Privacy Policy

Last updated: 24 September 2026 · Applies to ponavita.com and the Ponavita platform.

1. Who we are (Data Controller)

Ponavita is operated by BETTA HEALTH Solutions GmbH, Ahstr. 2, 45879 Gelsenkirchen, Germany ("Ponavita", "we", "us"). We are the controller of the personal data described here.

Data Protection contact / DPO: e-contact@ponavita.com.

2. What we collect

• Account & contact data: name, email, phone, country, preferred language.
• Case data: your enquiry, specialty of interest, non-clinical intake summary, case status.
• Special-category (health) data — GDPR Art. 9: medical documents, reports, and information you upload or that is created to coordinate your care.
• Documents: passport/visa/invoices and other files you provide for travel and treatment coordination.
• Communications: messages and email correspondence with our team.
• Technical data: authentication/session data and basic security logs.

3. Why we process it & legal bases

• To provide the service (coordinate a review, quote, travel and treatment) — performance of a contract (Art. 6(1)(b)).
• Health data — processed only with your explicit consent (Art. 9(2)(a)); the specific consent text and version are recorded. You can withdraw consent at any time.
• Legal obligations (e.g. accounting) — Art. 6(1)(c).
• Security and service integrity — legitimate interests (Art. 6(1)(f)).

4. Who we share it with

• German partner clinics — to obtain a medical opinion, quote or treatment. Clinics are proxied through Ponavita; your data is shared with a clinic only as needed to coordinate your care.
• Referral agents — where you came through an agent, the agent sees case status only and never your medical documents, quotes or consents.
• Processors — hosting and infrastructure providers acting on our instructions: Supabase (database/auth, EU region), Amazon Web Services (email delivery via SES, EU region), Cloudflare (content delivery).
• WhatsApp (Meta Platforms Ireland Ltd.) — only if you choose to contact us on WhatsApp; see section 4a.
• We do not sell your personal data.

4a. Contacting us on WhatsApp

You can reach us on WhatsApp at +49 2234 3898010. Using WhatsApp is voluntary — you can always use email or your Ponavita account instead. Our website only links to WhatsApp; no data is sent to WhatsApp until you tap a WhatsApp link or scan our QR code.

When you message us, WhatsApp is provided by Meta Platforms Ireland Ltd. under its own terms and privacy policy. Meta processes your phone number, profile and message metadata and may transfer data to the USA (EU–US Data Privacy Framework / Standard Contractual Clauses). Message content is end-to-end encrypted in transit. We process your messages to answer your enquiry (Art. 6(1)(b) GDPR — pre-contractual steps — and Art. 6(1)(f) — efficient communication you initiated).

Please do not send medical records or other health information over WhatsApp. Upload them securely in your Ponavita case, where they are stored in the EU and protected under GDPR Art. 9. We do not use WhatsApp to share medical documents, quotes or consents. [CONFIRM retention of WhatsApp chats and whether the WhatsApp Business app or API is used.]

5. Where your data is stored (international transfers)

Personal and health data is hosted in the European Union (Frankfurt / eu-central-1). Where any transfer outside the EEA is necessary (e.g. a treating clinic located outside the EEA, or your own choices), we rely on an appropriate safeguard such as your explicit consent or Standard Contractual Clauses. [CONFIRM/EXPAND per your actual providers and clinic locations.]

6. How long we keep it

We keep personal and health data for as long as needed to provide the service and to meet legal retention obligations, then delete or anonymise it. [SPECIFY retention periods.]

7. Your rights

Subject to the GDPR you may request access, rectification, erasure, restriction, portability, and object to processing; withdraw consent for health-data processing at any time; and lodge a complaint with your supervisory authority (in Germany, the competent data protection authority). To exercise these rights, contact e-contact@ponavita.com.

8. Security

Access to medical data is restricted by role (row-level security): agents never receive medical documents; only authorised medical reviewers and administrators can access clinical files. Data is encrypted in transit; access is authenticated.

9. Cookies

We use only the cookies/local storage necessary to keep you signed in and to secure the service. We do not use advertising cookies. [ADD a cookie/consent notice if you introduce analytics.]

10. Changes

We may update this policy; material changes will be posted here with a new "Last updated" date.

11. Contact

BETTA HEALTH Solutions GmbH, Ahstr. 2, 45879 Gelsenkirchen, Germany · e-contact@ponavita.com.