Privacy Policy

As of 8 October 2026

Scope

This privacy policy applies to the website s-h-e.me (gsoond.com redirects there) and to the SHE Portal at my.gsoond.com, our protected customer area. It is also the privacy information you acknowledge when entering the Portal.

Data Controller

gsoond gmbh, Arndtweg 5, 4020 Linz, Austria. Contact for data protection matters: impressum@gsoond.com.

The website s-h-e.me

The website s-h-e.me is operated by a web host in Germany that processes data on our behalf. The product images in the "SHE for you" area are served by our Portal server (my.gsoond.com); like any web server it receives your IP address for that request.

Server Logs (IP Address)

When you visit our website, information is automatically stored on the web server. This includes the browser used, the operating system used, the page from which you accessed our website, the IP address, the time of access, and other information. In our view, this data is pseudonymised and cannot be attributed to a specific person without additional data sources. We do not evaluate this data unless the website is used unlawfully. The legal basis is our legitimate interest in secure operation (Art. 6(1)(f) GDPR).

For the AI-supported features (SHE asks, protein/fibre calculator) and for the login and purchase endpoints, we additionally process the IP address for a short time to detect and block automated bulk requests and abuse; the data is automatically deleted after a short period. The legal basis is our legitimate interest in secure operation (Art. 6(1)(f) GDPR).

Cookies and Consent

Cookies are small text files that are sent when you visit a website and are temporarily stored on the user's device. The website s-h-e.me itself does not set any cookies. Your choice in the cookie banner is stored in your browser's local storage ; this entry contains only your decision and its timestamp, is never transmitted to us and remains until you change it via "Cookie Settings" or clear the site data in your browser. After a purchase the thank-you page remembers an identifier of your purchase in the same way so that a purchase is counted only once.

In the cookie banner you decide separately about two categories: Statistics(Google Analytics, Microsoft Clarity, Leadfeeder) and Marketing (Meta Pixel, Google Ads). Both are switched off by default; the corresponding services are only loaded and cookies only set after you have explicitly consented to that category. Declining is just as easy as consenting. You can change or withdraw your choice at any time via the "Cookie Settings" link in the footer; after a withdrawal no new data is collected, and scripts already loaded end with the next page view. The SHE Portal only sets technically necessary cookies for login and contains no analytics or advertising services at all.

External Services on the Website

Google Analytics: Only after your consent via the cookie banner do we use Google Analytics (GA4), a web analytics service provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; Google LLC, USA, as parent company). Google Analytics uses cookies or similar technologies to evaluate your use of our website (e.g. pages visited, time spent, approximate origin, device used) in a pseudonymised manner. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with future effect via "Cookie Settings" in the footer. Data transfer to Google LLC in the USA is based on the EU-US Data Privacy Framework, to which Google is certified. Further details on Google's data processing: policies.google.com/privacy.

Microsoft Clarity: Only after your consent via the cookie banner do we also use Microsoft Clarity, a web analytics service provided by Microsoft Ireland Operations Limited (One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland; Microsoft Corporation, USA, as parent company). Clarity creates anonymised click and scroll heatmaps as well as session recordings of your website usage to improve usability. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with future effect via "Cookie Settings" in the footer. Further details on Microsoft's data processing: privacy.microsoft.com.

Leadfeeder (Dealfront): Only after your consent via the cookie banner do we use Leadfeeder, a service provided by Dealfront Group GmbH (Durlacher Allee 73, 76131 Karlsruhe, Germany). Leadfeeder matches the IP address of your internet connection against a directory of corporate networks and thereby shows us which companies have visited our website and which pages they viewed. Individual persons are not identified; visits from private connections are not attributed to any company. For this purpose Leadfeeder sets a cookie (_lfa) in order to group repeat visits within the same session. Processing takes place exclusively within the EU; no transfer to a third country occurs. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with future effect via "Cookie Settings" in the footer. Further details on Dealfront's data processing: dealfront.com/privacy-notice.

Meta Pixel (Facebook, Instagram): Only after your consent to the "Marketing" category do we load the Meta Pixel provided by Meta Platforms Ireland Limited (Merrion Road, Dublin 4, Ireland). It lets us measure whether visitors found us through one of our ads on Facebook or Instagram. Your IP address, device information and the pages you view are transmitted to Meta and linked to an existing Meta account where applicable; transfers to Meta Platforms, Inc. in the USA take place on the basis of the EU-US Data Privacy Framework. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time via "Cookie Settings" in the footer. Without your consent the pixel is not loaded. At present (see date above) the Meta Pixel is not set up and is not loaded even after consent.

Google Ads (conversion measurement): Only after your consent to the "Marketing" category do we measure with Google Ads (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) whether a visit originates from one of our ads. We use Google Consent Mode v2: without your consent no advertising cookies are set and no identifiers are processed for advertising purposes. The legal basis is your consent (Art. 6(1)(a) GDPR), withdrawable via "Cookie Settings". At present Google Ads measurement is not set up either.

Fonts, images and videos: All fonts, images and the preview images of our Instagram and YouTube posts are served from our own server; no connection to Google or Meta is made when the page is displayed. Instagram videos are played from a copy on our server. A YouTube video (on the "About us" page and in the social media tiles on the home page) only loads once you start it by clicking the play button. With that click you establish a connection to YouTube (Google Ireland Limited) in privacy-enhanced mode (youtube-nocookie.com), and your IP address is transmitted to Google. Further information: policies.google.com/privacy.

AI-supported features (SHE asks, protein/fibre calculator): When you ask a question or upload a photo/text for analysis, this information is transmitted to a provider of AI-supported services (processor) for processing. We do not permanently store your request with personal reference; processing takes place statelessly for each individual request. In addition, we process the IP address for a short time to prevent abuse (see "Server Logs" above). Only after your consent via the cookie banner do we also record via Google Analytics that a question was asked or an analysis was requested (including the language and whether the request succeeded) — the content of your question or the photo itself is never sent to Google Analytics.

Medical appointments (Latido): The link "Book an appointment online" on the "About us" page leads to the external booking platform Latido (patient.latido.at) for medical appointments at the practice. When booking there, Latido's privacy policy applies; the data you enter is transmitted directly to Latido. SHE workshops are not booked via Latido but as described in the next section.

Purchase, Subscription, Booking and "Get it for free"

Through the forms on s-h-e.me (purchase dialog in the "SHE for you" area, subscription sign-up, workshop booking, "Get it for free") you send your first name, last name and email address — for workshops also your phone number and remarks — together with your decisions regarding the terms, immediate delivery and the SHE Letter directly to our SHE Portal (my.gsoond.com). The website itself stores none of it.

For paid offers the Portal stores nothing before payment. You are redirected to Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland) for payment; you enter your payment details exclusively at Stripe, we never see them. Only after successful payment does Stripe notify us of the purchase, and we create your customer account, the invoice and the access. Stripe is an independent controller for payment processing; details: stripe.com/privacy. The legal basis is performance of the contract (Art. 6(1)(b) GDPR); we keep invoices for seven years under Section 132 of the Austrian Federal Fiscal Code (BAO).

For "Get it for free" your account is only created when you click the login link in the email we send you (double opt-in). Until then we hold your details for at most one hour in a volatile cache; if you do not click, they are discarded.

SHE Letter (email marketing): Only if you actively tick the box "Yes, send me the SHE Letter" do we send you our letter with news and offers. A purchase alone is not treated as permission. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 174 of the Austrian Telecommunications Act 2021); every letter contains an unsubscribe link, and you can withdraw the permission in your Portal profile at any time. We log your decision with a timestamp.

Emails (login links, invoices, purchase confirmations, SHE Letter) are sent via an email service provider as our processor; your email address and the content of the message are transmitted for this purpose. For accountability we keep a dispatch log (recipient address, subject, time, delivery status).

The SHE Portal (my.gsoond.com)

The SHE Portal is our protected customer area. You log in exclusively via a login link that we send to your email address (no password). An account is created through a purchase, a booking, "Get it for free" or by us as part of a programme; there is no open self-registration. The Portal is excluded from search engines and contains no analytics or advertising services.

What the Portal processes: master data (name, email, where applicable phone, address, date of birth), purchases, invoices and subscriptions, which content you have opened (for "Keep going" and course progress), your consents with timestamp and IP address, and an access log (who accessed which data and when, with IP address) that serves to protect your data. The legal basis is performance of the contract (Art. 6(1)(b) GDPR) or our legitimate interest in the security of the Portal (Art. 6(1)(f)).

Health data (Art. 9 GDPR) is processed only with your explicit consent, which we ask for only where such data arises: before your first diary entry, before your first use of the SHE Chat, and as part of the SHE programmes (check-in, check-out, reports, sensor data). You can withdraw this consent at any time in your Portal profile under "Privacy"; afterwards we store no new health data, and existing entries can be deleted by you or on your request. The voluntary consent to pseudonymised use for research and programme improvement ("gender data gap") is asked together with the health consent and can be withdrawn separately.

AI features in the Portal (SHE Chat, SUPERFRIDGE, report texts): Your question in the SHE Chat or the photo of your fridge is transmitted to a provider of AI-supported services (processor) to generate the answer; chat messages are automatically checked for signs of an acute crisis so that support contacts can be shown to you if needed. Fridge photos are not stored. The chat history is stored in your account so you can read it again. The AI does not make diagnoses and takes no decisions with legal effect for you.

Notifications: Reminders and messages appear in the Portal behind the bell icon. Only if you explicitly allow push notifications in your browser do we store the device key required for this; push messages are delivered through your browser vendor's service (Apple, Google or Mozilla). You can revoke the permission in your browser at any time.

Retention: Portal data is kept as long as your account exists. On your request we delete your account including health data; invoice data is kept for seven years under Section 132 BAO, consent logs for as long as we have to prove the consent.

Processors

To operate the SHE Portal we use service providers that process data on our behalf, namely for database, application operation and file storage, for email delivery, for AI-supported features and for encrypted data backup. Payment processing is handled by Stripe (Stripe Payments Europe, Ltd., Ireland) as an independent controller.

Where service providers process data outside the European Economic Area, we base this on an adequacy decision of the European Commission or on standard contractual clauses.

Contacting Us

If you contact us by email or phone, the data you provide will be stored by us for six months for the purpose of processing your request and in case of follow-up questions. We do not pass on this data without your consent.

Principles of Processing Personal Data

The processing of personal data is based on strict principles that regard the protection and security of the data, as well as the rights of the data subjects, as paramount.

Lawfulness and transparency: Data processing is carried out lawfully and in good faith. The data subject is informed at the time the data is collected about the intended processing and the handling of the data.

Purpose limitation: Data is collected and processed for specified, explicit and legitimate purposes. The data is not processed in a manner incompatible with these purposes.

Data minimisation: Only the data strictly necessary for the specified purposes is collected and processed. Where this is possible in order to achieve the purpose and the effort involved is reasonable, only anonymised data is processed.

Storage limitation and deletion: Personal data is deleted as soon as the purpose for which it was originally collected lapses and statutory retention periods do not prevent deletion. Where legitimate interests worthy of protection exist with regard to this data in an individual case, it will continue to be retained until such interest has been legally clarified.

Data security: Personal data is subject to data confidentiality. The data is treated confidentially and is protected by appropriate organisational and technical measures against unauthorised access, unlawful manipulation or disclosure, as well as against loss and destruction.

Factual accuracy: Personal data is kept accurate, complete and up to date. Appropriate measures are taken to correct outdated, incorrect or incomplete data.

Commitment to confidentiality: All our employees are contractually bound to confidentiality and are regularly instructed and trained on the secure handling of personal and other sensitive data.

Rights of Data Subjects

Every data subject whose personal data is processed by us may at any time invoke and exercise their own rights as a data subject. To exercise your rights as a data subject, you may contact us in writing at any time by email at impressum@gsoond.com.

Right of access: Data subjects may at any time request information about which personal data concerning them is being processed and for which purposes this processing is carried out.

Right to rectification: Data subjects have the right to demand the prompt correction of incorrect personal data concerning them.

Right to restriction: Data subjects have the right to restriction of processing where the accuracy of the data concerning them is contested, the processing is unlawful, the data is no longer needed for the processing, or the data subject has objected to the processing.

Right to object: Data subjects have the right to object at any time to the processing of personal data concerning them.

Right to data portability: Data subjects have the right to receive the personal data concerning them that they have provided to us in a structured, commonly used and machine-readable format. They also have the right to request that this data be transmitted to another controller, provided this is technically feasible. Portability applies only to personal data processed by automated means.

Erasure — right to be forgotten: The data subject has the right to demand the prompt deletion of personal data concerning them where the legal basis for processing the data is missing or no longer applies, where the data subject has objected to the processing, where the data processing is unlawful, and where no statutory retention periods prevent deletion. The exercise of data subject rights is only possible following unambiguous identification of the data subject. Data subjects also have the right to lodge a complaint with the data protection authority at any time.

Data Transfer

Personal data is transferred to recipients outside the company as well as to recipients in third countries only in accordance with applicable law and on a lawful basis, and with the highest regard for confidentiality and data security. We engage various data processors for certain processing activities (see "External Services" above). Where required, these processors are contractually bound to comply with applicable data protection provisions.