a temporary two-factor cookie) and two that store a preference you have requested (the active profile choice and the language choice). The application runs no analytics and no third-party advertising or tracking cookies, so no health data ever reaches a measurement tool.

The public website www.jouhealth.com is separate and does measure traffic, using Google Analytics 4 and Microsoft Clarity. Measurement starts only after you agree to it in the cookie bar, and refusing means nothing is loaded at all. You can withdraw consent at any time through the Cookie settings link in the website footer.

A detailed breakdown, including lifetimes, localStorage items and search engine tools, is on the Cookies page.