Privacy Policy

We take the protection of your personal data very seriously. We treat your personal data as confidential and in accordance with applicable data protection laws and this Privacy Policy.

Information about our Healio Tree app and about enquiries sent from the app can be found under Healio Tree app.

1. Data Controller

2. Data Collection on Our Website

Server Log Files

The hosting provider automatically collects and stores information in server log files that your browser automatically sends to us. This information comprises browser type and version, the operating system used, referrer URL, host name of the accessing computer, time of the server request and IP address.

Contact Form

When you contact us through a form, we process the details you enter so that we can handle your enquiry and respond to follow-up questions. The next section explains the delivery provider used for this purpose.

E-book request

On some pages you can request free materials (e-books). For this we collect your name, e-mail address and, optionally, the name of your practice or company. The details are transmitted to us via our e-mail service provider so that we can assign your request and contact you personally if you wish. The download is available immediately after submission. The legal basis is your consent under Art. 6(1)(a) GDPR, which you can withdraw at any time with effect for the future, for example by e-mail to [email protected]. You will not be added to a newsletter list. The data is deleted as soon as it is no longer required for processing and no statutory retention obligations apply.

Health insurance bonus guide before the premium calculator

When you request the health insurance bonus guide before opening an external premium calculator, we process your first name, email address, the tariff page visited, the chosen application journey and the time. We use these details to assign your request and send you the guide once by email. Your request and delivery task are stored in our own Healio contact system on our Hetzner server; delivery uses our configured email service. Answers from tariff checks and health information are not transmitted through this form. Your browser stores only a flag for the current session indicating that you have already requested the materials. Your name and email address are not stored in the browser for this purpose. Submitting the form requests this one-time delivery; you are not subscribed to a newsletter. We delete the data when it is no longer required to handle your request and no statutory retention obligations apply. For questions or a deletion request, contact [email protected]. When you request a personal ARAG V100 quote, we also record the selected quote purpose and contact you by email to clarify your needs and prepare the quote. This does not submit an insurance application. The quote request is separate even if you previously requested the guide. Contact details of these website requests are deleted after no more than 90 days unless a subsequent procedure creates a longer statutory retention requirement. The legal basis for the personal quote request is Article 6(1)(b) GDPR (pre-contractual steps at your request).

Sending contact, quick-check and pet insurance forms via EmailJS

We send form enquiries to our inbox through the email delivery provider EmailJS (EmailJS Pte. Ltd., Singapore). Depending on the form, the data may include your name, email address, telephone number, practice or company and the content of your message. For the pet health-insurance form, it includes your name and email address as well as the animal profile: animal type, cover requested, age, optional breed and, for horses, the stated use. We also document the plan-review commission with its version and time and the confirmation of the privacy notice. We process these details to handle your enquiry, carry out the commissioned plan review and reply to you. The legal basis is Article 6(1)(b) GDPR where the enquiry concerns pre-contractual steps or the commissioned review and advice; otherwise it is Article 6(1)(f) GDPR, based on our legitimate interest in handling incoming enquiries efficiently. For the quick check on our campaign pages, the following section applies; the pregnancy check does not use EmailJS. EmailJS processes the data as a processor and states that it may store request data and metadata. Personal data may be transferred to the United States; EmailJS cites Standard Contractual Clauses as a safeguard for European users. We retain your enquiry only for as long as needed to handle it and comply with statutory retention duties.

EmailJS Privacy Policy · EmailJS Data Processing Agreement

Quick check on our campaign pages

On healio.de/check/naturheilkunde and healio.de/check/schwangerschaft you can complete a three-step quick check. We process your selection of what you are interested in, your statutory health insurer, your first name, your telephone number, your email address or both, the page from which you send the request, campaign parameters of the URL (utm values) where present, and the version and time of your consent. For the naturopathy check, the click identifier of a Google ad (GCLID) is added if you arrived through such an ad and allowed marketing in the cookie banner. For the pregnancy check, we store no ad click identifiers, but we do store a pseudonymised check value of your IP address, created with a secret key, to prevent abuse; we do not store the IP address itself. We use these details to calculate which supplementary cover suits you and how much your health insurer can contribute, and to call or write to you as requested. We do not use them for newsletters or advertising. Providing the details is voluntary, but without contact details and consent we cannot get back to you.

The legal basis is your consent under Article 6(1)(a) GDPR, given by ticking the box in the form. If your request leads to advice or a contract, we process the necessary details to prepare and perform the contract (Article 6(1)(b) GDPR). The pregnancy check may reveal that a pregnancy exists. This is health data and therefore a special category of personal data under Article 9 GDPR. We process it on the basis of your explicit consent under Article 9(2)(a) GDPR; the text next to the tick box of this form names it explicitly. For the evidence of your consent, Article 9(2)(f) GDPR additionally applies, as described below under retention. We do not ask for further health information such as week of pregnancy, due date, findings or treatments. We use the check value of the IP address only to prevent abuse, based on our legitimate interest in a secure form (Article 6(1)(f) GDPR).

On healio.de/check/schwangerschaft and its confirmation page we load neither the Meta pixel nor Google Ads nor Google Analytics, not even with your consent in the cookie banner. For the naturopathy check, a submitted request is counted on the confirmation page for Meta, Google Ads and Google Analytics, each only if you consented to that purpose in the cookie banner. Your answers, name and contact details are not sent to these services. Only in that case does your browser store a session-only marker without name or contact details, so that each request counts at most once and only within 30 minutes. Details are given in the sections on Google Analytics, Google Ads and Meta.

We send requests from the naturopathy check through EmailJS (EmailJS Pte. Ltd., Singapore) to our inbox [email protected], which we run on Google Workspace (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Both process the data on our behalf. EmailJS states that its servers are located in the United States, that it may store request data and metadata, and cites Standard Contractual Clauses as a safeguard for European users. Google may also process data outside the EU, for example in the United States; depending on the transfer, the adequacy decision for the EU-US Data Privacy Framework or Standard Contractual Clauses apply. Requests from the pregnancy check go neither through EmailJS nor through our inbox. They pass through the Cloudflare delivery network (see the hosting section) to a function of our host Vercel Inc. (United States) running in its Frankfurt am Main data centre, which stores them with Supabase Inc. (United States) in its EU region Frankfurt. Vercel and Supabase process the data on our behalf. As both companies are based in the United States, access from the United States cannot be ruled out entirely; for that case, the data processing agreements provide for EU Standard Contractual Clauses. We are notified of such a request by a short email to [email protected], which our automation service on our server at Hetzner Online GmbH (Germany) sends through Brevo (Sendinblue GmbH, Germany). It contains only a random identifier, the version of your consent and the time of receipt, and none of the details from your request. In addition, a daily overview states only the number of open requests. We pass your details to insurers only if you decide to apply after the consultation.

We file requests from the naturopathy check in a dedicated folder in our inbox. They stay there until the request has been dealt with, for no longer than 90 days. Requests from the pregnancy check are stored only in our database with Supabase in Frankfurt, which only we can access through a protected login; an automatic deletion run removes them after 90 days at the latest. If a request leads to a contract, we transfer only the necessary details to our client records, which are subject to statutory retention periods. Separately, we keep evidence of your consent: first name, contact details and the version and time of consent, without your answers from the quick check. For the pregnancy check, this evidence is kept in a separate area of the same database that is not publicly accessible. If you provided a telephone number, we keep this evidence for five years, counted from the completion of your request, after which we no longer use your consent, as required by Section 7a of the German Act against Unfair Competition (UWG); the legal basis is Article 6(1)(c) GDPR. Without a telephone number, we keep it until the end of the third calendar year following the completion of your request so that we can produce it in the event of claims; the legal basis is then our legitimate interest (Article 6(1)(f) GDPR). For the pregnancy check, the evidence itself shows that you used this check. To that extent, we additionally base its retention on Article 9(2)(f) GDPR, as we need the evidence to establish, exercise or defend legal claims.

You may withdraw your consent at any time with effect for the future, for example by emailing [email protected]. This does not affect the lawfulness of processing before withdrawal. After withdrawal we delete your request unless it has led to a contract. We keep the evidence of your consent together with your withdrawal for the period stated above.

Guide for practices

If you submit the form on the page “Guide for practices” (healio.de/partner/leitfaden), we process the data entered there in order to provide the guide and to contact you about it. We process: first name, email address, phone number (optional), type of practice, the time of the request and the version of your consent, as well as technical data, namely a shortened browser identifier, a non-reversible hash of the IP address and, where present, campaign parameters of the URL (utm values) and the referring site. Of the referring site we store only the domain of the website you came from, for example instagram.com, without path or other URL components. We use campaign parameters and the referring site to evaluate through which channels practices request the guide, and the IP hash to prevent abuse. Storage takes place with Supabase Inc. as processor in the EU region Frankfurt. The legal basis is your consent under Art. 6 (1) (a) GDPR and, for abuse prevention, our legitimate interest under Art. 6 (1) (f) GDPR. You may withdraw your consent at any time with effect for the future, for example by email to [email protected]. We delete the data as soon as the purpose no longer applies, at the latest after withdrawal, unless a statutory retention period applies.

Services and third-party providers used

Hosting and delivery (Vercel, Cloudflare)

This website is hosted by Vercel Inc. (United States) and delivered through the content delivery network of Cloudflare Inc. (United States). Technically necessary connection data, including IP addresses, is processed to provide the website and protect it against attacks. The legal basis is our legitimate interest in secure and high-performance operation under Article 6(1)(f) GDPR. We have data processing agreements incorporating EU Standard Contractual Clauses with both providers.

Google Analytics 4

Google Analytics 4 (Google Ireland Ltd.) is loaded only after you have expressly consented to analytics. Once enabled, usage data such as pages viewed and time spent on the site may be processed; according to Google, Google Analytics 4 does not store individual IP addresses. The resulting statistics help us improve our services. The legal basis for processing is your consent under Article 6(1)(a) GDPR. You may withdraw that consent at any time with effect for the future through the privacy settings. No analytics data is transferred to Google Analytics before you consent.

Google Ads conversion tracking

Only if you switch on “Marketing (Google Ads and Meta)” in the cookie banner and a Google Ads account is configured do we load the conversion tag of Google Ads, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The sole purpose is to measure whether our ads lead to enquiries and opened applications. An enquiry is a submitted contact form or a click on the link that opens our appointment calendar directly in Google Calendar; whether you then book an appointment there is not measured. An opened application is a click on an insurer's application or premium calculator. What is transmitted is the event, the page viewed, the time, the ad click identifier (GCLID) and the Google cookies _gcl_au and _gcl_aw. Contents of calculators, selection aids or forms, names and email addresses are not transmitted. If you submit our contact form after clicking an ad, we send the click identifier with your enquiry to our mailbox so that we can attribute a later contract to the right ad; this too happens only with your marketing consent. No advertising personalisation takes place; that setting remains switched off permanently. We never load Google Ads on our pregnancy page or in our pregnancy guides. If you arrive there via an ad and continue to a tariff page, the link only carries the ad click identifier. Measurement only happens on the tariff page, and Google only learns its address without additions, so neither the page you came from nor any campaign or entry codes. The legal basis is your consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG. You can withdraw it at any time via the cookie settings in the footer; after that we no longer send conversion events and delete the cookies. Google also processes data in the United States; Google LLC is certified under the EU-US Data Privacy Framework. Further information: https://policies.google.com/privacy and https://business.safety.google/adscookies/.

Meta pixel and Conversions API

Only if you switch on “Marketing (Google Ads and Meta)” in the cookie banner do we use the Meta pixel provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland, and additionally transmit the same events server side via the Conversions API. The purpose is to measure whether our ads on Facebook and Instagram lead to page views, calculator starts and enquiries, and to build audiences for renewed contact. What is transmitted is the event name, the page viewed, the time, a random event ID, IP address and browser identifier as well as the Meta cookies _fbp and _fbc. Contents of calculators, selection aids or forms, names and email addresses are not transmitted. The legal basis is your consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG. You can withdraw it at any time via the cookie settings in the footer; after that we no longer use the pixel and delete the cookies. Meta also processes data in the United States; Meta Platforms, Inc. is certified under the EU-US Data Privacy Framework. Further information: https://www.facebook.com/privacy/policy and https://www.facebook.com/privacy/policies/cookies. The Meta controller addendum applies to the joint controllership for event collection: https://www.facebook.com/legal/controller_addendum.

Forms in ads on Facebook and Instagram

If you complete and submit a form in one of our ads on Facebook or Instagram, Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland, provides us with the details entered there. Depending on the form, these are your name, your telephone number or email address and your statutory health insurer, for practice forms possibly your type of practice, plus the time and the campaign, ad set, ad and form through which you sent the request. Meta prefills name and contact details from your profile; you can check and change them before submitting. We do not ask for health information in these forms. We use the details exclusively to call or write to you as requested and to handle your request, such as your bonus check. We do not add them to newsletter or advertising lists.

The legal basis is your consent under Article 6(1)(a) GDPR, given by ticking the box in the form. If this leads to advice or a contract, Article 6(1)(b) GDPR also applies. Where an ad concerns preventive care during pregnancy, your request may reveal a pregnancy. We process this health data only with your explicit consent under Article 9(2)(a) GDPR, which the form then asks for separately.

We retrieve the details from Meta’s Leads Center and keep them in an internal call-back list that records only a neutral form name as the source. If no consultation takes place, we delete the details no later than 90 days after the last contact. If a contract results, statutory retention periods apply. We keep evidence of your consent for five years under Section 7a UWG (Article 6(1)(c) GDPR). You may withdraw your consent at any time with effect for the future, for example by emailing [email protected]; we then delete your details unless they have led to a contract.

Processing on Facebook and Instagram, such as delivering the ads, prefilling and storing the form entries at Meta, is governed by Meta’s privacy policy: https://www.facebook.com/privacy/policy. Meta also processes data in the United States; Meta Platforms, Inc. is certified under the EU-US Data Privacy Framework.

Nita, Healio’s digital assistant

Nita’s voice connection is provided through OpenAI and starts only after your express consent. No audio data is transferred to OpenAI before it starts. The legal basis is your consent under Article 6(1)(a) GDPR. You may withdraw that consent at any time with effect for the future through the privacy settings. Please do not share sensitive health data with Nita. Personal advice is available through the contact channels listed on this website.

Contact via WhatsApp

We provide a voluntary link to WhatsApp, a service provided in the European Region by WhatsApp Ireland Limited. Healio does not load WhatsApp code or transmit data to WhatsApp before you click the link. When you open the link, you leave our website. Depending on how you use the service, WhatsApp processes information such as your telephone number, profile and communication data as well as device, usage and connection data. Further information is available in the WhatsApp Privacy Policy.

If you contact Healio through WhatsApp, WhatsApp/Meta and Twilio Ireland Limited transmit your sender details, message content, time and technical message identifiers to Healio. General text questions may be answered automatically by “Nita”, Healio’s digital assistant. For this purpose, the text is sent through the OpenAI API to OpenAI Ireland Limited. Nita identifies itself in generated replies as Healio’s digital assistant. The Healio service does not download submitted media and does not use tools, web search or persistent conversation memory.

The Healio application does not retain raw message texts, telephone numbers, media or generated answers after processing. It stores only pseudonymous identifiers for duplicate protection for up to seven days and a pseudonymous opt-out status after STOP until START or deletion. OpenAI requests are sent with storage disabled. OpenAI may nevertheless retain prompts and replies in abuse-monitoring logs for up to 30 days unless stricter data controls have been activated for the API project. WhatsApp/Meta and Twilio may process or retain communication and usage data under their own service rules. See the Twilio Privacy Notice and the OpenAI API data controls.

We process the data to answer your voluntarily initiated request and to secure the channel. The legal basis is Article 6(1)(b) GDPR where the request concerns pre-contractual steps, and otherwise Article 6(1)(f) GDPR based on our legitimate interest in answering enquiries and preventing misuse. Providers and subprocessors may process data outside the EEA. Depending on the provider and transfer, safeguards may include adequacy decisions, standard contractual clauses or binding corporate rules. You can contact us equally by telephone, email or the contact form.

Please do not send health data, patient data, insurance numbers, diagnoses, findings, invoices, photographs, voice messages or documents through WhatsApp. A keyword filter cannot reliably recognise every sensitive statement. Messages recognised as sensitive, media and requests for a human contact bypass the AI and receive a fixed information response; no employee is automatically notified and no callback is commissioned.

Appointment booking (Google Calendar)

Embedded appointment booking through Google Calendar loads only after your separate consent. Google then receives technical connection data, particularly your IP address and browser information. You may withdraw this consent at any time with effect for the future through our privacy settings. When you book, the details you enter, such as your name, email address and chosen appointment, are processed through Google Calendar and made available to us to organise the appointment. The legal basis for loading the embed is Article 6(1)(a) GDPR; for the appointment you request, it is Article 6(1)(b) GDPR. Meetings take place through Google Meet; booking an appointment does not authorise a recording.

Google: Privacy Policy / Datenschutzerklärung

Email communication (Brevo)

We use Brevo (Sendinblue GmbH, Germany) to send information emails. Your email address is used for this purpose only if you have consented or an existing business relationship applies. You can unsubscribe at any time through the unsubscribe link.

Retirement account launch information

If you request retirement account launch updates, we process your name, email address, the originating page, the consent version and the request time. We send a confirmation email via Brevo (Sendinblue SAS, France). Only after you confirm your email address are you added to the separate launch information list. Based on your consent under Article 6(1)(a) GDPR, we then send new details, launch information from 2027 and relevant webinar invitations. The secure relay uses our existing n8n service on Hetzner; regular execution contents are not retained. No calculator inputs, health data or contract details are transmitted for this subscription.

You may withdraw consent at any time through the unsubscribe link in each update or by emailing [email protected]. The mailing address is retained while your subscription is active; after withdrawal we stop sending and retain only evidence necessary to demonstrate consent or prevent further messages for as long as that purpose requires. Your choice does not affect access to articles, the calculator or personal enquiries. A session-only browser flag prevents repeated automatic pop-ups; it contains no name, email address or tracking identifier.

External insurer application journeys

For premium calculators and online applications, we link to journeys provided by the respective insurers, for example SDK, die Bayerische and UKV/Versicherungskammer. The privacy policies of the relevant provider apply there; the insurer processes the data entered there as the controller.

Healio Tree app

Our app Healio Tree performs its calculations on your device. It stores your details, scenarios and settings as well as a copy of your prepared enquiries on your device. The app is configured to exclude these data from device cloud backups. It is currently not connected to any Healio server and does not automatically transmit your inputs to Healio. Healio cannot access the calculation values stored in the app. The app never adds your situation, details from the introduction, amounts, calculation results or variants to an enquiry. Anything you voluntarily write in the free-text field becomes part of the enquiry. With “Alle Angaben löschen” (delete all details) in the settings, you remove the data stored by the app, including local copies of your enquiries. This does not delete messages already sent from their recipients.

The app does not require a user account. It contains no advertising networks and no analytics or tracking services. At the end of certain areas, there is a contact route for Healio’s own services, explicitly labelled as advertising. The explanatory chat is switched off.

If you download the app from Apple's App Store or from Google Play, the respective provider processes data such as your account and the time of the download under its own responsibility. Apple's and Google's privacy notices apply to this. If you have allowed crash reports to be shared with app developers in your device settings, the store provider may make such reports available to us.

If you tap a link to a website in the app, your browser or the relevant app opens. The privacy policy of the website you visit applies there.

Enquiries from the app by email

From the app, you can prepare a voluntary enquiry about our own topics, investing money or capital investments, or finding a tax advisory firm. The app opens your email program with a prepared email to [email protected] or offers the text via your device’s share menu. You decide which route to use and what to send. The app does not send the enquiry itself. Healio receives the information contained in your email only when your email arrives. Beforehand, the app displays the wording of your consent and a privacy notice. A copy of the prepared enquiry remains on your device so that you can later prepare a withdrawal. This copy does not establish that the message was actually sent.

We accept enquiries from the app only by email to [email protected], not via WhatsApp. If you nevertheless write to us there, only the information under “Contact via WhatsApp” applies. Your message is not recorded as an enquiry there, and no one at Healio is notified automatically. We do not pass on details from your enquiry to third parties without your agreement. The only exceptions are service providers working on our behalf and cases in which a law obliges us to disclose them.

Please do not include any information about your health in your message. Where necessary, we clarify such questions in a conversation.

Enquiries about insurance, pensions and protection

For enquiries about health insurance, supplementary insurance, pensions and retirement, company pension or company health insurance (bAV or bKV) and protection, we process the details from your email: your concern and your message, your first name, your telephone number and your email address, as far as you provide them, your contact preference with preferred times and preferred appointment, where in the app the enquiry comes from (area, branch and screen, the topic only if you choose to send it), the version, wording and time of your consent, the version of the initial information (Erstinformation) that the app showed you before the form, an enquiry identifier, the name and version of the app, and your sender address and the time of your email. The app never adds your situation, details from the introduction, amounts, calculation results or variants. Information you voluntarily write in your message is part of your enquiry.

The purpose is to call you or write to you about your concern and, if you wish, to arrange an appointment with you. We do not use these details for newsletters or advertising. Providing your details is voluntary. Without contact details, however, we cannot get back to you. The legal basis is your consent under Article 6(1)(a) GDPR. If your enquiry leads to an engagement, we process the details required for it in order to prepare and perform the contract (Article 6(1)(b) GDPR).

Enquiries about investing money and capital investments, disclosure to cooperation partners

We accept enquiries about investing money or about capital investments by email to [email protected]. Our app Healio Tree prepares such an email for you; you send it yourself. We then process the details from this email: your concern and your message, your first name, your email address and, if you provide it, your telephone number, your contact preference with preferred times and preferred appointment, where in the app the enquiry comes from (area, branch and screen, the topic only if you choose to send it), the version, wording and time of the consent you gave in the app, an enquiry identifier and the name and version of the app, as well as your sender address and the time of your email. The app never adds your situation, your details from the introduction or amounts to this enquiry. The purpose is to get back to you and to clarify with you whether you would like to speak to a cooperation partner. Healio does not itself advise on investments and does not broker them. Providing your details is voluntary. Without contact details, however, we cannot get back to you.

We first reply to your email. If you have given a telephone number, we only call you once you have confirmed in your reply that the enquiry comes from you.

The legal basis is your consent under Article 6(1)(a) GDPR. This applies to the consent in the app, with which you allow us to store your details and to call you or write to you about your enquiry. It applies equally to your separate agreement to your enquiry being passed on to a cooperation partner. We keep the record of your consent because Section 7a of the German Act against Unfair Competition (UWG) requires us to do so. The legal basis for this is Article 6(1)(c) GDPR.

Recipients of your details may be financial investment intermediaries licensed under Section 34f of the German Trade Regulation Act (GewO) and real estate brokers licensed under Section 34c(1) sentence 1 no. 1 GewO with whom we cooperate. We pass on your enquiry only with your agreement. Beforehand, we tell you in a conversation the cooperation partner’s company name and licence. We tell you which details we would pass on, namely first name, contact details, preferred time and topic, never your message. We also ask whether the partner may call you and inform you that you can withdraw your agreement at any time. We then summarise this in an email to you and pass the enquiry on only after you have confirmed that email. Together with the enquiry, the cooperation partner receives a copy of your confirmation so that it can prove your consent itself. From receipt onwards, the partner is itself responsible for your details. The cooperation partner’s own privacy information applies to processing by it.

Technical service providers process your details only on our behalf. Currently this is the provider of our email mailbox. Details are given under “Mailbox, retention and record of consent”.

We delete your enquiry and the email with which you sent it as soon as we have passed the enquiry on, otherwise after 180 days at the latest. Separately, we keep the record of your consent for five years, in the case of disclosure together with the recipient and your confirmation (Section 7a(2) UWG).

You may likewise withdraw your agreement to the disclosure at any time with effect for the future. If your enquiry has already been passed on, we forward your withdrawal to the cooperation partner and ask it to delete your details.

Enquiries “Steuerberater gesucht” (tax advisor wanted), disclosure to a tax advisory firm

If you choose the concern “Steuerberater gesucht” (tax advisor wanted) in our app Healio Tree, the app prepares an email to [email protected]; you send it yourself. We then process the details from this email: your concern and your message, your first name, your email address and, if you provide it, your telephone number, your contact or appointment preference with preferred times and preferred appointment, where in the app the enquiry comes from (area, branch and screen, the topic only if you choose to send it), the version, wording and time of your consent, an enquiry identifier, the name and version of the app, and your sender address and the time of your email. Your answers to “Was brauchst du?” (What do you need?) and “Ich bin ...” (I am ...) are only included if you select them yourself. The app never adds your situation, details from the introduction, amounts, calculation results or variants to this enquiry. Information you voluntarily write in your message is part of your enquiry.

The purpose is to show you ways to a tax advisory firm and, if you wish, to pass your enquiry on to the firm you have chosen yourself. We do not use these details for insurance offers. We do not advise on tax matters, and we receive no money for the contact. We first reply to your email and only call you once you have confirmed this. The legal basis is your consent under Article 6(1)(a) GDPR and, for the disclosure, your separate agreement.

The only possible recipient is the tax advisory firm you have chosen yourself, and only if you agree and confirm this by email. We then pass on your first name, contact details, appointment preference, topic and, if you selected them yourself, your answers to “Was brauchst du?” and “Ich bin ...”. From receipt onwards, the firm is itself responsible for your details.

We delete your enquiry and the email with which you sent it when we pass it on, otherwise after 180 days at the latest. Separately, we keep the record of your consent for five years, in the case of disclosure together with the recipient and your confirmation. If your enquiry has already been passed on, we forward a withdrawal to the firm and ask it to delete your details.

Mailbox, retention and record of consent

Enquiries from the app arrive in our mailbox [email protected]. We operate this mailbox with Google Workspace, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google processes the emails on our behalf. Google may also process data outside the EU, for example in the USA. Depending on the transfer, safeguards may include in particular the adequacy decision for the EU-US Data Privacy Framework or standard contractual clauses.

We file each enquiry email in a separate folder for enquiries in the mailbox. It remains there until your enquiry has been dealt with, for no more than 180 days. If we pass an enquiry on to a cooperation partner or a tax advisory firm, we delete the enquiry and the email when we pass it on. If an enquiry about our own topics leads to an engagement, we transfer only the details required for it to our customer records, which are subject to the statutory retention periods. If you tell us that an enquiry does not come from you, we delete the enquiry and the record immediately.

Separately, we create a record of your consent in a second folder. This is a shortened extract of your email containing sender, recipient, date and subject, the wording, version and time of your consent, the enquiry identifier, your first name and your contact details (email address and, if provided, telephone number). Your message, your situation and your details are not part of it. We also note there when we called you or wrote to you, in the case of disclosure the recipient, the details passed on and your agreement, and, where applicable, your withdrawal. We keep this record for five years, counted from your consent and anew after each use. Section 7a of the German Act against Unfair Competition (UWG) obliges us to do so. The legal basis is Article 6(1)(c) GDPR.

Withdrawal

You may withdraw your consent from the app at any time with effect for the future by email to [email protected]. Under Einstellungen (Settings), you can prepare a withdrawal text for your email program or the share menu for each saved enquiry. You must send it to Healio yourself; we can process it once it has arrived. This does not affect the lawfulness of processing carried out before the withdrawal. After your withdrawal, we delete your enquiry and the email with which you sent it, unless it has led to an engagement. We keep the record of your consent together with your withdrawal for the period stated above. “Alle Angaben löschen” (delete all details) removes the local copy of the enquiry and the associated template but does not send a withdrawal. You can still write directly to [email protected]. Your further rights are set out in the following section.

3. User Rights

Within the framework of the statutory requirements, you have the right to obtain information free of charge about your personal data stored by us (Article 15 GDPR) and the rights to rectification (Article 16 GDPR), erasure (Article 17 GDPR), restriction of processing (Article 18 GDPR) and data portability (Article 20 GDPR). Where we base processing on our legitimate interest (Article 6(1)(f) GDPR), you may object to it at any time on grounds relating to your particular situation (Article 21 GDPR). You may withdraw any consent you have given at any time with effect for the future (Article 7(3) GDPR). To do so, write to us at [email protected]. You also have the right to lodge a complaint with a data protection supervisory authority (Article 77 GDPR). The authority responsible for us is the Hamburg Commissioner for Data Protection and Freedom of Information (Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit), Ludwig-Erhard-Straße 22, 20459 Hamburg.

4. Cookies

Our website uses cookies in some areas. Cookies do not damage your computer and do not contain viruses. They help make our services more user-friendly, effective and secure. Cookies are small text files stored on your computer by your browser.

5. Contact for privacy questions

If you have any questions about data protection, please send us an email:

Email: [email protected]

Last updated: 19 October 2026