Data protection at aiuno

Would you like to know what happens to your data and who you can contact? Here you will find out:

What we do and what rights you have – our data protection summarised in brief:

We, Appoco GmbH, are responsible for everything here. Our data protection officer supports us on all data protection matters.
We only store and use data from you that we need or whose processing you have expressly consented to. For this purpose we use cookies and other tracking methods, among others. You can find details below under items 8. to 10..
Of course, there is a legal basis for everything. We only do what we are permitted to do.
Others only receive your data if we cannot do something ourselves and/or on site. Of course, we have concluded contracts with our service providers to ensure that they look after your data just as we do.
Once we no longer need your data, it is deleted. If we have to keep it longer, e.g. for the tax office, the data is blocked. “Blocking” means that it is technically protected in such a way that it can no longer be changed or further processed.
Your data is protected – we take good care of it!
If you would like to know whether and what data we hold about you, if you would like this data deleted or handed over, or if you wish to object to specific data processing, call us or write to us. You can also contact us in the same way if you wish to withdraw consent.
If you are not satisfied with how we handle your data, the final step is a responsible supervisory authority (in Bavaria: Bayerisches Landesamt für Datenschutzaufsicht). You can call or write to them there.
Of course, we hope that we can talk things through first and find a joint solution.

Below you will find comprehensive information about the processing of your personal data when visiting our website.

Personal data is all data relating to an identified or identifiable natural person, e.g. name, address, e-mail addresses, user behaviour.

1. Who is responsible for the processing?

Controller pursuant to Art. 4 (7) GDPR:

Appoco GmbH
Kammergasse 9
85354 Freising
E-mail: service @aiuno.io
Website: aiuno.io

2. Hosting of the website

Our website is hosted on the web server of

IONOS SE, Elgendorfer Str. 57, 56410 Montabaur (hereinafter: IONOS) in Germany.

If you would like to know more about their data protection, you can find the details in the privacy policy at https://www.ionos.de/terms-gtc/terms-privacy.

We use IONOS on the basis of Art. 6 (1) (f) GDPR, i.e. we have a legitimate interest in presenting our website as reliably as possible. We have concluded a data processing agreement (DPA) with IONOS to ensure that the personal data of our website visitors is only processed in accordance with our instructions and in compliance with the GDPR.

3. What data do we collect and store, and for what purposes?

a) When visiting the website purely for information purposes
If you only visit our website for information purposes, do not register and do not otherwise enter or actively send us any data, we process the personal data that your browser transmits to our server. This is stored – without you doing anything – until automated deletion. What information is this? You can find this below:

– IP address of the requesting computer,
– date and time of access, time zone difference to Greenwich Mean Time (GMT)
– content of the request (page visited)
– access status/HTTP status code
– volume of data transferred in each case
– browser
– operating system
– language and version of the browser software.

We use the above data to operate our website, in particular to identify and rectify errors on the website, to determine the load on the website and to make adjustments and improvements. The legal basis for the data processing is Art. 6 (1) (f) GDPR. Our legitimate interest follows from the purposes of data collection just mentioned. In no case do we use the collected data for the purpose of drawing conclusions about your person. The data is also not merged with other data sources.

The personal data mentioned is only stored for the duration of your visit. It is deleted immediately afterwards.
Insofar as we use external links on our pages that take you to other service providers, you can recognise this by the link symbol for external links; the mouse cursor changes its shape when it is over a link, and the external link to which the redirection takes place appears at the bottom left of the website. If you click on an external link, your IP address becomes visible to the provider of that site.

b) When contacting us by e-mail and/or contact form
You can contact us via the e-mail address provided or the contact form. In this case, the data you provide (your e-mail address, possibly your name and telephone number) will be stored in order to process your enquiry and answer your questions.

We delete the data arising in this context if the enquiry is assigned to a contract after the contract term has expired, otherwise after 3 months, or we restrict the processing if statutory retention obligations exist.

c) For other functions and offers on our website
In addition to the purely informational use of our website, we offer various services that you can use if you are interested, and we use other standard functions for analysing or marketing our offers, which are presented in more detail below under items 8. to 10. For this purpose, you generally have to provide further personal data, or we process such further data that we use to carry out the respective services. The principles of data processing listed below apply to all data processing purposes described here.

4. How long do we store your data and when do we delete it?

If no specific deletion periods are stated in this privacy policy for the respective case, we delete your personal data as soon as the purpose of storage no longer applies. However, we must continue to store your data if we are obliged to do so by European or national legislators in EU regulations, laws or other provisions to which we are subject.
However, once the storage period prescribed in the aforementioned provisions has expired, your data will of course be deleted – unless it is still required at that time for the conclusion of a contract with us or the fulfilment of a contract that you have concluded with us.

5. What rights do you have as a data subject?

a) Auskunft Sie können von uns jederzeit gemäß Art.15 DSGVO Auskunft über die von uns verar-beiteten personenbezogenen Daten verlangen. Insbesondere werden wir Ihnen, so-fern Sie dies anfordern, Auskunft über die Verarbeitungszwecke, die Kategorie der personenbezogenen Daten, die Kategorien von Empfängern, gegenüber denen Ihre Daten offengelegt wurden oder werden, die geplante Speicherdauer, das Bestehen eines Rechts auf Berichtigung, Löschung, Einschränkung der Verarbeitung oder Wi-derspruch, das Bestehen eines Beschwerderechts, die Herkunft Ihrer Daten, sofern diese nicht bei uns erhoben wurden, sowie über das Bestehen einer automatisierten Entscheidungsfindung einschließlich Profiling und ggf. aussagekräftigen Informatio-nen zu deren Einzelheiten geben.
b) Berichtigung Sie können gemäß Art.16 DSGVO unverzüglich die Berichtigung unrichtiger oder Ver-vollständigung Ihrer bei uns gespeicherten personenbezogenen Daten verlangen.
c) Löschung Sie haben das Recht gemäß Art.17 DSGVO die Löschung Ihrer bei uns gespeicherten personenbezogenen Daten verlangen.
d) Einschränkung der Verarbeitung Sie können gemäß Art.18 DSGVO die Einschränkung der Verarbeitung Ihrer perso-nenbezogenen Daten verlangen.
e) Datenübertragbarkeit Sie können gemäß Art.20 DSGVO von uns verlangen, dass wir Ihnen Ihre personenbe-zogenen Daten, die Sie uns bereitgestellt haben, in einem strukturierten, gängigen und maschinenlesbaren Format zur Verfügung stellen oder an einen von Ihnen be-nannten anderen Verantwortlichen übermitteln.
d) Einschränkung der Verarbeitung Sie können gemäß Art.18 DSGVO die Einschränkung der Verarbeitung Ihrer perso-nenbezogenen Daten verlangen.
f) Widerruf der Einwilligung Sie können eine erteilte Einwilligung jederzeit gemäß Art.7 Abs. 3 DSGVO gegenüber uns widerrufen. Dies hat zur Folge, dass wir die Datenverarbeitung, die auf dieser Einwilligung beruhte, für die Zukunft nicht mehr fortführen dürfen.
g) Widerspruch gegen die Datenerhebung in besonderen Fällen sowie gegen Direkt-werbung Sie können gemäß Art.21 DSGVO Widerspruch gegen die Verarbeitung Ihrer perso-nenbezogenen Daten einlegen, soweit dafür Gründe vorliegen, die sich aus Ihrer be-sonderen Situation ergeben oder sich der WIDERSPRUCH GEGEN DIREKTWERBUNG richtet. Im letzteren Fall haben Sie ein generelles Widerspruchsrecht, das ohne An-gabe einer besonderen Situation von uns umgesetzt wird. Sie können Ihren Wider-spruch telefonisch, per E-Mail, oder an unsere zu Beginn dieser Datenschutzerklä-rung aufgeführte Postadresse formlos mitteilen.

If you would like to exercise one or more of your rights or require more detailed information about this, please contact us using the contact details provided above.

6. To whom, when and where do we pass on your data?

Initially, only our employees have access to your personal data. However, we share your personal data with third parties if:

you have given your express consent pursuant to Art. 6 (1) (a) GDPR to do so,
disclosure pursuant to Art. 6 (1) (f) GDPR is necessary for asserting, exercising or defending legal claims and there is no reason to believe that you have an overriding interest worthy of protection in your data not being disclosed,
in the event that disclosure pursuant to Art. 6 (1) (c) GDPR is subject to a legal obligation, and
this is legally permissible and necessary pursuant to Art. 6 (1) (b) GDPR for handling contractual relationships with you.

If we use commissioned service providers for individual functions of our offer, or if we wish to use your data for advertising purposes, we will always select and monitor these service providers carefully and inform you in detail below about the respective processes. In doing so, we also state the defined criteria for the storage period. Of course, we have concluded a data processing agreement (DPA) with all our service providers to ensure that the personal data of our website visitors and customers is only processed in accordance with our instructions and in compliance with the GDPR.

Insofar as our service providers or partners are based in a country outside the European Economic Area (EEA), we inform you about the consequences of this circumstance in the respective description of our offer. Some of our service providers are based in the USA, a third country that is not considered secure under data protection law. When these providers’ tools are active, your personal data may be transferred to the USA and processed there. We point out that the USA does not guarantee a level of data protection comparable to the EU. For example, US companies are obliged to disclose personal data to security authorities without you as the data subject being able to take legal action against this. It therefore cannot be ruled out that US authorities (e.g. intelligence services) process, analyse and permanently store your data located on US servers for surveillance purposes. Unfortunately, we have no influence on these processing activities.

The following categories of recipients receive your personal data (details may be shown for the respective service providers in these data protection notices):

Service providers who provide the video and voice technology. Personal data from you is transmitted to them to the extent necessary for conducting the video consultation. This primarily includes technical personal data, such as your IP address and your username.
Service providers who operate the technical infrastructure for providing our website.
Service providers who process payments on our behalf. If you use the video consultation or other paid services on our website, the personal data required for payment processing is transmitted to this service provider.
Debt collection companies and legal advisors for asserting our claims and enforcing our rights.

7. Right to lodge a complaint with a supervisory authority

You have the right pursuant to Art. 77 GDPR to lodge a complaint with a supervisory authority. As a rule, you can contact the supervisory authority of your usual place of residence or workplace, or of our registered office:

Bayerisches Landesamt für Datenschutzaufsicht
Postal address
Postfach 1349
91504 Ansbach
Germany

Phone: +49 (0) 981 180093-0
Fax: +49 (0) 981 180093-800
E-mail: poststelle @lda.bayern.de

8. What data from your end devices or other information do we collect and use?

a) General information on cookies and tracking
In addition to the data mentioned above, we use technical aids for various functions when you visit our website, in particular cookies, which can be stored on your end device (for the exception, see the following section b)). When you call up our website, and at any time afterwards, you can decide whether you generally permit the setting of cookies, restrict them to individual functions, or exclude them entirely, provided they are not strictly necessary cookies. You can make changes at any time via our consent manager (to be found in the footer of our website under “Cookie settings”). Below we explain the details of cookies from a technical perspective (1), before we go into your individual selection options by describing technically necessary cookies (2) and cookies that you can voluntarily switch on or off (3).

(1) What are cookies?
Cookies are text files or information in a database that are stored on your hard drive and assigned to the browser you are using, so that certain information can flow to the party setting the cookie. Cookies cannot execute programs or transmit viruses to your computer, but primarily serve to make the internet offer faster and more user-friendly. We use the following types of cookies on this website, whose functioning and legal basis we will explain below:

Transient cookies: These, in particular session cookies, are deleted automatically when the browser is closed or on logging out. They contain a so-called session ID. This allows various requests from your browser to be assigned to the joint session and your computer can be recognised when you return to our website.
Persistent cookies: These are deleted automatically after a predefined period, which varies depending on the cookie. In your browser settings you can view the cookies that have been set and their lifetimes at any time and delete the cookies manually.

(2) Mandatory functions technically necessary for displaying the website:
The technical structure of the website requires that we use technologies, in particular cookies. Without these technologies, our website cannot be displayed (fully correctly) or the support functions could not be enabled. These are basically transient cookies that are deleted at the end of your website visit, at the latest when you close your browser. You cannot switch off these cookies if you want to use our website. The individual cookies are visible in the cookie consent tool and are also shown below. The legal basis for this processing is Art. 6 (1) (f) GDPR.

(3) Optional cookies upon your consent:
We only set various cookies after your consent, which you can choose via the so-called cookie consent tool on your first visit to our website. The functions are only activated in the event of your consent and can in particular serve to enable us to analyse and improve visits to our website, to make it easier for you to use different browsers or end devices, to recognise you on a return visit, or to display advertising (possibly also in order to orient advertising towards interests, measure the effectiveness of adverts or display interest-based advertising). The legal basis for this processing is your consent, Art. 6 (1) (a) GDPR and § 25 (1) TTDSG, insofar as the consent covers the storage of cookies or access to information in the user’s end device (e.g. device fingerprinting) within the meaning of the TTDSG. You can withdraw your consent at any time. However, this does not affect the legality of the processing carried out until withdrawal.

b) Tracking without cookies or without access to your end device
We use the analysis service etracker to analyse usage data. The provider is etracker GmbH, Erste Brunnenstraße 1, 20459 Hamburg, Germany. In accordance with the EU directive, the data-block-cookies=“true” parameter in the tracking code ensures that no etracker cookies are set by default. The use of etracker Analytics in standard mode therefore does not require prior consent from visitors.

For the analysis, the data that your browser automatically makes available to our server when you visit our website is used and evaluated (see item 3.a) above). Depending on the use of the respective offer on our website, this data may be more extensive. eTracker records a maximum of the following data:

• Page views (automatic)
• End device type, operating system and browser (automatic)
• Geo information down to city level (automatic)
• Referrer websites (automatic)
• Campaign parameters
• Scroll events (automatic)
• Leaving the website (automatic and to the second)
• Click events such as search terms entered, files downloaded, videos viewed, external link calls (automatic and via CSS selector)

The recognition of each visitor is limited to the storage period pursuant to item 3.a)).

Usage profiles can be created from the data under a pseudonym. The data collected with etracker technologies is not used to personally identify you and is not merged with personal data about the bearer of the pseudonym.

The use of this analysis tool is based on Art. 6 (1) (f) GDPR. We have a legitimate interest in the anonymised analysis of user behaviour in order to optimise our website offering and also our advertising. You can object to the described data processing at any time

c) Cookie banner We use the cookie consent tool Etracker Consent Manager on our website, provided by etracker GmbH, Erste Brunnenstraße 1, 20459 Hamburg, Germany, in order to obtain your consent to the storage of certain cookies on your end device or to the use of certain technologies accessing your end device, and to document this in a data protection-compliant manner (hereinafter “Consent Manager”). When you visit our website, a connection is established to the Consent Manager’s servers in order to obtain your consents and other declarations regarding cookie usage by means of the cookie banner. The Consent Manager then stores a cookie in your browser so that we can assign the consents given, or their withdrawal. In addition, the browser stores a cookie so that you can withdraw this consent by click during your visit (uc_ui_version). We store this data until you ask us to delete it, you delete the Consent Manager cookie yourself, or the purpose of the data storage no longer applies. Mandatory statutory retention obligations remain unaffected. You can find details at: https://www.etracker.com/datenschutz/ We use a consent manager in order to obtain the legally required consents for the use of cookies. The legal basis for this is Art. 6 (1) (c) GDPR. Of course, we have concluded a data processing agreement (DPA) with eTracker to ensure that the personal data of our website visitors is only processed in accordance with our instructions and in compliance with the GDPR.

d) Which cookies and tracking services do we use?

Google Ads
We use Google Ads on our website. Google Ads is an online advertising programme from Google.
Google Ads enables us to display adverts in the Google search engine or on third-party websites when you enter certain search terms on Google (keyword targeting). Furthermore, targeted adverts can be displayed based on the user data available at Google (e.g. location data and interests) (audience targeting). As website operators, we can evaluate this data quantitatively, for example by analysing which search terms led to the delivery of our adverts and how many adverts led to corresponding clicks. The transfer of data to the USA is also based here on the EU Commission’s standard contractual clauses (details at: https://policies.google.com/privacy/frameworks and https://privacy.google.com/businesses/controllerterms/mccs/).

The use of Google Ads is based on your consent pursuant to Art. 6 (1) (a) GDPR and § 25 (1) TTDSG. Your consent can be withdrawn at any time.

Google Remarketing
This website uses the functions of Google Analytics Remarketing from Google.
Google Remarketing analyses your user behaviour on our website (e.g. clicks on specific products) in order to assign you to specific advertising target groups and then deliver suitable advertising messages to you when you visit other online offers (remarketing or retargeting).
Furthermore, the advertising target groups created with Google Remarketing can be linked with Google’s cross-device functions. In this way, interest-based, personalised advertising messages that have been adapted to your previous usage and surfing behaviour on one end device (e.g. mobile phone) can also be displayed on another of your end devices (e.g. tablet or PC).
If you have a Google account, you can object to personalised advertising at the following link: https://www.google.com/settings/ads/onweb/.
The use of Google Remarketing is based on your consent pursuant to Art. 6 (1) (a) GDPR and § 25 (1) TTDSG. Your consent can be withdrawn at any time.

Further information and the privacy policy can be found in Google’s privacy policy at: https://policies.google.com/technologies/ads?hl=de.

Google Conversion Tracking
This website uses Google Conversion Tracking from Google.
With the help of Google Conversion Tracking, Google and we can recognise whether you have carried out certain actions. For example, we can evaluate which buttons on our website were clicked how often and which products were viewed or purchased particularly frequently. This information is used to create conversion statistics. We learn the total number of users who clicked on our adverts and what actions they carried out.
We do not receive any information that would allow us to identify you personally.
Google itself uses cookies or comparable recognition technologies for identification.

The use of Google Conversion Tracking is based on your consent pursuant to Art. 6 (1) (a) GDPR and § 25 (1) TTDSG. Your consent can be withdrawn at any time. You can find more information about Google Conversion Tracking in Google’s privacy policy: https://policies.google.com/privacy?hl=de.

9. What data do we collect and use for our AI services

a) Registration with a customer account with us
If you would like to use the services of aiuno, you need a customer account with us. To create this account, you must provide your personal data, which we need for the purpose of handling contracts and invoicing. Mandatory fields are marked separately; further details are optional.

The data you provide when creating the account under “My account” is stored on a revocable basis. You can delete the data you have provided, including your user account, in the customer area at any time.

b) Payment service provider
To bill the aiuno services, we use the payment service provider Stripe Payments Europe Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland (hereinafter “Stripe”).

The legal basis for this is our legitimate interest in offering an efficient and secure payment method (Art. 6 (1) (f) GDPR). In this context, we collect the following data and pass it on to Stripe insofar as this is necessary for the fulfilment of the contract (Art. 6 (1) (b) GDPR):

Expert:
• Mobile phone number (for authentication),
• Type of company
• Business address
• First name, surname
• Business e-mail address
• Date of birth
• Business telephone number
• VAT number (optional)
• Industry
• Website address
• Product description
• IBAN with country and currency for receiving payments
• Customer support phone number
• Proof-of-address document (e.g. registration certificate)
• Copy of ID document

Patient:
• Surname, first name,
• Payer,
• Amount,
• Surname, first name of the recipient,
• Payment data

The processing of the data provided in this section is neither legally nor contractually required. Without the transmission of your personal data, we cannot process a payment via Stripe.
Stripe assumes a dual role as controller and processor for data processing activities. As a controller, Stripe uses the data you transmit to fulfil regulatory obligations. This corresponds to Stripe’s legitimate interest (pursuant to Art. 6 (1) (f) GDPR) and serves the performance of the contract (pursuant to Art. 6 (1) (b) GDPR). We have no influence on this process.

Stripe acts as a processor in order to be able to conclude transactions within the payment networks. As part of the data processing relationship, Stripe acts exclusively on our instructions and has been contractually obliged within the meaning of Art. 28 GDPR to comply with the data protection provisions.

In addition, Stripe has implemented compliance measures for international data transfers. These apply to all worldwide activities in which Stripe processes personal data of natural persons in the EU. These measures are based on the EU standard contractual clauses (SCCs).
You can find further information on objection options against Stripe at: https://stripe.com/privacy-center/legal
Your data will be stored by us until the payment process is completed. This also includes the period required for processing refunds, receivables management and fraud prevention.

c) Use for advertising purposes
We may also process the data you have provided in order to inform you about further interesting products from our portfolio by e-mail or post, provided you have not objected to this (see item 5.f). The legal basis for this is our legitimate interest, Art. 6 (1) (f) GDPR.

d) Storage period of your account data
Due to commercial and tax law requirements, we are obliged to store your address, payment and order data for a period of ten years. However, after three years we restrict the processing, i.e. from that point in time your data is only used to fulfil legal obligations. This does not apply if you open a customer account with us. In that case, a restriction of processing is only carried out when you delete your customer account.

e) Security
To prevent unauthorised access by third parties to your personal data, the ordering process is encrypted using SSL or TLS technology.

10. How do we handle data for our newsletter?

We use the tool CleverReach to send newsletters.

The provider is CleverReach GmbH & Co. KG, Schafjückenweg 2, 26180 Rastede, Germany (hereinafter “CleverReach”). CleverReach is a service that can be used to organise and analyse newsletter sending. The data you enter for the purpose of receiving the newsletter (e.g. e-mail address) is stored on CleverReach’s servers in Germany or Ireland.
The newsletters we send via CleverReach enable us to analyse the behaviour of newsletter recipients. Among other things, it can be analysed how many recipients opened the newsletter message and how often which link in the newsletter was clicked. With the help of so-called conversion tracking, it is also possible to analyse whether a previously defined action (e.g. purchase of a product on this website) took place after clicking the link in the newsletter. You can find further information on data analysis by CleverReach newsletters at: https//www.cleverreach.com/de/funktionen/reporting-und-tracking/.
The data processing is based on your consent (Art. 6 (1) (a) GDPR), which we obtain when you register for the newsletter. You can withdraw this consent at any time by unsubscribing from the newsletter. For this purpose, we provide a corresponding link in every newsletter message. However, you can also contact us directly and withdraw. Once you have withdrawn your consent, you will no longer receive a newsletter from us. The lawfulness of the data processing operations that have already taken place remains unaffected by the withdrawal.
The data you have stored with us for the purpose of receiving the newsletter will be stored by us or by CleverReach until you unsubscribe from the newsletter, and deleted from the newsletter distribution list after you unsubscribe from the newsletter. Data that has been stored with us for other purposes remains unaffected by this.
After your removal from the newsletter distribution list, your e-mail address may be stored by us or by CleverReach on a blacklist if this is necessary to prevent future mailings. The data from the blacklist is only used for this purpose and is not merged with other data. This serves both your interest and our interest in complying with the legal requirements when sending newsletters (legitimate interest within the meaning of Art. 6 (1) (f) GDPR). Storage on the blacklist is not limited in time. You can object to the storage if your interests override our legitimate interest.
You can find more information in the CleverReach data protection regulations at: https://www.cleverreach.com/de/datenschutz/.

11. How secure is your data?

All information you transmit to us is stored on servers within the European Union. Unfortunately, the transmission of information via the internet is not completely secure, which is why we cannot guarantee the security of data transmitted via the internet to our website. However, we secure our website and other systems against loss, destruction, access, alteration or dissemination of your data by unauthorised persons through technical and organisational measures. In particular, your personal data is transmitted to us in encrypted form. We use the SSL (Secure Socket Layer) [or TLS (Transport Layer Security)] encoding system for this purpose.

Status and updating of this privacy policy

We reserve the right to change these data protection regulations at any time with effect for the future. A current version is available on the website. Please visit our website regularly and inform yourself about the applicable data protection regulations.

Status: 02.07.2025