Legal

Privacy Policy

Last updated: 19.08.2026

This website is operated by Ivelion Health GmbH, Berlin, Germany (referred to as “we”, “us”, or “our”).

We are committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit ivelion.com, including any related media form, media channel, mobile website, or mobile application (collectively, the “Site”). Please read this policy carefully. If you do not agree with its terms, please do not access the Site.

We reserve the right to change this Privacy Policy at any time and for any reason. We will alert you to changes by updating the “Last updated” date. Please review this policy periodically to stay informed.

Legal basis for processing (GDPR)

Our legal basis depends on the data concerned and the context in which we collect it:

  • Email correspondence: Art. 6(1)(b) GDPR where your message concerns a contract or steps taken before entering into one, otherwise Art. 6(1)(f) GDPR, our legitimate interest in answering enquiries addressed to us.
  • Operating and securing the Site, including server log data: Art. 6(1)(f) GDPR, our legitimate interest in a stable, secure, and functioning website.
  • Website analytics with Google Analytics, and the storing and reading of the associated cookies: Art. 6(1)(a) GDPR and § 25(1) TDDDG, your consent.
  • The cookieless signal sent before you choose: Art. 6(1)(f) GDPR, our legitimate interest in a basic, non-individual measure of how this Site is used. You may object at any time under Art. 21 GDPR using the contact details above.
  • Storing your cookie choice: § 25(2) no. 2 TDDDG, because storing it is strictly necessary to honour the choice you expressly made, together with Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR, our obligation to be able to demonstrate consent.

Where processing rests on your consent, giving it is voluntary and refusing or withdrawing it carries no disadvantage: this Site remains fully usable either way.

Data controller

The data controller responsible for your personal data is:
Ivelion Health GmbH
Altensteinstraße 40
14195 Berlin
Germany
nils.zaenker@ivelion.com

Information we collect

We may collect information about you in a variety of ways. Information collected on the Site may include:

  • Personal data: Personally identifiable information, such as your name and email address, that you voluntarily provide when contacting us through the supplied email links. We collect only the information you choose to share.
  • Server log data: Our servers may automatically log standard technical information when you access the Site, including your IP address, browser type, operating system, access times, and referring website. This data is used primarily for site operation, security, and basic usage statistics, not to track individual behavior across websites.
  • Tracking technologies: This Site uses cookies for website analytics, and only after you have consented. If you accept analytics in our cookie banner, Google Analytics 4 sets two first-party cookies in your browser and records which pages you open, how you move between them, and which source brought you here. If you decline, or simply ignore the banner, no cookies are set and nothing is stored on your device. Every part of this Site works either way. We use no advertising, remarketing, or cross-site tracking technologies at all.

Use of your information

If you provide information by email, we will use it to contact you and discuss your questions or possible co-creation opportunities. Beyond that, we process only the technical server log data described above and, where you have consented, the website analytics data described under “Google Analytics” below. We do not use any of this data to build profiles of individual visitors, and we do not sell it.

Google Analytics

With your consent, this Site uses Google Analytics 4, a web-analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”), which processes the data on our behalf together with Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. The measurement ID of our property is G-3Q3M54PYVN.

We use Google Analytics for one purpose: to understand which pages are read, how visitors navigate the Site, and which sources bring them here, so that we can improve the content and structure of this Site. We do not use it for advertising, remarketing, audience building, or cross-site profiling. Google Signals, ads personalization, and data sharing with other Google products are switched off for this property.

Where you have consented, the following data may be processed:

  • Pages viewed, page titles and URLs, and the time and duration of the visit
  • The navigation path through the Site, including scroll depth and clicks on links leading away from this Site
  • The referrer and traffic source that brought you here, for example a search engine, a link on another site, or a direct visit
  • An approximate location, as a rule country, region, or city, derived from a truncated IP address
  • Device type, screen resolution, operating system, browser, and browser language, and the language you are reading this Site in
  • A randomly generated identifier stored in the analytics cookies, by which Google Analytics recognizes a returning browser

IP anonymization. IP anonymization is active. For traffic from the European Union, Google Analytics 4 collects the data on servers within the EU and truncates the IP address there before any further processing; full IP addresses are neither logged nor stored. The IP address serves only to derive the approximate location described above and is then discarded. It is never disclosed to us.

Cookies and storage periods. After you accept, Google Analytics sets two first-party cookies on this domain:

  • _ga: distinguishes browsers and stores the randomly generated identifier. Storage period: 2 years.
  • _ga_3Q3M54PYVN: maintains the session state for our property. Storage period: 2 years.

Legal basis. The legal basis for the use of Google Analytics, and for storing and reading the associated cookies on your device, is your consent under Art. 6(1)(a) GDPR and § 25(1) TDDDG. Consent is voluntary, is not a condition of using this Site, and can be withdrawn at any time with effect for the future. Withdrawal does not affect the lawfulness of the processing carried out before it.

Google Consent Mode v2. This Site implements Google Consent Mode v2. The signals for analytics storage, ad storage, ad user data, and ad personalization are set to “denied” before any Google tag runs, and the advertising signals remain denied permanently because we run no advertising on this Site. If you accept, the analytics signal is set to “granted” and the cookies described above are set. If you decline, or make no choice at all, no cookies are set or read and no identifier is stored on your device; Google receives only a cookieless signal that a page was opened, from which it produces aggregated, non-individual estimates of overall usage. We rely on Art. 6(1)(f) GDPR for that cookieless signal, our legitimate interest in a basic, non-individual measure of how this Site is used, and you can object to it at any time under Art. 21 GDPR using the contact details above.

How to withdraw your consent. Select Cookie settings at the foot of any page of this Site and choose “Decline”. Analytics cookies are deleted immediately and are no longer read. You can additionally delete cookies in your browser settings, or block collection permanently with the Google Analytics opt-out browser add-on .

Processing on our behalf. We have concluded a data processing agreement with Google under Art. 28 GDPR. Transfers to the United States are described under “International data transfers” below. Further information is available in Google’s privacy policy and in Google’s notes on data privacy and security in Google Analytics .

On your first visit, a banner asks whether you consent to cookies and similar technologies. It is worded in general terms; the analytics described above under “Google Analytics” is the only non-essential purpose for which we use such technologies, and that section sets out the processor, the cookies, their lifetimes, and the data involved. Until you choose, no analytics cookie is set. “Accept” and “Decline” are given equal weight and are equally easy to reach; declining costs you nothing and hides nothing.

We store your choice in your browser’s local storage under the key ivelion.consent, together with the date of the choice and a version number, so that we can demonstrate which version of this notice you were shown. This is not a cookie: it is never transmitted with your requests, is not readable by third parties, and stays on your device until you change your choice or clear your browser storage.

You can change or withdraw your choice at any time by selecting Cookie settings at the foot of any page. If you clear your browser storage, the banner will appear again on your next visit, because the record of your choice will have been deleted along with it.

Disclosure of your information

We may share collected information in certain situations:

  • By law or to protect rights: We may share information as permitted or required by applicable law if release is necessary to respond to legal process, investigate or remedy potential policy violations, or protect the rights, property, and safety of others.
  • Third-party service providers: We may share information with third parties that perform services for us or on our behalf, including hosting, email delivery, and website analytics. This Site is hosted on Firebase Hosting and, subject to your consent, measured with Google Analytics 4, both services of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. These providers act as processors on our instructions under data processing agreements pursuant to Art. 28 GDPR.
  • Business transfers: We may share or transfer information in connection with, or during negotiations for, a merger, sale of company assets, financing, or acquisition of all or part of our business.

Data security

We use administrative, technical, and physical safeguards to protect your personal information. Although we take reasonable steps to secure information you provide, no security measure is perfect or impenetrable and no transmission method can be guaranteed against interception or other misuse.

Data retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, including legal, accounting, or reporting requirements. Email correspondence is kept for as long as needed to handle your enquiry and any resulting business relationship, and thereafter for the periods German commercial and tax law requires.

Analytics data collected through Google Analytics is subject to a retention period of 14 months, measured from the last activity of the browser concerned. Google deletes the underlying user- and event-level records automatically at the end of that period. Aggregated reports, which contain no user- or event-level data, are unaffected.

Your data-protection rights (GDPR)

If you are a resident of the European Economic Area (EEA), you have the right to:

  • Access: Request access to your personal data.
  • Rectification: Request correction of inaccurate personal data.
  • Erasure: Request deletion of your personal data.
  • Restriction: Request restriction of processing.
  • Data portability: Request transfer of your personal data to you or a third party.
  • Object: Object to processing of your personal data.
  • Withdraw consent: Withdraw consent at any time where processing relies on your consent.

To exercise these rights, contact us using the details above. You may also lodge a complaint with a supervisory authority. The competent authority in Germany depends on your federal state or our registered office. A list is available from the Federal Commissioner for Data Protection and Freedom of Information (BfDI) .

International data transfers

We process personal data within the European Union wherever we can. Two parts of this Site involve a provider with a US parent company: hosting, which runs on Google Firebase Hosting, and, subject to your consent, website analytics with Google Analytics. In both cases our contractual partner is Google Ireland Limited in Dublin, and analytics data from the EU is collected on servers within the EU. Access by Google LLC in the United States, and by Google entities in other countries, cannot be ruled out, in particular for operation, support, and content delivery.

For those transfers we rely on two safeguards. Google LLC is certified under the EU-US Data Privacy Framework; by its adequacy decision of 10 July 2023 the European Commission found that the United States ensures an adequate level of protection for personal data transferred to certified organizations. You can verify the certification in the Data Privacy Framework List . In addition, and as a fallback for any transfer not covered by that decision, our agreement with Google incorporates the standard contractual clauses adopted by the European Commission under Art. 46(2)(c) GDPR.

Even with these safeguards in place, we cannot entirely exclude that US authorities may seek access to data held by US providers. If you would prefer that no data about your visit reaches Google at all, decline analytics in the cookie banner.

Contact us

For questions or comments about this Privacy Policy, contact nils.zaenker@ivelion.com.