Privacy Notice

Controller

The intended controller is:

Idunox AG, in formation Idunox AG c/o Switzerland Innovation Park Ost AG Lerchenfeldstrasse 3 9014 St. Gallen Switzerland [Company registration number / UID to be added]

Privacy contact: privacy@idunox.com

Data We Collect

Depending on the product and customer interaction, IduScore may collect:

Contact and account data: name, email, phone number, address, language, and customer account details.

Order and payment data: product purchased, order number, payment status, refund status, billing details, and payment metadata. Full payment card details are handled by the payment provider and are not intended to be stored by IduScore.

Questionnaire data: age, sex at birth, lifestyle factors, family history, selected self-reported disease history, prior disease answers, medication-related answers, and related form responses.

Blood-marker data: laboratory marker names, values, units, collection dates, data files, and source details.

Lab appointment data: selected partner lab, collection location, appointment time, scheduling status, sample status, and related support messages.

Report data: generated IduScore wellbeing report, score outputs, marker context, and report delivery status.

Support data: emails, requests, complaints, refund messages, privacy requests, and operational notes.

Technical data: website, checkout, upload, and security logs where required for operations, security, fraud prevention, or compliance.

Sensitive Health Data

Questionnaire answers, blood-marker data, lab appointment data, and report outputs may include health-related personal data. IduScore processes these data only for the stated service purposes, with access controls and appropriate safeguards.

How We Use Data

IduScore uses data to:

Process orders and payments.

Contact customers after purchase.

Coordinate blood collection where included.

Receive and review questionnaire and blood-marker data.

Generate and deliver IduScore wellbeing reports.

Provide customer support, refunds, and operational follow-up.

Maintain repeated-testing timelines and progress comparisons when customers keep their history.

Improve the product using anonymized data.

Protect systems, prevent misuse, and comply with legal obligations.

Legal Bases and Consent

IduScore relies on customer consent for processing health-related data submitted for the wellbeing report. Customers can withdraw consent by contacting privacy@idunox.com, but withdrawal may prevent IduScore from completing or continuing the service.

IduScore may also process data where needed for contract performance, compliance with legal obligations, security, fraud prevention, and legitimate operational interests.

Service Providers and Partners

IduScore may share data only where necessary with:

Wix and the selected payment provider for website, checkout, order, payment, and refund processing.

Vitalcheck and its partner-lab network for blood collection coordination where the product includes collection.

Future at-home collection partners if and when that option becomes available.

Google Cloud Platform for infrastructure and secure processing.

OpenAI for report-generation support where used.

Email, support, security, and operational providers used to run the service.

IduScore does not sell or rent personal data.

International Transfers

Some providers may process data outside Switzerland. Where required, IduScore relies on appropriate contractual, technical, and organizational safeguards for such transfers.

Retention

IduScore retains non-anonymized order, questionnaire, blood-marker, report, lab appointment, and support data until the customer requests deletion, subject to legal or operational retention obligations.

Keeping history is recommended for customers who want repeated testing, timelines, and progress comparisons over time.

Anonymized data may be retained and used for product improvement.

Deletion and Rights

Customers may request access, correction, deletion, restriction, or information about their data by contacting privacy@idunox.com.

IduScore may ask the customer to verify identity before acting on a request. Some data may need to be retained where required by law, accounting obligations, dispute handling, fraud prevention, or security records.

Security

IduScore uses reasonable technical and organizational safeguards, including access controls, encryption where appropriate, provider-side security controls, and controlled handling processes. No internet service can guarantee absolute security.

Children

IduScore is for adults only. Customers must be at least 18 years old. IduScore does not knowingly collect data from minors.

Cookies and Tracking

Cookies and tracking are described in the IduScore Cookie Notice. Wix, payment providers, analytics tools, or marketing tools may set cookies or similar technologies depending on the final site configuration.

Changes

Idunox may update this Privacy Notice. Material changes will be communicated or highlighted where required.

Contact

Privacy contact: privacy@idunox.com

General support: info@idunox.com