Version 1.0 | Effective from: January 9, 2026
Original Language: This Privacy Policy was originally drafted in German language.
Translations: We provide translations of this Privacy Policy in other languages for your reference.
Authoritative Version: In the event of any contradiction, inconsistency, or different interpretation between the German version and any translation, exclusively the German version is legally binding and authoritative.
This Privacy Policy informs you about how we collect, use, and protect your personal data when you use the mobile application SuppScan AI (the "App").
Controller:
Lokman Beser Dr.-Golm-Str. 24 27232 Sulingen Germany
Email: [email protected] Website: https://suppscan.ai
Data Protection Officer:
Abdullah Sögüt Email: [email protected]
This Privacy Policy complies with the requirements of:
When creating an account, we collect:
Important: Health data constitutes "special categories of personal data" under GDPR and requires your explicit consent.
We collect the following health-related information:
Legal Basis: Your explicit consent pursuant to Art. 9(2)(a) GDPR, which is obtained separately during account creation.
Important Notice for Users in Illinois, Texas, and Washington (USA):
SuppScan AI does not collect, store, or process any biometric identifiers or biometric information within the meaning of the Illinois Biometric Information Privacy Act (BIPA), the Texas Biometric Privacy Law, or the Washington Biometric Privacy Law.
What We Do NOT Capture:
Our Photo Scan Feature:
When you use the AI-powered photo scan feature to photograph supplement labels:
If a Photo Accidentally Contains People:
Your Responsibility:
When photographing supplement packaging:
Compliance with Illinois Biometric Information Privacy Act (BIPA):
Pursuant to 740 ILCS 14/1 et seq. (Illinois BIPA):
Contact:
If you have questions regarding photo processing or biometric data:
Email: [email protected] Subject: "Biometric Privacy Inquiry"
We process your account and supplement data in order to:
Without this processing, we cannot provide the App.
We use your health data in order to:
You may withdraw your consent at any time by deleting your account. However, withdrawal means you can no longer use the personalized features of the App.
We use error monitoring services in order to:
This processing is necessary to provide a functioning app. Without crash monitoring, we cannot maintain app quality.
We retain certain data as required by law:
Apple collects and processes technical data through the App Store infrastructure:
We share your data with the following categories of service providers:
Within the EU:
Outside the EU (USA):
Payment Processing:
Apple processes technical data through the App Store infrastructure as a data processor:
Some of our service providers are located outside the EU, particularly in the USA:
Safeguards for USA Transfers:
We ensure that these transfers are protected by one or more of the following guarantees:
EU-US Data Privacy Framework (DPF) - EU Commission adequacy decision of July 10, 2023. To the extent service providers are certified under the DPF, the transfer is based on this framework.
Standard Contractual Clauses (SCCs) - EU Commission-approved contractual clauses that guarantee EU data protection standards. We use these with service providers without DPF certification.
EU Establishments - Some service providers have established EU establishments as data controllers.
Copies of Guarantees: You may request a copy of the Standard Contractual Clauses or information regarding the DPF status of our service providers by emailing: [email protected]
Important Notes:
Before we send your data to AI providers:
We may share your personal data with professional advisors insofar as this is necessary for the provision of their services:
Legal Basis: Art. 6(1)(f) GDPR (legitimate interest in ensuring proper corporate governance and legal compliance).
All professional advisors are subject to professional confidentiality obligations and are contractually obligated to treat your data confidentially.
When you sign in to SuppScan AI with a third-party service, we receive certain information from that service:
When you choose "Sign in with Apple," we receive from Apple:
Important: Apple offers the option to "Hide My Email," whereby Apple creates a forwarding email address. We respect your choice.
Apple Privacy Policy: https://www.apple.com/legal/privacy/
When you choose "Sign in with Google," we receive from Google:
Google API Services User Data Policy: Our use of information received from Google APIs complies with the Google API Services User Data Policy, including Limited Use requirements.
We use this data exclusively for:
Important: We do not sell data received from Google APIs and only share it as described in this Privacy Policy.
Google Privacy Policy: https://policies.google.com/privacy
You may revoke SuppScan AI's permissions at any time in your Apple or Google account settings. Please note that revoking permission may impair your ability to sign in to the App.
Legal Basis: Art. 6(1)(b) GDPR (contract performance) and your consent at the time of sign-in.
We may disclose or transfer your personal data in connection with actual or contemplated business transactions:
Before completing a transaction, we may need to share personal data with:
These parties are contractually obligated to maintain confidentiality and may use your data only for the purpose of transaction review.
In the event of a completed transaction, your personal data may be transferred to:
Important: The new owner will remain bound by this Privacy Policy, unless:
In the event of material business transactions, we will notify you:
Legal Basis: Art. 6(1)(f) GDPR (legitimate interest in ensuring business continuity) and Art. 6(1)(b) GDPR (contract performance).
We do NOT sell, rent, or share your personal data with:
Exception: We may disclose data if required by law (e.g., court orders, law enforcement requests).
We store your data only as long as your account is active and you use the App.
When you delete your account:
Exceptions:
AI Interaction Logs (Art. 17(3)(e) GDPR): To defend against legal claims (e.g., product liability), we retain encrypted AI interaction logs for maximum 10 years:
Purpose: If you claim the App provided faulty health recommendations, we can demonstrate what inputs you provided and what recommendations the AI gave.
Security: All data remains AES-256 encrypted. Your deleted user ID remains stored but points to a non-existent account.
Automatic Deletion: No later than 10 years after the AI interaction.
Further Exceptions:
Accounts inactive for longer than 60 months (5 years) may be deleted following prior notice.
While Your Account Is Active:
After Account Deletion:
Inactive Accounts:
Should Apple terminate the App license due to non-compliance with Apple terms:
You have the following rights regarding your personal data:
You may request information about what personal data we have stored about you.
How to Exercise: Email [email protected]
You may request correction of inaccurate personal data.
How to Exercise: Edit your profile directly in the App.
You may request deletion of your personal data.
How to Exercise: Delete your account in App Settings → Delete Account.
You have the right to request restriction of processing of your data.
Important: Since processing of your data is necessary for providing App functionality (Art. 6(1)(b) GDPR), we cannot provide services if you request restriction. Your account will remain, but:
More Practical Alternative: If you no longer wish to use the App, we recommend full account deletion (see 6.3).
How to Exercise: Email [email protected]
You may obtain a copy of your data.
How to Exercise: Email [email protected]
Since our data processing is based on contract performance and consent, objection is not applicable.
How to Exercise: Delete your account.
You may withdraw your consent to processing of health data at any time.
How to Exercise: Delete your account (withdrawal applies only to future processing).
You have the right to lodge a complaint with a data protection supervisory authority.
Competent Supervisory Authority:
The Lower Saxony State Commissioner for Data Protection Website: https://www.lfd.niedersachsen.de/
We protect your data with industry-standard security measures:
In the event of a data breach affecting your rights:
We have conducted a Data Protection Impact Assessment pursuant to Art. 35 GDPR to assess risks of processing health data and implement appropriate safeguards.
For All Users:
In the event of a data breach (security incident, unauthorized access, data leak) that poses a risk to your rights and freedoms, we will:
Additionally for US Users - FTC Health Breach Notification Rule:
For users in the United States, additional notification requirements apply pursuant to the FTC Health Breach Notification Rule (16 CFR Part 318), as amended on July 21, 2024.
What is the FTC Health Breach Notification Rule?
The US Federal Trade Commission (FTC) requires health apps like SuppScan AI to report data breaches affecting unsecured personal health information (PHR). This rule applies to apps not covered by HIPAA (like SuppScan AI).
In the event of a notifiable security breach, we will:
Notify You - Within 60 days of discovering the breach via:
Notify the FTC - Within 60 days of discovering the breach
Notify Third-Party Service Providers - Who may be affected by the breach
What Our Notification Will Contain:
What Qualifies as a "Security Breach" under the FTC Rule:
A breach occurs when unsecured personal health information is acquired without authorization, including through:
What Does NOT Qualify as a Breach:
Your Rights in the Event of a Data Breach:
FTC Contact for Complaints:
Federal Trade Commission Consumer Response Center 600 Pennsylvania Avenue NW Washington, DC 20580 Phone: 1-877-FTC-HELP (1-877-382-4357) Website: https://www.ftc.gov/complaint
Additionally for California Users - California Civil Code §1798.82:
For California residents, additional notification requirements apply pursuant to the California Data Breach Notification Law. In the event of a breach affecting unencrypted personal information, we will notify California users "without unreasonable delay" and in the "most expedient time possible" as required by California law.
How We Prevent Data Breaches:
We implement comprehensive technical and organizational measures to prevent data breaches:
Security Vulnerability Reporting:
If you discover a security vulnerability in our services, please report it immediately to:
Email: [email protected] Subject: "Security Vulnerability Report"
We are committed to responsible disclosure and will not take action against researchers who report security issues in good faith.
Note: This Privacy Policy applies primarily to our Mobile App. Our APIs are accessible exclusively through the Mobile App.
We take a strict privacy-first approach and do not use third-party services for analytics, advertising, or tracking. Your usage data is not shared with marketing or advertising platforms.
We collect exclusively technical data required for providing App functionality:
Legal Basis: Art. 6(1)(b) GDPR (necessary for contract performance).
This data processing is technically required for the App to function properly. Without this data, we cannot provide the App's basic functions.
Our public website (suppscan.ai) uses exclusively technically necessary cookies:
Legal Basis: Art. 6(1)(f) GDPR (legitimate interest in technical functionality).
We do not use marketing, analytics, or tracking cookies on our website. A cookie consent banner is therefore not required.
This App is intended for users aged 18 and above.
Age restriction is technically enforced at multiple levels:
By using the App, you confirm that you are at least 18 years of age.
Important: We do not knowingly collect data from persons under 18 years of age. If we become aware that we have inadvertently collected such data, we will delete it immediately.
For US Users: We do not knowingly collect data from children under 13 years of age pursuant to the Children's Online Privacy Protection Act (COPPA). If we discover that we have inadvertently collected personal data from children under 13, we will delete it immediately.
We use AI for:
AI-generated recommendations are for informational purposes only and do NOT constitute medical advice.
For users in the EU/EEA:
You are hereby informed that:
Our App uses automated processing (AI) to generate personalized supplement recommendations and nutrient targets.
Important Clarification: These automated recommendations have no legal effects on you and do not significantly impair you. They serve exclusively for informational purposes.
You make all decisions yourself, including:
Pursuant to Art. 22 GDPR, you have the right not to be subject to a decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you.
Since our AI recommendations:
... the use of our AI features does not fall under the restrictions of Art. 22 GDPR.
You are in control at all times and may:
We may update this Privacy Policy from time to time.
For Material Changes:
Version History:
Email: [email protected] Mail: Lokman Beser, Dr.-Golm-Str. 24, 27232 Sulingen, Germany
Email: [email protected]
Email: [email protected] Subject: "GDPR Data Request"
Response Time: We will respond to your request within 30 days, as required by Art. 12(3) GDPR.
If you have concerns about our data processing, you may contact:
Competent Supervisory Authority:
The Lower Saxony State Commissioner for Data Protection Website: https://www.lfd.niedersachsen.de/
Data protection laws in some countries grant you additional rights. If you reside in one of the following countries, the jurisdiction-specific provisions below apply in addition to the rights mentioned above.
If you reside in California, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):
Right to Know: You may request information twice per year at no cost regarding:
Right to Delete: You may request deletion of your personal data, subject to certain exceptions.
Right to Opt-Out of Sale/Sharing: We do NOT sell your personal data and have not done so in the past 12 months. We do not share your personal data for cross-context behavioral advertising (cross-device advertising profiling).
Right to Correct: You may request correction of inaccurate personal data.
Right to Limit Use of Sensitive Data: Health data constitutes "sensitive personal information." We use this only for the purposes described in this Privacy Policy and no other purposes.
Right to Non-Discrimination: We will not discriminate against you if you exercise your CCPA rights.
In the past 12 months, we have collected the following categories of personal data:
Email: [email protected] Subject: "CCPA Request"
We will respond to your request within 45 days (extendable by another 45 days if needed).
You may designate an authorized agent to make requests on your behalf. The agent must provide written authorization.
If you reside in Nevada, you have the right under Nevada Revised Statutes (NRS) 603A to opt out of the sale of certain personal data.
Important: We do NOT sell your personal data and have never done so. Should we change our practices in the future, we will notify you and provide you the opportunity to opt out of the sale.
If you nonetheless wish to make a Nevada opt-out request:
Email: [email protected] Subject: "Nevada Opt-Out Request"
Please provide your name and the email address associated with your account.
For Users in Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Virginia (VCDPA):
If applicable, you have similar rights as under CCPA:
Exercise Your Rights:
Email: [email protected] Subject: "[State]-Privacy Request" (e.g., "Colorado-Privacy Request")
We will respond to your request within 45 days.
Note: These laws apply only if we meet certain processing thresholds in your state (e.g., 100,000+ residents). Regardless, we respect these rights for all US users.
If you reside in Brazil, you have the following additional rights under the Lei Geral de Proteção de Dados (LGPD):
We process your data based on:
Email: [email protected] Subject: "LGPD Request"
We will respond to your request within 15 days.
Autoridade Nacional de Proteção de Dados (ANPD) Website: https://www.gov.br/anpd/pt-br
If you reside in Canada, you have the following rights under the Personal Information Protection and Electronic Documents Act (PIPEDA):
Your personal data may be transferred to service providers in the USA and other countries for processing. This data may be subject to access by authorities in these countries pursuant to their laws.
We protect your data through:
Email: [email protected] Subject: "PIPEDA Request"
We will respond to your request within 30 days.
Office of the Privacy Commissioner of Canada 30 Victoria Street, Gatineau, Quebec K1A 1H3 Phone: 1-800-282-1376 Website: https://www.priv.gc.ca
If you reside in the United Kingdom, you have the same rights as under EU GDPR (see Section 6), with the following UK-specific details:
Information Commissioner's Office (ICO) Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF Phone: 0303 123 1113 Website: https://ico.org.uk
Data transfers from the UK to third countries are protected by:
Switzerland: Users in Switzerland have similar rights as under GDPR. The competent authority is the Federal Data Protection and Information Commissioner (EDÖB): https://www.edoeb.admin.ch
Australia: Users in Australia have rights under the Privacy Act 1988. The competent authority is the Office of the Australian Information Commissioner (OAIC): https://www.oaic.gov.au
Other Jurisdictions: If you reside in another country, local data protection laws may apply. Contact us at [email protected] for jurisdiction-specific information.
Date: January 9, 2026 Version: 1.0
© 2026 Lokman Beser. All rights reserved.