Privacy Policy.

Personal Data

“Personal data” means any information relating to an identified or identifiable natural person; a natural person is considered identifiable if they can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.

Processing

“Processing” means any operation or set of operations performed on personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination, or any other form of disclosure; the alignment or combination; the restriction, erasure, or destruction.

3.1. Access Data

When you visit our websites www.goodscare.com and www.gc-diagnostics.com, the browser used on your device automatically sends information to our website’s server. This information is temporarily stored in a so-called log file. The following information is collected automatically without any action on your part and stored until it is automatically deleted:

– IP address of the requesting computer
– Date and time of access
– Name and URL of the file accessed
– Website from which the access originated (referrer URL)
– browser used, as well as
– if applicable, your computer’s operating system and the name of your Internet service provider.

We process the data provided for the following purposes:

To ensure a smooth connection to the website,
to guarantee a user-friendly experience on our website,
to evaluate system security and stability, and
for other administrative purposes.

The legal basis for data processing is Article 6(1), first sentence, letter f of the GDPR. Our legitimate interest arises from the aforementioned purposes of data collection. The access data is not used for the purpose of drawing direct conclusions about your identity. Personal data is analyzed only to the extent necessary to ensure IT security, investigate misuse, or enforce or defend legal claims.

In addition, we use cookies and analytics services when you visit our website. You can find more detailed information on this in Sections 6 and 7 of this Privacy Policy.

3.2. Purchase of Goods and Services

If you purchase goods and services from us, we process the following personal data for contractual purposes in accordance with Art. 6(1), first sentence, lit. b of the GDPR:

– First name, last name, email, address
– Optional data: phone number and company name

The information marked as required is necessary for the conclusion and performance of the contract. Without this information, we are generally unable to process your order, fulfill the contract, or ship the goods.

We use Shopify to operate our online store. In connection with your order, we may process, in particular, order, contact, shipping, payment, and transaction data.
Depending on the payment method you select, payment data will be transmitted to the respective payment service providers. These may include, in particular, providers for Shop Pay, Visa, Mastercard,
American Express, Maestro, UnionPay, Apple Pay, Google Pay, and Klarna. Processing is carried out for payment processing purposes based on Art. 6(1), sentence 1, lit. b of the GDPR. The respective payment service providers’ own privacy policies apply in addition to this regarding their data processing.

3.3. Pharmacy Finder

If you have provided separate consent pursuant to Article 6(1), first sentence, letter a of the GDPR, we will publish your pharmacy’s contact information (e.g., pharmacy name, address, phone number, email address, and, if applicable, opening hours and service information) as part of the Pharmacy Finder so that users can find your pharmacy online.

Providing this data is voluntary. Without your consent, your pharmacy will not be published in the Pharmacy Finder.

You may revoke your consent at any time with future effect by contacting us at info@goodscare.com. The lawfulness of the processing carried out up to the time of revocation remains unaffected.

The data will be stored for the duration of its publication in the Pharmacy Finder. After you revoke your consent or the purpose for processing no longer applies, the data will generally be removed from the Pharmacy Finder immediately, provided that no legal retention obligations or legitimate interests in further storage prevent this.

Please note that the data published in the Pharmacy Finder is publicly accessible and, where applicable, available worldwide. We have no control over storage or further processing by third parties, such as search engines.

3.4. Newsletter

If you subscribe to our newsletter, we process your email address and, if applicable, your name to send you regular information about our products, offers,
news, and events.

Subscription to our newsletter generally follows a double opt-in procedure. This means that after you subscribe, we will first send you an email in which you must confirm your subscription. Only after this confirmation will your email address be added to our newsletter distribution list. If you do not confirm your subscription, your data will not be used for sending the newsletter and will be deleted after a reasonable period of time.

The legal basis for sending the newsletter is your consent pursuant to Art. 6(1), sentence 1(a) of the GDPR. The logging of your subscription and confirmation is based on Article 6(1), first sentence, (f) of the GDPR. Our legitimate interest lies in proving that the newsletter is sent lawfully and that the necessary consent has been granted.

Providing your email address is required to receive the newsletter. Additional information, particularly your name, is provided voluntarily. Without an email address, we cannot send you the newsletter.

You may withdraw your consent to receive the newsletter at any time with future effect. You will find an unsubscribe link in every newsletter. Alternatively, you may send your withdrawal via email to info@goodscare.com. The lawfulness of the processing carried out on the basis of your consent up until the time of withdrawal remains unaffected.

We use the following service providers to send and manage our newsletter:

– lempire SAS (provider of “lemlist”), 128 rue La Boétie, 75008 Paris, France;
– HubSpot Germany GmbH, Am Postbahnhof 17, 10243 Berlin.

These service providers process personal data on our behalf in accordance with Article 28 of the GDPR. In particular, the email address and, if provided, the name are processed. Recipients of the data may also include IT and hosting service providers, to the extent necessary for the technical provision and delivery of the newsletter.

The data processed via lemlist is stored within the European Economic Area on servers in France, which are hosted by OVH SAS, 2 rue Kellermann, 59100 Roubaix, France, as a subprocessor of lemlist, and is processed by OVH SAS.

To the extent that personal data is transferred to third countries in connection with the use of HubSpot, this is done only in compliance with the requirements of Articles 44 et seq. of the GDPR, in particular on the basis of an adequacy decision pursuant to Article 45 of the GDPR or EU Standard Contractual Clauses pursuant to Article 46(2)(c) of the GDPR. A copy of the relevant safeguards can be requested at info@goodscare.com.

We store your data for the purpose of sending the newsletter until you withdraw your consent. Upon withdrawal, we will delete your data from the newsletter distribution list, provided that no legal
retention obligations or legitimate interests in further storage prevent this. We may store data verifying your consent and your revocation for the duration of the statutory limitation periods.

If you have provided separate consent for this purpose, we analyze your usage behavior in connection with the newsletter. To do so, we use the services “lemlist” provided by lempire SAS, 128 rue La Boétie, 75008 Paris, France, and “HubSpot” provided by HubSpot Germany GmbH.

In particular, this may include recording whether and when you opened a newsletter, which links you clicked within it, and, if applicable, whether and when you unsubscribed from the newsletter.
For this purpose, tracking pixels and personalized links embedded in the newsletter may be used.

The analysis serves to tailor the newsletter to your interests, measure its reach and effectiveness, and optimize our content and communication. The legal basis for this processing is your separate consent pursuant to Article 6(1), first sentence, letter a of the GDPR. To the extent that information is stored on or retrieved from your device in this context, this is additionally based on Section 25(1) of the TDDDG.

You may revoke your consent to the measurement of performance and the analysis of your usage behavior at any time with future effect. You may revoke your consent by clicking the unsubscribe link in the respective newsletter or by sending a message to info@goodscare.com. The lawfulness of the processing up until the time of revocation remains unaffected.

If you have any questions, we offer you the option to contact us via a form provided on the website. To do so, you must provide a valid email address so that we know who is sending the inquiry and can respond to it. Additional information may be provided voluntarily.

Data processing for the purpose of handling and responding to your inquiry is based on Article 6(1), first sentence, letter b of the GDPR, provided your inquiry relates to the conclusion or performance of a contract. In all other cases, processing is based on Article 6(1), first sentence, letter f of the GDPR. Our legitimate interest lies in the proper processing and response to your inquiry.

Providing your email address is required so that we can respond to your inquiry. Additional information is provided on a voluntary basis. Without a means of contact, we may not be able to process your inquiry at all or in full.

If you purchased the Igloo Reader Pro from us, the following personal data will be disclosed to goodscare GmbH’s partner (Dx365 UG, Hedwig-Porschütz-Straße 14, 10557 Berlin) for the purpose of maintenance, software updates, and technical support for the Igloo Reader Pro and processed in accordance with Art. 6(1), sentence 1, lit. b of the GDPR:

– Name
– Address
– Email address
– Customer number
– Device data (e.g., model, serial number)
– Information on previous maintenance or service operations

We also engage external service providers to deliver our services. These providers process personal data either as data processors acting on our behalf in accordance with our instructions or—to the extent permitted by law—as independent data controllers.

Recipients or categories of recipients may include, in particular:

– Hosting and IT service providers;
– Providers of our online store system;
– Payment service providers, banks, and credit card companies;
– Shipping and logistics service providers;
– Providers of analytics, tracking, and consent management services, to the extent you have consented to such services;
– Customer service and technical support service providers;
– Tax advisors, auditors, legal advisors, insurance companies, and government agencies, to the extent required by law.

Personal data is transferred to countries outside the European Union or the European Economic Area only to the extent necessary for the use of specific service providers. If no adequacy decision has been issued by the European Commission for the third country in question, an adequate level of data protection is ensured, in particular, by entering into the European Commission’s Standard Contractual Clauses and, where necessary, by implementing additional safeguards. Information regarding the specific recipients, the third countries involved, and the underlying appropriate safeguards can be found in the details for the respective services in this Privacy Policy.

Otherwise, we will only disclose your personal data to third parties if:

– you have given us your consent to do so pursuant to Art. 6(1), sentence 1, lit. a GDPR;
– the disclosure is necessary pursuant to Art. 6(1), sentence 1, lit. f GDPR to assert, exercise, or defend legal claims and does not conflict with any overriding legitimate
of the data subject;
– we are legally obligated to disclose the data pursuant to Article 6(1), first sentence, letter c of the GDPR;
– the disclosure is necessary pursuant to Article 6(1), first sentence, letter b of the GDPR for the performance of a contract with you or for the implementation of precontractual measures.

We use cookies on our website. Cookies are small text files that may be stored on your device by our website when you visit it.

We use the “Real Cookie Banner” consent management tool to manage and document the cookies and similar technologies we use, as well as the consents you have provided in this regard.
For more information on data processing by “Real Cookie Banner,” please visit https://devowl.io/de/rcb/datenverarbeitung/.

To the extent that the use of the consent management tool is technically necessary, the storage or retrieval of information on your device is based on Section 25(2) of the TDDDG. The associated processing of personal data is based on Article 6(1), first sentence, letter f of the GDPR. Our legitimate interest lies in the legally compliant management and documentation of your cookie consents.

To the extent that cookies or similar technologies are not technically necessary, we use them exclusively with your consent in accordance with Section 25(1) of the TDDDG. The subsequent processing of personal data is based on Article 6(1), first sentence, letter a of the GDPR. You may revoke or modify your consent at any time with future effect via the settings in our cookie banner.

We use technically necessary cookies to the extent required to provide our website and its basic functions. We use cookies and similar technologies for analysis, audience measurement, or optimization only with your consent; you can find more detailed information on this in Section 7.

The use of cookies serves, on the one hand, to make your experience with our services more pleasant. For example, we use so-called session cookies to recognize that you have already visited individual pages of our website. These are automatically deleted when you leave our site.

In addition, we also use temporary cookies to optimize user-friendliness; these are stored on your device for a specific, predetermined period of time. If you visit our site again to use our services, the system automatically recognizes that you have previously visited us and recalls the entries and settings you made, so you do not have to re-enter them.

We also use cookies to collect statistical data on the use of our website and to optimize our service for you. When you return to our website, these cookies allow us to automatically recognize that you have visited us before. These cookies are automatically deleted after a certain period of time.

Most browsers automatically accept cookies. However, you can configure your browser so that no cookies are stored on your computer or so that a notification always appears before a new cookie is created. Please note, however, that completely disabling cookies may prevent you from using all features of our website.

We use analytics and tracking tools to statistically analyze the use of our website, optimize our offerings in terms of technology and content, and measure the reach and effectiveness of our marketing activities.

To the extent that information is stored on or read from your device in this process, this is done exclusively with your consent in accordance with Section 25(1) of the TDDDG. The subsequent processing of personal data is based on Article 6(1), first sentence, letter a of the GDPR. You may revoke your consent at any time with future effect via the settings on our cookie banner.

7.1 Google Analytics

We use Google Analytics 4 (“GA4”) on our website, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Google Analytics enables us to analyze and statistically evaluate the usage behavior of visitors to our website in order to optimize our online offering in terms of both technology and content, as well as to measure the reach and effectiveness of our marketing measures.

When using Google Analytics, the following data in particular is processed: usage and interaction data (e.g., page views, click paths, time spent on the site, scroll and click events), device and technical information (e.g., browser type, operating system, screen resolution), approximate location information, as well as referrer and campaign information. In addition, pseudonymous online identifiers such as cookie or device identifiers may be used. According to Google, IP addresses are not permanently stored in GA4 but are used solely to derive approximate location information and are subsequently discarded.

The use of Google Analytics is based exclusively on your consent.
The legal basis for setting and reading cookies or comparable technologies is Section 25(1) of the TDDDG. The legal basis for the subsequent processing of personal data is Article 6(1), first sentence, letter a of the GDPR. You may revoke your consent at any time with future effect via the settings in our cookie banner.

Google processes the collected data on our behalf as a data processor in accordance with Article 28 of the GDPR. It cannot be ruled out that personal data may be transferred to Google LLC in the United States. Google LLC is certified under the EU-U.S. Data Privacy Framework. The transfer is based on the European Commission’s adequacy decision for the EU-U.S. Data Privacy Framework pursuant to Article 45 of the GDPR.

The retention period for data processed within the scope of Google Analytics is determined by our settings in Google Analytics and is currently 14 months. For more information on
data processing by Google, please see Google’s Privacy Policy at https://policies.google.com/privacy.

7.2. Other tools

Our website includes features of the Skype communication service. The provider is Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA.

To the extent that the integration of Skype results in information being stored on or read from your device, or in personal data being transmitted to Microsoft or Skype servers, this occurs only with your consent in accordance with Section 25(1) of the German Telecommunications Data Protection Act (TDDDG) and Article 6(1), first sentence, (a) of the General Data Protection Regulation (GDPR).

In particular, your IP address, device and browser information, and usage data may be processed. Personal data may be transferred to third countries, in particular the United States.

For more information, please visit: https://privacy.microsoft.com/de-de/privacystatement

8.1. Access Data

For security reasons (e.g., to investigate cases of misuse or fraud), access data is stored on our hosting provider’s servers for a maximum of 90 days and then deleted. Data that must be retained for evidentiary purposes is exempt from deletion until the respective incident has been fully resolved.

8.2. Cookies and IP Addresses Processed by Third Parties

The retention period for individual cookies and similar technologies is specified in our cookie banner. Session cookies are generally deleted at the end of the respective browser session. Other cookies are stored for the duration indicated in the cookie banner.

We store records of consent that has been granted or revoked, to the extent necessary, for the duration of the statutory limitation periods in order to be able to demonstrate compliance with data protection requirements.

The retention period for data processed as part of Google Analytics is currently 14 months. Further information can be found in Section 7.1 of this Privacy Policy.

8.3. Contract Data

Once the contract has been fully fulfilled, your data will generally be deleted, provided that no statutory retention obligations preclude this. Such obligations arise in particular from the German Commercial Code (HGB) and the German Fiscal Code (AO) and typically amount to six (6) or ten (10) years. During the period covered by the statutory retention obligations, the data is stored exclusively to fulfill these legal obligations and is not processed for any other purposes.

In addition, we store personal data to the extent necessary to assert, exercise, or defend legal claims. In this regard, the retention period is governed by the statutory limitation periods, which generally amount to three (3) years, beginning at the end of the year in which the claim arose and we became aware of the circumstances giving rise to the claim or should have become aware of them had it not been for gross negligence (Sections 195, 199 BGB).

8.4. Pharmacy Finder

We store and publish data in the Pharmacy Finder for the duration of your consent or until such consent is revoked. Upon revocation of consent or the cessation of the purpose, the data will generally be removed from the Pharmacy Finder without delay, provided that no statutory retention obligations or legitimate interests in further storage preclude this.

8.5. Other Input Data

We store other data entered via the contact forms for as long as we need it to process your request, provided this data is not subject to tax-related,
commercial or other statutory retention periods (retention periods range from 2 to 10 years) or we require this data to fulfill data protection documentation and evidence requirements, as well as to defend against legal claims.

You have the right:

Pursuant to Article 15 of the GDPR, to obtain information about your personal data that we process. In particular, you may request information regarding the purposes of the processing, the categories of personal data, the categories of recipients to whom your data has been or will be disclosed, the intended retention period, the existence of a right to rectification, erasure, restriction of processing, or objection; the existence of a right to lodge a complaint; the source of your data in the case of data not collected by us; and the existence of automated decision-making, including profiling, and, where applicable, relevant information regarding this.

Pursuant to Article 16 of the GDPR, to request without undue delay the rectification of inaccurate personal data stored by us or the completion of incomplete personal data.

Pursuant to Article 17 of the GDPR, to request the erasure of your personal data stored by us, unless the processing is necessary for the exercise of the right to freedom of expression and
information, to comply with a legal obligation, for reasons of public interest, or to assert, exercise, or defend legal claims.

Pursuant to Article 18 of the GDPR, to obtain the restriction of the processing of your personal data if you contest the accuracy of the data, the processing is unlawful but you oppose its erasure, and we no longer need the data but you require it to assert, exercise, or defend legal claims, or if you have objected to the processing pursuant to Article 21 of the GDPR.

Pursuant to Article 20 of the GDPR, to receive the personal data you have provided to us in a structured, commonly used, and machine-readable format, or to have it transmitted to another controller.

To withdraw your consent granted to us at any time pursuant to Article 7(3) of the GDPR. This means that, as of that point in time, we may no longer continue processing the data based on that consent.

To lodge a complaint with a supervisory authority pursuant to Article 77 of the GDPR. You can generally do this with the supervisory authority in your country of habitual residence, your place of work, or the location where our company is headquartered. The supervisory authority responsible for us is the Hamburg Commissioner for Data Protection and Freedom of Information, Ludwig-Erhard-Straße 22, 20459 Hamburg, Phone: +49 40 42854-4040, Fax: +49 40 42854-4000, Email: mailbox@datenschutz.hamburg.de.

If your personal data is processed on the basis of legitimate interests pursuant to Article 6(1), first sentence, letter f, you have the right under Article 21 of the GDPR to object to the processing of your personal data if there are reasons arising from your particular situation or if the objection relates to direct marketing. In the latter case, you have a general right to object, which we will honor without requiring you to provide a specific reason.

You can exercise your right of withdrawal or objection by sending an email to info@goodscare.com.

We do not engage in automated decision-making, including profiling, as defined in Article 22(1) and (4) of the GDPR.

Should we in the future process personal data for a purpose other than that for which the data was originally collected, we will inform you of the new purpose and all other relevant information prior to such further processing.

Improvements to our website and our product offerings, or changes in legal or regulatory requirements, may necessitate an amendment to this Privacy Policy. You can access and print the most current Privacy Policy at any time on our website at https://goodscare.com/privacy-protection and https://gc-diagnostics.com/datenschutz/.

This Privacy Policy is current as of August 2026.