In case of dispute, the German version of this page prevails — read it in German.

Privacy policy

1. Controller

IVG Holding B.V.
Harmenkaag 1
1741 LA Schagen
Netherlands
Email: kontakt@vitalmyn.com

2. What data we collect

Account data

When you register, we collect your name, email address and, where applicable, telephone number. Therapists additionally provide their qualifications, specialisms and practice address.

Verification documents (therapists)

For verification, therapists upload an identity document (identity card or passport) and their Heilpraktiker licence (the official permit to practise). Both are kept in non-public storage that only our review team can reach, through short-lived links. When we delete them is set out under “Retention period”.

Usage data

We collect technical data such as IP address, browser type, operating system, page views and time spent on the site in order to improve the Platform.

Payment data

Payments are processed via Stripe. Credit card data is processed exclusively by Stripe and never stored on our servers.

Waitlist

On vitalmyn.de and vitalmyn.com you can join our waitlist for the practitioner programme. We store the email address you enter, your first name and the type of your practice if you choose to give them, the version of the consent text you were shown and the language it was shown in, and the time of signup and of confirmation. The address is used only after you confirm it by clicking the link in our confirmation email (double opt-in); an unconfirmed address is never contacted. Our security log keeps a salted hash of the IP address of the signup request, with no link to your entry, to limit the number of signups per hour and as a brake against abuse of the form.

Legal basis: your consent, Art. 6(1)(a) GDPR. We send the confirmation email through our email provider Resend (Resend, Inc., USA; EU standard contractual clauses) and the Vitalmyn product emails through lemlist (lempire SAS, France, EEA only), which acts as our processor. You can withdraw your consent at any time via the unsubscribe link in every email or by writing to kontakt@vitalmyn.com; we then delete your entry. If you do not confirm within 30 days, we delete the entry. A confirmed entry we keep until you withdraw or until we close the waitlist.

Contact via LinkedIn

We approach Heilpraktiker and other health professionals on LinkedIn to present Vitalmyn. In doing so we process data we did not collect from you (Art. 14 GDPR): your name, job title, practice and the details of your public LinkedIn profile, plus the history of our messages. The source is your public LinkedIn profile.

The purpose is business contact (B2B). The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in approaching professionals directly about our offer. LinkedIn (LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland) is an independent controller for the processing on its platform. We use lemlist (lempire SAS, France) as our processor to manage these contacts.

We delete this data no later than six months after the last contact if no business relationship follows, and immediately if you object. You can object to the processing at any time (Art. 21 GDPR) by replying to our message or by emailing kontakt@vitalmyn.com.

3. Legal basis

Your data is processed on the basis of the GDPR:

• Art. 6(1)(a)— consent (e.g. waitlist and product emails, optional cookies)
• Art. 6(1)(b)— performance of a contract (user account, bookings, orders)
• Art. 6(1)(c)— legal obligation (retention for tax purposes)
• Art. 6(1)(f)— legitimate interest (platform security, fraud prevention, business contact via LinkedIn)

4. Health data (special category)

Information that allows conclusions to be drawn about your health belongs to the special categories of personal data under Art. 9(1) GDPR. On this Platform such information arises around your supplement plan: in the products your therapist recommends to you, in their dosage and intake notes on them, in your orders from the plan, in bookings, consultations and treatment notes and in messages between you and your therapist.

Purposes

Vitalmyn sells and ships the products itself. We therefore process this information for two purposes: your care on the Platform, and fulfilling your order — shipping, invoicing, payment and returns. Your therapist sees their own recommendations to you, your messages and the status of your orders; they do not see payment data. The information is not passed on to advertising platforms and is not analysed for advertising.

Legal basis

We process this data exclusively on the basis of your explicit consent under Art. 9(2)(a) GDPR. The consent is obtained separately at registration — apart from your agreement to the Terms and Conditions and without any pre-selection. Without this consent we cannot operate the Platform for you.

Video consultation

For appointments held as a video consultation, we obtain an additional, separate consent to the appointment being carried out as remote treatment before it takes place. This is independent of the consent given at registration.

Record and withdrawal

For each of these consents we store the time, the purpose and the version of the text you saw. If the text changes materially, we ask again. You can withdraw any consent at any time with effect for the future; this does not affect the lawfulness of the processing carried out until then. Withdrawing the consent given at registration means that we can no longer operate your account.

No advertising, no disclosure

Health-related data is not analysed for advertising and not transmitted to advertising platforms. It is made accessible only to the people involved in your care and, to the extent necessary, to the processors named in section 6.

5. Cookies, consent and measurement

We distinguish three purposes. They are asked for separately and never granted together.

Necessary

Sign-in, session management, shopping cart and security. Legal basis: Art. 6(1)(b) GDPR, § 25(2) TDDDG. No consent is required for this, which is why we offer no choice here.

On vitalmyn.de and vitalmyn.com two further necessary cookies exist: vitalmyn_gate, which remembers that you entered the pre-launch password, and vm_panel_lang, which remembers the language you picked. Neither contains personal data and neither is read by a third party.

Analytics (public pages only)

Audience measurement on public pages, to understand which content is found. Vercel Web Analytics does this without cookies; Google Analytics 4 sets cookies for it, only with your consent. We load Google Analytics through Google Tag Manager, which sets no cookies of its own and is itself loaded only after your consent. On vitalmyn.de and vitalmyn.com we also use Microsoft Clarity, loaded the same way and only with your consent. Clarity records how pages are used (clicks, scrolling, mouse movement) as session replays and heatmaps; everything typed into a field is hidden before anything is sent. It sets the cookies _clck and _clsk. Addresses are shortened to page templates and query strings are removed before anything is sent. Off by default. Legal basis: Art. 6(1)(a) GDPR, § 25(1) TDDDG. No audience measurement takes place behind sign-in, in checkout or in the video consultation.

Marketing

Measurement of our campaigns to attract therapists, and the Vitalmyn product emails you have signed up for through the waitlist. Off by default. Legal basis: Art. 6(1)(a) GDPR. We do not transmit data about patients, bookings, orders, products or consultations to advertising platforms.

Withdrawal

You can change or withdraw your consent at any time with effect for the future: via “Cookie settings” in the footer of every page or in your account settings. We store your decision with the time, the purpose and the version of the notice text so that we can prove it.

On vitalmyn.de and vitalmyn.com the site itself holds no database. Your cookie decision is recorded by our app at app.vitalmyn.com, which we operate, with the time, the purposes and the version of the notice text. The site reads one figure from our database when it is built, the current reward rate, which contains no personal data.

Our own operational measurement

To evaluate our own processes, we record events such as “booking confirmed” or “order paid” on our servers in pseudonymised form. These records contain no content from treatment, messages or plans, do not leave our systems and are not transmitted to third parties. No data is stored on or read from your device in the process.

6. Third-party providers and processors

We use the following service providers:

• Supabase(EU servers) — database and authentication
• Stripe(USA, EU standard contractual clauses) — payment processing
• lemlist(lempire SAS, France, EU) — sending the Vitalmyn product emails after confirmation and managing our LinkedIn contacts
• Resend(Resend, Inc., USA, EU standard contractual clauses) — sending the confirmation email
• Vercel(Frankfurt, EU) — hosting and delivery of the Platform as well as cookieless audience measurement on public pages, only with your consent
• Google Ireland Ltd.(Dublin, IE; transfers to Google LLC, USA under the EU-US Data Privacy Framework and standard contractual clauses) — audience measurement with Google Analytics 4, loaded through Google Tag Manager, on public pages, only with your consent
• Microsoft Ireland Operations Ltd.(Dublin, IE; transfers to Microsoft Corporation, USA under the EU-US Data Privacy Framework and standard contractual clauses) — session replays and heatmaps with Microsoft Clarity, loaded through Google Tag Manager, on vitalmyn.de and vitalmyn.com, only with your consent

Data processing agreements under Art. 28 GDPR are in place with all service providers.

7. Your rights

You have the following rights at any time:

• Access— which data we hold about you (Art. 15 GDPR)
• Rectification— correction of inaccurate data (Art. 16 GDPR)
• Erasure— erasure of your data unless a statutory retention obligation applies (Art. 17 GDPR)
• Restriction— restriction of processing (Art. 18 GDPR)
• Data portability— receiving your data in a common format (Art. 20 GDPR)
• Withdrawal— withdrawal of consent given, with effect for the future
• Complaint— complaint to a supervisory authority, in particular the one responsible for our seat

8. Retention period

We store personal data only for as long as is necessary for the respective purposes or as statutory retention periods require. After your account is deleted, your data is erased within 30 days unless there is a legal obligation to keep storing it.

Data from contact via LinkedIn (section 2) is deleted no later than six months after the last contact if no business relationship follows, and immediately on objection.

By way of exception, fixed periods apply to therapists’ verification documents:

• Identity document and Heilpraktiker licence after a rejection— We delete both 30 days after the rejection, unless a new review is under way by then. The period allows a correctable mistake to be fixed, such as an illegible page.
• Identity document and Heilpraktiker licence after an approval— We keep both as the basis of the approval for as long as the practice works with us, and delete them three years after the collaboration ends (the regular limitation period, § 195 BGB).
• Unassigned files— Uploaded files that belong to no verification, for example from an abandoned application, are deleted automatically in the nightly clean-up, no earlier than one day after upload.

9. Contact

If you have questions about data protection, you can reach us at:
Email: kontakt@vitalmyn.com

Last updated: October 2026