Privacy policy

Last updated: September 25, 2026

English translation. This translation is provided for convenience only. In case of any discrepancy, the German version is the legally binding one: read the German original.

1. General information

We are pleased that you are visiting our website and thank you for your interest in our company and our products. We would like to take this opportunity to inform you which data we collect, when we collect it, how we use and process it, and how we handle your personal data.

The following notes provide a straightforward overview of what happens to your personal data when you visit this website. Personal data is any data by which you can be personally identified. For detailed information on the subject of data protection, please refer to the privacy policy set out below this text.

2. Data collection on this website

Personal data is information by means of which a person can be identified as such. This includes, for example, your name, your address, your email address or your telephone number.

(1) Who is responsible for data collection on this website?

Data processing on this website is carried out by the website operator. You can find their contact details in the section “Information on the controller” in this privacy policy.

(2) Collection of personal data when using the website

Your data is collected, on the one hand, by you providing it to us. This may, for example, be data you enter into a contact form.

Other data is collected automatically, or with your consent, by our IT systems when you visit the website. This is primarily technical data (e.g. internet browser, operating system or time of the page view). This data is collected automatically as soon as you enter this website.

Where you use the website purely for information — that is, where you do not register or otherwise transmit information to us — we collect only the personal data that your browser transmits to our server. If you wish to view our website, we collect the following data, which is technically necessary for us in order to display our website to you and to ensure stability and security:

IP address
date and time of the request
time zone difference from Greenwich Mean Time (GMT)
content of the request (the specific page)
access status / HTTP status code
the volume of data transferred in each case
the website from which the request comes
browser
operating system and its interface
language and version of the browser software.

The legal basis for processing this data is Art. 6 (1) (f) GDPR. Our legitimate interest lies in delivering the website reliably, quickly and securely.

Hosting with Cloudflare. This website is provided via Cloudflare Pages, a service of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA (“Cloudflare”). Every request runs through Cloudflare’s network. In the process, Cloudflare processes the access data listed above, in particular your IP address, in order to deliver the pages and protect the website against attacks; the legal basis for this too is Art. 6 (1) (f) GDPR. Cloudflare operates data centres worldwide, so processing outside the EU, in particular in the USA, cannot be ruled out. Cloudflare is certified under the EU-US Data Privacy Framework; the European Commission’s standard contractual clauses pursuant to Art. 46 (2) (c) GDPR additionally apply. Cloudflare processes the data on our behalf; a data processing agreement pursuant to Art. 28 GDPR is in place with Cloudflare.

Further information: Cloudflare’s privacy policy.

(3) Collection of personal data on registration

To use the Lab Mate app you create an account, either with an email address and password or via your Apple or Google account. It is not possible to register on this website itself.

For your account we store:

your name
your email address

You enter your name when setting up the app; you can change it at any time in the settings. We also record which version of the terms of use you accepted and when.

The legal basis is Art. 6 (1) (b) GDPR, because without this information we cannot provide you with an account. We store the record of your acceptance on the basis of our legitimate interest in being able to prove that the contract was concluded (Art. 6 (1) (f) GDPR).

You can remove your account at any time in the app under “Settings → Delete Account”. When you do, we delete your account data, unless statutory retention obligations prevent this.

(4) What do we use your data for?

Some of the data is collected in order to ensure that the website is provided without errors. Other data may be used to analyse your user behaviour.

(5) What rights do you have regarding your data?

You have the right at any time to obtain information free of charge about the origin, recipients and purpose of your stored personal data. You also have a right to request the correction or deletion of this data. If you have given consent to data processing, you can withdraw that consent at any time with effect for the future. You also have the right, in certain circumstances, to request the restriction of the processing of your personal data. You also have a right to lodge a complaint with the competent supervisory authority.

You can contact us at any time regarding this and any further questions on the subject of data protection.

3. Data collection in the Lab Mate app

The following information describes the processing of personal data when installing and using the Lab Mate mobile application. It also explains the choices you have with regard to your personal data.

(1) Processing of data when downloading the app:

By downloading our app you have identified yourself to the respective App Store or Google Play Store, e.g. via your ID. Lab Mate cannot rule out the possibility that Apple or Google may use the data collected in connection with the download or use of the applications in a way that does not comply with the EU General Data Protection Regulation (GDPR). Lab Mate has no influence over this. We do not pass data you record in the app on to Apple or Google in their role as app store operators.

The app uses the following permissions:

camera – only when you photograph a report in order to import it
photos – only when you select an image from your library for the import
internet access and network status – for your account, storing your data and the AI functions
Google Play billing service (Android only) – for purchasing Lab Mate Premium

The app only accesses the camera and photos when you use the respective function; where applicable, the operating system asks for your permission. You can revoke these permissions at any time in your device’s settings.

(2) Processing of data when using the app: Certain data is collected automatically by Lab Mate IT systems when the app is used. This is primarily technical data (e.g. mobile device, operating system, or time and usage). This data is collected automatically as soon as you use the app, and is collected pursuant to Art. 6 (1) (b) and (f) GDPR respectively in order to enable use of the app as well as analysis and troubleshooting. The following data may be processed:

type of mobile device
operating system used
language used
technical information about the device used
date and time of the request
IP address

(3) Sign-in, data storage, purchases and statistics:

For these tasks the app uses services from Google Firebase and RevenueCat. Both process the data exclusively on our behalf; a data processing agreement pursuant to Art. 28 GDPR is in place with each of them.

Google Firebase. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). The app uses these Firebase services:

Firebase Authentication for signing in. This processes your email address, your password – which Google stores only as a non-reversible hash –, the account details transmitted by Apple or Google if you sign in with them, as well as IP addresses and information about your device. Firebase Authentication runs exclusively in data centres in the USA. Google keeps IP addresses for a few weeks and the other sign-in data until your account is deleted; they are removed from backups no later than 180 days after that. If you sign in with Apple or Google, their privacy policies also apply to the sign-in process. The legal basis is Art. 6 (1) (b) GDPR.
Cloud Firestore as the database. It holds your profile, your tests and lab values, lab values and reference ranges you have created yourself, your health and lifestyle details over time, saved AI analyses and a counter of how often you have used the AI functions. The database is located in Frankfurt am Main (Google region europe-west3). The data remains stored until you delete it in the app or delete your account. For health data, the legal basis is your explicit consent pursuant to Art. 9 (2) (a) GDPR; otherwise it is Art. 6 (1) (b) GDPR.
Firebase App Check for protection against misuse. For requests to Firebase, Apple (App Attest) or Google (Play Integrity) confirms that they come from an unmodified Lab Mate app. App Check does not store the verification data generated for this; the tokens issued are valid for no more than seven days. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest is protecting your data and our services against unauthorised access.
Firebase Crashlytics for crash reports. If the app crashes, Google receives a report with technical details of the crash, the device, the operating system and the app version, as well as randomly generated identifiers of your app installation. We do not add any details from your account or any health data. Google keeps the reports for 90 days.
Firebase Performance Monitoring for measuring loading times and network requests. This processes an installation identifier, your IP address and device information such as model, operating system, memory and processor usage, mobile carrier, network type, country, language and app version. Google keeps data linked to IP addresses for 30 days and the rest for 60 days.

For Crashlytics and Performance Monitoring, the legal basis is Art. 6 (1) (f) GDPR; our legitimate interest lies in detecting errors and keeping the app stable and fast.

Cloud Firestore stores your data in the EU. For the other Firebase services, processing in the USA is possible; for Firebase Authentication it takes place exclusively there. Google LLC is certified under the EU-US Data Privacy Framework; the European Commission’s standard contractual clauses pursuant to Art. 46 (2) (c) GDPR additionally apply. Further information: Privacy and security in Firebase.

RevenueCat. So that the app knows whether Lab Mate Premium is unlocked for your account – on all your devices – it uses RevenueCat, a service of RevenueCat, Inc., 1032 E Brandon Blvd #3003, Brandon, FL 33511, USA. For this, the app checks in with RevenueCat every time it starts, even if you have not bought anything. RevenueCat processes the internal identifier of your Lab Mate account (not your name and not your email address), the purchase receipts from Apple or Google – such as product, time of purchase, term and status of a subscription – and technical information such as device type, operating system and IP address. Apple or Google handle the payment itself; neither we nor RevenueCat receive payment data. The legal basis is Art. 6 (1) (b) GDPR. RevenueCat stores the data with Amazon Web Services in the USA; the transfer is safeguarded by the European Commission’s standard contractual clauses pursuant to Art. 46 (2) (c) GDPR. We have the data deleted as soon as it is no longer required for these purposes and no statutory retention obligations stand in the way. Further information: RevenueCat’s privacy policy.

App store statistics. Apple and Google provide us with aggregated statistics via App Store Connect and the Google Play Console, for example on downloads, crashes and ratings. These statistics do not allow any conclusions to be drawn about you personally. Apple only shares usage and crash data if you have agreed in the settings to share it with app developers. You can change this at any time: open Settings, select “Privacy & Security”, tap “Analytics & Improvements” and deactivate “Share with App Developers”. Further information: Apple’s privacy policy and Google’s privacy policy.

(4) AI functions with Google Gemini

For two functions of the app we use the language model Gemini: the AI-assisted analysis of your lab values and the import of reports by PDF or photo. The provider is Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland (“Google”). We use Gemini via the Google Cloud platform Gemini Enterprise Agent Platform (formerly Vertex AI), connected through Firebase AI Logic. Data only goes to Google when you call up one of these two functions; all other functions of the app work without this transmission.

For the AI-assisted analysis we transmit:

the lab values being analysed, with name, measured value, unit, reference range, classification (such as “too high”) and date of measurement
your profile details, insofar as you have provided them, including how they have changed over time: age, biological sex, an existing pregnancy, height, weight, your goal in the app, physical activity, diet, smoking and alcohol, pre-existing conditions, medications and dietary supplements including dosage, allergies and family medical history
the language of the app and the level of detail you want in the explanation

Information that identifies you directly is not transmitted — that is, neither your name nor your email address, your postal address or your date of birth. From your date of birth, the app only calculates your age and transmits that alone. Even without this information, the transmitted values relate to you: they are health data and therefore specially protected personal data within the meaning of Art. 9 GDPR, and we treat them accordingly.

For the import by PDF or photo we transmit the pages you select as an image or PDF. From them, Gemini reads the measured values with name, unit, sample material and reference range, the date the sample was taken, the name of the practice or laboratory, and any indication that the sample was taken while fasting. In a second request, Gemini matches the recognised names to the lab values in the app, including lab values you have created yourself; in this step only names go to Google, no measured values. We do not transmit profile details during the import.

Please note: whatever is on the pages is transmitted with them. Lab reports often show your name, your date of birth or a patient number. We do not add the name, email address or postal address from your account. If you want to avoid such details from the report being transmitted, photograph only the table with the values or black out those details beforehand. Entering values by hand is possible at any time without this transmission.

No training with your data. Google does not use the transmitted data or the model’s responses to train or fine-tune AI models. This is excluded in the Google Cloud contract terms; we do not give our permission for it.

Storage. Google stores inputs and responses only temporarily: for up to 24 hours for technical reasons, and for a limited period insofar as Google logs requests under its terms of service to detect abuse. We store the result of an analysis in your Lab Mate account so that you can call it up again. From an import we store only what you accept after checking it; we do not store the selected pages themselves.

Place of processing. We have set up Gemini so that processing by the language model takes place in Google data centres within the European Union. Google belongs to a group headquartered in the USA; access from the USA, for example by authorities there, therefore cannot be completely ruled out. Google LLC is certified under the EU-US Data Privacy Framework; the European Commission’s standard contractual clauses pursuant to Art. 46 (2) (c) GDPR additionally apply.

Google processes the data exclusively on our behalf and in accordance with our instructions. A data processing agreement pursuant to Art. 28 GDPR is in place with Google.

The legal basis is your explicit consent pursuant to Art. 9 (2) (a) GDPR in conjunction with Art. 6 (1) (a) GDPR. Consent is voluntary: without it, the AI-assisted analysis and the import by PDF or photo are not available, while all other functions remain usable. You can withdraw your consent at any time with effect for the future, for example by email to hello@labmate.app. The lawfulness of the processing carried out up to the point of withdrawal remains unaffected.

Further information: Google Cloud Privacy Notice and Google Cloud Data Processing Addendum.

General information and mandatory disclosures

(1) Data protection

The operators of these pages take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory data protection provisions and with this privacy policy.

When you use this website, various items of personal data are collected. Personal data is data by which you can be personally identified. This privacy policy explains which data we collect and what we use it for. It also explains how and for what purpose this happens.

We point out that data transmission over the internet (e.g. when communicating by email) can have security gaps. Complete protection of data against access by third parties is not possible.

(2) Information on the controller

The controller for data processing on this website is:

Lab Mate Nelly-Sachs-Str. 24 73760 Ostfildern, Germany

Telephone: +49 711 255 191 35 Email: hello@labmate.app

The controller is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data (e.g. names, email addresses or similar).

(3) Storage period

Unless a more specific storage period has been stated within this privacy policy, your personal data remains with us until the purpose for the data processing no longer applies. If you assert a justified request for deletion or withdraw consent to data processing, your data will be deleted unless we have other legally permissible grounds for storing your personal data (e.g. retention periods under tax or commercial law); in the latter case, deletion takes place once those grounds cease to apply.

(4) General information on the legal bases for data processing on this website

Insofar as you have consented to the data processing, we process your personal data on the basis of Art. 6 (1) (a) GDPR or Art. 9 (2) (a) GDPR where special categories of data pursuant to Art. 9 (1) GDPR are processed. In the case of explicit consent to the transfer of personal data to third countries, the data processing is additionally carried out on the basis of Art. 49 (1) (a) GDPR. Insofar as you have consented to the storage of cookies or to access to information on your device (e.g. via device fingerprinting), the data processing is additionally carried out on the basis of section 25 (1) TTDSG. Consent can be withdrawn at any time. If your data is required for the performance of a contract or for the implementation of pre-contractual measures, we process your data on the basis of Art. 6 (1) (b) GDPR. We furthermore process your data where this is necessary for compliance with a legal obligation, on the basis of Art. 6 (1) (c) GDPR. Data processing may also be carried out on the basis of our legitimate interest pursuant to Art. 6 (1) (f) GDPR. The legal bases applicable in each individual case are set out in the following paragraphs of this privacy policy.

(5) Information on data transfer to the USA and other third countries

We use, among other things, tools of companies based in the USA or other third countries that are not secure under data protection law. When these tools are active, your personal data may be transferred to and processed in these third countries. We point out that no level of data protection comparable to that of the EU can be guaranteed in these countries. US companies, for example, are obliged to hand over personal data to security authorities without you as the data subject being able to take legal action against this. It can therefore not be ruled out that US authorities (e.g. intelligence services) process, evaluate and permanently store your data held on US servers for surveillance purposes. We have no influence over these processing activities.

(6) Withdrawal of your consent to data processing

Many data processing operations are only possible with your explicit consent. You can withdraw consent you have already given at any time. The lawfulness of the data processing carried out up to the point of withdrawal remains unaffected by the withdrawal.

(7) Right to object to data collection in particular cases and to direct marketing (Art. 21 GDPR)

Where the processing of your personal data is carried out on the basis of Art. 6 (1) (e) or (f) GDPR, you have the right at any time to object to the processing of your data on grounds relating to your particular situation. This also applies to profiling based on these provisions. The legal basis on which the processing is carried out can be found in this privacy policy.

In the event of an objection, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms. Alternatively, the processing may serve the establishment, exercise or defence of legal claims (objection pursuant to Art. 21 (1) GDPR).

If your personal data is used for direct marketing, you have the right to object at any time to the processing of your data for that purpose. This also applies to profiling insofar as it is connected with direct marketing. Following an objection, your personal data will no longer be used for direct marketing (objection pursuant to Art. 21 (2) GDPR).

(8) Right to lodge a complaint with the competent supervisory authority

In the event of infringements of the GDPR, data subjects have the right to lodge a complaint with a supervisory authority, in particular in the member state of their habitual residence, place of work or the place of the alleged infringement. This right to complain is without prejudice to any other administrative or judicial remedy.

(9) Right to data portability

You have the right to have data that we process automatically on the basis of your consent or in performance of a contract handed over to you or to a third party in a common, machine-readable format. If you request the direct transfer of the data to another controller, this will only take place insofar as it is technically feasible.

(10) Information, correction and deletion

Within the framework of the applicable statutory provisions, you have the right at any time to obtain information free of charge about your stored personal data, its origin and recipients and the purpose of the data processing and, where applicable, a right to have this data corrected or deleted. You can contact us at any time regarding this and any further questions on the subject of personal data.

(11) Right to restriction of processing

You have the right to request the restriction of the processing of your personal data. You can contact us about this at any time. The right to restriction of processing exists in the following cases:

If you contest the accuracy of your personal data stored with us, we generally need time to check this. For the duration of that check, you have the right to request the restriction of the processing of your personal data.
If the processing of your personal data took place or is taking place unlawfully, you can request the restriction of the data processing instead of deletion.
If we no longer need your personal data, but you need it for the exercise, defence or establishment of legal claims, you have the right to request the restriction of the processing of your personal data instead of deletion.
If you have lodged an objection pursuant to Art. 21 (1) GDPR, a balancing of your interests and ours must be carried out. As long as it has not yet been established whose interests prevail, you have the right to request the restriction of the processing of your personal data.

If you have restricted the processing of your personal data, this data may — apart from being stored — only be processed with your consent, or for the establishment, exercise or defence of legal claims, or for the protection of the rights of another natural or legal person, or on grounds of an important public interest of the European Union or a member state.

(12) SSL or TLS encryption

For security reasons and to protect the transmission of confidential content, such as enquiries you send to us as the site operator, this site uses SSL or TLS encryption. You can recognise an encrypted connection by the fact that the address line of the browser changes from “http://” to “https://” and by the padlock symbol in your browser line.

When SSL or TLS encryption is activated, the data you transmit to us cannot be read by third parties.

(13) Objection to advertising emails

The use of contact data published under the obligation to provide a legal notice for the purpose of sending unsolicited advertising and information material is hereby objected to. The operators of the pages expressly reserve the right to take legal action in the event of the unsolicited sending of advertising information, for instance by spam emails.

(14) Cookies

In order to make visiting our website attractive and to enable the use of certain functions, we use cookies. These are small text files that your web browser receives when you visit our pages and stores on your computer. Some of the cookies are deleted again immediately after the browser is closed. Other cookies remain on your computer permanently and enable us to recognise you or your computer on your next visit to our website.

This site uses the following types of cookies, whose scope and functioning are explained below:

a) Transient cookies: these are deleted automatically when you close your browser. These include session cookies in particular. They store what is known as a session ID, by means of which the various requests from your browser can be assigned to the shared session. This allows your computer to be recognised when you return to our website. Session cookies are deleted when you log out or close the browser.

b) Persistent cookies: these are deleted automatically after a set period, which can differ depending on the cookie. You can delete cookies at any time in your browser’s security settings.

Cookies can originate from us (first-party cookies) or from third-party companies (known as third-party cookies). Third-party cookies enable certain services of third-party companies to be integrated within websites.

You can influence the use of cookies by changing the settings of your browser. Most browsers have an option with which the storage of cookies can be restricted or prevented. Every browser is individual in the way it manages cookie settings. This is described in the help menu of the browser in question.

You can find this for the respective browsers at the following links:

Internet Explorer: http://windows.microsoft.com/de-DE/windows-vista/Block-or-allow-cookies
Firefox: https://support.mozilla.org/de/kb/cookies-erlauben-und-ablehnen
Chrome: http://support.google.com/chrome/bin/answer.py?hl=de&hlrm=en&answer=95647
Safari: https://support.apple.com/kb/ph21411?locale=de_DE

Please note, however, that deactivating cookies may mean that only limited functions of the website are available to you.

The legal basis for the use of cookies is Art. 6 (1) (f) GDPR.

When cookies are used, a distinction must be drawn between strictly necessary cookies and those used for further purposes (measurement of access figures, advertising purposes). Via our consent manager you generally have the choice of accepting or rejecting all or some of the non-necessary cookies. If you opt for the latter, it is possible that you will not be able to use everything we offer. You can control and withdraw this consent via our consent management (also known as the “cookie banner” or “cookie settings”).

(15) Contact form

If you send us enquiries via the contact form, the details you provide in the enquiry form, including the contact details you give there, will be stored by us for the purpose of processing the enquiry and in case of follow-up questions. We do not pass this data on without your consent.

The processing of this data is carried out on the basis of Art. 6 (1) (b) GDPR where your enquiry is connected with the performance of a contract or is necessary for the implementation of pre-contractual measures. In all other cases the processing is based on our legitimate interest in the effective handling of the enquiries addressed to us (Art. 6 (1) (f) GDPR) or on your consent (Art. 6 (1) (a) GDPR) where this was requested; consent can be withdrawn at any time.

The data you enter in the contact form remains with us until you ask us to delete it, withdraw your consent to its storage, or the purpose for storing the data no longer applies (e.g. after your enquiry has been dealt with). Mandatory statutory provisions — retention periods in particular — remain unaffected.

(16) Enquiry by email or telephone

If you contact us by email or telephone, your enquiry including all personal data arising from it (name, enquiry) will be stored and processed by us for the purpose of handling your request. We do not pass this data on without your consent.

The data you send us by way of contact enquiries remains with us until you ask us to delete it, withdraw your consent to its storage, or the purpose for storing the data no longer applies (e.g. after your request has been dealt with). Mandatory statutory provisions — statutory retention periods in particular — remain unaffected.

(5) Analysis tools

(1) Google Analytics 4

This website uses Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). We use it exclusively for reach measurement: to see which pages are called up, for how long, and by which route visitors come to us.

Google Analytics is only loaded after you have consented in the cookie notice. Before your consent, no script is loaded from Google and no data is transmitted to Google. If you decline or make no decision, measurement with Google Analytics does not take place at all; the website remains usable without restriction.

After your consent, Google Analytics sets the cookies _ga and _ga_T8R8SCEQPQ, each with a lifetime of two years. What is recorded is in particular the pages called up, time spent, approximate location on the basis of the truncated IP address, device type, browser and operating system, and the previously visited page. Google Analytics 4 truncates IP addresses as a matter of principle before any storage; a complete IP address is not stored.

In addition we measure three events without any personal reference: the successful submission of the contact form, a click on one of the buttons leading to an app store, and the opening of an FAQ question. They tell us whether the site is serving its purpose, and contain none of the content you enter.

The legal basis is exclusively your consent pursuant to Art. 6 (1) (a) GDPR and section 25 (1) TDDDG. You can withdraw it at any time with effect for the future — via “Cookie settings” in the footer of every page. The lawfulness of the processing carried out up to the point of withdrawal remains unaffected.

Advertising functions are switched off. We use Google’s consent mode; the consent signals for ad_storage, ad_user_data and ad_personalization are permanently set to “denied” — even where you consent to measurement. Google Signals are deactivated in our property. Neither cross-device consolidation nor advertising or retargeting processing takes place, and we pass no data on to Google advertising products.

Third-country transfer: Google may also process data in the USA. Google LLC is certified under the EU-US Data Privacy Framework; the European Commission’s standard contractual clauses pursuant to Art. 46 (2) (c) GDPR additionally apply. Insofar as a transfer takes place beyond that, we base it on your explicit consent pursuant to Art. 49 (1) (a) GDPR. In the view of the Court of Justice of the European Union, a level of data protection corresponding in every respect to EU standards cannot be guaranteed in the USA; in particular, access by US authorities cannot be ruled out.

A data processing agreement pursuant to Art. 28 GDPR is in place with Google. The data collected is deleted automatically after 14 months.

Further information: Google’s privacy policy and Google Analytics terms of service.

(2) Cloudflare Web Analytics

In addition, this website measures its reach and loading times with Cloudflare Web Analytics, a service of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA (“Cloudflare”), which also delivers the website (see 2 (2)). This measurement runs independently of the cookie notice, i.e. also without your consent: when a page is called up, your browser loads a small script from Cloudflare (static.cloudflareinsights.com). Using a browser interface, it reads the page’s loading times and transmits them to Cloudflare together with details of the page view: the page called up, the previously visited page, browser, operating system and device type. In the process, Cloudflare derives the country from your IP address.

Cloudflare Web Analytics sets no cookies and uses no other storage in your browser. According to Cloudflare, visitors are neither tracked across several visits nor recognised by their IP address or browser data. We only see aggregated statistics, no details about individual people; Cloudflare makes them available to us for the past six months.

The legal basis is Art. 6 (1) (f) GDPR. Our legitimate interest lies in recognising which pages are used and how quickly they load, in order to improve the website. You can object to this processing pursuant to Art. 21 GDPR; the simplest way to prevent the measurement is to block scripts from static.cloudflareinsights.com in your browser, for example with a content blocker.

Processing in the USA cannot be ruled out. Cloudflare is certified under the EU-US Data Privacy Framework; the European Commission’s standard contractual clauses pursuant to Art. 46 (2) (c) GDPR additionally apply. A data processing agreement pursuant to Art. 28 GDPR is in place with Cloudflare.

Further information: Cloudflare Web Analytics and Cloudflare’s privacy policy.

(6) Plugins and tools

(1) Google Fonts

For a uniform appearance, the Lab Mate app uses the typefaces Nunito Sans and Varela Round from Google Fonts, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). The app loads these fonts from Google’s servers the first time they are needed – usually on first launch – and then stores them on your device. In the process, Google receives your IP address and the information that the fonts were requested; no other data from the app is transmitted. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest lies in a uniform presentation of the app. A transfer to the USA cannot be ruled out; Google LLC is certified under the EU-US Data Privacy Framework.

This website itself does not embed Google Fonts: the website’s fonts are delivered from our own server, without any connection to Google.

Further information: Google Fonts privacy FAQ and Google’s privacy policy.

(7) Data security

We have taken a large number of security measures to protect your personal data. Our servers and databases are protected by physical and technical measures, among others.

When transmitting data via our website and the app we use TLS encryption; on the website you can recognise it by the padlock symbol and the addition of “https://” in the address bar.

With encrypted communication, the data you transmit to us cannot be read by third parties. With communication by email, 100 % data security cannot be guaranteed.

(1) Changes to this privacy policy

This privacy policy may be changed by us at any time. All changes to this privacy policy will be published on this website and will take effect automatically 30 days after their publication. We will inform you of material changes to this privacy policy by email.