Privacy Notice anomalie

Introduction

Welcome to anomalie. Your privacy is a cornerstone of our service. This Privacy Notice explains which personal data anomalie processes when you use our website, the anomalie web app (os.getanomalie.com), the anomalie iOS app and related services, why we do so, on which legal basis, who receives the data, where it is stored and how long it is kept. Your use of our services is subject to our Terms of Use.

anomalie helps you build and keep your Health Profile: anomalie connects your wearables and apps, extracts information from documents you upload, requests your existing medical records from doctors, laboratories and your health insurer on your behalf (only if you grant a power of attorney), organizes lab test results and presents all of this in your Health Profile. Most of this information is health data within the meaning of Art. 4(15) GDPR and therefore a special category of personal data under Art. 9 GDPR. We process it in compliance with the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the German Federal Data Protection Act (BDSG) and the German Telecommunications and Digital Services Data Protection Act (TDDDG).

1. Controller and Data Protection Officer

The controller for the processing of your personal data is anomalie GmbH, Marienburger Straße 26b, 10405 Berlin, Germany. Email: support@getanomalie.com

We have designated a data protection officer ("DPO"). You can reach our DPO with any questions or requests regarding your personal data:

• By post at the address above, with the addition "Attn: Data Protection Officer"
• By email: dpo@agent.getanomalie.com

2. Where your data is stored

• Database and file storage: Your account, your Health Profile, uploaded and retrieved health documents, your power of attorney, your signature and a copy of your ID document (if provided) are stored with our database provider Supabase in the region eu-central-1 (Frankfurt am Main, Germany).
• Application servers: Our web applications and server functions are hosted by Vercel and run in the region fra1 (Frankfurt am Main, Germany). Static files and cached pages are delivered through Vercel's global content delivery network, so your request may be answered by the edge location nearest to you.
• Providers outside the EU: Supabase, Inc. and Vercel Inc. are US companies. Even though your data is stored in Frankfurt, access by these companies (for example for support or under US law) cannot be fully excluded; we have concluded data processing agreements with them and safeguard such transfers as described in Section 6. Some features necessarily send data to providers outside the EU, in particular the AI services described in Section 3.F. Section 5 lists every recipient, and Section 6 explains how transfers to third countries are safeguarded.

3. Purposes and legal bases of processing

We process personal data only for specified purposes and on a valid legal basis. Because anomalie is a health service, the processing of health data is generally based on your explicit consent (Art. 9(2)(a) GDPR). You can withdraw any consent at any time with effect for the future (Art. 7(3) GDPR), in the App or by email to dpo@agent.getanomalie.com. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

A. Account and Health Profile (contract & explicit consent)

Data categories:

• Registration data: name, email address, password (stored only as a hash), and, if you sign in with Google or Apple, the identifier and email address provided by that service (with Apple, possibly a relay address).
• Profile data: date of birth, gender, postal address, phone number, health insurer and type of insurance, as far as you provide them.
• Health data: lab results, health markers, diagnoses and other clinical facts, medications, questionnaire (anamnesis) answers, wearable and fitness data, uploaded documents, appointment notes and everything else you add to your Health Profile.
• Data generated by anomalie: structured values extracted from your documents, calculated metrics, trends, summaries, recommendations and timelines.

Purpose: Creating and securing your account; storing, organizing and visualizing your information in your Health Profile; providing the features you choose.

Legal basis: Art. 6(1)(b) GDPR for registration and profile data. Art. 9(2)(a) GDPR for health data, based on the explicit consent you give during registration by an active opt-in. Without this consent, we cannot process health data and cannot provide the core functionality of anomalie.

Sign in with Google / Apple: If you choose this option, Google (Google Ireland Limited, Ireland / Google LLC, USA) or Apple (Apple Distribution International Ltd., Ireland / Apple Inc., USA) confirms your identity to us. These providers do not receive health data from us.

B. Uploading health documents (explicit consent)

You can upload documents (for example lab reports, doctor's letters, discharge letters, insurance statements) by photo or file.

Processing: The document is stored in a private storage bucket. anomalie reads the text (OCR), extracts values, diagnoses and other clinical facts using AI (see Section 3.F), and shows you the result for review. Values are only saved to your Health Profile after you confirm them. Documents that a connected AI assistant uploads on your instruction (Section 3.H) are saved directly; you can edit or delete the values afterwards. If an insurance statement lists the doctors and practices you have visited, anomalie may suggest them as record sources (see Section 3.C); no request is sent without your confirmation.

Legal basis: Art. 9(2)(a) GDPR.

C. Requesting your medical records with a power of attorney (explicit consent)

This optional feature lets anomalie collect your existing records from your health insurer, doctors, laboratories and clinics for you. It only starts after you have granted a separate power of attorney ("Vollmacht") in the App.

The power of attorney: Before granting it, you see its full wording in the App. You can read it again at any time under Account › Power of attorney, and we send you the wording before registration on request to dpo@agent.getanomalie.com. The power of attorney names anomalie GmbH as the authorized party. It is limited to requesting, following up on and receiving records that already exist. It does not authorize treatment decisions, applications, contract changes, cancellations, financial obligations, legal proceedings or disclosure to uninvolved third parties. Results of genetic examinations are only covered if you give separate written consent.

Who is contacted and which data is requested:

We only contact record holders that you have entered or confirmed. anomalie may identify doctors and practices from your insurer's data or from references in other records, but shows them to you in your Health Profile before the first contact.

How the requests are made: anomalie GmbH makes the requests itself; no external collection agency is involved. Each request is a letter sent by email from a mailbox assigned to your Health Profile on the domain agent.getanomalie.com, with the power of attorney attached as a PDF. Depending on the record holder's requirements, the letter is accompanied by your signature and a copy of your ID document. For statutory insurers, we request under § 305(1) sentence 2 SGB V that your data be sent to anomalie GmbH as the recipient you have named. We do not access your insurer's systems, an insurer app or your electronic patient record (ePA). Record holders reply by email, by upload to a secure upload portal operated by anomalie, by fax to our fax number, or by post to you. AI drafts and classifies parts of the correspondence (see Section 3.F); the first letter is sent automatically once your request is complete, and follow-up letters are reviewed and sent by our staff. Record holders may call the phone number you provided to confirm your identity.

Data processed: your name, date of birth, postal address, phone number, insurer and insurance number (if provided), your signature, a copy of your ID document (if provided), the content of the correspondence and the records you receive. Received records are processed like uploaded documents (Section 3.B) and only become part of your Health Profile after your review.

Source of data (Art. 14 GDPR): Your health insurer, doctors, laboratories and other record holders that you have authorized us to contact.

Legal basis: Your explicit consent under Art. 6(1)(a) and Art. 9(2)(a) GDPR, given together with the power of attorney. Through the power of attorney you also consent to your insurer transmitting your social data (§ 67b SGB X) and release the record holders from professional secrecy (§ 203 StGB) to the extent needed to confirm and transmit your records.

Validity and withdrawal: The power of attorney is valid until you withdraw it. You can withdraw it in whole or in part at any time with effect for the future under Account › Power of attorney or by email to dpo@agent.getanomalie.com or support@getanomalie.com. After withdrawal, no new requests are sent and open requests are stopped; the copy of your ID document is deleted immediately. Records already received remain in your Health Profile until you delete them or your account. Requests that a record holder has already received cannot be recalled by us, but we inform record holders on request that the power of attorney has ended.

D. Lab tests, purchases and subscriptions (contract & explicit consent)

Data categories: Name, email address, billing and shipping address, order and payment data, the test ordered, sample information and test results.

Purpose: Selling and shipping lab tests and other products, organizing sample collection, transmitting your order to the laboratory, importing your results into your Health Profile, managing Premium subscriptions and invoices.

Recipients: Laboratories and medical providers that perform and assess your test (for example SYNLAB, Biolyz, Remi Health, Anovator, Nix Biosensors) receive the data needed for the analysis (typically name, date of birth, sex, sample). They act under their own medical responsibility as independent controllers. At-home test kits are sent to you by Remi Health GmbH (Berlin, Germany), which receives your name and postal address for this purpose. Payments are processed by Stripe; product orders from our shop are processed via Shopify; parcels are shipped via DHL.

Legal basis: Art. 6(1)(b) GDPR for order, payment and shipping data; Art. 9(2)(a) GDPR for the test and its results; Art. 6(1)(c) GDPR for retention required by commercial and tax law.

E. Connected wearables, health apps and Apple Health (explicit consent)

You may connect wearables and health apps to your Health Profile so it stays current without manual entry. You choose each connection yourself, sign in with the provider and grant access on the provider's own consent screen.

Sources you can connect: Garmin Connect (Garmin Ltd. and its subsidiaries), WHOOP, Oura, Ultrahuman, Polar, COROS, Fitbit (Google), Wahoo, Zwift, TrainingPeaks, Withings, InBody, MyFitnessPal, Strong, Strava and, on the iOS app, Apple Health (HealthKit). Each provider is a separate controller for the data it holds about you; its own privacy policy applies there. With Apple Health you grant permission per data category through Apple's permission sheet on your device.

How the data reaches us: Strava sends data directly to anomalie. Every other source, including Apple Health, sends data through Terra (Terra API Inc., USA), which receives the data from the provider on our behalf, normalizes it and passes it to us. Terra acts as our processor under our instructions and a data processing agreement and does not use the data for its own purposes. For Garmin, Terra uses an app that anomalie GmbH registered with Garmin.

Data categories: Depending on the source and the permissions you grant: daily activity and steps, workouts and training sessions (including GPS routes, see Section 3.J), heart rate, heart rate variability (HRV), sleep, stress, respiration and blood oxygen, body measurements and body composition, blood pressure, menstrual cycle data, nutrition and calorie intake, and the device model that recorded the data.

Purpose: To show you your own data in your Health Profile, as trends over time and next to your lab results, and to prepare personal insights such as recovery, sleep quality and training load. You may also choose to include a summary in what you share with a health professional (Section 3.I). AI-supported features use this data only as described in Section 3.F and only with your consent. Data from connected sources, including HealthKit data, is never sold, never used for advertising, never shared with third parties for their own purposes and never used to train AI models (Section 3.G).

Legal basis: Your explicit consent (Art. 9(2)(a) GDPR), given when you connect the source in the App and on the provider's consent screen.

Disconnecting and deleting: You can disconnect a source at any time in the App under Account › Connections, or for Apple Health in iOS Settings › Health › Data Access & Devices › anomalie. Disconnecting revokes our access at the provider and deletes the data we received from that source. You can also withdraw access from the provider's side (for Garmin: Garmin Connect › Settings › Connected Apps); we then delete that source's data when the provider notifies us. All connected-source data is deleted when you delete your account. You can request access to or export of this data at any time (Section 8).

F. AI-supported features (explicit consent)

We use AI to read and structure documents, extract values and clinical facts, identify trends, draft summaries, daily messages and informational recommendations, prepare appointment briefings, and draft and classify correspondence with record holders (Section 3.C).

Data minimization: Before sending structured Health Profile data to an AI model, we exclude account-level fields such as your name, email address, postal address, exact date of birth and internal IDs, and limit the payload to what the feature needs. Documents you upload or that we receive for you are sent as they are and may contain your name and other identifiers; correspondence with record holders likewise contains your name. We therefore treat every AI payload as personal health data and not as anonymous.

Text recognition of uploaded documents: When you upload a scan or photo of a health document, we first convert each page into machine-readable text. Pages of digital PDFs are read directly from the file. Scanned pages and photos are processed by Google Cloud on our behalf: by the Gemini model through Vertex AI and, if a page cannot be read reliably, by Google Document AI. These requests are sent exclusively to Google's European Union endpoint, where Google processes them within EU member states. Google acts as our processor under the Google Cloud Data Processing Addendum and does not use this data to train or improve its models. Google may keep request data for a short period where this is required to detect abuse of its services. The recognised text is then used for the AI-supported extraction described above.

AI providers:

The providers process the data on our behalf under data processing agreements and receive it over encrypted connections.

Legal basis: Art. 9(2)(a) GDPR. If you withdraw this consent, features that require AI processing are no longer available to you.

No automated decisions: AI outputs are informational. We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR).

G. AI model training

We do not train AI models with personal data. Machine learning models are trained and evaluated only with anonymised data, and only if you have given your separate consent under Section 3.N.

Data from connected wearables and health apps (Section 3.E) is never used to train, evaluate or improve AI models, with or without consent.

H. Connected AI assistants (explicit consent)

You may connect an AI assistant such as ChatGPT, Claude or Codex to one Health Profile you own. The assistant can then read that Health Profile through anomalie; you confirm the connection on anomalie before any access is granted, and you can disconnect it at any time under Account › Assistants.

Data categories: Readings, clinical facts, document metadata and timeline items from the connected Health Profile, as requested by the assistant. Your name, email address, date of birth and internal identifiers are not passed to the assistant. When the assistant asks anomalie a health question on your behalf, anomalie receives the text of that question.

Question history: Health questions an assistant asks anomalie are saved to your Health Profile. anomalie uses them to make your insights, messages and recommendations more personal, and our team may review them to support you and to improve anomalie. Before questions are used in an AI-supported feature, account-level identifiers are removed as described in Section 3.F. You can see and delete individual questions or your whole question history at any time under Account › Assistants; deleted questions are removed immediately.

Legal basis: Your explicit consent (Art. 9(2)(a) GDPR), given on the consent screen when you allow the connection. You can withdraw it at any time by disconnecting the assistant.

Recipients: The assistant's provider (for example OpenAI or Anthropic) processes what you ask it and what anomalie returns under its own terms, as a separate controller you have chosen.

Retention: The question history is kept until you delete it or delete your account.

I. Sharing with health professionals (explicit consent)

You can share selected data with a health professional of your choice (for example your doctor, coach or physiotherapist), including through an appointment briefing that the practice can open via a personal link or QR code.

Data categories: Only what you select, such as specific values, reports, time periods or the content of an appointment briefing.

Legal basis: Your separate explicit consent (Art. 9(2)(a) GDPR).

Controller roles: We make the data you select available to the health professional on your instruction and remain responsible for that step; contact us for any questions about it. Once the health professional has accessed your data, they are an independent controller for any further processing, governed by their own professional duties. To exercise your rights regarding their processing, please contact them directly.

J. Workout routes and maps

When a connected wearable or app records a workout with GPS, we store the route so we can show it on a map. Before storage, the first and last 200 metres are removed, so the place where you start and finish (often your home) is not kept.

Map display: Mapbox (Mapbox, Inc., USA) draws the small route previews and Google Maps (Google Ireland Limited / Google LLC) the full map. Your route itself is never sent to these services; we draw it on top of the map. The map service receives the map area shown (centre and zoom level) and the technical data every web request carries, such as IP address and browser or device information. Google Maps / Places is also used for address autocompletion in checkout and for partner location maps; it then receives the address characters you type. When you search for your doctor or practice, our server sends the search text (for example practice name and city) to Google Places, without your name or other account data.

Exercise animations: Strength workouts show animations loaded from ExerciseDB (AscendAPI). ExerciseDB only receives the request for the animation file and technical request data; no workout data is sent.

Legal basis: Storing and showing workouts and routes: Art. 6(1)(b) and Art. 9(2)(a) GDPR. Loading maps and animations: Art. 6(1)(f) GDPR (legitimate interest in a clear visual presentation).

Retention: Routes are kept as long as the workout they belong to.

K. Communication

Support: When you contact us, we process your message and contact details to answer it (Art. 6(1)(b) or (f) GDPR; for health data contained in your message, Art. 9(2)(a) GDPR).

Service emails and push notifications: We send emails about your account, orders, results and record requests (via Resend), and, if you allow it on your device, push notifications via Apple Push Notification service (APNs). You choose which categories you receive under Settings › Notifications (Art. 6(1)(b) GDPR; for health-related content, Art. 9(2)(a) GDPR). Push notifications do not contain test values. If you turn on medication reminders on iOS, a Live Activity shows the medication name and intake time on your lock screen; it is delivered via APNs.

Newsletter and marketing emails: Only with your consent (Art. 6(1)(a) GDPR) or, for similar products to existing customers, on the basis of § 7(3) UWG; you can unsubscribe at any time via the link in every email.

Appointment booking: If you book a call with us, Cal.com (Cal.com, Inc., USA) processes your name, email address and the appointment (Art. 6(1)(b) GDPR).

L. Internal operations

Our team is notified of new sign-ups, orders, document uploads, the progress of record requests and privacy requests sent to our DPO via Slack (Slack Technologies, LLC, USA), so that we can check quality, resolve problems quickly and answer privacy requests within the legal deadline. These notifications contain only the type and status of the event, masked names and email addresses (for example "Luk* Hofst*") and links into our internal admin area. They do not contain health data, document contents, postal addresses or the text of your messages. Only staff who need this access receive it, and all staff are bound to confidentiality. Legal basis: Art. 6(1)(b) and (f) GDPR.

M. Cookies, analytics and marketing (consent)

Strictly necessary storage: Cookies and local storage needed to sign you in, keep you signed in, store your cookie choice and secure the service are set without consent (§ 25(2) no. 2 TDDDG, Art. 6(1)(b) and (f) GDPR).

Analytics and marketing: All other cookies, pixels and similar technologies are only used if you agree in our cookie banner (§ 25(1) TDDDG, Art. 6(1)(a) GDPR). Because usage data in a health service can allow inferences about your health, we also base this processing on Art. 9(2)(a) GDPR. You can change your choice at any time via the cookie settings link in the website footer; on iOS, marketing measurement additionally requires your permission under Apple's App Tracking Transparency.

Server-side conversion messages (Meta, OpenAI, Google) are only sent if you have given marketing consent. They never contain test results or other content of your Health Profile.

Embedded content: Videos on our website are loaded from YouTube in privacy-enhanced mode (youtube-nocookie.com) and from Mux; editorial content and images are delivered by Sanity. In the App, recipe images in nutrition plans are loaded from TheMealDB, and an image on the sign-in screen is loaded from Cloudinary. These services receive technical request data such as your IP address (Art. 6(1)(f) GDPR).

N. Anonymised use of health data, including after account deletion (explicit consent)

With your separate consent, we anonymise your health data and use it in anonymised form for analyses, to train and evaluate machine learning models, and to improve anomalie.

Data categories: Laboratory values (marker, value, unit, reference range), coded questionnaire answers, sex, age group in five-year bands, and the month of measurement. Never included: name, contact and address data, date of birth, identity documents, signatures, uploaded documents, free text, account and profile IDs, data from connected wearables and health apps (Section 3.E), and workout routes (Section 3.J).

How we anonymise: We remove all direct identifiers, generalise the remaining details (age group instead of date of birth, month instead of exact date, no postcode), and suppress values or combinations that occur in only a few people. The anonymised data is stored separately, without any link to your account. We document the procedure and review it regularly.

After account deletion: If your consent is in place when you delete your account, we create the anonymised data set immediately before deletion. All other data is then deleted as described in Section 7. The anonymised data set is no longer personal data and is kept without a fixed time limit.

Legal basis: Your explicit consent (Art. 9(2)(a) GDPR). Participation is voluntary; anomalie works without it.

Withdrawal: You can withdraw your consent at any time in your account. From then on, we no longer anonymise your data, including when you delete your account. Data that was already anonymised cannot be linked to you and therefore cannot be removed.

O. Legal obligations and legal claims

We retain invoices, booking records and business correspondence as required by commercial and tax law (Art. 6(1)(c) GDPR in conjunction with § 147 AO and § 257 HGB). We keep records of the consents and powers of attorney you have granted to be able to prove them (Art. 7(1) GDPR, Art. 6(1)(c) and (f) GDPR, Art. 9(2)(f) GDPR).

4. Is providing data required?

Providing registration data and consenting to the processing of health data is required to use anomalie. All other features (power of attorney and record requests, AI features, wearables, sharing, anonymised use of health data, analytics and marketing) are optional. If you do not use them, you can still use the rest of the service.

5. Recipients

We disclose personal data only to processors bound by data processing agreements (Art. 28 GDPR), to independent controllers where described above, when legally required, or based on your consent.

6. Transfers to third countries

Where personal data is transferred to a country outside the EU/EEA, we ensure an adequate level of protection:

• USA: If the recipient is certified under the EU-U.S. Data Privacy Framework, the transfer is based on the European Commission's adequacy decision of 10 July 2023 (Art. 45 GDPR) — for example Google LLC as sub-processor for text recognition. Otherwise, we use the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR).
• In each case we assess the legal situation in the recipient country (transfer impact assessment) and apply supplementary measures such as encryption in transit and at rest, data minimization and pseudonymization where the feature allows it.

You can request a copy of the safeguards from our DPO.

7. Retention periods

8. Your rights

You have the right to:

• Access your data (Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Withdraw any consent with effect for the future (Art. 7(3) GDPR)

Right to object (Art. 21 GDPR): Where we process your data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation. You can object to direct marketing at any time without giving reasons.

You can delete your account yourself in the App under Account. To exercise your rights, contact our DPO at dpo@agent.getanomalie.com.

You have the right to lodge a complaint with a supervisory authority, in particular in the EU member state of your residence, place of work or the place of the alleged infringement. The authority responsible for us is:

Berliner Beauftragte für Datenschutz und Informationsfreiheit Alt-Moabit 59–61, 10555 Berlin, Germany

9. Data security

We use encryption in transit (TLS 1.2 or higher) and at rest (AES-256), private storage for documents, row-level access controls in our database, role-based staff access on a need-to-know basis, confidentiality obligations for all staff, security reviews and an incident response process.

10. Changes to this Privacy Notice

We may amend this notice when our services or the law change. We will inform you of significant changes in the App or by email and ask for renewed consent where required.