Privacy Policy

Besser Sehen Landshut Andreas Polzer Veldener Straße 16 84036 Landshut Germany Email: hallo@bessersehen.la (hereinafter "we" or "Controller")

We process personal data in connection with our web-based platform for myopia management and vision training. Processing is based on the following legal grounds: - Art. 6(1)(b) GDPR: Performance of contract (provision of the platform for registered practices) - Art. 6(1)(f) GDPR: Legitimate interest (security and stability of the platform as well as update management of the DATEYE connector software) - Art. 9(2)(h) GDPR: Processing of health data for preventive medicine purposes (clinical measurement data is collected and processed exclusively by medical professionals)

We process the following categories of personal data: - Account data: Email address, practice name, specialty - Clinical measurement data: Refraction values, biometry, keratometry and other ophthalmological measurements (stored in pseudonymized form) - Usage data: Time of access, features used (no tracking cookies, no third-party analytics) - Connector telemetry: For the DATEYE connector installations linked to your practice, we process the software version, the operating system (coarse: Windows or macOS), and the time of the last connection. This information is used solely for update management, in particular the staged and therefore low-risk rollout of new versions. We do not process device identifiers, hostnames for identification purposes, IP addresses, or patient data.

Your data is hosted on servers in Germany. Recipients are exclusively processors pursuant to Art. 28 GDPR: - Hetzner Online GmbH — hosting, data center in Germany - Sendinblue SAS ("Brevo"), France — delivery of emails and one-time codes; this generates delivery, open and click data - Functional Software, Inc. ("Sentry"), data stored in the EU region — monitoring of application errors and load times Sentry receives technical error reports and a 10 % sample of execution-time measurements. Personal content is stripped before transmission; no session recordings take place. No data is disclosed to third parties for advertising purposes. Processing takes place in the European Union. Sentry belongs to a US company, so access from a third country cannot be entirely ruled out; it is governed by the data processing agreement concluded with Sentry.

Account data is stored for the duration of use and deleted within 30 days after termination. Clinical measurement data is deleted after termination, unless statutory retention obligations apply. You can request deletion of your data at any time.

You have the following rights regarding your personal data: - Right of access (Art. 15 GDPR) - Right to rectification (Art. 16 GDPR) - Right to erasure (Art. 17 GDPR) - Right to restriction of processing (Art. 18 GDPR) - Right to data portability (Art. 20 GDPR) - Right to object (Art. 21 GDPR) To exercise your rights, please contact: hallo@bessersehen.la

You have the right to lodge a complaint with a data protection supervisory authority regarding the processing of your personal data. Competent supervisory authority: Bayerisches Landesamt für Datenschutzaufsicht (BayLDA) Promenade 18 91522 Ansbach, Germany

We implement comprehensive technical and organizational measures to protect your data: - Encryption of all data in transit (TLS/HTTPS) - Encryption of sensitive data at rest (AES-256) - Role-based access control - Regular security updates - Hosting exclusively in German data centers

We only use technically necessary session cookies for authentication. We do not use tracking cookies or advertising cookies, nor audience measurement tools such as Google Analytics. To keep the application stable we use Sentry (see section 4). Sentry records errors and a sample of load times, sets no cookies for this and builds no usage profiles. Emails we send you are delivered via our mail provider and contain delivery and open tracking (see section 4). A cookie banner is not required, as no consent-dependent cookies are used.

When you write to us using the contact form, we process the details you enter there: name, email address and your message. The sole purpose is to answer your enquiry. The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to a contract with us, and otherwise our legitimate interest in responding to enquiries (Art. 6(1)(f) GDPR). Providing the details is voluntary; without them we cannot answer your enquiry. Your message is not stored in the platform. It is delivered to our mailbox as an email, sent via our processor Sendinblue SAS ("Brevo"), France (see section 4). On our side we only log that a contact email was sent — not its content. We keep your enquiry for as long as it is needed to handle it and to answer follow-up questions, and delete it no later than six months after the enquiry has been dealt with. Statutory retention obligations remain unaffected. To prevent automated submissions the form contains a hidden field that only programs fill in. We do not store IP addresses for this purpose. Your rights as a data subject are set out in section 6.