Privacy Policy | Website

‍Her-Medical-Aid GmbH | Last updated: April 2026 | Version 1.1

1. Data Controller & Contact

Below we inform you, in accordance with Art. 13 GDPR, about the processing of personal data when using the hermaid app (a CE-certified medical device for women in perimenopause and menopause).

Data Controller

Her-Medical-Aid GmbH (hermaid),
Entrepreneurship Hub Halle 21, 1st floor, Room A1-22
Schwartzkopffstraße 1, 15745 Wildau, Germany
‍
support@hermaid.me
Legally represented by: Anne Feldt and Susanne Feldt

Data Protection Officer

heyData GmbH, Schützenstraße 5, 10117 Berlin, Germany
Email: datenschutz@heydata.eu

Supervisory Authority

LDA Brandenburg, Stahnsdorfer Damm 77, 14532 Kleinmachnow, Germany
poststelle@lda.brandenburg.de | www.lda.brandenburg.de

2. Your Rights as a Data Subject

You can exercise the following rights at any time by emailing support@hermaid.me or datenschutz@heydata.eu:

Access

Art. 15

What data we process about you and for what purpose

Correction

Art. 16

Correction of inaccurate or incomplete data

Deletion

Art. 17

Deletion of your data (unless retention obligations apply)

Restriction

Art. 18

Temporary restriction of processing

Data Portability

Art. 20

Receive your data in a machine-readable format

Objection

Art. 21

To processing based on legitimate interests

Withdrawal

Art. 7 III

Withdraw any consent given at any time with future effect

Complaint

Art. 77

With the LDA Brandenburg or another supervisory authority

Notice of Your Right to Object under Art. 21 GDPR

To the extent we process your data based on legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR) — in particular for aggregated usage analysis and secure app operation — you have the right to object to this processing at any time.

To object: support@hermaid.me or in the app settings under "Profile."

Following an objection, we will no longer process your data for the relevant purposes, unless there are compelling legitimate grounds that outweigh your interests (Art. 21 para. 1 GDPR).

3. Data Processing on the Website

3.1 Visiting the Website & Server Logs

Every time you visit our website, your browser automatically transmits information to our servers, which we store in what are known as server log files. This includes your IP address, the date and time of access, the URL accessed, the browser and operating system used, the referrer URL, and the amount of data transferred.

We have a legitimate interest in ensuring the stable and secure operation of the website. The legal basis is Art. 6 para. 1 sentence 1 lit. f GDPR. The data is deleted after 30 days at the latest, unless a statutory retention obligation applies.

‍

3.2 Email Newsletter

We send newsletters and marketing emails through two separate channels:

Nutzer-Newsletter

Tool/Anbieter: Brevo (Sendinblue SAS, Paris, FR)

Empfängerkreis: App-Nutzerinnen und Website-Abonnentinnen

Rechtsgrundlage: Bestandskundschaft: Art. 6 I f DSGVO (Direktwerbung, Ewgr. 47); Sonstige: Art. 6 I a DSGVO (Einwilligung)

B2B-Kommunikation & HR

Tool/Anbieter: HubSpot (HubSpot Inc., USA)

Empfängerkreis: Unternehmenskontakte, Bewerberinnen, Partnerinnen — nicht App-Nutzerdaten

Rechtsgrundlage: Art. 6 I f DSGVO; Drittlandtransfer: EU-US Data Privacy Framework (DPF)

Brevo processes open and click rates exclusively in aggregated form (no individual user tracking). § 25 para. 1 TDDDG applies to sending via Brevo insofar as tracking pixels are set — use is consent-based. Every email contains a simple unsubscribe link. Processing by Brevo takes place within the EU.

We use external services for hosting and fast delivery of our website. Meta/communication data (e.g. IP address, usage and content data) is transmitted in the process. The legal basis in all cases is Art. 6 para. 1 sentence 1 lit. f GDPR — we have a legitimate interest in providing sufficient storage and delivery capacity.
‍

3.3 Hosting & Content Delivery Networks (CDN)

Webflow (Hosting)

Anbieter & Sitz: Webflow, Inc., 398 11th St., San Francisco, CA 94103, US

Datenverarbeitung: AUS-Server; Meta-/Kommunikationsdaten

Drittlandtransfer: Angemessenheitsbeschluss (EU-US DPF)

Vercel (CDN)

Anbieter & Sitz: Vercel Inc., 340 S Lemon Ave Unit 4133, Walnut, CA 91789, USA

Datenverarbeitung: Datenverarbeitung auf EU-Servern; US-Unternehmen

Drittlandtransfer: Standardvertragsklauseln (SCCs) gem. Art. 46 Abs. 2 lit. c DSGVO

Cloudflare (CDN)

Anbieter & Sitz: Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, US

Datenverarbeitung: AUS-Server; Meta-/Kommunikationsdaten

Drittlandtransfer: Angemessenheitsbeschluss (EU-US DPF)

Amazon CloudFront (CDN)

Anbieter & Sitz: Amazon Web Services, Inc., P.O. Box 81226 Seattle, WA 98108, US

Datenverarbeitung: AUS-Server; Meta-/Kommunikationsdaten

Drittlandtransfer: Angemessenheitsbeschluss (EU-US DPF)

All providers listed are contractually bound as data processors under Art. 28 GDPR.

3.4 Contact Form

When you contact us via our web form, we store the data you enter (name, email address, message content) as well as meta/communication data. The legal basis is Art. 6 para. 1 sentence 1 lit. f GDPR — we have a legitimate interest in responding to inquiries directed to us. The data is deleted once the inquiry has been fully processed and no statutory retention obligation applies.

3.5 Job Postings & Applications

We publish job postings on our website as well as on third-party platforms. We process the data collected as part of the application process based on Art. 88 para. 1 GDPR in conjunction with § 26 para. 1 BDSG for the purpose of conducting the application process. We ask applicants to refrain from including information about political opinions, religious beliefs, or other special categories of data in their resume and cover letter. If such information is provided anyway, the legal basis is consent under Art. 9 para. 2 lit. a GDPR. We only share application data with responsible employees and, where applicable, data processors in the recruiting field. Once the process is complete, we delete applicant data no later than six months after rejection, unless the applicant has consented to further storage (in which case up to one year).

3.6 Booking Appointments

Through our website, you can arrange appointments with us. In doing so, we process the data you enter (name, email address, preferred appointment) as well as meta/communication data. Appointment booking takes place via our own technical infrastructure, without integrating external booking tools. The legal basis is Art. 6 para. 1 sentence 1 lit. f GDPR — we have a legitimate interest in enabling prospective clients to schedule appointments in a user-friendly way.

3.7 Third-Party Services

3.7.1 Piwik Pro (Website Analytics)

We use Piwik Pro to analyze usage behavior on our website. The provider is Piwik PRO SA, ul. Sw. Antoniego 2/4, 50-073 Wrocław, Poland. Piwik Pro processes meta/communication data (e.g. IP address, device data) exclusively on servers within the EU.
Processing takes place based on your consent. Legal basis: Art. 6 para. 1 sentence 1 lit. a GDPR and § 25 para. 1 TDDDG. You can withdraw your consent at any time with future effect by contacting support@hermaid.me or adjusting the settings in the cookie banner. Withdrawal does not affect the lawfulness of processing carried out before it. More information: https://piwikpro.de/datenschutz/

3.7.2 heyData Privacy Seal

Our website includes the privacy seal of heyData GmbH. The provider is heyData GmbH, Schützenstraße 5, 10117 Berlin, Germany. The provider processes meta/communication data (e.g. IP addresses) within the EU; the data is masked immediately upon collection so that no personal reference remains. The seal serves to provide website visitors with confirmation of our data protection compliance and to ensure that only customers with an existing contract use the certificate. Legal basis: Art. 6 para. 1 sentence 1 lit. f GDPR and § 25 para. 2 no. 2 TDDDG (technically necessary access). More information: https://heydata.eu/datenschutzerklaerung

3.7.3 HubSpot (B2B Communication & HR)

We use HubSpot to manage company contacts, communicate with business partners, and support our HR processes. The provider is HubSpot Inc., 25 First Street, Cambridge, MA 02141, USA. HubSpot processes contact data (name, email address, company) as well as communication data. App user data is not processed via HubSpot. Legal basis: Art. 6 para. 1 sentence 1 lit. f GDPR (legitimate interest in efficient B2B contact management). Third-country transfer to the USA: EU-US Data Privacy Framework (DPF). HubSpot is contractually bound as a data processor under Art. 28 GDPR.
More information: https://legal.hubspot.com/privacy-policy

3.7.4 Google Analytics (Webanalyse)

Zur Analyse des Nutzungsverhaltens auf unserer Website setzen wir zusätzlich Google Analytics ein. Anbieter ist Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Irland. Verarbeitet werden Meta-/Kommunikationsdaten (z. B. IP-Adresse, Gerätedaten, Nutzungsverhalten). Die Verarbeitung erfolgt auf Grundlage Ihrer Einwilligung (Art. 6 Abs. 1 S. 1 lit. a DSGVO, § 25 Abs. 1 TDDDG), die Sie über unser Cookie-Consent-Tool Usercentrics erteilen und jederzeit mit Wirkung für die Zukunft widerrufen können. Drittlandtransfer in die USA: EU-US Data Privacy Framework (DPF). Weitere Informationen: https://policies.google.com/privacy

3.7.5 AppsFlyer (Tracking-Links)

Für die Erfolgsmessung von Tracking-Links (z. B. Weiterleitungen von der Website in die hermaid-App im Google Play Store oder App Store) setzen wir AppsFlyer ein. Anbieter ist AppsFlyer Ltd., Tel Aviv, Israel; die Datenverarbeitung erfolgt auf Servern innerhalb der EU. Verarbeitet werden Meta-/Kommunikationsdaten (z. B. IP-Adresse, Geräte- und Kampagnendaten) zur Zuordnung von Klicks zu Installationen. Die Verarbeitung erfolgt auf Grundlage Ihrer Einwilligung (Art. 6 Abs. 1 S. 1 lit. a DSGVO, § 25 Abs. 1 TDDDG), die Sie über unser Cookie-Consent-Tool Usercentrics erteilen und jederzeit mit Wirkung für die Zukunft widerrufen können.

3.7.6 Usercentrics (Cookie-Consent-Management)

Für die Einholung, Verwaltung und Dokumentation Ihrer Cookie-Einwilligungen setzen wir das Cookie-Consent-Tool von Usercentrics ein. Anbieter ist Usercentrics GmbH, Rosental 4, 80331 München. Verarbeitet werden dabei Meta-/Kommunikationsdaten (z. B. IP-Adresse, Zeitpunkt und Umfang Ihrer Einwilligung) zum Nachweis der erteilten bzw. verweigerten Einwilligungen gemäß Art. 7 Abs. 1 DSGVO. Rechtsgrundlage: Art. 6 Abs. 1 S. 1 lit. c DSGVO (rechtliche Verpflichtung zum Nachweis der Einwilligung) sowie § 25 Abs. 2 Nr. 2 TDDDG für den technisch notwendigen Zugriff. Die Verarbeitung erfolgt innerhalb der EU.

3.7.7 Meta Ads (Facebook & Instagram Werbeanzeigen)

Zur Bewerbung unserer Angebote schalten wir zeitweise Werbeanzeigen über Meta Ads (Facebook und Instagram); dies erfolgt nicht kontinuierlich, sondern kampagnenbezogen. Anbieter ist Meta Platforms Ireland Ltd., 4 Grand Canal Square, Dublin 2, Irland. Dabei können mittels Meta-Pixel bzw. Conversions API Meta-/Kommunikationsdaten (z. B. IP-Adresse, Gerätedaten, Interaktionen mit unseren Anzeigen) verarbeitet werden. Die Verarbeitung erfolgt auf Grundlage Ihrer Einwilligung (Art. 6 Abs. 1 S. 1 lit. a DSGVO, § 25 Abs. 1 TDDDG), die Sie über unser Cookie-Consent-Tool Usercentrics erteilen und jederzeit mit Wirkung für die Zukunft widerrufen können. Drittlandtransfer in die USA: EU-US Data Privacy Framework (DPF). Weitere Informationen: https://www.facebook.com/privacy/policy/

5. General Privacy Notices

Data Security

All data transmissions are encrypted via SSL/TLS.
Our data processors are contractually bound under Art. 28 GDPR.

Third-Country Transfer

For transfers to countries outside the EEA, either an adequacy decision by the EU Commission (Art. 45 GDPR) or Standard Contractual Clauses (Art. 46 para. 2 lit. c GDPR) apply. The specific mechanism is indicated in each of the sections above.

Cookies & § 25 TDDDG

§ 25 TDDDG additionally applies to accessing or storing information on your device (cookies, pixels, scripts). Where consent is required (§ 25 para. 1 TDDDG), we obtain it via our cookie banner. Technically necessary access is based on § 25 para. 2 no. 2 TDDDG.

Storage Period

Data is deleted once the purpose of processing no longer applies — unless statutory retention obligations (e.g. up to 10 years under tax law) require otherwise.

Obligation to Provide Data

Only fields required for the relevant functionality (contact form, appointment booking, application) are mandatory. Other information is voluntary.

6. Changes to this Privacy Policy

We reserve the right to amend this Privacy Policy — for example, in the event of new website features or changed legal requirements. The current version is always available at hermaid.me. We will notify you separately of any material changes.

7. Questions & Comments

For questions or comments about this Privacy Policy, please contact:

Her-Medical-Aid GmbH

support@hermaid.me | Entrepreneurship Hub Halle 21, 1st floor, Room A1-22, Schwartzkopffstraße 1, 15745 Wildau, Germany

Data Protection Officer

heyData GmbH | datenschutz@heydata.eu