Scope of application
We take privacy and transparency seriously. Thus, we commit to ensure the highest possible protection of your personal data. We collect, process and use your personal data strictly in accordance with the European Data Protection Regulation (GDPR) and other applicable legislation.
Of course, we are aware that you provide us with highly sensitive personal information especially when using our Ovy App. Your health data is particularly protected since it is a so-called ‘special category of personal data’ according to Article 9 of the GDPR. We process your sensitive data only if you give us your explicit consent. Below you will find the content of the consent that we request from you as part of the registration and usage of the Ovy App. Therefore, if you tick the relevant Opt-in box during the registration process, you give us your consent to use your personal information as described in detail below.
To use the Ovy App you must be at least 18 years old.
If you want more information, feel free to contact us at firstname.lastname@example.org.
1. Persons in charge
Große Theaterstrasse 39
Company registered at: Hamburg
Local Court (Amtsgericht) of Hamburg, HRB 140562
Management board: Lina Wüller, Eva Wüller
VAT ID DE305785062
The data protection officer can be reached via the Ovy GmbH. In the following you find the contact details:
Name: T. Kastek
Große Theaterstrasse 39
2. Processing of your personal data
The subject matter of data protection is "personal data". This is any information relating to an identified or identifiable natural person (the data subject). This includes information such as name, postal address, email address or telephone number.
The processing of personal health data is essential so that we can calculate your individual cycle. In the Ovy app, please give your explicit consent that we may process this special type of personal data in accordance with GDPR Art. 9. In the following we would like to inform you about the specific purposes for which we process your health data.
If you use the Ovy app free of charge or subscribe to Ovy Premium for a charge and give us your consent, we collect, store and process the following (special) personal data, provided you enter these in the Ovy app.
Profile data in the registration process, including email address, encrypted password, intended use of the Ovy app ("Getting to know your body", "Natural Family Planning (NFP)", "Trying to conceive"), whether and when you have used hormonal contraception, duration and date of your last period and your average cycle length. We need this cycle data to calculate your current cycle. The information on hormonal contraception is important, as different rules apply for the first cycle after coming off the pill. You can skip some of these questions when setting up the Ovy app so they are not recorded. You can find the details on the registration screen. We ask whether you have an Ovy Bluetooth basal thermometer or Beurer Bluetooth basal thermometer to give you the opportunity to pair it directly. Note: You do not need to verify your email address in order to use the Ovy app.
Settings data with which the Ovy app saves adjustments you make. These include all data and notifications entered in the registration process, for example so that the Ovy app reminds you to take the daily measurement, document your period, etc. You can also enter your date of birth so that we can carry out an internal analysis of which age group the Ovy app is relevant for. You can access, check and change the data you provided to Ovy GmbH at any time via your profile.
Information that you add every day via the (+) in the Ovy app. This includes:
- The basal body temperature: To calculate the cycle or ovulation phase. Missing data may mean it is not possible to carry out an analysis in "Natural Family Planning" mode (NFP). On these days, it must be assumed that you are "fertile".
- The cervical mucus: To calculate the cycle or ovulation phase according to the symptothermal method. The Ovy app needs another symptom in addition to the basal body temperature, such as cervical mucus, to carry out the NFP analysis.
- The cervix position & opening: To calculate the cycle or ovulation phase according to the symptothermal method. The Ovy app needs another symptom in addition to the basal body temperature, such as cervix, to carry out the NFP analysis.
- Interference factors: The factoring out of the temperature values due to an interference factor such as alcohol, lack of sleep, etc. ensures that the temperature is not influenced by external factors, but instead is factored out.
- The period: You can start a new cycle in the app by entering the period.
- Results of ovulation test: In "Trying to conceive" mode, the results of positive ovulation tests influence the ovulation calculation.
- Results of pregnancy test: As soon as you enter a positive pregnancy test in the app, the Ovy app "Pregnancy" mode starts, which calculates the due date and displays the current week of pregnancy.
- The following body signals can be recorded but are not included in the algorithm: Sex, hygiene agent, pain, libido, illness, medication, notes, sleep, mood and activity. The purpose of documenting these anonymous data is for potential future research projects in the field of gynaecology, whereby Ovy GmbH guarantees that such research data cannot be linked to you. All information is encrypted and made anonymous. Ovy GmbH may publish the results of internal research in the form of data visualisations or articles in its own name. We would like to point out to you in this respect that such use is not on the basis of your consent, but rather it is outside the scope of the GDPR, which does not apply to anonymous data.
After setting up a profile in the Ovy app, your data will be saved on the Ovy GmbH servers in order to provide you with a backup function and to provide additional features within the scope of services. The data are transmitted and stored in encrypted form.
3. Links to other website
Our website contains links to other websites of third parties. Ovy GmbH is not responsible for the privacy policies or the content of these third-party websites and cannot make any statements about the level of data protection prevailing on these third-party websites. Responsible is solely the respective site operator.
4. Purposes of processing your personal information
Below we would like to inform you about the specific purposes for which we process your personal data. These purposes vary, depending on whether we collect data through the Ovy App or through the Website.
5. Purposes of processing data that we collect through the Ovy App
We need your personal information specified in section 2 in order to offer you all the functions of the Ovy App. For example, you should enter your health data in the Ovy App on a daily basis to get a reliable cycle prediction.
In addition, by admitting to the registration process, you agree that Ovy may store and process this information in order to generally improve Ovys’ services.
Furthermore, by giving your consent, you agree that we may send you information about Ovy's offers (advertisement consent) and reminders via the Ovy App or to the email address you have provided.
Through your profile, you can access, review and change your data provided to Ovy at any time. You can enter new data yourself. Further rights can be found under in section 8 (Affected rights).
The transfer of your information happens via an encrypted connection.
6. Purposes of processing data that we collect through the Ovy Website
The IP addresses and other data collected when visiting our website in accordance with section 3.2 are processed by us for the following purposes:
- Ensuring a smooth connection to our website
- Ensuring comfortable use of our website
- Evaluation of system security and stability as well
- For further administrative purposes
You can create a customer account by registering on our website. With your customer account accessible through your email address and password of your choice, you have at all times access to your previous orders and you can control your personal data to process orders. You can also check out as a guest without setting up a customer account.
Upon request we delete your customer account. Until then, we will save the corresponding data without time limitation, so you have access to it at any time. We block data for specific orders when deleting the customer account after the completion of the order (expiry of the warranty period) and delete it after expiration of the statutory retention periods. The data which is entered as part of an order as a guest, we also lock after the completion of the order (expiry of the warranty period) and delete them after expiration of the statutory retention periods.
You can buy the Ovy Thermometer or other fertility products through our website. To purchase the Ovy Thermometer, fill in an order form stating the following information: first name, last name, address, telephone number and e-mail address (personal data). We use the data to fulfil the contract, in particular to deliver the thermometer and to contact you if we have any questions.
Furthermore, personal data such as first name, name, e-mail address via our website can be specified voluntarily to pre-order the Ovy Bluetooth basal thermometer.
7. Disclosure of your personal data
8. Legal Basis
According to the GDPR, we are obliged to inform you about the legal grounds on which we base our data processing. We are happy to comply with this obligation.
As far as we carry out the processing of your data on the basis of your consent, which you give us in the course of the registration process, the legal basis is Article 6 (1) sentence 1 lit. a GDPR. In order to make it easier to understand which specific processing operations are based on your consent, we have clearly highlighted (in bold) the concept of consent in this document.
According to Art. 7 (3) GDPR, you have the opportunity to revoke your consent once given to us. As a result, we are no longer allowed to continue the data processing based on this consent for the future. However, it is unfortunately the case that, according to the GDPR, we are only allowed to process your health data on the basis of your consent. Therefore, we will not be able to provide you with any or at least not all functions of the Ovy App after your withdrawal.
Insofar as we process your data for the purpose of fulfilling a contract, in particular for the purchase of the thermometer or other fertility products via our website, the legal basis is Article 6 paragraph 1 sentence 1 lit. b GDPR.
9. Rights of the data subject
You have the following rights:
- in accordance with Article 15 GDPR to request information about your personal data processed by us. In particular, you have the right to obtain information on why we process data, the category of personal data we collect, the categories of recipients to whom your data has been disclosed, the planned retention period. You have the right to rectification, deletion, limitation of processing or opposition, the right to lodge a complaint, to find out the source of your data, if it was not collected from us, and the existence of automated decision-making including profiling and, where appropriate, meaningful information about their details.
- in accordance with Article 16 GDPR to immediately demand the correction of incorrect or incomplete personal data stored with us
- in accordance with Article 17 GDPR to erasure of your personal data held by us, except if the processing is required for the exercise of the right to freedom of expression and information, for the fulfillment of a legal obligation, for reasons of public interest or for the assertion, exercise or defense of legal claims
- in accordance with Article 18 GDPR to demand the restriction of the processing of your personal data as far as the accuracy of the data is disputed by you, the processing is unlawful, but you reject their deletion and we no longer need the data, but you assert this, Exercise or defense of legal claims or you have objected to the processing in accordance with Article 21 GDPR
- in accordance with Article 20 GDPR to receive your personal data provided to us in a structured, standard and machine-readable format or to request the transfer to another person responsible
- in accordance with Article 7 paragraph 3 GDPR to revoke your once given consent to us at any time (see above). As a result, we are not allowed to continue the data processing based on this consent for the future
- in accordance with Article 77 GDPR to complain to the supervisory authority of your habitual residence or place of work if you feel it infringes these regulations.
10. Right of objection
If your personal data is processed accordance with Article 6 paragraph 1 sentence 1 lit. f GDPR is processed on our legitimate interests, you have the right to file an objection against the processing of your personal data in accordance with Article 21 GDPR. Still, this applies only if there are reasons for this arising from your particular situation or the objection is directed against direct mail. In the latter case, you have a general right to objection, which is implemented by us without requiring specification of any particular situation.
If you would like to exercise your right of revocation or objection, please send an e-mail to email@example.com.
11. Further guidance
Please be aware of the in accordance with Article 13 paragraph 2 lit. e GDPR to the following:
The provision of your personal data to us is not required by law. However, the specification of mandatory fields in the registration process is a prerequisite for a contract with us. You are not required to provide us with additional personal information. Not providing us with this information will not result in any negative consequence for you.
We assign you in accordance with Article 13 paragraph 2 lit. f GDPR: We do not process your personal information for the purpose of automated decision-making.
12. Data security
We use the widespread SSL (Secure Socket Layer) method for every website visit, in conjunction with the highest level of encryption supported by your browser. In general, this is a 256-bit encryption. If your browser does not support 256-bit encryption we'll use 128-bit v3 technology instead. Whether an individual website of our website is encrypted is shown by the closed representation of the key or lock icon in the lower status bar of your browser.
We also take appropriate technical and organizational security measures to protect your data against accidental or intentional manipulation, partial or total loss, destruction or against unauthorized access by third parties. We are continuously improving our security measures in line with technological progress.
13. Storage and deletion of the data
On quarterly basis, we check whether the data transmitted to us is still needed for the information exchange with you. Data that is no longer needed will be deleted by us immediately, provided that no statutory storage periods are in place.
We reserve the right to have medical data such as cycle lengths and body signals stored in anonymous form on the servers of Ovy GmbH (for details see section 5.1 above). However, this data cannot be assigned in any form to a person and is used solely for research purposes. If you want to delete your data yourself, you can do this in the Ovy App in your profile independently. You can also withdraw your consent at any time by requesting that Ovy deletes your account for you. To do so please write an email to firstname.lastname@example.org and put "Deletion of personal data" in the subject heading.
Please be aware that once you decide to delete your data, we will not be able to restore that data.
14. Data protection
If you have an account in the Ovy App, your personal information about yourself and your cycle, as well as the information added on a daily basis, will be stored separately. Thereby we guarantee a very high security of your data. Your password is stored encrypted.
When transferring your data between your device and Ovy's servers, the HTTPS protocol is used for encryption. HTTPS is the same technology used to make secure connections to your web browser and is indicated by a padlock icon in the browser.
While we cannot guarantee that there will never be misuse, loss or alteration, we make every reasonable effort to protect your personal information in our power from misuse, loss and alteration.
We take reasonable action to ensure the security of your personal information in a technically feasible and reasonable manner. Your data will be carefully protected against loss, destruction, falsification, manipulation and unauthorized access or disclosure.
15. Age restriction for the use of the services of Ovy (Article 8 GDPR)
Ovy does not collect and use personal information from children under the age of 18. When registering for an Ovy Account, you must confirm that you are at least 18 years old. If Ovy becomes aware that this information is incorrect, we reserve the right to delete this information immediately. The use of the Ovy App is therefore only permitted at the age of 18 or older.
16. Data transfer outside of the EU and third-party applications (Chapter 5 GDPR)
All personal information that you collect may only be transferred to countries outside the European Union / European Economic Area (EEA) if in compliance with applicable privacy policies, and to ensure that your privacy is protected.
As a startup, we depend on working with cooperation partners or investors. It is also possible to merge with a company later on (for example as part of an acquisition). In the context of such cooperation and transactions, it may be necessary to disclose the data provided by the users to investors, cooperation partners, acquirers or other third parties. By using our app, you hereby agree. Even in such cases, we will handle all data in a highly sensitive manner and resort to statistical, aggregated, pseudonymous or anonymized data.
- Apple Health (iOS)
Ovy will not share personal information with Apple's Health App without your prior consent. The approval will be granted by you in the corresponding settings of the Health app or in the Ovy app during the initial configuration of the user profile or via the Ovy app settings. The consent can be withdrawn at any time. Once you have given your consent, Ovy will be able to interact with the Health app on your iOS device and read and / or write information between the Ovy App and Health. This may include the transfer of your personal information to Apple servers outside the European Union.
You can choose whether and to what extent your personal information is shared between Ovy and Apple Health by granting or revoking appropriate permissions in Apple’s Health App settings. For more information, see the Apple Health privacy information.
- Google Fit (Android)
Ovy will not share personal information with Google Fit without your prior consent. This approval will be granted by you in the appropriate settings of Google Fit or in the Ovy app during the initial configuration of the user profile or via the Ovy app settings and can be revoked by you at any time. Once you've given your consent, Ovy can interact with Google Fit on your Android device and read and / or write information between the Ovy App and Google Fit. This may include the transfer of your personal information to Google servers outside the European Union.
You can choose to share your personal information between Ovy and Google Fit by granting or revoking permissions in the Google Fit settings. For more information, see the Google Fit privacy information.
- Google Analytics
- Google Analytics for Firebase und Firebase Crashlytics
In the Ovy app we use Google Analytics Firebase and Firebase Crashlytics, features of Google Firebase (Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, "Google"). Firebase is part of the Google Cloud Platform and offers numerous services for developers. You can find a list here: https://firebase.google.com/terms/. Some Firebase services process personal data. In most cases, personal data are limited to so-called "instance IDs", which have a time stamp. These "instance IDs" assigned by Firebase are unique and therefore allow different events or processes to be linked. These data do not constitute identifiable information for us, nor do we make any efforts to personalise these afterwards. We process these aggregated data in order to analyse and optimise usage behaviour, such as through the evaluation of crash reports.
Firebase Cloud Messaging is used to send push messages or so-called in-app messages (messages that are only displayed within the Ovy app). A pseudonymised push reference is assigned to the end device that serves as the destination for the push messages or in-app messages. The push messages can be disabled and re-enabled at any time in the end device settings.
We do not use Firebase services that use personally identifiable information, such as IP addresses, email addresses, phone numbers or passwords. Read more about Firebase's privacy and security here: https://firebase.google.com/support/privacy/
To continuously improve our Ovy app, we conduct tests on individual pages - for example to find out more about optimal design or the greatest possible clarity of our pages. For such test purposes, we also collect statistical data using Google's Firebase A/B Testing web analysis system (https://firebase.google.com/docs/ab-testing/). Firebase does not collect any personal data. The information about your use of this website is transmitted anonymously to a Firebase server and stored there.
The sending of emails via the registration portal and for the production of passwords is carried out using "Mailgun". For this purpose, we use the features of the email delivery platform of the US provider Mailgun Technologies, Inc., 535 Mission St., San Francisco, CA 94105. The provider is designated as Privacy Shield-certified (https://www.privacyshield.gov/participant?id=a2zt0000000PCbmAAG&status=Active), which guarantees compliance with the EU GDPR and all other data protection laws or regulations of a data protection nature applicable in EU Member States. Further information on data processing by the provider can be found at https://www.mailgun.com/privacy-policy.
- Cycle sharing with third parties
You can share your Ovy Account data with external persons. Contacts with which you share your cycle will see your past, present and future periods, ovulations, fertile phases and possibly other body signals. You can revoke your consent at any time by removing the approval or contacts. This removal takes place immediately.
17. Bluetooth transfer
The Ovy app can be used in combination with the Ovy Bluetooth basal thermometer and accesses the services of "Bluetooth SIG", Bluetooth Special Interest Group, Inc. (5209 Lake Washington Blvd NE Suite 350, Kirkland, WA 98033 USA). You can find more information at: www.bluetooth.com.
Use of this transfer between hardware and smartphone requires your consent. Bluetooth Low Energy (BLE) data transfer only works if Bluetooth is enabled on your iOS device. When starting the Ovy app or first pairing a Bluetooth device, you will be asked if you want to allow this service.
In Android, Bluetooth Low Energy transfer is also connected to the location services. Data transfer with Bluetooth Low Energy (BLE) therefore only works if the location services are enabled on your Android device. This applies to all Android versions 6.0 or higher. We only use this permission to perform BLE scans and enable synchronisation. Ovy GmbH does not record your location.
In Android, you can enable or disable usage under "Settings" > "Location". In Android, you can use the slider to enable or disable Bluetooth under "Settings" > "Connections" > "Bluetooth".
In iOS, you can see which apps are allowed to access Bluetooth and allow or withdraw any future access under "Settings" > "Privacy". In iOS, under "Settings" > "Ovy", you can see whether Bluetooth is enabled for the app.
You can prevent the storage of cookies by adjusting the settings of your device accordingly. However, we point out that in this case, you may not be able to use all the features of this app in full. In addition, you can prevent the collection of data generated by the cookies and related to your use of the app (including your IP address) by Google as well as the processing of this data by Google by downloading and installing the browser plug-in available under the following link.
19. Social Media Plugins
On our website (not in the Ovy App), we use buttons ("plugins") of different social networks through which you can make use of the interactive possibilities of the social networks you’re using on our website. These plugins provide different functionalities. These are determined by the providers of social networks.
By activating the social media buttons, you agree to the transfer of your data (not your app data) to the respective network. The social media providers based in the USA may have a different level of data protection than in the EU member states, i.a. due to legal access rights of state authorities.
Please note that Ovy is not a provider of social networks and has no control over the data processing by the respective service providers. More information about the individual plugins can be found on the websites of the respective operators.
Within our offer, due to our legitimate interests in the analysis, optimization and economic operation of our online offer and for this purpose, the so-called Facebook pixel of the social network Facebook, operated by Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbor, Dublin 2 , Ireland ("Facebook") is being used.
With the help of the Facebook pixel, it is on the one hand possible for Facebook to identify the visitors of our offer as a target group for the presentation of advertisements, so-called "Facebook ads" or "Instagram ads". Accordingly, we use the Facebook pixel to display the Facebook ads we have posted only to those Facebook users who have also shown an interest in our offer or who have certain characteristics (e.g. Interests in certain topics or products that are determined by the websites visited) that we submit to Facebook (so-called "custom audiences").
With the help of the Facebook pixel, we also want to make sure that our Facebook ads are in line with the potential interest of users and are not annoying. With the help of the Facebook pixel, we can also understand the effectiveness of the Facebook ads for statistical and market research purposes, in which we see whether users were redirected to our website after clicking on a Facebook ad (so-called "conversion"). Based on data collected via our web shop, e.g. e-mail addresses, we create "lookalike audiences" to reach interested parties with our offers.
You can prevent Facebook from collecting the information by clicking on this link and following the instructions there.
For our advertising, we use the services of the company AdRoll, 972 Mission St., 3rd Floor, San Francisco, CA 94103, USA. AdRoll helps us to show you our ads on other websites. AdRoll specifically targets users who have previously shown interest in our offer. To do this, AdRoll stores a cookie on your computer to better understand your interests. No personal data is stored. You can object to the anonymous analysis of your surfing behavior and the display of interest-based advertising by clicking on the opt-out button. For more information about AdRoll data collection, processing, and usage, visit.
This website uses Hotjar, an analysis software of Hotjar Ltd. ("Hotjar"), 3 Lyons Range, 20 Bisazza Street, Sliema SLM 1640, Malta, Europe). With Hotjar, it is possible to measure and analyze the usage behavior (clicks, mouse movements, scroll heights, etc.) on our website. The information generated by the "tracking code" and "cookie" from your visit to our website will be transmitted to the Hotjar servers in Ireland and stored there. The tracking code collects the following information:
Device dependent data. The following information may be recorded through via your device and your browser: IP address of your device (collected and stored in an anonymous format), e-mail address including your first and last name, assuming you have provided it on our website, screen size of your device, device type and browser information, geographic viewpoint (country only), the preferred language for displaying our website. The following data is automatically generated by our servers when Hotjar is used: Referring domain, visited pages, geographic location (only the country), the preferred language to represent our website, date and time when the website was accessed.
ADCELL affiliate program
20. Automatically collected information
For reasons of system security and to detect and track inadmissible access attempts and access to our app or our web server, certain information is automatically collected and stored in a log file. This happens as soon as you download our app, visit the website, or retrieve content.
This automatically collected information in the app includes: your smartphone's device number, operating system, software version used, the date and time of usage and the error logs. This automatically collected information on the Ovy website includes: browser type / version, operating system used, referrer URL, IP address or host name of the accessing computer, date and time of the request, visited subpages, device type (mobile / web) and location. The storage of this data is done to ensure the stability and reliability of the app and to detect cases of abuse. This data is also deleted or overwritten on a quarterly basis, providing that there has been no suspicion of unlawful access to our app. The analysis of the automatically collected data only takes place in the case of such suspicion and only by authorized persons for purposes of data protection control, data storage or to ensure the proper operation of a data processing system. If you contact our service by sending an e-mail to the support team, e.g. to communicate with Ovy at email@example.com or otherwise, we will record the communication history as well as the information you send in this context (e.g., e-mail address). This ensures that we can process requests and provide appropriate support.
21. Newsletter, Advertisment
Based on your explicit consent, we will regularly send you our newsletter or similar information by email to the email address you have provided.
Providing us with an email address is sufficient for receiving the newsletter. When you subscribe to our newsletter, the data you provide will only be used for this purpose. Subscribers can also be informed by email about circumstances relevant to the service or registration (for example, changes to the newsletter or technical conditions).
We need a valid email address for registration. To verify that a log-in attempt is actually made by the owner of an email address, we use the "double opt-in" procedure. To do this, we log the subscription to the newsletter, the sending of a confirmation email and the receipt of the requested response. No further data is collected. The data will only be used for sending newsletters and will not be passed on to third parties.
Newsletter by Klaviyo: We use the Klaviyo component to send our newsletters. Klaviyo is a service provided by Klaviyo Inc, Boston, USA. Your data (email address, if applicable name, IP address, date and time of your registration) saved when you register for the newsletter will be transferred to a Klaviyo Inc. server in the USA and stored there in accordance with the "EU-U.S. Privacy Shield". You can find more information about privacy at Klaviyo at http://klaviyo.com/privacy/. You can cancel or withdraw your subscription to this newsletter and your consent to the storage of your data at any time with future effect. You can find more details on this in the confirmation email and in each individual newsletter.
Newsletter tracking: Our newsletters contain web beacons that allow us to identify whether and when an email has been opened and which links in the email have been followed by the personalised recipient. We store these data so that we can tailor our newsletters to the needs and interests of our subscribers. Accordingly, the data collected in this way are used to send personalised newsletters to the respective recipient.
You can unsubscribe from our newsletter by clicking on the unsubscribe link at the bottom of the message and disabling notifications.
22. Contact form
You can contact us by email or via the contact form if you have any questions. This requires a valid email address. This is used to assign and then answer the enquiry. The provision of further data is optional. The information you provide will be stored for the purpose of processing the enquiry and for possible follow-up questions.
23. Links to other websites
Our app contains links to other websites of third parties. Ovy GmbH is not responsible for the privacy policies or the content of these third-party websites and cannot make any statements about the level of data protection prevailing on these third-party websites. Responsible is solely the respective site operator.
Ovy is operated by Ovy GmbH. To exercise your rights, please contact:
Große Theaterstraße 39
Data protection officer: Tom Kastek, firstname.lastname@example.org
Date of last change: June 2020