Privacy Policy

Our commitment to your privacy

At Eteia, your health data is yours. We built this service to give you a clear, continuous picture of your own health, and we take the responsibility of holding that information seriously. This policy explains what personal data we collect, why we process it, who we share it with, and the rights you have over it.

About this policy

This policy applies to the Eteia website and application (together, the "Service"), operated by EternaLaboratory GmbH i.G. ("Eteia," "we," "us," or "our"). It applies to anyone who creates an account or otherwise uses the Service, which is intended for adults at least 18 years old, as set out in our Terms of Service. If you have any questions about this policy or how we handle your data, contact us at hello@eteia.ai.

Why we process your data

We collect and process personal data to provide, secure, and improve the Service. This includes:

• Account data: your email address and authentication credentials, used to create and secure your account.
• Consent records: a record of the choices you make about how your data is used, so we can honor them.
• Health profile information: details you choose to share with us, such as your date of birth, biological sex, medical history, medications, allergies, lifestyle factors, and, where relevant, reproductive health information. This is special category health data, and we only process it with your explicit consent.
• Wearable and biometric data: metrics synced from wearable devices you connect, such as heart rate, sleep, and activity data. This is also special category health data, processed with your explicit consent.
• Documents you upload: lab reports, discharge letters, and similar documents, along with the structured facts our systems extract from them, such as medications, allergies, and conditions.
• Technical and usage data: information such as your IP address, browser and device information, and access logs, used to keep the Service secure.

We rely on the following legal bases for this processing: your explicit consent for the storage and processing of your health data, wearable data synchronization, and AI-powered features, all of which you control individually in your account settings and can withdraw at any time; performance of our contract with you, to provide the Service you've signed up for; and our legitimate interest in keeping the Service secure and preventing abuse, which you have the right to object to.

Where you consent to AI-powered features, we use artificial intelligence and machine-learning technology to extract structured information from documents you upload, and to power a conversational companion that can answer questions about your own stored data.

If you track your menstrual cycle, the companion can show how your own logged data (wearable readings, moods and symptoms) lined up with the phases of your past cycles. It describes what happened at the same time, never what caused it. When you ask, it can also suggest general ideas for meals, recipes and movement, based on Eteia's calendar estimate of your current cycle phase and on the preferences you share; allergies and intolerances in your health profile are only used to leave ingredients out, and the companion tells you when it does. It can give general information about supplements from a reviewed reference list, but never personal supplement advice.

These features are informational only, are never a medical diagnosis or personal medical advice, and you're always told when you're interacting with an AI system. We do not currently generate any automated health score, risk prediction, or personalised medical recommendation, and no decision that produces legal or similarly significant effects is made about you by automated means.

Data sharing and international transfers

We do not sell your personal data. We share it only with the following categories of recipients, each bound by appropriate data protection agreements:

• Cloud infrastructure providers, who host and store your data securely within the European Union.
• AI and machine-learning processing providers, who power the features described above, including the web search the companion uses to find general information. This processing takes place on infrastructure operated by a specialised third-party provider, within the EU, rather than on infrastructure we operate ourselves.
• Our wearable-integration platform, which connects to the wearable providers you choose to link, such as Oura, Apple Health, Withings, Whoop, or Google Health. Each of those providers is also subject to its own privacy policy, which we encourage you to review.
• Push notification services, only if you switch on the daily check-in reminder: the reminder passes through our notification provider and the push service run by the maker of your browser or phone, such as Apple or Google, which may be located outside the EU. What passes through is a device address and the same short, generic sentence everyone receives. It never contains health data or anything else about you, and you can switch reminders off at any time.

Your data is processed within the European Union. When our conversational companion looks up general information on the web, the search uses only generic terms, such as a food, an exercise or a term to explain, put together without access to your health records. Your health data is never part of a search, and the search service we use does not log the queries. Exercise suggestions may link to a video or a video search on YouTube; nothing is sent to YouTube unless you open such a link, and YouTube's own privacy policy applies from then on. We do not otherwise transfer personal data outside the EU/EEA without appropriate safeguards.

Safeguarding your data

We protect your data using industry-standard technical and organisational measures, including encryption of data at rest and in transit, additional field-level encryption for particularly sensitive identifiers, strict access controls limiting who within our organisation can access your data, and regular review of our security practices.

Pseudonymisation

Where your data is used for analysis beyond your own record, for example to measure and improve the quality of the recommendations we produce, it is keyed by a random pseudonymous identifier rather than by your name, your email address or your account ID. This describes a safeguard we already apply; it does not extend the purposes you consent to, which remain limited to providing the service to you.

Data retention

We retain your personal data for as long as your account is active, and delete it when you close your account, subject to a small number of exceptions required by law: for example, we may need to retain limited records for accounting or tax purposes, or to comply with a legal obligation or resolve a dispute. Where a connected wearable provider is disconnected, data obtained from that provider is deleted within 72 hours.

Cookies and similar technologies

We use a small amount of first-party storage on your device, all of it set by us directly. Some of it is strictly necessary to provide the Service you asked for, for example your language and theme choice, your signed-in session, and the record of the cookie choice you make when you visit. That storage does not require your consent. We do not currently use any analytics, tracking, or advertising storage, and we set no third-party tags or cookies of any kind. If we ever introduce optional analytics, it will run only if you switch it on, and you can change or withdraw that choice at any time. Our Cookie Policy lists every item we store, what it is for, and how long it lasts.

Your rights

As a data subject, you have a number of rights over your personal data. You have the right to know what personal data we process about you, and to request a copy of it. You can ask us to correct information that's inaccurate or incomplete, or to delete your data in certain circumstances. Where we process your data based on your consent, you can withdraw that consent at any time, and where we rely on legitimate interest, you can object to that processing. You can also request that we restrict how we use your data, or receive it in a portable, machine-readable format. To exercise any of these rights, contact us at hello@eteia.ai.

How to reach us

If you have questions about this policy, or want to exercise any of the rights described above, contact us at hello@eteia.ai. If you believe we have processed your data in a way that doesn't comply with the GDPR, you have the right to lodge a complaint with a supervisory authority, in particular the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 27, 91522 Ansbach, Germany, or the supervisory authority in your own EU member state. We may update this policy from time to time; when we make material changes, we'll notify you in the app and, where required, ask for your renewed consent. The current version of this policy is dated at the top of this page.