Privacy Policy

Data Controller

gsoond gmbh, Arndtweg 5, 4020 Linz, Austria. Contact for data protection matters: impressum@gsoond.com.

Purpose of Data Processing

We process personal data submitted through forms (e.g. contact and appointment requests) for the purpose of carrying out our business activities and fulfilling the related statutory and contractual requirements.

Server Logs (IP Address)

When you visit our website, information is automatically stored on the web server. This includes the browser used, the operating system used, the page from which you accessed our website, the IP address, the time of access, and other information. In our view, this data is pseudonymised and cannot be attributed to a specific person without additional data sources. We do not evaluate this data unless the website is used unlawfully.

For the AI-supported features (SHE asks, protein/fibre calculator), we additionally store temporarily how many requests are received from the same IP address within a 15-minute window (the IP address is only stored as a hash, not in plain text). This is used exclusively to detect and block automated bulk requests and abuse; the count is automatically overwritten once the window expires. The legal basis is our legitimate interest in a functional service free of abuse (Art. 6(1)(f) GDPR).

Cookies

Cookies are small text files that are sent when you visit a website and are temporarily stored on the user's device. When the corresponding server is accessed again, the browser sends the previously received cookie back to the server. This website itself does not set any technically necessary cookies. Non-essential cookies (e.g. from Google Analytics or Microsoft Clarity, see below) are only set after you have explicitly consented via the cookie banner shown when you visit the site. You can change or withdraw your choice at any time via the "Cookie Settings" link in the footer of the website. If embedded third-party content (see "External Services" below) sets its own cookies, you can additionally prevent this through the corresponding settings in your internet browser (e.g. Chrome, Firefox, Safari).

External Services & Third-Party Providers

Google Analytics: Only after your consent via the cookie banner do we use Google Analytics (GA4), a web analytics service provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; Google LLC, USA, as parent company). Google Analytics uses cookies or similar technologies to evaluate your use of our website (e.g. pages visited, time spent, approximate origin, device used) in a pseudonymised manner. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with future effect via "Cookie Settings" in the footer. Data transfer to Google LLC in the USA is based on the EU-US Data Privacy Framework, to which Google is certified. Further details on Google's data processing: policies.google.com/privacy.

Microsoft Clarity: Only after your consent via the cookie banner do we also use Microsoft Clarity, a web analytics service provided by Microsoft Ireland Operations Limited (One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland; Microsoft Corporation, USA, as parent company). Clarity creates anonymised click and scroll heatmaps as well as session recordings of your website usage to improve usability. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with future effect via "Cookie Settings" in the footer. Further details on Microsoft's data processing: privacy.microsoft.com.

AI-supported features (SHE asks, protein/fibre calculator): When you ask a question or upload a photo/text for analysis, this information is transmitted to OpenAI, L.L.C. (USA) for processing. We do not permanently store your request with personal reference; processing takes place statelessly for each individual request. In addition, our server counts how often these features are used from a given IP address within a short time frame (see "Server Logs" above) to prevent abuse. Only after your consent via the cookie banner do we also record via Google Analytics that a question was asked or an analysis was requested (including the language and whether the request succeeded) — the content of your question or the photo itself is never sent to Google Analytics.

External appointment booking: The "Book an appointment" button links to the external booking platform Latido (patient.latido.at). When making a booking, Latido's privacy policy applies; the data you enter there (e.g. name, contact details, requested appointment) is transmitted directly to Latido.

YouTube video embedding: Our "About us" page embeds a YouTube video. When this page is loaded, a connection is established to servers of YouTube/Google LLC (USA), through which your IP address is transmitted and cookies may be set. Further information: Google's privacy policy at policies.google.com/privacy.

Social media links: We link to our profiles on YouTube and Instagram and display preview images (thumbnails) of our public posts there. When these preview images are loaded, a connection is established to the servers of Google/YouTube or Meta (Instagram), through which your IP address is transmitted to these providers.

Contacting Us

If you contact us via a form on the website or by email, the data you provide will be stored by us for six months for the purpose of processing your request and in case of follow-up questions. We do not pass on this data without your consent.

Principles of Processing Personal Data

The processing of personal data is based on strict principles that regard the protection and security of the data, as well as the rights of the data subjects, as paramount.

Lawfulness and transparency: Data processing is carried out lawfully and in good faith. The data subject is informed at the time the data is collected about the intended processing and the handling of the data.

Purpose limitation: Data is collected and processed for specified, explicit and legitimate purposes. The data is not processed in a manner incompatible with these purposes.

Data minimisation: Only the data strictly necessary for the specified purposes is collected and processed. Where this is possible in order to achieve the purpose and the effort involved is reasonable, only anonymised data is processed.

Storage limitation and deletion: Personal data is deleted as soon as the purpose for which it was originally collected lapses and statutory retention periods do not prevent deletion. Where legitimate interests worthy of protection exist with regard to this data in an individual case, it will continue to be retained until such interest has been legally clarified.

Data security: Personal data is subject to data confidentiality. The data is treated confidentially and is protected by appropriate organisational and technical measures against unauthorised access, unlawful manipulation or disclosure, as well as against loss and destruction.

Factual accuracy: Personal data is kept accurate, complete and up to date. Appropriate measures are taken to correct outdated, incorrect or incomplete data.

Commitment to confidentiality: All our employees are contractually bound to confidentiality and are regularly instructed and trained on the secure handling of personal and other sensitive data.

Rights of Data Subjects

Every data subject whose personal data is processed by us may at any time invoke and exercise their own rights as a data subject. To exercise your rights as a data subject, you may contact us in writing at any time by email at impressum@gsoond.com.

Right of access: Data subjects may at any time request information about which personal data concerning them is being processed and for which purposes this processing is carried out.

Right to rectification: Data subjects have the right to demand the prompt correction of incorrect personal data concerning them.

Right to restriction: Data subjects have the right to restriction of processing where the accuracy of the data concerning them is contested, the processing is unlawful, the data is no longer needed for the processing, or the data subject has objected to the processing.

Right to object: Data subjects have the right to object at any time to the processing of personal data concerning them.

Right to data portability: Data subjects have the right to receive the personal data concerning them that they have provided to us in a structured, commonly used and machine-readable format. They also have the right to request that this data be transmitted to another controller, provided this is technically feasible. Portability applies only to personal data processed by automated means.

Erasure — right to be forgotten: The data subject has the right to demand the prompt deletion of personal data concerning them where the legal basis for processing the data is missing or no longer applies, where the data subject has objected to the processing, where the data processing is unlawful, and where no statutory retention periods prevent deletion. The exercise of data subject rights is only possible following unambiguous identification of the data subject. Data subjects also have the right to lodge a complaint with the data protection authority at any time.

Data Transfer

Personal data is transferred to recipients outside the company as well as to recipients in third countries only in accordance with applicable law and on a lawful basis, and with the highest regard for confidentiality and data security. We engage various data processors for certain processing activities (see "External Services" above). Where required, these processors are contractually bound to comply with applicable data protection provisions.