Privacy Policy

1. Data Controller

The data controller for data processing on this website is nu:dx Deutschland GmbH, Bürgerweide 24, 21423 Winsen (Luhe), email: support@nu-dx.com.

2. Collection and Processing of Personal Data

We collect and process your personal data exclusively for the purpose of processing your order, evaluating your samples, displaying your results, settling commissions with our partners, and sending our newsletter. Processing is based on your consent (Art. 6(1)(a) GDPR), for the performance of a contract (Art. 6(1)(b) GDPR), or on the basis of legitimate interests (Art. 6(1)(f) GDPR).

3. Newsletter

If you subscribe to our newsletter, we use your email address to regularly send you information about our products, offers, and news. You can unsubscribe from the newsletter at any time via the unsubscribe link in every email or by sending a message to support@nu-dx.com Your email address will be promptly deleted from the distribution list after unsubscription.

4. Disclosure to Third Parties

Your personal data will only be disclosed to third parties if this is necessary for the performance of the contract. This includes:

• Our partner laboratory that analyzes your samples.
• The payment service provider Stripe that processes your payment data.
• Shipping service providers for newsletter delivery.
• nu:dx partners, when an order came about through their referral link or coupon code. They learn only the date, amount, type and invoice number of the order, never your name or contact details. The legal basis is our legitimate interest in paying our partners correctly (Art. 6(1)(f) GDPR).

Beyond this, your data will not be disclosed to third parties unless you have expressly consented or there is a legal obligation to do so.

5. Connected Devices and Health Apps

In your customer account, you can voluntarily connect third-party devices and services to nu:dx so that the fitness and health values they record can be displayed alongside your test results. The connection is established via the OAuth 2.0 authorization procedure: you log in directly with the respective provider and grant us access to the data listed below. We never receive your login credentials for these services. We currently support:

• Oura Ring (Oura Health Oy, Elektroniikkatie 10, 90590 Oulu, Finland): Once you have granted access, we retrieve your user ID with the provider as well as your daily health and activity values via the Oura interface. This includes sleep duration and sleep score, readiness score, activity score, heart rate variability (HRV), resting heart rate, oxygen saturation (SpO₂), steps, calories burned, and recorded workouts (activity type, intensity, start and end, calories, distance). When you first connect, we transfer the history available in your Oura account; after that, new values are synchronized continuously. Oura also processes your data on servers outside the European Economic Area, in particular in the USA (see section 10).
• Withings (Withings SA, 2 rue Maurice Hartmann, 92130 Issy-les-Moulineaux, France): Once you have granted access, we retrieve your user ID with the provider, your body measurements (weight, body fat percentage, muscle mass, heart rate), and your daily activity values (steps, total and active calories, activity duration by intensity, average heart rate, and time spent in heart rate zones) via the Withings interface. New and changed values are synchronized continuously. Values that you delete in your Withings account are also removed from your nu:dx account during the next full synchronization. We additionally copy your most recent weight into the connected test profile so that analyses and recommendations can build on it; that value then forms part of your test profile and is kept if you disconnect or delete the transferred history.
• WHOOP (WHOOP, Inc., One Kenmore Square, Boston, MA 02215, USA): Once you have granted access, we retrieve your user ID with the provider as well as your daily health and activity values via the WHOOP interface. This includes day strain, steps, calories burned, average and maximum heart rate, the recovery score, heart rate variability (HRV), resting heart rate, oxygen saturation (SpO₂), skin temperature, sleep duration and sleep stages, sleep need and sleep performance, respiratory rate, the body weight stored in your WHOOP account, and recorded workouts (sport, strain, start and end, heart rate, calories, distance). When you first connect, we transfer the history available in your WHOOP account; after that, new values are synchronized continuously. WHOOP processes your data on servers in the USA (see section 10).

This data constitutes health data within the meaning of Art. 9 GDPR. We process it exclusively on the basis of your explicit consent (Art. 6(1)(a) in conjunction with Art. 9(2)(a) GDPR), which you give by connecting the respective account. Use of this feature is voluntary; without a connection, all other nu:dx services remain available to you unchanged. The values are used solely for display and analysis in your customer account, are not disclosed to any further third parties, and are not used for advertising purposes.

In order to retrieve the data on a recurring basis, we store the access and refresh tokens issued by the provider, the scope of the access granted, the connection status, and the time of the last synchronization. We also set up notifications with the provider so that new measurements are reported to us promptly.

You can disconnect at any time in your customer account or revoke access directly with the provider. Upon disconnection, we revoke the authorization you granted via the provider's interface, so that no permission for nu:dx remains on their side either, delete the stored access and refresh tokens from our database, and end the notifications; no further data is retrieved after that. When disconnecting, you choose whether the values already transferred are kept or deleted immediately. They are also removed when the associated test profile is deleted; if your customer account is deleted, after the period stated in section 6.

6. Storage Duration

We store your personal data only for as long as is necessary for the fulfilment of the purposes for which it was collected, or as required by law. Once the purposes have been fulfilled or the statutory retention periods have expired, your data will be deleted.

You can request deletion of your customer account yourself in the account settings. After a 30-day period we anonymise the account and remove health and wearable data as well as the personal details of your test profiles. Signing in during that period restores the account. Orders, invoices and lab results (including samples and analysis data) are retained because we are required to keep them under tax and medical law.

7. Your Rights

You have the right:

• In accordance with Art. 15 GDPR, to request information about the data stored by us.
• In accordance with Art. 16 GDPR, to request the prompt rectification of inaccurate data or completion of your personal data stored by us.
• In accordance with Art. 17 GDPR, to request the deletion of your personal data stored by us, unless other legal requirements (e.g. statutory retention obligations) prevent this.
• In accordance with Art. 18 GDPR, to request the restriction of processing of your personal data.
• In accordance with Art. 20 GDPR, to receive your personal data in a structured, commonly used, and machine-readable format, or to request its transfer to another controller.
• In accordance with Art. 21 GDPR, to object to the processing of your data if it is based on legitimate interests.
• In accordance with Art. 7(3) GDPR, to withdraw your previously given consent to us at any time.

To exercise your rights, you can contact us at support@nu-dx.com.

8. Error Monitoring

To ensure the stability and security of this website, we use the Sentry service provided by Functional Software, Inc., 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA.

If a technical error occurs, we automatically transmit information that allows us to diagnose and fix it. This may include the time of the error, the page accessed (without query parameters), the browser type, the operating system, and a technical error report (stack trace).

We have disabled the transmission of personal data as far as possible. No IP addresses, user accounts, cookies, form inputs, or request contents are sent to Sentry. Health data, laboratory results, and information from your customer account are not transmitted.

The legal basis is our legitimate interest in the functionality, security, and error-free operation of our offering (Art. 6(1)(f) GDPR). We do not use Sentry for reach measurement, and it does not set tracking cookies.

Error reports are stored in the European Union (Germany). We have a data processing agreement with Sentry pursuant to Art. 28 GDPR. Where Sentry staff in the USA may access the data, this transfer is based on the EU-US Data Privacy Framework and the EU Standard Contractual Clauses (see section 10).

Error reports are generally deleted automatically after 90 days.

You may object to this processing at any time by contacting us at support@nu-dx.com.

9. Cookies and Web Tracking

We use cookies and similar technologies. Which ones run depends on your choice in the cookie banner. You can change that choice at any time via "Cookie settings" in the footer.

• Google Analytics 4: A web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics 4 is only configured after you consent to the Statistics category. Cookies are then set and usage data (pages visited, without search parameters or access codes, device, approximate region) is sent to Google. Storage is usually in the EU; access from the USA is possible and relies on the EU-US Data Privacy Framework and the EU standard contractual clauses. The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG).
• Google Ads: An advertising service of Google Ireland Limited. If you consent to the Marketing category, we set cookies to measure and personalise ads. Even without that consent the site loads the Google tag and sends cookieless signals to Google: the page visited without search parameters or access codes, the previous page, the browser type, an approximate region, the consent state and events such as a purchase value. No advertising cookies are set, and click identifiers from ads are removed. These signals are used to estimate ad performance. The legal basis is our legitimate interest in measuring our advertising (Art. 6(1)(f) GDPR). You can object by contacting us at the address above. You can withdraw consent to marketing cookies via the cookie settings.
• Vercel Web Analytics: An audience service of Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA. Vercel Web Analytics does not use cookies. Visitors are recognised by a hash of the request for that day, not across days or websites. Pages visited, referrers, device and an approximate location are collected in aggregated form. The legal basis is our legitimate interest in anonymous audience measurement (Art. 6(1)(f) GDPR).
• reviews.io: Reviews from REVIEWS.io Limited, 29–35 Forresters Building, St Nicholas Place, Leicester, LE1 4LD, United Kingdom, load only after you consent to the External media category. Your IP address may be sent to reviews.io. The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG).
• Vimeo: Videos from Vimeo.com, Inc., USA, load only when you play them. Your IP address is then sent to Vimeo. We use the parameter dnt=1, which asks Vimeo not to set tracking cookies. The legal basis is your consent by pressing play (Art. 6(1)(a) GDPR, § 25(1) TDDDG).
• Font Awesome: Icons are loaded via a stylesheet from kit.fontawesome.com (Fonticons, Inc., USA). Your IP address is sent to the provider. No analytics cookies are set. The legal basis is our legitimate interest in a consistent presentation of the website (Art. 6(1)(f) GDPR).
• Consent cookie: We store your choice in the cookie "cookieConsent" for 12 months. It contains the version of the request, the time and your decision on statistics, marketing and external media. The cookie is required to honour your decision. The legal basis is § 25(2)(2) TDDDG.
• Partner referral links: If you open our website through a partner’s referral link (an address with the parameter "partner"), we store that partner’s code in the cookie "nudx_partner" for 30 days. Only our own website sets and reads the cookie, and it contains nothing but this code. If you order within these 30 days, we credit the order to that partner in order to pay their commission; another partner’s link replaces the code. No usage profile is created, and the code is not passed to Google or any other third party. Because working with our partners is part of our service, we set the cookie regardless of your choice in the cookie banner. The legal basis for storing it is § 25(2)(2) TDDDG; for crediting the order it is our legitimate interest in paying our partners correctly (Art. 6(1)(f) GDPR). You can object at any time by deleting the cookie in your browser or by contacting us at the address above (Art. 21 GDPR). It cannot be switched off in the cookie settings.

You can withdraw consent at any time with effect for the future by clicking "Cookie settings" in the footer and turning categories off. Processing that happened before the withdrawal remains lawful. You can also delete or block cookies in your browser.

10. Data Transfer to Third Countries

If we transfer personal data to a third country (i.e. outside the European Union (EU) or the European Economic Area (EEA)), we ensure that appropriate safeguards are in place, such as the conclusion of standard contractual clauses, to ensure an adequate level of data protection. This applies in particular to the connected device providers named in section 5, to the Sentry service named in section 8, insofar as staff of the provider in the USA may access error reports stored in the EU, and to the services named in section 9 where a transfer to a third country is described there.

11. Security Measures

We take technical and organizational measures to protect your data against loss, misuse, or unauthorized access. These measures are regularly reviewed and adapted to the state of the art.

12. Contact for Data Protection Inquiries

If you have questions about data protection or wish to exercise your rights, you can contact us at support@nu-dx.com.