Privacy Policy

In this privacy notice, we explain how we handle your personal data and set out your rights under the General Data Protection Regulation (GDPR) and the Federal Data Protection Act (BDSG). The data controller is nio Pharma GmbH (hereinafter referred to as “we” or “us”).

I. General information

1. Contact

If you have any questions or comments regarding this information, or if you wish to contact us to exercise your rights, please direct your enquiry to

nio Health GmbH
Van-der-Smissen- Strasse 1, 22767 Hamburg
Phone: +49 40 441 809 555
Email: info@nio-health.com

2. Legal basis

The data protection term “personal data” refers to any information relating to an identified or identifiable natural person. We process personal data in compliance with the relevant data protection regulations, in particular the GDPR and the BDSG. We process data only on the basis of a legal authorisation. We process personal data only with your consent (Section 15(3) of the German Telemedia Act (TMG) or Article 6(1)(a) of the GDPR), to fulfil a contract to which you are a party, or at your request to take pre-contractual measures (Article 6(1)(b) of the GDPR), to fulfil a legal obligation (Article 6(1)(c) of the GDPR) or where processing is necessary to safeguard our legitimate interests or the legitimate interests of a third party, provided that your interests or fundamental rights and freedoms requiring the protection of personal data do not override those interests (Article 6(1)(f) of the GDPR).

3. Duration of storage

Unless otherwise stated in the following information, we will only retain data for as long as is necessary to fulfil the purpose of processing or to meet our contractual or legal obligations. Such legal retention obligations may arise, in particular, from commercial or tax law provisions. From the end of the calendar year in which the data was collected, we will retain personal data contained in our accounting records for ten years and personal data contained in commercial correspondence and contracts for six years. Furthermore, we will retain data relating to consents requiring proof, as well as complaints and claims, for the duration of the statutory limitation periods. We will delete data stored for advertising purposes if you object to its processing for this purpose.

4. Categories of data recipients

We use data processors in connection with the processing of your data. The processing operations carried out by such data processors include, for example, hosting, sending emails, maintenance and support of IT systems, marketing activities, and the destruction of files and data storage media. A data processor is a natural or legal person, public authority, agency or other body that processes personal data on behalf of the data controller. Data processors do not use the data for their own purposes, but carry out data processing exclusively on behalf of the data controller and are contractually obliged to ensure appropriate technical and organisational measures for data protection. In addition, we may transfer your personal data to entities such as postal and delivery services, our bank, tax advisers/auditors or the tax authorities. Further recipients may be identified in the following information.

5. Data transfers from third countries

Visiting our website may involve the transfer of certain personal data to third countries, i.e. countries where the GDPR does not apply. Such a transfer is lawful if the European Commission has determined that an adequate level of data protection is ensured in that third country. Where no such adequacy decision has been issued by the European Commission, the transfer of personal data to a third country shall only take place if suitable safeguards are in place in accordance with Article 46 of the GDPR or if one of the conditions set out in Article 49 of the GDPR is met.

Unless otherwise stated below, we use the EU Standard Data Protection Clauses as appropriate safeguards for the transfer of personal data to third countries. You have the option of receiving a copy of these EU Standard Data Protection Clauses or viewing them. Please contact us at the address provided under ‘Contact’ for this purpose.

If you consent to the transfer of personal data to third countries, the transfer will take place on the legal basis of Article 49(1)(a) of the GDPR.

6. Processing in connection with the exercise of your rights

When you exercise your rights under Articles 15 to 22 of the GDPR, we process the personal data provided for the purpose of implementing those rights and to be able to provide evidence of this. We will process data stored for the purpose of providing information and preparing such information solely for this purpose and for data protection monitoring purposes, and will otherwise restrict processing in accordance with Article 18 of the GDPR.

This processing is based on the legal basis set out in Article 6(1)(c) of the GDPR, in conjunction with Articles 15 to 22 of the GDPR and Section 34(2) of the BDSG.

7. Your rights

As a data subject, you have the right to exercise your data subject rights in relation to us. In particular, you have the following rights:

In accordance with Article 15 of the GDPR and Section 34 of the BDSG, you have the right to request information as to whether, and if so to what extent, we process personal data relating to you.
You have the right to request that we rectify your data in accordance with Article 16 of the GDPR.
You have the right to request that we erase your personal data in accordance with Article 17 of the GDPR and Section 35 of the BDSG.
You have the right to have the processing of your personal data restricted in accordance with Article 18 of the GDPR.
You have the right, in accordance with Article 20 of the GDPR, to receive the personal data concerning you that you have provided to us in a structured, commonly used and machine-readable format, and to transmit this data to another controller.
If you have given us separate consent to process your data, you may withdraw this consent at any time in accordance with Article 7(3) of the GDPR. Such withdrawal does not affect the lawfulness of processing carried out on the basis of your consent prior to the withdrawal.

If you believe that the processing of your personal data infringes the provisions of the GDPR, you have the right to lodge a complaint with a supervisory authority in accordance with Article 77 of the GDPR.

8. Right to object

In accordance with Article 21(1) of the GDPR, you have the right to object to processing carried out on the legal basis of Article 6(1)(e) or (f) of the GDPR on grounds relating to your particular situation. Where we process personal data relating to you for the purposes of direct marketing, you may object to such processing in accordance with Article 21(2) and (3) of the GDPR.

9. Data Protection Officer

You can contact our Data Protection Officer using the following contact details:

Herting Oberbeck Datenschutz GmbH
Hallerstr. 76, 20146 Hamburg
Email: dpo@nio-health.com
https://www.datenschutzkanzlei.de

II. Data processing on our website

When you use the website, we collect information that you provide yourself. In addition, during your visit to the website, we automatically collect certain information about your use of the website. Under data protection law, an IP address is generally also considered to be personal data. An IP address is assigned to every device connected to the internet by the internet service provider so that it can send and receive data.

This site uses SSL or TLS encryption for security reasons and to protect the transmission of confidential information, such as orders or enquiries that you send to us as the site operator. You can recognise an encrypted connection by the fact that the address bar of your browser changes from “http://” to “https://” and by the padlock symbol in your browser bar.

If SSL or TLS encryption is enabled, the data you send to us cannot be intercepted by third parties.

1. Processing of server log files

When you use our website for purely informational purposes, general information transmitted by your browser to our server is initially stored automatically (i.e. without registration). By default, this includes: browser type and version, operating system used, page accessed, the previously visited page (referrer URL), IP address, date and time of the server request, and HTTP status code. Processing is carried out to safeguard our legitimate interests and is based on the legal basis of Article 6(1)(f) of the GDPR. This processing serves the technical administration and security of the website. The stored data is deleted after seven days, unless there are concrete indications of a legitimate suspicion of unlawful use and further examination and processing of the information is necessary for this reason. We are unable to identify you as a data subject on the basis of the stored information. Articles 15 to 22 of the GDPR therefore do not apply in accordance with Article 11(2) of the GDPR, unless you provide additional information enabling your identification in order to exercise your rights set out in those articles.

2. Contact details and enquiries

3. Reports of side effects

We are legally obliged to investigate suspected cases of adverse reactions and, where necessary, to forward them (without names) to the relevant health authority. Your report is of great importance to public health. You may submit the report anonymously or provide your personal details. If you have provided your details and consented to this, we may contact you if we have any further questions. We will use and share this data exclusively for pharmacovigilance purposes (pharmacovigilance refers to the activities involved in the detection, assessment, understanding and prevention of adverse effects or other issues related to medicines).

Contact details are required so that we can follow up with the reporter and thus obtain high-quality and complete information on suspected cases of adverse reactions. If the reporter does not wish to provide their contact details to nio Pharma or the authorities, ‘Data Protection’ will be entered in the field for the reporter’s name.

When you call us, certain data is automatically transmitted to us for technical reasons, e.g. your telephone number, the date and the time. In the event of a report of a side effect, your call will be immediately transferred to the relevant department responsible for drug safety. Should this not be possible in exceptional cases, your contact details will be recorded in an email and forwarded to the relevant drug safety department so that you can be called back. Please also pass this information on to anyone else involved in the call on your end, such as family members or patients. We collect, process and use the information provided solely for the purpose of dealing with your specific enquiry.

If, when submitting your report, you provide information such as your name that could be used to identify you, the processing of this data is carried out with your consent. The legal basis for the data processing is Article 9(2)(a) of the GDPR.

nio Pharma is obliged to report information relevant to pharmacovigilance to health authorities in the EU/EEA. The reports contain detailed information about the potential adverse reaction; however, personal data is used only to a limited extent and on the basis of your consent provided in the ‘Adverse Reaction Report’ form. With regard to the reporter, depending on the information provided, the report will contain your name, professional occupation (if you are reporting as a member of the healthcare profession, e.g. doctor, pharmacist), address, email address and telephone number.

As reports of adverse events are important for public health reasons, they are retained for at least 10 years after the product is no longer marketed in any country.

4. Cookies

We use cookies and similar technologies (“cookies”) on our website. Cookies are small data files that are stored by your browser when you visit a website. This identifies the browser being used and allows it to be recognised by web servers. You have full control over the use of cookies via your browser. You can delete cookies at any time via your browser’s security settings. You can object to the use of cookies via your browser settings, either generally or in specific cases.

The use of cookies is, in some cases, technically necessary for the operation of our website and is therefore permitted without the user’s consent. We may also use cookies to provide specific features and content, as well as for analytical and marketing purposes. These may include third-party cookies. We only use such non-essential cookies with your consent.

You can find information on the purposes, providers, technologies used, data stored and the storage duration of individual cookies in the cookie settings of our consent management tool, which you can access via the button below:

5. Consent Management Tool

This website uses a consent management banner to manage cookies. The consent banner allows users of our website to give their consent to specific data processing activities or to withdraw consent that has already been given. By clicking the “I accept” button or by saving individual cookie settings, you consent to the use of the associated cookies. The legal basis under data protection law is your consent within the meaning of Article 6(1)(a) of the GDPR.

In addition, the banner helps us to provide evidence that consent has been given. To this end, we process information regarding the declaration of consent, as well as log data relating to this declaration. Cookies are also used to collect this data.

The processing of this data is necessary in order to be able to provide evidence of the consent given. The legal basis for this is our legal obligation to document your consent (Article 6(1)(c) in conjunction with Article 7(1) of the GDPR).

6. Google Analytics

We use the Google Analytics service provided by Google Ireland Limited (Google Ireland/EU) on our website.

Google Analytics is a web analytics service that enables us to collect and analyse data on visitor behaviour on our website. To do this, Google Analytics uses cookies that allow us to analyse how our website is used. In doing so, personal data is processed in the form of online identifiers (including cookie identifiers), IP addresses, device identifiers and information about interactions with our website.

Some of this data consists of information stored on the device you are using. In addition, further information is stored on your device via the cookies used. Google Analytics will only store such information or access information already stored on your device with your consent.

Google Ireland will process the data collected in this way on our behalf in order to analyse how users use our website, to compile reports on activity within our website, and to provide us with other services relating to the use of our website and internet usage. In doing so, pseudonymous user profiles may be created from the processed data.

The use of cookies and the further processing of personal data described here is carried out with your consent. The legal basis for data processing in connection with the Google Analytics service is therefore Article 6(1)(a) of the GDPR. You may withdraw this consent at any time via our Consent Management Tool, with effect for the future.

The personal data processed on our behalf for the provision of Google Analytics may be transferred to any country in which Google Ireland or Google Ireland’s sub-processors maintain facilities. The legal basis for this transfer is the Standard Contractual Clauses for the transfer of personal data to third countries pursuant to Article 46(2)(c) of the GDPR.

We only use Google Analytics with IP anonymisation enabled. This means that the IP addresses of users located within Member States of the European Union or in other signatory states to the Agreement on the European Economic Area are truncated by Google Ireland. The IP address transmitted by the user’s browser is not combined with any other data.

We use the Google Universal Analytics version. This enables us to link interaction data from different devices and sessions to a unique user ID. This allows us to place individual user actions in context and analyse long-term relationships.

Data relating to user actions is stored for a period of 14 months and then automatically deleted. Data whose retention period has expired is automatically deleted once a month. Further information.

We also use the Google Analytics advertising features (remarketing). This feature, in conjunction with Google’s cross-device capabilities, enables us to display adverts in a more targeted manner and present users with adverts tailored to their interests. Through remarketing, users are shown adverts and products for which an interest has been identified on other websites within the Google network. This feature allows us to link advertising audiences created via Google Analytics remarketing with the cross-device features of Google Ads. In this way, interest-based, personalised advertising messages, which have been tailored to a user based on their previous usage and browsing behaviour on one device (e.g. mobile phone), can also be displayed on another of the user’s devices (e.g. tablet or PC).

If you have given your consent, Google will link your web and app browsing history to your Google Account for this purpose. This allows the same personalised adverts to be displayed on any device on which you sign in with your Google Account. The aggregation of the data collected in your Google Account is based solely on your consent, which you can give or withdraw via Google. Data is then collected via Google Analytics for advertising purposes for these linked services. To support the remarketing function, Google Analytics collects the Google-authenticated IDs of users, which are temporarily linked to our Google Analytics data. This serves to define and create target groups for cross-device advertising.

You can also prevent the collection of information generated by the cookie by downloading and installing the browser plugin available at the following link: https://tools.google.com/dlpage/gaoptout. If you are visiting our website via a mobile device, you can disable Google Analytics by clicking on this link.

You can permanently opt out of cross-device tracking by disabling personalised advertising in your Google Account; to do so, follow this link: https://www.google.com/settings/ads/onweb/

Further information on the use of data for advertising purposes can be found in Google’s privacy policy at: www.google.com/policies/technologies/ads/

7. External media and third-party services

a. Font Awesome

Our website uses so-called web fonts and icons provided by Fonticons, Inc. (USA) to ensure consistent display of fonts and icons. When you visit a page, your browser loads the required web fonts and icons into its cache to display text, fonts and icons correctly.

To this end, the browser you are using must establish a connection to the servers of Fonticons, Inc. As a result, Fonticons, Inc. becomes aware that our website has been accessed via your IP address. The use of Font Awesome is carried out to safeguard our legitimate interests in the optimisation and economic operation of our website and is based on the legal basis of Article 6(1)(f) of the GDPR.

If your browser does not support Font Awesome, a default font from your computer will be used. For more information about Font Awesome, please visit https://fontawesome.com/help and consult the privacy policy of Fonticons, Inc.: https://fontawesome.com/privacy.

b. Google reCAPTCHA

When you register for the corporate customer portal, we use the reCAPTCHA service provided by Google Ireland Limited (Ireland/EU). For this integration, processing of your IP address is technically necessary so that the content can be sent to your browser. Your IP address is therefore transmitted to Google. Google also collects further data, e.g. about your browser and your clicking behaviour. We use the service for security reasons to verify that form entries are made by a natural person. In this way, automated access attempts and attacks can be detected and prevented. We are legally obliged to take technically and economically reasonable measures to ensure the security of the portal. The legal basis is Article 6(1)(c) of the GDPR in conjunction with Article 32 of the GDPR and Section 19(4) of the TTDSG.

You can disable this data processing at any time via the settings of your browser or certain browser extensions. One such extension is the matrix-based firewall uMatrix for Firefox and Google Chrome. Please note that this may result in some features of the website or portal being restricted.

When using Google services, it cannot be ruled out that data may be transferred to Google Inc. in the USA. Please refer to the information in the section ‘Data transfers to third countries’. Users can find further information on data protection at Google in Google’s privacy policy: https://www.google.com/policies/privacy

As of April 2026