Privacy Policy

1. Controller

Cooper Digital, Frank Müller, Geisbergstr. 5, 86316 Friedberg, Germany, email: hello@expandhealthspan.com. A data protection officer is not required by law.

2. Visiting the website (server logs)

When you visit the site, technically necessary data is processed (IP address, date and time, page requested, browser and device information, referrer). The purpose is delivery, stability and security of the service. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in secure operation). Storage is generally limited to a maximum of 30 days.

3. User account and authentication

For account and login we process your email address, password hash and — with Google login — the basic data transmitted by Google (name, email, profile image URL). Legal basis: Art. 6 (1) (b) GDPR (performance of a contract). Data is stored until the account is deleted.

4. Healthspan Assessment and plan

Your answers concern lifestyle habits (including sleep, movement, nutrition, stress, recovery, social contacts, alcohol and smoking). Where this information allows conclusions about your health, it constitutes a special category of personal data under Art. 9 GDPR. We process it exclusively on the basis of your explicit consent (Art. 9 (2) (a) GDPR) in conjunction with Art. 6 (1) (b) GDPR, in order to calculate your score and individualise your 30-day plan.

Processing is rule-based and automated; it produces no legal effect within the meaning of Art. 22 GDPR and is not a medical diagnosis. Consent can be withdrawn at any time with effect for the future, e.g. by email or by deleting your account.

5. Payment processing (Stripe)

Payments are processed by Stripe Payments Europe, Ltd., Dublin, Ireland. Data transmitted includes name, email, payment method and transaction data. We ourselves do not receive full card details, only status and reference information. Legal basis: Art. 6 (1) (b) GDPR (performance of a contract) and Art. 6 (1) (c) GDPR (commercial and tax retention obligations, generally 10 years). Any transfer to third countries is based on the EU standard contractual clauses.

6. Hosting and database

Website hosting and database/authentication are operated through our processors (Lovable / hosting infrastructure and Supabase, EU region). Data processing agreements pursuant to Art. 28 GDPR are in place with all providers. Legal basis: Art. 6 (1) (b) and (f) GDPR.

7. Cookies, analytics and the Meta Pixel

Technically necessary cookies (e.g. session/login) are used on the basis of § 25 (2) TDDG without consent. Analytics and marketing technologies — in particular the Meta Pixel of Meta Platforms Ireland Ltd. — are only used if you have consented in the cookie banner (§ 25 (1) TDDG, Art. 6 (1) (a) GDPR). Pseudonymous usage data and device/browser information may be transmitted to Meta and transferred to the USA (standard contractual clauses or the EU-US Data Privacy Framework). You can withdraw your consent at any time in the cookie settings.

8. Contacting us

If you contact us by email we process your details to handle your request (Art. 6 (1) (b) or (f) GDPR). The data is deleted once the request has been dealt with conclusively and no retention obligations apply.

9. Recipients and third-country transfers

Data is only shared with the processors named above, with payment service providers and with authorities where legally required. Where data is transferred to third countries, we rely on adequacy decisions or EU standard contractual clauses together with additional safeguards.

10. Retention periods

We store assessment and plan data for the duration of your account so that you can access your history and plan. After account deletion it is erased unless statutory retention periods apply (in particular tax obligations relating to purchases).

11. Your rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and the right to object to processing based on legitimate interests (Art. 21 GDPR). You can withdraw consent at any time with effect for the future. Please contact hello@expandhealthspan.com.

You also have the right to lodge a complaint with a supervisory authority, e.g. the Bavarian Data Protection Authority (BayLDA), Promenade 27, 91522 Ansbach, Germany.

12. Necessity of providing data

Providing your data is necessary for the account, the assessment and the purchase. Without it we cannot create your score and your individualised plan.

13. Changes to this policy

We adapt this privacy policy when our processing or the legal situation changes. The version published on this page applies.