Privacy information for customers and patients of Adon Health UG

(As of December 2025)

1. Subject matter of this privacy notice

This privacy notice informs you, in accordance with Art. 13 of the General Data Protection Regulation (GDPR), about how personal data is processed by Adon Health UG if you use the services of Adon Health UG. In particular, you receive information about the type, scope, purposes and legal bases of the data processing, about possible recipients of personal data, as well as about your rights as a data subject.

This privacy notice applies exclusively to customers and patients of Adon Health UG and relates to the processing of personal data in connection with the ordering and performance of test kits, the organization and provision of laboratory services and laboratory results, the facilitation of telemedicine treatment consultations with independent cooperating doctors, the transmission of medical prescriptions to pharmacies, and, if expressly requested, the use of personal data for scientific or quality assurance purposes. The processing of personal data in connection with the purely informational use of the website is not the subject of this privacy notice.

2. Controller

The controller within the meaning of Art. 4 No. 7 GDPR for the processing operations described in this privacy notice is the 

Adon Health UG (limited liability),
Falkenstraße 11F
81541 Munich, Germany
Email: support@adon-health.de

In the event of questions about or technical problems with our platform, you can contact us by email at hallo@adon-health.de.

Adon Health is not a medical facility and does not itself provide medical services. The company operates a digital platform through which medical services provided by independent third parties are organized, coordinated and facilitated technically and administratively.

3. Data Protection Officer

We have appointed a data protection officer in accordance with Art. 37 GDPR. This person monitors compliance with data protection requirements within our company and is available to you as an independent contact person for all questions related to the processing of your personal data and the exercise of your rights as a data subject.

You can contact our data protection officer confidentially at any time, especially if you have questions about this privacy notice, the processing of your personal data, or your rights under the GDPR.

Contact details of the data protection officer:

Email: dsgvo@datendo.de

Regardless of contacting our data protection officer, you are always free to contact us directly or the competent data protection supervisory authority regarding data protection concerns.

4. Categories of personal data

In the course of using the services of Adon Health, personal data is processed that you either provide yourself or that arises during the provision of the service by the cooperating partners involved. This includes general personal data, in particular identity, contact, contract, billing and organizational data.

In addition, depending on the specific scope of the service, special categories of personal data within the meaning of Art. 9(1) GDPR are processed. This includes, in particular, health data such as information about symptoms, complaints, pre-existing conditions, medication, results of medical questionnaires, laboratory values, as well as medical findings and prescription information.

5. Origin of the personal data

Personal data is generally collected directly from you, in particular within the framework of ordering, registration and booking processes, as well as through the medical questionnaires you complete. In addition, personal data may come from cooperating partners, in particular from laboratories in connection with the performance of laboratory analyses, as well as from treating cooperating doctors in connection with telemedicine treatment consultations and medical prescriptions. Finally, personal data may come from the service providers used, insofar as this is necessary for the provision of the services.

6. Purposes and legal bases of processing

6.1 General principles

Personal data is processed exclusively to the extent and for as long as this is necessary for the performance of the services you request or where a legal obligation exists. Where general personal data is processed, the processing is based, depending on the respective processing operation, on Art. 6(1)(b) GDPR, provided that the processing is necessary for the performance of a contractual relationship, or on Art. 6(1)(c) GDPR, provided that statutory retention obligations exist.

Where special categories of personal data, in particular health data, are processed, this is done exclusively on the basis of your prior, express consent pursuant to Art. 9(2)(a) GDPR in conjunction with Art. 6(1)(a) GDPR. Without such consent, the provision of the corresponding services is generally not possible.

6.2 Ordering and performance of test kits as well as laboratory process

If you order a test kit, Adon Health processes your personal data to process the order, clearly assign the test kit to you, collect medical questionnaire data, organizationally initiate the laboratory analysis, receive the laboratory results, and provide them to you. At your express request, the laboratory results can also be transmitted to a cooperating doctor selected by you. The processing of the health data required for this purpose is a mandatory prerequisite for the performance of the laboratory process.

6.3 Payment processing

Payment processing is carried out by external payment service providers. Adon Health regularly receives only billing-relevant information, such as payment status or transaction references, but not complete payment data such as credit card numbers. The processing of payment data is carried out for the performance of the contractual relationship as well as for the fulfillment of statutory bookkeeping and retention obligations.

6.4 Facilitation and organization of telemedicine treatment consultations

If you schedule an appointment for a telemedicine treatment consultation via the platform, Adon Health processes personal data for appointment organization, the technical performance of the video consultation, as well as organizational documentation at the platform level. The medical treatment itself is carried out exclusively by the cooperating doctor selected by you.

7. Allocation of roles between Adon Health and cooperating doctors

The treating cooperating doctors process your personal data within the framework of the medical treatment as independent controllers within the meaning of Art. 4 No. 7 GDPR and independently fulfill their data protection information and accountability obligations.

Adon Health, on the other hand, processes personal data to organize, coordinate, and technically support the platform services. Insofar as Adon Health acts on behalf of a doctor, for example by providing practice management software, technical documentation, or sending documents or invoices in the name of the doctor, this processing is carried out as data processing on behalf of the controller pursuant to Art. 28 GDPR. In these cases, the respective doctor is the controller, and Adon Health is the data processor.

8. Transmission of prescriptions to pharmacies

At your express request, Adon Health processes personal data to transmit a doctor-issued prescription to a pharmacy selected by you. This processing is also carried out exclusively on the basis of your consent.

9. Processing for scientific and quality assurance purposes

If you have separately consented, personal data may be processed for scientific or quality assurance purposes. The processing is carried out either in pseudonymized form on the basis of your consent or in fully anonymized form. Anonymous data are data that cannot be assigned directly or indirectly to a specific person; in this case, the GDPR does not apply. Publications are made exclusively in aggregated or anonymized form.

10. Recipients of personal data and access restrictions

Access to your personal data within Adon Health UG is granted exclusively to those employees who strictly need this data to fulfill the purposes described in this privacy notice. Access is restricted to the required minimum in each case and is based on a binding role and authorization concept. All employees are bound by confidentiality and are regularly trained in data protection.

The transmission of your personal data to external recipients is generally only carried out insofar as this is necessary for the performance of the services you request or you have expressly consented to it. This particularly concerns the transmission of data to medical cooperating partners as well as to technical and organizational service providers involved in the provision of the services.

In the course of performing laboratory services, we transmit the personal data required for the analysis, including health data, to our laboratory partner Remi Health GmbH, Am Mühlenberg 11, 14476 Potsdam, as well as to the laboratory that actually performs the respective analysis, currently in particular MOMA Test Labor, Am Mühlenberg 11, 14476 Potsdam. The transmission is carried out exclusively for the performance of the laboratory analysis and the return transmission of the examination results. The mentioned laboratory partners process your data within the framework of their respective medical and statutory obligations.

If you decide to use a telemedicine treatment consultation, we transmit the personal data required for this purpose, in particular master data, contact data, relevant medical history data, as well as laboratory results, to the treating doctor selected by you. The respective doctor processes your personal data within the framework of the medical treatment as an independent controller within the meaning of Art. 4 No. 7 GDPR. The data protection information obligations with regard to medical treatment are fulfilled independently by the treating doctor.

At your express request, we also transmit the personal data required for the redemption of a medical prescription, in particular prescription data as well as contact and identification data, to the pharmacy selected by you. The pharmacy also processes your personal data as an independent controller within the framework of statutory requirements.

In addition, we use selected IT and service providers for the technical and organizational performance of our services. These service providers only receive access to personal data to the extent required to provide the respective services they have been commissioned to perform, and process the data exclusively on our instructions.

These include, in particular:

  • Stripe Payments Europe Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland, as well as Shopify International Ltd., 2nd Floor, 1–2 Victoria Buildings, Haddington Road, Dublin 4, D04 XN32, Ireland, which are used as payment and processing service providers. These service providers process payment and billing-relevant data to carry out payment processing. Adon Health regularly receives no complete payment data, but only payment status and billing information. Further information on data transfers to Stripe Inc. can be found in Stripe's Privacy Notice and Shopify's Privacy Notice.
  • Shopify International Ltd., 2nd Floor, 1–2 Victoria Buildings, Haddington Road, Dublin 4, D04 XN32, Ireland, for the provision of the e-commerce platform. As a data processor, Shopify processes identification and contact data, order and transaction data, as well as usage and store activity data. Further information can be found in Shopify's Privacy Notice.

  • RED Medical Systems GmbH, Lutzstraße 2, 80867 Munich, whose practice management software we use to manage health data together with the doctor selected by you and to store it securely. Insofar as we operate this software on behalf of the doctor or provide technical support services, the processing is carried out as data processing on behalf of the controller pursuant to Art. 28 GDPR.
  • Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, (Google Workspace / Gmail) for the performance of individual digital customer communication, in particular for processing inquiries, contractual communication, as well as sending service-related information by email. In particular, the following personal data may be processed: contact data (e.g., name, email address), contract and customer data, communication content (e.g., email content, attachments, metadata such as sending and receiving times).
  • For the secure and encrypted transmission of personal data, in particular in exchange with laboratories and medical cooperating partners, we use the service of Zivver B.V., Spaklerweg 52, 1114 AE Amsterdam, Netherlands.
  • Sendinblue GmbH, operating under the Brevo brand, Köpenicker Str. 126, 10179 Berlin, for the management and performance of digital customer communication, in particular for sending emails in connection with existing or initiated contractual relationships (e.g., service information, reminders, follow-ups, as well as – if consent is present – marketing emails). In particular, the following personal data may be processed: contact data (e.g., name, email address), contract and customer data (e.g., status, product or service relationship), communication data (e.g., sending, opening, clicks of emails).
  • For the technical performance of telemedicine consultations, together with the treating doctor, we use the services of Facharzt-Sofort GmbH (Viomedi), Marktplatz 30, 94431 Pilsting, which provides the necessary secure video communication infrastructure.
  • We use Zapier, Inc., 548 Market St. #62411, San Francisco, CA 94104-5401, United States, as an automation and integration service to technically link various software services we use and automate processes (e.g., transmission of status information, triggering workflows, or synchronization of selected data). In this context, Zapier may temporarily receive access to personal data during technical processing, in particular: identification and contact data (e.g., name, email address), contract and customer data (e.g., status information), technical process and metadata (e.g., timestamps, trigger information).

Zapier is used exclusively for technical forwarding and automation and not for independent analysis or use of the data.

  • We use Zendesk, Inc., 181 Fremont Street, 17th Floor, San Francisco, CA 94105, United States, as a support and ticketing system to systematically collect, process, and document customer and patient inquiries.

Through Zendesk, in particular, support inquiries are processed, communication within the framework of existing or initiated contractual relationships is carried out, as well as the documentation of the support history. In particular, the following personal data may be processed: identification and contact data (e.g., name, email address), contract and customer data, communication content (e.g., inquiries, answers, attachments), support and case data (e.g., ticket status, timestamps, internal notes), technical metadata (e.g., timestamps).

Support inquiries may also contain health-related information if this is disclosed by the customer or patient.

  • Klaviyo, Inc., 125 Summer Street, Floor 6, Boston, MA 02110, United States, for the management and performance of digital customer communication, in particular for sending emails in connection with existing or initiated contractual relationships (e.g., service information, reminders, follow-ups, as well as – if consent is present – marketing emails). In particular, the following personal data may be processed: contact data (e.g., name, email address), contract and customer data (e.g., status, product or service relationship), communication data (e.g., sending, opening, clicks of emails).
  • We use Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855, Luxembourg, as a cloud infrastructure to operate our own software and securely store, process, and provide the data processed through it.

Through this infrastructure, our systems for contract processing, patient management, performance of medical services, as well as the technical provision and securing of data processing are operated. In particular, the following personal data may be processed: identification and contact data (e.g., name, email address), contract and customer data, health-related data (e.g., information from medical histories, medical questionnaires, and treatment documentation), technical usage and log data (e.g., access times, system logs)

  • We use Dropbox, Inc., 1800 Owens Street, San Francisco, CA 94158, USA (Dropbox Sign) as an electronic signature service to digitally provide contracts and forms, allow them to be filled out, and have them legally signed.

This includes, in particular, treatment contracts, master data forms, medical history forms, as well as medical questionnaires. In particular, the following personal data may be processed: identification and contact data (e.g., name, email address), contract and master data, health-related information from medical histories and medical questionnaires, signature and metadata (e.g., time of signing, IP address, document status).

  • Appointments for telemedicine treatment consultations are arranged via the portal of eTermin GmbH, Mättivor 3, 6430 Schwyz, Switzerland. The personal data processed in this context is limited to the information required for appointment scheduling. Processing is carried out on the basis of appropriate data protection guarantees.
  • We have concluded data processing agreements with all service providers that process personal data on our behalf in accordance with Art. 28 GDPR. These agreements ensure that personal data is processed exclusively according to our instructions, while maintaining confidentiality and complying with appropriate technical and organizational security measures.
  • Cooperating physicians gain access via the systems used exclusively to the personal data of patients with whom a specific treatment relationship exists. Access to the data of other customers is precluded by appropriate technical and organizational measures, in particular client and patient separation, role-based access concepts, and logging.

11. Transfer to Third Countries

Personal data is only transferred to countries outside the European Union or the European Economic Area if there is a legal basis for doing so. In such cases, the transfer is carried out on the basis of an adequacy decision by the European Commission or comparable appropriate safeguards.

12. Retention Period

Personal data is only stored for as long as is necessary to fulfill the respective purposes or as long as statutory retention obligations exist. Data processed on the basis of consent will be deleted upon withdrawal of consent or when the purpose of processing no longer exists, unless statutory retention obligations apply. Research data will be deleted or anonymized at the latest after ten years.

13. Voluntary Provision of Data

The provision of personal data is voluntary. However, the respective services cannot be provided without the data required for them.

14. Rights of Data Subjects

As a “data subject” within the meaning of Art. 4 No. 1 GDPR, you have certain non-waivable rights (data subject rights).

Adon Health is obliged to guarantee these data subject rights and must also contractually require the data processors it uses to provide the best possible support in implementing these rights. In this respect, you have the following data subject rights:

  • Right of access (Article 15 GDPR): You have the right to receive information from us about whether we process personal data about you and, if so, which data that is and for what purpose the processing takes place.
  • Right to rectification (Article 16 GDPR): You have the right to have inaccurate or incomplete personal data that we have stored about you corrected.
  • Right to erasure (Article 17 GDPR): Under certain circumstances, you have the right to request that we delete your personal data. This right exists, for example, if the data are no longer necessary for the purposes for which they were collected or if you have withdrawn your consent.
  • Right to restriction of processing (Article 18 GDPR): Under certain circumstances, you have the right to restrict the further processing of your personal data. This right exists, for example, if you contest the accuracy of the data or if the processing is unlawful.
  • Right to data portability (Article 20 GDPR): You have the right to receive a copy of your personal data from us in a structured, commonly used, and machine-readable format. You can also have this data transmitted to another controller, provided this is technically possible.
  • Right to object (Article 21 GDPR): You have the right to object to the processing of your personal data for reasons arising from your particular situation. We will then no longer process your data unless there are compelling legitimate grounds for the processing.
  • Right to withdraw consent (Article 7(3) GDPR): If we process your personal data on the basis of your consent, you can withdraw this consent at any time. The lawfulness of the processing up to the point of withdrawal remains unaffected.
  • Right to lodge a complaint with a supervisory authority (Article 77 GDPR): You have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data violates data protection provisions.

The competent data protection authority is:

Bavarian State Office for Data Protection Supervision (BayLDA)
Promenade 18
91522 Ansbach

You can assert your data subject rights at any time in writing or electronically by notifying Adon Health using the contact details listed in the “Controller” section of this privacy policy. In this context, Adon Health reserves the right to verify your identity through a suitable procedure.

15. Definitions

For the sake of clarity, we use certain terms in this privacy policy in the sense assigned to them by the GDPR. The following definitions are intended to clarify and ensure uniform interpretation. If any of the terms are unclear, you can contact Adon Health and/or the Data Protection Officer at any time.

  • “Controller” is, pursuant to Art. 4 No. 7 GDPR, the party that decides the purposes and means of processing personal data. It determines, above all, what, how, and for what purpose data is processed. It is responsible for the processing and must ensure that data protection regulations are complied with.
  • “Data processor” is, pursuant to Art. 4 No. 8 GDPR, the party that acts on behalf of the controller and processes personal data on its behalf.
  • “Personal data” are, pursuant to Art. 4 No. 1 GDPR, all information relating to an identified or identifiable natural person (“data subject”).
  • “Processing” means, pursuant to Art. 4 No. 2 GDPR, all possible types of data processing. This includes, in particular, the collection, recording, organization, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure, transmission, dissemination, linking, restriction, erasure, or destruction of personal data.
  • “Data subject” is, pursuant to Art. 4 No. 1 GDPR, the natural person to whom the data processed by the controller can be directly or indirectly attributed.
  • “Recipient” is, pursuant to Art. 4 No. 9 GDPR, the party to whom personal data is disclosed, regardless of whether it is a third party or not.
  • “Third party” is, pursuant to Art. 4 No. 10 GDPR, anyone other than the data subject, the controller, the data processor, and the persons authorized under the direct responsibility of the controller or the data processor to process the personal data.
  • “Special categories of personal data” are, pursuant to Art. 9(1) GDPR, in particular health data of the data subject. This data requires a higher level of protection.
  • “Health data” are, pursuant to Art. 4 No. 15 GDPR, personal data relating to the physical or mental health of the data subject and from which information about the health status of the data subject can be derived.
  • “Consent” means, pursuant to Art. 4 No. 11 GDPR, any freely given, specific, informed, and unambiguous indication of the data subject’s wishes in the form of a statement or another clear affirmative action (e.g., ticking a checkbox provided for this purpose), by which the data subject indicates that they agree to the processing of their personal data.
  • “Pseudonymization” means, pursuant to Art. 4 No. 5 GDPR, that personal data is processed in such a way that it can no longer be attributed to a specific person without additional information. This additional information must be kept separately, and measures must be taken to ensure that the data can no longer be attributed to an identified or identifiable person.
  • “Anonymization” describes, pursuant to DIN EN ISO 25237, the process by which personal data is irreversibly altered either by the controller responsible for processing the data alone or in cooperation with another party, such that the data subject can no longer be identified directly or indirectly.

16. Update of this Privacy Policy

Adon Health reserves the right to update this privacy policy with future effect to respond appropriately to changes in law, changes in case law, or changes in economic circumstances. Your rights as a data subject under the GDPR will never be restricted by an amendment to this privacy policy.