The controller within the meaning of the General Data Protection Regulation (GDPR), other applicable data protection laws and other provisions of a data protection nature is:
Deep Care GmbH
Königsallee 43
71638 Ludwigsburg
Germany
e-mail: info@deep-care.com
Managing Director: Dr Milad Geravand
Commercial Register: Stuttgart District Court, HRB 731472
VAT ID No.: DE326604972
We, Deep Care GmbH, wish to inform you about data protection within our company with this document. This document is provided for information purposes only and does not constitute a contractual document.
Deep Care GmbH as the operator of the digital health coach „Isa“ and the booking portal on the website booking.deep-care.com takes the protection of personal data very seriously and respects privacy.
For the remainder of this document, „Isa“ will be referred to as „the Product“ for simplicity.
Please note that as part of our cooperation with BG prevent GmbH, the system offered by BG prevent under the name „KICO“ is based on „Isa“. Since it is the same system in terms of content and technology, all references to the „product“ used in this document apply equally to „KICO“. As part of the cooperation with BG prevent GmbH, Deep Care GmbH remains the sole controller within the meaning of the GDPR.
In this document, the term „Customer“ refers to the company to which Deep Care makes the product available. This definition applies analogously to companies that are still in a free trial or pilot phase and are therefore not yet bound by contract.
We process users„ personal data (hereinafter referred to collectively as “user„ or “data subject" regardless of gender or role) primarily only to the extent necessary for the performance of a contract or pre-contractual relationship, the provision of a functional website, and the making available of our content and services. The processing of our users' personal data is generally carried out only with the user's consent. An exception applies in cases where obtaining prior consent is not possible for factual reasons and the processing of the data is permitted by legal regulations. Processing is carried out in compliance with applicable data protection laws, such as the General Data Protection Regulation (GDPR), the Federal Data Protection Act (BDSG) and the Telecommunications and Digital Services Data Protection Act (TDDDG).
With this data protection concept, we document the internal and product-related data protection measures of Deep Care GmbH. It serves both as internal guidance and to ensure transparency towards our customers. The aim is to comply with the General Data Protection Regulation (GDPR) and to ensure systematic and sustainable data protection management within the company. This data protection concept refers to our product. Information on data processing on our website can be found in the separate privacy policy at deep-care.com/en/privacy-policy/.
The circle of individuals affected by the processing of personal data within the scope of the main contract includes:
Personal data is processed exclusively by users who have agreed to the collection and processing of their data directly with Deep Care.
For the processing operations described in this document, Deep Care GmbH is the data controller within the meaning of Art. 4 No. 7 GDPR. Data processing on behalf of the customer does not take place in this respect; the conclusion of a data processing agreement is therefore not required.
Within the scope of the main agreement and this addendum, Deep Care GmbH processes the following types of data:
Below we describe the purposes of processing, as well as the processing operations and the categories of data processed, in relation to the user.
Through our booking portal, a user of a company that is a customer of Deep Care GmbH can order a product. During a testing or pilot phase, these are the test subjects designated by the company. The order can also be placed via sales partners (e.g., like BG Prevent). However, these do not act as data controllers under data protection law, but rather mediate the order on behalf of the customer. Deep Care GmbH remains the sole data controller in this regard. The registration form collects the contract-relevant information for the order. This includes, among other things, the name(s) of the user(s), email address(es), shipping address(es), and the desired start date of use. These data are processed and stored exclusively for the fulfilment and purpose of the contract with the customer or the user, such as logistics, shipping of the product, and invoicing.
The personal data of the data subjects shall be deleted or blocked as soon as the purpose of storage ceases to apply. Storage may also take place if this has been provided for by the European or national legislator in Union regulations, laws or other provisions to which we are subject. The data shall also be blocked or deleted when a storage period prescribed by the aforementioned standards expires, unless there is a necessity for further storage of the data for the conclusion or fulfilment of a contract.
Once the user has received a product, they have full control over how the product is used and how long they store any captured data. The product does not require data capture or a Wi-Fi connection for normal use. The user has the following options in this regard:
Option A: The user can configure the product so that their data is only available during the device's runtime. With this option, no data is stored after the device is switched off.
Option B: Users can select in the product's settings for their data to be stored in the form of statistics and for long-term tracking. However, with this option, users can still delete all data at any time at the touch of a button.
In each of the options described above, the product gives the user the option to delete any data at any time (Settings > Data Storage > Delete All).
During use of the product, the following data will be stored exclusively locally and in anonymised form on the device, depending on the duration or the storage options described above chosen by the respective user:
a) It is recorded which selection of features and functions the respective user has made and what other interactions they have with the product, such as selecting the intensity level or activating/deactivating individual coaching tips. This configuration allows the user to customise the product, and it adapts accordingly to the specific user.
b) Furthermore, information for statistics, such as information on sitting postures, number of videos played or exercises performed, amount of water drunk, number of breaks, including the user's successes over time, can be recorded. This allows the user to see their progress over time.
c) The device runtime is recorded for the purpose of monitoring the product's lifespan and facilitating device maintenance, ensuring users always have a functional product.
d) Storing changes to environmental or desk height sensor data is primarily used to rectify a potential incorrect desk height setting or to make necessary adjustments when the product is placed on a new desk. For example, by checking available Wi-Fi or Bluetooth connections (without connecting to them), the product can detect that it has been placed in a new environment. This could then trigger, for instance, prompting the user to reconfigure their desk ergonomically.
e) For individual optimisation of digital coaching, the product can optionally ask the user whether they are currently experiencing musculoskeletal complaints (e.g. back, neck or joint pain).
Providing this information is voluntary and is done solely on the user's own initiative.
Provided corresponding details are given, this information can be used to individualise the analysis of posture and movement behavior and — in the future — of breathing patterns, and based upon this, to provide personalised recommendations for relief or prevention.
In this context, health data may be processed within the meaning of Article 9 GDPR, in particular:
Postural and movement data are generally processed independently of any other factors. However, these data are only processed as health data within the meaning of Article 9 GDPR if they are used in connection with voluntarily provided complaints for the individual adaptation of coaching.
The processing of the aforementioned health data is carried out exclusively on the basis of the express consent of the user in accordance with Art. 9 para. 2 lit. a GDPR. This consent is obtained directly within the product before corresponding details are first recorded or processed.
Consent is voluntary and can be withdrawn at any time with future effect. In the event of withdrawal, the data concerned will be deleted immediately in compliance with data protection regulations. Neither granting nor withdrawing consent will result in any disadvantages for the user regarding the further use of the product.
The data will be treated with strict confidentiality, stored encrypted, and processed exclusively for the stated purposes. No data will be passed on to third parties without explicit consent.
Regardless of this, the user can independently delete all data stored in the product at any time or activate automatic deletion after switching off the device.
Before a rental period expires, we will inform the respective user about the upcoming renewal and the option of free return shipping. The notification will be sent to the email address provided when ordering in the booking portal.
Whenever a product is returned to Deep Care GmbH, we then register the date of receipt and save it for billing purposes. All personal data not deleted by the user will be completely erased from the device before it is reused.
For the purposes of maintenance, product optimisation and the creation of statistical overviews for the customer, only aggregated usage data without personal references are read out. These data do not allow any conclusions to be drawn about individual users.
The company shall receive access to an online portal designated as „Cockpit“ for the duration of the collaboration: depending on the point of entry, either during a preceding free trial or pilot phase or at the commencement of the contractual relationship. This Cockpit is a password-protected web application that is exclusively accessible to authorised persons designated by the customer. The Cockpit provides all information relevant to the customer – in particular, current usage metrics as well as the respective up-to-date communication materials – in a structured and bundled form.
Additionally, the cockpit contains an overview of the participating users of the „Product“ system, which enables the customer's health management to track and manage any devices that have not been returned on time or are missing. This overview also serves as documentation of participation and the whereabouts of the devices. Furthermore, the cockpit shows which usage periods are expiring in the coming weeks – in each case with details of the user – so that the customer's health management can plan for future requirements.
Furthermore, aggregated and non-personal usage data regarding the application of the product are provided via the cockpit. Data is only displayed in the cockpit as soon as at least 10 (ten) data records are available, in order to rule out any traceability to individual persons. The data provided serves exclusively for the organisation-related, internal company analysis of usage by health management. The cockpit does not permit individual personal analyses. All individual evaluations and coaching functions are processed exclusively locally on the product as part of regular usage.
At regular intervals, usually once a month, a QR code is displayed to users on the product. By voluntarily scanning this QR code, users can view their individual health status assessment. This assessment includes, in particular, evaluations of ergonomics, sitting dynamics, and environmental factors such as lighting, air quality, and noise conditions. This individual assessment is provided anonymously and contains no personal data. Scanning the QR code is voluntary; users can skip this step at any time without incurring any disadvantages. The overarching results generated from the individual assessments are transmitted to the cockpit exclusively in aggregated form, without any personal reference, and following the user's explicit consent. Data can only be viewed once at least 10 (ten) data records are available.
Access to the cockpit can be set up even before a contract is concluded: a contact person acting on behalf of the company can register themselves for this, obtain a free test device and request a quote in the portal. During registration, we collect your first name, last name, business email address, telephone number, job title within the company, company name and a self-chosen password. In addition, we ask for information about the company and requirements: size category of office workstations, industry, and the topics for which Isa is to be used.
The purpose of the registration data is to set up access and to carry out the pre-contractual relationship, in particular the provision of a test device and the preparation of a quotation; the legal basis is Art. 6(1)(b) GDPR. The information on company size, industry and requirements also serves the purpose of needs-based advice and the preparation of a suitable quotation; the legal basis in this respect is Art. 6(1)(f) GDPR (legitimate interest in addressing the customer based on their needs). The access and contact data are described in more detail below.
Onboarding can also take place without self-registration, for example as part of a personal consultation or individually guided onboarding. In this case, we collect the same information as part of initiating the contract – in writing, by phone or in conversation – and subsequently set up access to the cockpit for the designated individuals. The purposes, legal bases and storage periods are the same in both cases; the only difference is the method by which we receive the information.
The cockpit is operated by Deep Care GmbH itself; the servers are located in a data centre belonging to Hetzner Online GmbH in Nuremberg (Germany), see section 12. For the use of the cockpit, we process the following data:
Access and contact details of the named persons: Name, business email address, corporate function as well as a self-chosen password in encrypted form. Optionally, a profile picture, provided the person uploads one. The purpose is the provision of access and the assignment of permissions. The legal basis is Art. 6 para. 1 lit. b GDPR (performance of a contract).
Company details Company name, billing address, VAT identification number, billing contact person, optionally a company logo and the permitted email domains for the booking portal specified by the customer. The purpose is contract processing and invoicing. The legal basis is Art. 6 para. 1 lit. b GDPR, and with regard to retention, Art. 6 para. 1 lit. c GDPR in conjunction with commercial and tax law retention obligations.
Server log data: When accessing the cockpit, the IP address, time of access, page accessed, amount of data transferred, as well as browser type and operating system are logged (cf. section 9). The purpose is operational security, error analysis, and the defence against attacks. The legal basis is Art. 6(1)(f) GDPR. The log data is deleted after 30 days at the latest.
Portal operating data: The cockpit saves display settings, login status and the progress of the tasks and introductions stored in the portal – such as which areas have already been accessed and which notes have already been seen. The sole purpose is the operation of the application so that introductions do not appear repeatedly and open tasks can be displayed; the legal basis is Article 6(1)(b) GDPR.
Profiling, performance or behavioural monitoring, and evaluation for advertising purposes do not take place; data is not passed on to third parties.
Health-related data is not processed in the cockpit.
The customer can designate additional individuals within their company as authorised via the portal. For this purpose, they provide their business email address and job title; we then send an invitation to set up a personal account. The purpose is the management of the customer's access permissions, with the legal basis being Art. 6(1)(b) GDPR. The customer is responsible for the lawfulness of disclosing their employees' contact details. The invited person is informed in the invitation of who nominated them and for what purpose the account is being set up.
Test devices and pilot positions can be obtained through the portal, quotes can be requested, and quotas can be ordered or expanded; these same processes can also be handled outside the portal, such as through a signed quote or an order by email. The data processed in this context includes details of the ordering company and the ordering person, billing data, the order and quote history, the status of the quota, as well as confirmation of the underlying contract terms including the time and version. The purpose is the initiation and performance of the contract, and invoicing; the legal basis is Art. 6(1)(b) GDPR, and with regard to retention, Art. 6(1)(c) GDPR in conjunction with retention obligations under commercial and tax law.
Customers can recommend Deep Care to other businesses. For this purpose, the portal provides a shareable link with a referral identifier. The referred business registers itself; we then process the referral identifier, the referred business and the status of the referral in order to be able to allocate the referring customer's reward. Contact details of third parties are not transmitted to us by the referring customer in the process. The amount of the reward is independent of the contract data of the referred business; its commercial data is neither communicated to the referring customer nor evaluated to determine the reward. The purpose is the implementation of the referral programme, the legal basis being Art. 6 (1) (b) GDPR with regard to the referring customer and Art. 6 (1) (f) GDPR with regard to the allocation of the referral.
In connection with the portal, we send out contract-related messages, in particular offers, order confirmations, invitations to the portal as well as shipping and return information. To arrange appointments – such as the kickoff meeting for a pilot project – we use the appointment booking function of our customer relationship management system; in the process, the name, email address and selected appointment of the person booking are processed. The purpose is the performance of the contractual or pre-contractual relationship, the legal basis is Art. 6 para. 1 lit. b GDPR. For the service providers used, see section 12.
Access data will be deleted as soon as the person in question is no longer designated as authorised, at the latest upon termination of the contractual relationship. If no contract is concluded, we shall delete registration and access data twelve months after the last contact at the latest. Data regarding invitations that are not accepted will be deleted after three months. The statutory retention periods apply to documents subject to commercial or tax law retention obligations – in particular quotes, orders and billing data.
The data generated during the use of the product and the data processed in the cockpit are not merged. Portal accounts of the designated authorised persons are not linked to Isa usage data.
If an authorised person uses an Isa themselves – for example as part of a test device – then solely the preceding provisions regarding the product shall apply to this usage: your Isa usage data shall remain locally on the device and shall only be incorporated into the evaluations in the cockpit with your explicit consent, without personal reference and in aggregated form from a minimum of 10 (ten) data records. Association with your portal account or display as an individual evaluation shall not take place.
In supporting the risk assessment through the product, Deep Care takes a very conservative approach to ensure the protection of user personal data. When the risk assessment function and its associated services are used by the user, the following processing operations take place:
a) During the analysis phase, several measurements of the product are taken. The evaluations and analyses of the results take place on-site on the product. Simple optimisations to the workstation are suggested directly by the product to the user on the device locally.
b) The final results of the analysis will be communicated in a reduced form, to an absolute minimum, via a QR code. This will be displayed on the product screen. These results are anonymous and do not contain any personal data.
c) The user is free to scan the provided QR code. If a suitable terminal device is used to scan the QR code, the information contained in the QR code will be transmitted to the Deep-Care.com server anonymously and without the collection of personal data. Following this, the user has the option to voluntarily provide their name and the associated company in order to generate a personalised evaluation in the form of a complete documentation or measurement report.
I. If this function is used as part of an official risk assessment, the report is sent by default to a central email address previously designated by the customer (e.g. to the responsible occupational safety specialist) to ensure structured recording in the context of the risk assessment. In addition, individual users are free to arrange for the additional transmission of the report to an email address entered individually by them.
II. Provided the function is used solely for employees to independently review their workplace without intended documentation in the sense of an official risk assessment, the user can only choose to have the report sent to their own email address on a voluntary basis; in this case, the report will not be automatically forwarded to the employer.
d) In addition, an anonymised version of the report – i.e. without stating the user's name or other identifying features – is stored in the customer's company-specific online portal („Cockpit“). Personal details, such as a name, which the user optionally provided during the creation of the report, appear exclusively on the full report, which is provided separately and not via the cockpit. This ensures that only authorised persons within the customer's company (usually the departments responsible for occupational safety or corporate health management) are able to access the relevant evaluations as part of the risk assessment and analyse them without it being possible to draw conclusions about individual natural persons.
The product is fully offline-capable for regular use – it requires neither a permanent internet connection nor the transmission of personal data to third parties.
However, to ensure technical safety, functionality and to provide new software features, an occasional software update may be required.
An update is carried out exclusively upon the express decision of the company or the user. In its factory setting, the product is configured so that it does not establish a connection to the Internet. A software update is therefore only possible if a temporary connection – e.g. via a local WLAN or a mobile hotspot – is set up manually.
The update process usually takes less than five minutes and can be carried out from any location (e.g. at home). During this process, only the serial number of the device is transmitted to the update server of Deep Care GmbH. No other data, in particular no personal or usage data, is transmitted, stored or evaluated. Once the update is complete, the product can be used in offline mode again.
For corporate clients, there is also the option to operate the product permanently in a mode where no update function is displayed or offered. In this case, the product remains completely offline, and there is no possibility of receiving future software updates. This may result in the product no longer being up-to-date with current technology over time.
The execution of software updates is solely for the purpose of improving the stability, security, and functionality of the product. The processing of the device serial number is carried out in accordance with Art. 6(1)(f) GDPR, based on the legitimate interest of Deep Care GmbH to ensure the technical safety and maintainability of the products. No profiling, analysis of user behaviour, or disclosure to third parties will take place.
Deep Care GmbH will in future provide an optional smartphone app for private end-users. Use of this app is entirely voluntary and is independent of using the product within the scope of company health management. The installation and use of the app are solely at the decision of the respective user on their private end devices.
Users have the option to connect the app to the product if they wish, in order to save and view certain usage statistics locally on their own mobile device. Data transfer only takes place if the user explicitly activates this function and establishes the connection with the product. In this case, data transfer takes place exclusively between the product and the user's respective end device.
For business customers, providing this private app does not create any additional obligations, and its use by employees can be regulated or excluded internally as needed.
Under the GDPR, data subjects have the right of access to personal data concerning them (Art. 15), the right to rectification of inaccurate data (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and the right to object to processing based on a legitimate interest (Art. 21).
If processing is based on consent, this may be revoked at any time with effect for the future.
To exercise the rights available to data subjects, they can contact us at any time: datenschutz@deep-care.com
Please note that these rights apply exclusively to personal data. Data that has been fully anonymised and cannot be traced back to a natural person is no longer subject to the GDPR. Therefore, targeted deletion or information about such anonymised data is not possible.
Regardless of this, there is the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The supervisory authority responsible for Deep Care GmbH is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg.
We mitigate any risks through technical and organisational measures (see section 10).
„A risk within the meaning of the GDPR is the existence of the possibility of the occurrence of an event which itself constitutes damage (including unjustified impairment of the rights and freedoms of natural persons) or may lead to further damage for one or more natural persons. It has two dimensions: firstly, the severity of the damage and secondly, the probability that the event and the consequential damage will occur.“ (cf. DSK_Nr18_Risiko_Lizenzvermerk (datenschutzkonferenz-online.de))
We have identified potential risks and mitigated them through appropriate protective measures to ensure the security, integrity and confidentiality of the personal data entrusted to us.
We use appropriate technical and organisational security measures to protect users' data against accidental or intentional manipulation, partial or complete loss, destruction, or unauthorised access by third parties, taking into account the state of the art, implementation costs, and the nature, scope, context, and purposes of processing, as well as the existing risks of a data breach (including its probability and impact) for the user.
Our security measures are continuously improved in line with technological developments.
We use tools and plugins to improve the security of the website and our internal systems. We collect log data that arises during the operation of our company's communication technology and on the website, and we analyse this data automatically to the extent necessary to detect, localise or eliminate disruptions or errors in the communication technology, or to defend against attacks on our IT infrastructure, or to detect and defend against malware.
During maintenance and software updates for the product, only the device's serial number and IP address will be encrypted and transmitted via SSL over the internet.
To ensure a level of protection appropriate to the risk of data processing under the contract and service addenda, the contractor has implemented the following technical and organisational measures:
Documentation of the technical and organisational measures taken within the scope of operating the Cockpit Services are available under https://www.hetzner.com/AV/TOM.pdf available from the subcontractor (see Section 12).
| Measure | Implementation of the measure |
|---|---|
| Access control Measures that are suitable for preventing unauthorised persons from gaining access to data processing facilities used to process or utilise personal data. Access control measures for building and room security can include, among others, automatic access control systems, the use of chip cards and transponders, access control by gate staff and alarm systems. |
Access to the office premises is restricted to authorised personnel with a personal transponder or key card. The office areas are secured by an electronic locking system with access logging. Outside of working hours, access is only possible via the security service. |
| Access control It must be prevented that data processing systems can be used by unauthorised persons. Access control means the unauthorised prevention of the use of facilities. Examples of possibilities include boot passwords, user IDs with passwords for operating systems and software products used, screen savers with passwords, the use of chip cards for logging in, and the use of callback procedures. |
Access to internal systems is only permitted following successful authentication using a username and password. In addition, two-factor authentication (2FA) is used for all administrative and cloud access. Automatic screen locks after inactivity are enabled. Master user records are managed centrally and reviewed regularly. |
| Access control It must be ensured that those authorised to use a data processing system can exclusively access the data subject to their access authorisation, and that personal data cannot be read, copied, modified or erased without authorisation during processing. Access control can be ensured, among other things, by means of suitable authorisation concepts that allow for differentiated control of access to data. |
We ensure that only authorised persons have access to your personal data. This data is stored exclusively in German data centres operated by Hetzner Online GmbH, specifically on physical servers in Nuremberg. Access is strictly limited to authorised employees of Deep Care GmbH who have a clearly defined maintenance mandate. All employees involved in the collection, processing or use of personal data receive regular training on data protection and security matters and are bound to data secrecy (Datengeheimnis). The server environment is secured by the following technical and organisational protection measures: • Load Balancer Protection: The servers are positioned behind a load balancer that regulates access from the public network and only permits legitimate traffic. • Monitoring and logging: All safety-related accesses and system activities are logged and regularly reviewed. |
| Forwarding control It must be ensured that personal data cannot be read, copied, altered or removed without authorisation during electronic transmission, transport or storage on data carriers, and that it can be verified and determined to which recipients personal data transmissions by data transmission facilities are intended. To ensure confidentiality during electronic data transmission, encryption techniques and Virtual Private Networks can be used, for example. Measures for data carrier transport or data transfer include transport containers with locking mechanisms and regulations for data protection-compliant destruction of data carriers. |
HTTPS Encryption: All user connections to the booking portal are exclusively via encrypted HTTPS connections. |
| Input check It must be ensured that it can be subsequently checked and determined whether and by whom personal data has been entered, modified, or removed from data processing systems. Input control is achieved through logging, which can take place at various levels (e.g., operating system, network, firewall, database, application). |
Incoming data traffic is protected by a configurable firewall. Only specified IP addresses – e.g. from the DeepCare office – are permitted. Monitoring and logging: All security-related accesses and system activities are logged and regularly reviewed. In addition, changes to data at the application layer are logged and regularly evaluated. |
| Availability check It must be ensured that personal data is protected against accidental destruction or loss. This includes aspects such as uninterruptible power supplies, air conditioning, fire protection, data backups, secure storage of data carriers, virus protection, RAID systems, disk mirroring, etc. |
Regular backups: Automated daily data backups are created to prevent data loss. Deep Care GmbH has an internal disaster recovery procedure that describes measures to ensure data availability and system functionality in the event of technical failures or security incidents. This procedure is regularly reviewed and updated as part of internal risk management. |
| Separation control It must be ensured that data collected for different purposes can be processed separately. This can be guaranteed by, for example, the logical and physical separation of the data. |
Data from different customers and application areas are processed in a logically separated, multi-tenant system. Development, test, and production systems are completely separated. The separation occurs at both the database and application levels. Access to test systems is only permitted for authorised developers, and production data must not be used there. |
This data protection concept is regularly updated as part of internal reviews and adapted to legal or technical changes. Responsibility for maintenance and further development lies with the management of Deep Care GmbH in consultation with the Data Protection Officer. The current version is documented internally and clearly version-controlled.
Subcontractor checks (contractual position, DPA, third-country transfers pursuant to Articles 44 et seq. GDPR).
Processing takes place within the EU or the EEA. In the event that a service provider processes personal data outside the EEA in individual cases – particularly in the United States – the transfer is based on the EU-US Data Privacy Framework and additionally on the standard contractual clauses of the European Commission.
| Company name, address (including country) | Description of subcontractor performance |
|---|---|
| Hetzner Online GmbH Industriestr. 25 91710 Gunzenhausen Germany |
hosting services, cloud storage space Physical location: The servers are located in a certified Hetzner data centre in Nuremberg, Germany. Deep Care GmbH has concluded a data processing agreement with Hetzner Online GmbH. |
| IONOS SE Elgendorfer Str. 57 56410 Montabaur Germany |
Hosting services, email servers, DNS servers Physical location: The servers are located in a certified data centre in Karlsruhe (Germany). |
| HubSpot, Inc. / HubSpot Ireland Limited 2 Canal Park, Cambridge, MA 02141, USA resp. 1 Sir John Rogerson’s Quay Dublin 2 Ireland |
Customer Relationship Management (CRM): Management of contact and company data, quote and funnel status, appointment bookings, and receipt of form submissions from our website and portal. Physical location: Data storage takes place in HubSpot's EU data centre in Frankfurt am Main (Germany). In limited individual cases – such as for support access or when using integrated third-party applications – processing may take place outside the EU data centre. To this extent, transfers to the USA are made on the basis of the EU-US Data Privacy Framework, additionally on the basis of the Standard Contractual Clauses. A data processing agreement is in place with HubSpot. |
When you order Isa through the booking portal, we process the necessary details, such as your name, email address, delivery address, and start date. We require this data to organise the order, delivery, and usage. Health-related details are not collected in the booking portal.
After receiving the ISA, you have full control over the use and storage of your data yourself.
'Isa' essentially works offline. You can choose whether data is only available while in use, or if statistics are saved. You can delete saved data directly on the device at any time. Certain usage information, for example about settings, movement patterns, or exercises performed, is stored locally on the device depending on your selection.
When you use Isa, you can optionally indicate whether you are currently experiencing any discomfort (e.g., in your back or neck). This feature is optional. If you use it, your explicit consent will be obtained directly on your device. This information is used to tailor your coaching more individually and to support you with prevention and relief of discomfort. The processing of this information takes place exclusively locally on the device. No data is transferred to your company or to Deep Care. Your company will not have access to this data. Providing this information is voluntary. You decide for yourself at any time whether you want to provide information. You can withdraw your consent at any time in the settings and delete all corresponding data. This will not result in any disadvantages for your use of Isa.
Your company does not receive personal individual analyses from your usage. Only aggregated data that cannot be traced back to individuals is displayed in the company portal. Therefore, a display only occurs from at least 10 data records.
For data protection queries, please contact us at any time at datenschutz@deep-care.com Contact.
You are currently viewing a placeholder content from Facebook. To access the actual content, click the button below. Please note that doing so will share data with third-party providers.
More InformationYou are currently viewing a placeholder content from HubSpot Embedded Content. To access the actual content, click the button below. Please note that doing so will share data with third-party providers.
More InformationYou are currently viewing a placeholder content from HubSpot. To access the actual content, click the button below. Please note that doing so will share data with third-party providers.
More InformationYou are currently viewing a placeholder content from Hubspot Meetings. To access the actual content, click the button below. Please note that doing so will share data with third-party providers.
More Information