Privacy Policy

1. Data protection at a glance

General information

The following information provides a simple overview of what happens to your personal data when you visit this website. Personal data is any data by which you can be personally identified.

2. Controller

The controller for the data processing described in this policy is:

2a. Data protection officer

No separate data protection officer is currently appointed. Please address data protection enquiries to the controller named above.

3. Data collection on this website

Which data is collected?

We collect the following personal data:

• Email address (for account creation and communication)
• Name (first and last name)
• Contact, appointment and video call data for public initial consultations
• Postcode and the location data derived from it
• Sport, experience level and training goals (athletes)
• Profession, specialist areas and hourly rate (professionals)
• Location and booking administration data (location accounts)
• Chat messages between athletes and professionals
• Health data (special category under Art. 9 GDPR), only with your explicit consent. Within a care relationship: weekly check-ins (load, hours of sleep, pain, mood, free-text note), feedback from the professional on them, working notes by the professional (with separate consent), analysis and measurement values (title, notes, unit, date measured), focus areas, milestones, recommendations from the professional and uploaded documents (file name, file type, content). A recommendation may contain the suggestion of an analysis, also with a location that offers it. Whether and where you book the analysis is your own decision. Outside a care relationship: the health values you document yourself in your record
• Subscription and entitlement status (e.g. Pro features per role)
• Payment and billing information (processed by Stripe)
• Tax-relevant details, insofar as legally required
• IP address and the details of your browser and operating system (user agent) on registration and consent events
• Email addresses of professionals whom another professional invites to co-care (section 3c)
• for an ended participation in a care relationship, who ended it, and whether the person being cared for allowed a person they removed again (section 3c)

Which of these details we publish for professionals is set out in section 3a. Which we release to other accounts for locations is set out in section 3b.

How do we collect your data?

Some of your data is collected because you provide it to us. This may be, for example, data that you enter when registering or in your profile. In a care relationship, your professional also records data about you, for example feedback, recommendations, working notes and the handover note.

Other data is collected automatically or with your consent by our IT systems when you visit the website. This is mainly technical data (e.g. internet browser, operating system or the time of the page view).

What do we use your data for?

• Providing and operating the platform
• Handling public online initial consultations including email verification and video appointment
• Matching between athletes and sports professionals (the operator is a software platform provider, not a contracting party to the coaching service)
• Communication via the chat function
• History, feedback and documentation of a care relationship using the health data recorded there (with explicit consent per care relationship). Your own record with self-documented health values (with separate consent). Access to your entire record by the lead professionals and co-professionals of your active or paused care relationships (only with separate team-transparency consent). Your professional's working notes for the respective care relationship (only with separate consent; your professional decides per note whether you see it; the data export gives you all of them).
• Handling appointment payments and monthly subscriptions
• Enabling and administering role-based Pro features
• Improving our services

3a. Publication of professional profiles

This section describes the publication of the profiles of professionals and of teams of professionals. It states which details we publish, who can retrieve them, whether search engines can index them, and what we base the publication on. We do not publish athlete profiles.

Which details are published

From the profile of a professional who appears in the search, we release exactly the following details:

• the internal identifier of the profile
• first and last name
• professional title
• the sports and activities offered
• the languages offered
• hourly rate and price of the first session
• the region
• the postcode and the coordinates derived from it (latitude and longitude); they are used to calculate distance
• the self-written profile text
• the usual appointment duration
• whether online appointments, on-site appointments or both are offered
• whether any appointment slots exist at all
• the verification status: whether a valid verification badge has been granted and at what level, and whether a verification is currently in progress and since when (only for athlete accounts, see below)
• whether a paid platform subscription exists and until when
• whether payment via the platform is currently possible
• the active packages, each with identifier, name, description, price, number of sessions, duration, sports and the dates of creation and last change

The following are not published, in particular: email address, telephone number, postal address, date of birth, bank details, the information from payment onboarding, tax-relevant details, messages, appointments including athlete names, and all contents of ongoing care relationships. We also do not release the stored weekly times and the deviations from them, including their reason. Only the professional sees them. Logged-in athletes only see the free appointments our server calculates from them. They see these only for professionals who appear in the search or with whom they have an ongoing care relationship. Professionals from a shared team also see these free appointments.

From the profile of a team that appears in the search, we release exactly the following details:

• the internal identifier of the team
• the name of the team
• the profile text of the team
• the sports and activities offered
• hourly rate and price of the first session
• the region
• whether online appointments, on-site appointments or both are offered

For every team that appears in the search, we also release its packages, each with these details:

• name and description
• price
• number of sessions and duration
• sports
• creation date

We likewise release for every team that appears in the search which professionals belong to it, each with these details:

• the internal identifier of the profile
• first and last name
• the role in the team
• the languages offered
• whether any appointment slots exist at all

A team only appears in the search if every professional who belongs to it appears there. The packages of a team that does not appear in the search are seen only by the professionals who belong to it.

What the public booking page shows

If a professional or a team creates a public booking link, a public booking page is created for it. It is accessible without a login and shows only:

• the display name of the professional or the team
• the self-written introductory text of the link
• the free appointment slots of the coming days
• the packages offered, with name, description, price, number of sessions, duration and sports, provided that payment via the platform is possible

The page shows no other details from the profile, such as the postcode, professional title or hourly rate. The page title and the short description of the page contain the name of the professional or the team.

Who can retrieve this information

The search results require a login. Since 6 August 2026, the technical interface behind them also serves profile data only to signed-in accounts. Anyone who registers can retrieve the information listed above for all professionals and teams that appear in the search. We show the verification status only to athlete accounts. The name and usual session length of a professional who does not appear in the search are seen only by people with whom they share a care relationship. Even these people do not see the professional’s prices. We do not vet who creates an account. The information is therefore visible to an indeterminate group of registered people.

Of the details listed above, only what the public booking page shows can be retrieved by anyone without a login. The page is meant to reach interested people who do not have an account. Anyone who requests a first consultation there receives a personal link to their own request. The page behind this link additionally shows the name of the professional who conducts the consultation and the offers for further care. Where payment via the platform is possible, these are individual sessions and packages with their price; for individual sessions, this price is the hourly rate. Otherwise the page shows only individual sessions, without a price. In addition, the page behind an invitation link to co-care shows, without a login, the name of the inviting professional and the invited email address (section 3c).

Indexing by search engines

The logged-in areas of the platform (including the result list) and the programming interfaces are excluded from search engine crawling in the robots.txt file. The same applies to the pages behind invitation links to co-care.

The public booking page is not excluded. It is not listed in our sitemap, but search engines can crawl it and include it in their results as soon as the link is shared publicly or linked from another site. Search engine operators and the indeterminate public of the internet are therefore categories of recipients within the meaning of Art. 13(1)(e) GDPR.

Test and preview environments of the platform are fully excluded from indexing: there, the robots.txt file prohibits it for the entire domain, and every response additionally carries the header "noindex, nofollow". The production platform at tavonto.com has been reachable for search engines since its release, subject to the exceptions named in this section.

Legal basis

• Display after logging in and via the personal link (Art. 6(1)(b) GDPR): A professional account is created in order to be found and contacted on the platform. Displaying the profile on the platform is therefore part of the subject matter of the usage contract. The same applies to the details shown on the page behind the personal link to one's own request.
• Public booking page and possible indexing by search engines (Art. 6(1)(f) GDPR): This reach goes beyond what the user agreement strictly requires. We base it on legitimate interests, which we name individually below.
• Display of the verification status (Art. 6(1)(f) GDPR): We show the verification status from the list above only to athlete accounts. Unlike the first point, we base this on legitimate interests. Our interest is that athletes can see before an enquiry which credentials of a professional we have checked or are currently checking. The verification status also helps determine the order of the search results. Professionals with a valid verification badge appear there ahead of professionals without one. A check in progress does not count for this. Our interest here is that athletes first find professionals whose credentials we have checked. We do not show the verification status to other logged-in people; the professional sees their own.

For the public booking page and its possible indexing by search engines, the legitimate interests are, individually:

• the ability to make one’s own offering visible outside the platform: a professional should be able to share their booking link without requiring interested people to create an account.
• enabling professionals to pass their own booking link to interested parties without forcing those parties to register.
• making the offer comprehensible before an enquiry: packages with price, scope and sports as well as free appointment slots should be visible on the booking page without an account, so that enquiries do not come to nothing.

Professionals may object to the publication at any time under Art. 21(1) GDPR. We then remove the profile from the search and deactivate any existing public booking link. There is currently no button for this; an informal message to support@tavonto.com is sufficient. If the objection is directed only against the display of the verification status, we stop displaying the verification status without undue delay and without any balancing of interests, and confirm this to the professional. The verification status then no longer counts towards the order of the search results either.

Visibility and payability are separate

A profile appears in the search without any payment onboarding with the payment service provider Stripe having taken place. Without that onboarding a professional is findable and can accept free first sessions; they cannot accept payments via the platform. The result card states this.

This also means that in such a case no identity check by Stripe takes place. Whether the details in a profile are accurate has not been verified before an enquiry, unless a valid verification badge has been granted. A valid verification badge confirms only the credentials required for its level, not every detail in the profile.

3b. Information about locations

This section describes which details from the profile of a location we release, to whom, and on what basis.

Which details are released

From an active location, we release exactly the following details to logged-in athletes:

• the internal identifiers of the location, of the location account and, where applicable, of the organisation
• name and description
• the analyses offered with notes on them, as well as services and equipment
• the address with town, region and postcode and the coordinates derived from it (latitude and longitude)
• website and external booking link
• email address and telephone number
• whether enquiries can be made via the platform, with session length and number of simultaneous appointments
• the price stored for an enquiry via the platform
• the dates of creation and last change

Who can retrieve the details

All logged-in athletes see the details above. We do not vet who creates an account, and anyone can register as an athlete. The details are therefore visible to an indeterminate group of people.

Professionals only see the internal identifier, name, town, postcode and the analyses offered of active locations. They need these details to suggest a location in a recommendation. Other logged-in accounts do not see any details of other locations.

The opening and blocked times of a location and the reason for a blocked time are seen only by the location account. Athletes only see the free times our server calculates from them.

Legal basis

The legal basis is Art. 6(1)(b) GDPR: a location is created in order to be found and contacted by athletes. For the contact details of contact persons, the following paragraph applies instead.

Contact persons of a location

If the email address or telephone number is the business contact detail of a contact person, we do not receive it from that person but from the location account. We display it to logged-in athletes on the basis of legitimate interests (Art. 6(1)(f) GDPR). Our interest is that athletes can reach a location even if it does not offer enquiries via the platform. The detail is stored until the location account changes it or until the account itself is deleted. While the location is not active, we do not display it.

Contact persons may object to the display at any time under Art. 21(1) GDPR; an informal message to support@tavonto.com is sufficient.

After the location account is deleted

If the location account is deleted, we deactivate its locations. In doing so, we delete the identifiers of the location account and of the organisation, the description and the notes on the analyses. From the address, we delete the street and house number, along with the coordinates. We also delete the website and external booking link, the email address and the telephone number. The other details in the list above, including name, town, region and postcode, remain stored for as long as past bookings at the location are stored. We no longer display these details on the platform.

3c. Inviting a professional to co-care

A lead professional can invite another professional to co-care in one of their care relationships. To do so, they enter that person's email address. This also applies if the person already has an account. In no case does anyone become a co-caring professional without accepting themselves. We therefore receive the address not from you but from the inviting professional.

We store the email address entered, the inviting professional, the care relationship and the role the invitation is for, the times of the invitation and of its expiry, the status of the invitation, how often the link was renewed and a checksum of the invitation link. We do not store the link itself.

We do not send any email about the invitation, not even to an existing account. The inviting professional sends the link themselves, by a means of their choice. If the address belongs to a professional account with a confirmed address, we show the invitation there and point it out once in the notification bell. We do not send reminders.

Anyone who opens the invitation link sees, without logging in, the name of the inviting professional, that the invitation concerns joint care, which email address the invitation is for and until when it is valid. The page shows no details about the person being cared for and nothing from the care relationship. Search engines do not index it.

The purpose is to match the invitation to exactly the invited person. Only a person who has an account with this address or signs up with it, has confirmed the address and expressly accepts the invitation becomes a co-caring professional. Only then do they see data from the care relationship. The legal basis is Art. 6(1)(f) GDPR. The legitimate interests are the inviting professional's interest in running a care relationship together with a colleague and our interest in providing this function. We count how often the link was renewed so that we can check whether the balancing of interests under Art. 6(1)(f) GDPR also holds when an invitation is renewed several times. We do not show this number on the platform. If you accept the invitation, we process your data to perform your user agreement (Art. 6(1)(b) GDPR).

The inviting professional sees the address they entered and the status of the invitation. The person being cared for learns about the invitation only once you accept. We then tell them your name and your role (section 5).

An open invitation is valid for 14 days. We delete expired, withdrawn and declined invitations completely 14 days later. If you accept, we delete the address entered from the invitation immediately. What remains, until one of the two accounts is deleted, is who invited whom and when, who accepted and when, and how often the link was renewed.

You can object to the processing at any time under Art. 21(1) GDPR. An informal message to support@tavonto.com is enough, and we will then delete the invitation.

If the person being cared for removes a professional or an observer from a care relationship, we record on that participation that the person being cared for ended it. For other ended participations we likewise record whether the lead professional, the person themselves or their leaving a team ended it. Anyone removed by the person being cared for cannot co-care, observe or deputise in that care relationship again, not even through an invitation, unless the person being cared for allows it again. In that case we also record when they did so. The person being cared for sees in their care relationship whom they removed and when. Towards the person being cared for, the legal basis is Art. 6(1)(b) GDPR: keeping their decision about who receives their data in force is part of our service. Towards the removed person it is Art. 6(1)(f) GDPR. Our legitimate interest, and that of the person being cared for, is that this decision about their health data is not circumvented.

4. Legal bases for processing

Your data is processed on the following legal bases:

• Art. 6(1)(a) GDPR (consent): where you have consented to the processing
• Art. 9(2)(a) GDPR (explicit consent): for health data, in four consents that are given and withdrawn separately. Per care relationship for the health data recorded there (check-ins, feedback from the professional, analysis and measurement values, focus areas, milestones, recommendations, documents). Per care relationship for the working notes of your professional. For the health values you document yourself in your record. For access to your entire record by the lead professionals and co-professionals of your active or paused care relationships. Withdrawal applies for the future; the lawfulness of processing up to that point is not affected.
• Art. 6(1)(b) GDPR (performance of a contract): for the performance of our service contract
• Art. 6(1)(c) GDPR (legal obligation): for compliance with statutory retention, record-keeping and possible reporting obligations, for statements of reasons for restrictions under Art. 17 Digital Services Act, and for the confirmation of receipt and the refund on withdrawal from a subscription or licence (section 6)
• Art. 6(1)(f) GDPR (legitimate interests): for the secure and stable operation of the platform (technical error logs and performance measurement, abuse and fraud prevention, rate limiting), for the public booking page and its possible indexing by search engines, for the display of the verification status of professionals, for the invitation of a professional to co-care and for ensuring that a professional removed by the person being cared for does not rejoin (section 3c), for keeping the statement of reasons for a restriction that has ended (section 6), for evidencing a withdrawal via the withdrawal function (section 6), for evidencing an order, a request for immediate performance for a subscription or licence and a consent to immediate performance for a care relationship (section 6) and for the handover note. A professional of your care relationship creates this note when they hand the care over to professionals outside the platform. It records only that and when the handover took place and who recorded it, without a reason and without stating to whom the care was handed over. You and the team of this care relationship can see it. It is kept until the professional who created it withdraws it or your account is deleted. Our interest is to document that sports care stays within the legal boundary of the practice of medicine (Section 1(2) of the German Non-Medical Practitioners Act, HeilprG). We state the interests in the public booking page and in the display of the verification status in section 3a and the interest in error analysis and performance measurement with Sentry in section 5.

5. Recipients and third-party providers

Categories of recipients at a glance

Personal data reach the following categories of recipients:

• Processors: providers that process exclusively for us and on our instructions. They are listed individually below.
• Stripe as an independent controller: payment processing, Connect onboarding and the identity check carried out as part of it.
• OpenStreetMap Foundation as an independent controller: deriving coordinates from a postcode or a search text. Details are set out below.
• Other users of the platform as recipients: The lead professional sees the data required for the respective care relationship. The same applies to the co-professionals. Observers and temporary stand-ins in the team of a care relationship also see this data, but not the professional working notes. Locations see the data of the respective booking. If your professional suggests a location, the location learns nothing about it, nor anything from your care relationship; your professional does not see your requests to the location. Health data of a care relationship is seen only by the professional and their team, and only with your explicit consent. The circle is narrower for care notes (professional working notes): within the team, they are seen only by the lead professional and the co-professionals, and only with your separate consent. Within the team, a withdrawal declaration is seen only by the professional with whom you concluded the contract (section 6). Beyond the individual care relationship, your record is seen only by the lead professionals and co-professionals of your active or paused care relationships, and only with your team-transparency consent; observers and temporary stand-ins are not included. Locations do not see health data. Anyone who is logged in can also retrieve the published details from the profiles of professionals and teams that appear in the search. Which of them only certain accounts see is set out in section 3a. Athletes see the details of active locations, professionals only part of them (section 3b). What a professional or a location does with this data in their own records outside the platform is their own responsibility.
• Organisations: clubs, studios and federations as independent controllers. The scope is set out below.
• Search engine operators and the indeterminate public of the internet: The details on the public booking page of a professional or a team can be retrieved without a login. Search engines can index the page (section 3a).
• Authorities and public bodies: only where there is a legal obligation or where transfer is necessary to establish, exercise or defend legal claims.

Processors in detail

We work with the following third-party providers, which may have access to your data:

OpenStreetMap Foundation (geocoding)

To obtain coordinates from a postcode for the distance calculation, we query the Nominatim service of the OpenStreetMap Foundation (St John’s Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom). The postcode is transmitted with fixed search parameters for Germany. If you search for locations near a place, we transmit the text you enter for this instead of the postcode.

The request is always made by our server, including when a profile or a location is saved. The OpenStreetMap Foundation does not receive your IP address in the process. The OpenStreetMap Foundation processes the request under its own responsibility and is not our processor. The legal basis is Art. 6(1)(b) GDPR. The distance calculation is part of the search we provide under the user agreement, both to you when you search and to professionals and locations that are to be found in the search.

According to its own information, the OpenStreetMap Foundation stores the data in the United Kingdom and the Netherlands. According to the same information, backup copies are kept in the EU. For the United Kingdom, there is an adequacy decision of the EU Commission (Art. 45 GDPR).

OpenStreetMap Foundation privacy policy (opens in a new tab)

Our Instagram presence (Meta)

We run a profile on Instagram. The provider is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland ("Meta"). Meta is not a processor acting for us: whatever Meta processes about you when you visit our profile, view our posts or are shown our advertising (usage and device data, cookies, your Instagram account) is processed under Meta's own responsibility according to Instagram's privacy policy, where you can also change your advertising and privacy settings.

For the statistics of our profile ("Insights", such as reach, views and the aggregated distribution of age and location) we are jointly responsible with Meta (Art. 26 GDPR). The allocation of duties is governed by Meta's "Controller Addendum" (Page Insights Controller Addendum), which Meta applies to the Insights of professional Instagram accounts under its terms for such accounts; under it, Meta fulfils the information duties and answers data-subject requests concerning Insights. Regardless of that agreement, you may exercise your rights under Art. 15 to 22 GDPR against us as well (Art. 26(3) GDPR); we forward requests concerning Insights to Meta. We only see aggregated figures, never individuals. The legal basis is our legitimate interest in public communication and in contact with interested people (Art. 6(1)(f) GDPR).

If you send us a direct message or comment on Instagram, we process your username and the content in order to reply (Art. 6(1)(b) or (f) GDPR). Please do not send us health data via Instagram; the platform itself is the right channel for that (section 3). Should we nevertheless receive information about your health via Instagram, we do not answer it substantively but point you to the platform and delete the message afterwards; we do not transfer such information into our systems. We delete messages and comments once your request has been dealt with; you can delete them yourself at any time. We do not store Insights or advertising figures outside Instagram.

We pay Meta to promote individual posts. For this we define the region and the age and interest groups in which Meta shows the ad; whether you belong to them is determined by Meta from the characteristics you have stored with Meta. We do not upload customer data, we do not build audiences from users of our platform, and we use neither the Meta Pixel nor any other Meta tool on tavonto.com. We only receive aggregated figures about the ad from Meta.

According to its own statements, Meta also transfers data to Meta Platforms, Inc. in the USA and bases this on the EU Commission's adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR) and on standard contractual clauses (Art. 46(2)(c) GDPR). Details, including how to obtain a copy of the clauses, are set out in Instagram's privacy policy.

Where we base the processing of your data on Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation (Art. 21(1) GDPR). For Insights, address your objection to Meta or to us; for comments and messages, to us via the contact details in section 2.

Instagram privacy policy · Meta's Controller Addendum (Insights)

The public and search engines

Of the published details about professionals and teams, only what the public booking page shows can be retrieved by anyone without a login. Search engines can index this page. The other published details from the profiles can be retrieved only after logging in. Some of them are also shown on the page behind the personal link that a person receives after their own request. What the booking page shows, what we base the publication on, and how professionals can object is set out in section 3a. The page behind an invitation link to co-care shows anyone who has the link the name of the inviting professional and the invited email address (section 3c).

Organisations (clubs, studios, federations)

If you belong to an organisation as a member, its administration learns your name and email address, and whether and by which trainer you are being supported under the organisation's licence. All trainers of that organisation can also see the member list, not only the one supporting you. The organisation is an independent controller for this, not our processor.

The legal basis is the consent you give by joining (Art. 6(1)(a) GDPR). You can withdraw it at any time by leaving under “Clubs” in your account. Without joining, the organisation does not learn your name; it only sees anonymous totals.

What the organisation explicitly does NOT see: the contents of your care relationship, your record, health and measurement values, check-ins, recommendations and messages. Those stay with you and your care team.

Authorities / public bodies

Personal data is transferred to authorities only insofar as there is a legal obligation to do so or the transfer is necessary to establish, exercise or defend legal claims.

This may include, in particular, retention, record-keeping or reporting obligations under tax and commercial law, insofar as these apply in the individual case.

Safeguards for third-country transfers

Insofar as we transfer data to countries outside the EU/EEA, this takes place only where the requirements of Art. 44 et seq. GDPR are met. For this purpose we use in particular:

• EU Standard Contractual Clauses (SCCs)
• supplementary technical and organisational measures
• Transfer Impact Assessments (TIAs)
• where applicable, a valid Data Privacy Framework (DPF)

6. Retention period

Your data is stored for as long as your account is active or for as long as it is necessary for the provision of our services.

• Account data: until the account is deleted
• Chat messages: 365 days after they are sent. After that the message text is overwritten and cannot be restored; all that remains is who wrote when and in which engagement. This happens regardless of whether the account remains
• Payment data: 10 years (statutory retention obligation)
• Subscription and invoice data: for the duration of the subscription and thereafter in accordance with statutory retention obligations
• Tax and record-keeping data: in accordance with statutory retention and documentation obligations
• Audit logs: 10 years (statutory retention obligation for financial transactions)
• Public initial consultations without a platform account: only for as long as is necessary for handling the appointment, abuse prevention and evidentiary purposes; cases that do not convert are retained for a shorter period
• Statements of reasons for restrictions (Art. 17 Digital Services Act): if we restrict your account, individual features or your content, we store the statement of reasons we give you. It states the type, territorial scope and duration of the measure, the underlying facts and where they came from, whether automated means were used, and the legal or contractual ground. When signed in, you can see the statement on the page “Restrictions on your account”. While the restriction is in place, we process the statement to comply with our obligation under Art. 17 Digital Services Act (Art. 6(1)(c) GDPR). When the restriction ends, including when it ends because your account is deleted, we keep the statement for a further 1,095 days and then delete it. We base this retention on our legitimate interest in being able to evidence the measure for as long as claims arising from it can be asserted (Art. 6(1)(f) GDPR)
• Withdrawal from a contract with a professional (Section 356a of the German Civil Code, BGB): if you withdraw from a contract with a professional via the platform’s withdrawal function, we store the content of your declaration, the reference number and the date and time of receipt. We also store your email address for the confirmation of receipt, whether the right of withdrawal had already expired at that time, and the status of any repayment. In addition, we store the times of the confirmation of receipt and of the transmission, and your IP address and the details of your browser and operating system (user agent). This serves to record your declaration and transmit it to the professional, to confirm receipt to you by email (Section 356a(4) BGB) and to be able to evidence all of this. The recipient is the professional with whom you concluded the contract. They receive your name, your email address, the content of the declaration, the reference number and the date and time of receipt by email, and they see the declaration in the care relationship. We also record the transmission to the professional with the time, the reference and the recipient, so that we can provide information about recipients (Art. 15(1)(c) GDPR). We do not disclose the content of the entry to other users; they can only learn that a withdrawal exists. In the care relationship the professional sees only the declaration, the reference and the times. We process the IP address and user agent only on our servers. We send the emails via Resend (section 5). A repayment for a payment made through the platform runs via Stripe. The legal basis is our contract with you (Art. 6(1)(b) GDPR). We base the evidence and the IP address and user agent on our legitimate interest in being able to evidence the declaration, the confirmation of receipt and the transmission (Art. 6(1)(f) GDPR). We delete the IP address and user agent after 30 days. Once the email has been sent, we redact the delivery details 30 days after the sending order, or immediately when your account is deleted. If a transmission to the professional has not gone out by then, we give it up after those 30 days and redact it as well. We delete the sending order itself after 90 days. We delete the rest of the entry when your account is deleted; there is no shorter period. This deletion does not reach the email in the professional’s mailbox
• Withdrawal from a subscription or licence (Section 356a BGB): for these contracts, we ourselves are your contracting party. If you withdraw from your subscription or your organisation’s licence via the withdrawal function, signed in or with the link from the order confirmation, we store the content of your declaration with the name you provided, the reference number and the date and time of receipt. We also store the account’s email address for the confirmation of receipt, the access route, the time of the confirmation of receipt, the status and records of the refund, and the IP address and the details of your browser and operating system (user agent). This serves to record your declaration, end the contract, confirm receipt by email (Section 356a(4) BGB), repay fees paid and be able to evidence all of this. The recipients are Stripe for ending the contract, the credit note and the refund, and Resend for the email (section 5). We do not disclose the entry to other users. Towards consumers, we thereby comply with our legal obligation (Art. 6(1)(c) GDPR in conjunction with Sections 356a and 357 BGB). Otherwise the legal basis is our contract with you (Art. 6(1)(b) GDPR) and, if you act for an organisation, our legitimate interest in processing the declaration (Art. 6(1)(f) GDPR). We base the evidence and the IP address and user agent on our legitimate interest in being able to evidence the declaration, the confirmation of receipt and the refund (Art. 6(1)(f) GDPR). We delete the IP address and user agent after 30 days. Once the email has been sent, we redact the delivery details 30 days after the sending order. We delete the sending order itself after 90 days. We delete the rest of the entry when the account assigned to it is deleted; there is no shorter period. For invoices, the period under “Subscription and invoice data” applies
• Ordering a subscription or licence: for every order we store as evidence the tier, the displayed price and billing period, the version and checksum (a calculated fingerprint of the text) of the notice on immediate start of performance, the reference number and the name of the legal entity (your company or organisation). We also store the version and checksum of the trader declaration, a checksum of your personal withdrawal link, the time, and the IP address and the details of your browser and operating system (user agent). This serves to be able to evidence your express request for immediate performance (Section 357a(2) BGB) and the content of the order, and to enable withdrawal via the link. We send the order confirmation with the link via Resend (section 5). We do not disclose the evidence to other users; for a licence, your organisation’s administrators see only the reference and the order date when withdrawing. The legal basis is our contract with you (Art. 6(1)(b) GDPR) and, if you order for an organisation, our legitimate interest in processing the order (Art. 6(1)(f) GDPR). We base the evidence and the IP address and user agent on our legitimate interest in being able to evidence the request and the order (Art. 6(1)(f) GDPR). We delete the IP address and user agent after 30 days. We delete the rest of the evidence when the account assigned to it is deleted; there is no shorter period. If you change tier within an existing contract, we currently send no order confirmation and no link; you can then withdraw via the withdrawal function when signed in
• Consent to immediate start of performance for a care relationship (Section 356(5) no. 2 BGB): if you consent to the professional starting performance before the withdrawal period ends, we store your consent with the version and checksum of the text and the time. We also store the place where you consented, any scheduled appointment, and the IP address and the details of your browser and operating system (user agent). We confirm the consent to you by email via Resend (section 5). The professional only learns whether the consent exists. The legal basis is our contract with you (Art. 6(1)(b) GDPR); for the evidence and for the IP address and user agent, it is our legitimate interest in being able to evidence the consent (Art. 6(1)(f) GDPR). We delete the IP address and user agent after 30 days. We delete the rest of the evidence when your account is deleted; there is no shorter period
• Invitations to co-care: An open invitation is valid for 14 days. We delete expired, withdrawn and declined invitations 14 days later. On acceptance, we delete the email address entered from the invitation; until one of the two accounts is deleted, we keep who invited whom and when, who accepted and when, and how often the invitation link was renewed. We keep who ended a participation and when a removed person was allowed again for as long as the participation itself.

Health data from care relationships and your record: tied to your consent and your account. After a withdrawal the data stays stored but is hidden from the professional and everyone else involved in the care relationship; if you consent again while the care relationship is running, it becomes visible again. Your own entries stay visible to you and can be deleted individually; you can also delete recommendations and focus areas from your professional. Only documents uploaded by the professional or by someone from their team are hidden from you. You delete this data completely at any time by deleting your account.

7. Your rights

You have the following rights regarding your personal data:

• Right of access (Art. 15 GDPR): you can request information about the data stored about you.
• Right to rectification (Art. 16 GDPR): you can request the rectification of inaccurate data.
• Right to erasure (Art. 17 GDPR): you can request the erasure of your data, provided that no statutory retention obligations preclude this.
• Restriction (Art. 18 GDPR): you can request the restriction of processing.
• Notification obligation (Art. 19 GDPR): where legally required, we inform recipients about the rectification, erasure or restriction of your data.
• Data portability (Art. 20 GDPR): you can receive your data in a commonly used format.
• Right to object (Art. 21 GDPR): where we process your data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation. This concerns all processing that this policy bases on Art. 6(1)(f) GDPR, including the handover note.
• Withdrawal of consent: you can withdraw consent you have given at any time.

To exercise your rights, please contact us by email at support@tavonto.com.

8. Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority about our processing of personal data. Which supervisory authority is responsible for you depends on your place of residence.

You can find a list of the data protection supervisory authorities and their contact details at: www.bfdi.bund.de (opens in a new tab)

9. Cookies

Our website uses cookies. These are small text files that are stored on your end device.

Necessary cookies

We use technically necessary cookies for authentication and session management. These cookies are required for the operation of the website and cannot be deactivated.

• Supabase Auth cookies: for login and session management

Optional analytics and marketing cookies

We set analytics and marketing cookies only after your explicit consent. You can change your selection at any time via the “Cookie settings” link.

• Analytics: Sentry Browser Monitoring, Vercel Web Analytics and Vercel Speed Insights (only after consent; Vercel sets no cookies, see section 5)
• Marketing: currently no active marketing tracking services; if activated in future, only with consent

In order to be able to demonstrate your consent, we store the time of the decision as well as technical metadata, including the IP address and the details of your browser and operating system (user agent).

10. SSL/TLS encryption

For security reasons and to protect the transmission of confidential content, this website uses SSL/TLS encryption. You can tell that a connection is encrypted by the browser's address bar changing from "http://" to "https://" and by the padlock symbol in your browser bar.

11. Validity and amendment of this privacy policy

This privacy policy is currently valid and is dated November 2026.

As our website develops further, or as a result of changed statutory or regulatory requirements, it may become necessary to amend this privacy policy.