Privacy Policy
Last updated: [26.01.2026]
This Privacy Policy (the “Policy”) explains how Santelle SARL, a company incorporated under the laws of Switzerland, with its registered office at 5B Route de Pressy, 1243 Vandoeuvres, Switzerland (“Santelle”, “we”, “our”, “us”), collects, uses, discloses and protects personal data when you access or use our website www.santellehealth.com (the “Website”), our mobile application (the “App”) and related services (together, the “Services”).
This Policy is intended to comply with the Swiss Federal Act on Data Protection (FADP) and with the General Data Protection Regulation (GDPR) of the European Union.
1. Data controller
Santelle SARL acts as the Swiss data controller for the processing of personal data under this Policy. Contact for privacy questions: privacy@santellehealth.com
Representative in the European Union: LEXR Germany Rechtsanwalts GmbH, Gormannstrasse 14, 10119 Berlin, Germany, contact@lexr.com
2. Who this Policy applies to
This Policy applies to users located in Switzerland, the European Union and the United Kingdom, including users aged 16 to 17 who are legally permitted to use the Services.
Our Services are not intended for children or minors, and Santelle does not knowingly collect or solicit personal or sensitive information from anyone under 16. If Santelle learns that we have collected such information, Santelle will promptly take steps to delete it from our records.
3. Personal data we collect
“Personal information” (also called “personal data”) means information that identifies, relates to, describes or could reasonably be linked, directly or indirectly, to a particular individual or household. Examples include name, email address, telephone number, postal address, online identifiers, IP address and cookie identifiers.
3.1 Data you provide directly
We may collect the following personal data when you use the Services:
Name
Email address
Account credentials (passwords are stored in hashed form)
Age confirmation or date of birth
Test results (for example positive/negative indicators)
Symptoms entered manually
Communications with customer support
3.2 Data collected automatically
When you access the Services, we may collect:
Device type, operating system and app version
IP address
Approximate location (country level)
Usage data within the App and the Website
3.3 Data we do not collect
We do not collect:
Photos or images
Document uploads
Audio or video recordings
Free-text medical records
Precise geolocation data
4. Sources of data
We collect personal data:
Directly from you; and
Automatically through your use of the Services.
We do not obtain personal data from data brokers or third-party data enrichment services.
5. Purposes of processing
We process personal data for the following purposes:
Providing access to the Website and the App;
Displaying and explaining test results;
Providing educational content;
Managing user accounts;
Customer support and communications;
Improving and developing the Services;
Security, fraud prevention and abuse monitoring;
Legal and regulatory compliance;
Sending marketing communications where you have given your consent.
6. Legal bases for processing
Depending on the context, we rely on the following legal bases:
Performance of a contract;
Your explicit consent, in particular for the processing of health data;
Legitimate interests, including security, analytics and service improvement;
Compliance with legal obligations.
7. Health data
Some personal data processed through the Services constitutes sensitive health data.
We process health data in accordance with Article 9(2)(a) of the GDPR on the basis of your explicit consent and only for the purposes described in this Policy. Your explicit consent is obtained when you create your account, activate a test kit or enter health-related information in the App, through clear affirmative actions (such as ticking a consent box or completing the relevant activation flow). You may withdraw your consent at any time, subject to legal retention obligations.
8. Data sharing and processors
We may share personal data with trusted third-party processors, including:
Shopify (e-commerce and payments);
Amazon Web Services (AWS) (hosting and infrastructure);
Email service providers (to be selected);
Analytics providers, including Google Analytics.
These processors act under contractual obligations to protect personal data and to process it only on our instructions.
Cookies and similar technologies
We use cookies, pixels and similar technologies to operate and improve the Website and to support analytics and marketing activities.
We group these technologies as follows:
Strictly necessary cookies: required for the basic functionality and security of the Website. You cannot object to these through our cookie banner.
Analytics and performance cookies: help us understand how visitors use the Website so we can improve its content and usability.
Functional cookies: remember the choices you make, such as language or region.
Advertising and marketing cookies: allow us and our third-party partners to show you relevant advertising, measure campaign performance and build marketing audiences. This may include cross-context behavioural advertising as defined by certain US state laws.
In the EU and the UK, where the law requires it, we ask for your consent before setting non-essential cookies (such as analytics, functional and advertising cookies). These countries and regions are referred to as the “Prior Consent Regions”.
You can manage cookies in several ways:
Through our cookie banner or preference centre, where available;
By adjusting your browser settings to refuse or delete cookies; and/or
For certain advertising cookies, through industry opt-out tools (for example the Digital Advertising Alliance).
9. International data transfers
Personal data is mainly stored and processed in Ireland.
Personal data is not transferred outside Switzerland, the European Union or the United Kingdom.
10. Data retention
We keep personal data for as long as necessary to fulfil the purposes described in this Policy.
As a general rule:
Account and health data are kept for as long as your account is active;
When the account is closed, data is deleted or anonymised, unless it must be kept for legal, accounting or dispute resolution purposes;
Some data may be kept for up to five (5) years after the account is closed where applicable law requires it.
11. Your rights
Depending on where you live, you may have the right to:
Access your personal data;
Rectify inaccurate data;
Request erasure;
Restrict or object to processing;
Data portability;
Withdraw your consent at any time;
Lodge a complaint with a supervisory authority.
Requests can be submitted by contacting us at privacy@santellehealth.com.
12. Marketing communications
You will only receive marketing communications where you have given explicit consent. You can unsubscribe at any time through the unsubscribe link or by contacting us.
13. Cookies and tracking
We use cookies and similar technologies to operate and improve the Website, including analytics cookies. Where the law requires it, cookie consent mechanisms are provided.
14. Security
We put in place appropriate technical and organisational measures to protect personal data against unauthorised access, loss or misuse.
These measures include encryption, access controls and regular security reviews.
15. Changes to this Policy
We may update this Policy from time to time. Material changes will be communicated where the law requires it.