In this section we describe each and every purpose, for which we process personal data.

If you are an individual using the Platform for your own personal life, we may process your personal data for the following purposes:

1. Account creation

We process the following categories of personal data: password (in a hashed form), user ID, user email, age verification data (whether you are above 18), verification email logs (whether we have sent you the registration confirmation email and whether you have confirmed the registration).

We store these data: for 1 year after your last authorization.

The legal basis for processing the data: contract (Art. 6(1)(b) of the GDPR). If we cannot process these personal data, we will not be able to create an account for you.
2. Logging in to the user account

We process the following categories of personal data: password (in a hashed form), user ID, user email.

We store these data: for 1 year after your last authorization.

The legal basis for processing the data: contract (Art. 6(1)(b) of the GDPR). If we cannot process these personal data, we will not be able to provide you with access to your account.
3. Password recovery and account access restoration

We process the following categories of personal data: password (in a hashed form), user ID, user email, verification email logs (whether you have confirmed password change).

We store these data: for 1 year after your last authorization.

The legal basis for processing the data: contract (Art. 6(1)(b) of the GDPR). If we cannot process these personal data, we will not be able to restore your access to your account.
4. Changing account email address

We process the following categories of personal data: user ID, user email, verification email logs (whether you have confirmed change of your account email).

We store these data: for 1 year after your last authorization.

The legal basis for processing the data: contract (Art. 6(1)(b) of the GDPR). If we cannot process these personal data, we will not be able to change the email you use to access your account.
5. STI test result sharing (creation and use of the Exchange Page, including uploading STI test results, requesting STI test results and QR code sharing – and QR code scanning and partner verification)

We process the following categories of personal data: encrypted STI test results document, encrypted STI test results requested from the partner, QR code linking to the Exchange Page, personal message (if a custom message is added, it is also end-to-end encrypted), passphrase*, link between members’ profiles and the Exchange Page, Exchange Page ID, Exchange Page interaction status, the partner’s decision to share her STI test results, user ID.

*To access the Exchange Page, the passphrase is used locally on the user’s device to unlock the content. The Company does not receive, store, or hash the passphrase. Only encrypted content and limited technical parameters are stored on our servers, and the Company cannot access the underlying content without the passphrase.

We store these data: either until both parties have viewed the STI test results of each other (in this case the Exchange Page is deleted automatically once the person having created the Exchange Page has viewed the STI test results of the partner) or until the Exchange Page is deleted. The Exchange Page is deleted either manually by the user having created it or automatically 3 months after it was created.

The legal basis for processing the data: contract (Art. 6(1)(b) of the GDPR) and explicit consent (Art. 9(2)(a) of the GDPR). If we cannot process these personal data, we will not be able to provide you with this type of service – sharing your STI test results with your partner. Since we process special categories of personal data for this particular purpose, the additional legal basis is your explicit consent to processing your health data (Art. 9(2)(a) of the GDPR).
6. Purchasing medical tests

We process the following categories of personal data: user email, first name, surname, phone number, appointment details (services booked, selected medical tests and/or test package in a pseudonymized format, e.g. internal reference codes), appointment date and time, testing provider address, order ID, testing provider name, package price, payment status, and user ID.

To minimise the use of health-related details, we use neutral internal references where possible instead of descriptive test names.

We store these data: for 6 months after the tests were ordered.

The legal basis for processing the data: contract (Art. 6(1)(b) of the GDPR) and, where the booking data reveals health-related information, explicit consent (Art. 9(2)(a) of the GDPR). If we cannot process these personal data, we will not be able to provide you with this type of service – ordering and paying for medical tests.

Before completing the purchase, we ask you to give explicit consent for the processing of health-related booking data through a separate, non-pre-ticked checkbox. The purchase cannot be completed unless this checkbox is actively selected.
7. Displaying the nearest testing providers using map services

We process the following categories of personal data: geolocation, IP address, medical tests chosen (this piece of data is needed to ensure that only testing providers that offer the medical services you need are shown on the map).

We store these data: up to 1 week after the data were collected.

The legal basis for processing the data: contract (Art. 6(1)(b) of the GDPR). If we cannot process these personal data, we will not be able to show you the map with the partner testing providers offering the services you need.
8. Saving medical tests purchasing history

We process the following categories of personal data: user email, first name, surname, phone number, appointment details (services booked, selected medical tests and/or test package in a pseudonymized format, e.g. internal reference codes), appointment date and time, testing provider address, order ID, testing provider name, package price, payment status, and user ID.

We store these data: for 6 months after the tests were ordered.

The legal basis for processing the data: contract (Art. 6(1)(b) of the GDPR) and, where the purchasing history reveals health-related information, explicit consent (Art. 9(2)(a) of the GDPR). If we cannot process these personal data, we will not be able to show you your medical test order history.

For legal, accounting, and compliance purposes, we may retain a limited subset of transaction-related information for a longer period where required or permitted by applicable law. In such cases, the legal basis for processing is compliance with a legal obligation (Art. 6(1)(c) GDPR).

Such information is stored exclusively in a neutral, non-medical coded form and does not contain direct references to specific medical tests (e.g. their exact names). The conversion of such codes into human-readable names is performed solely in the user interface for display purposes.
9. Sending order confirmation emails

We process the following categories of personal data: user email, appointment details (appointment date and time, testing provider address), order ID, testing provider name, testing provider contact details, and support-related links or actions.

We store these data: for 3 months after the order confirmation was sent.

The legal basis for processing the data: contract (Art. 6(1)(b) of the GDPR). If we cannot process these personal data, we will not be able to provide you with order confirmation information.
10. Sending notification emails about actions taken by the user within the Platform and actions taken by the user’s partner with regard to the Exchange Page

We process the following categories of personal data: user email, Exchange Page interaction status, actions taken within the account (e.g., account deletion request), user ID.

We store these data: for 3 months after the email notification was sent.

The legal basis for processing the data: pursuing a legitimate interest (Art. 6(1)(f) of the GDPR). The legitimate interest pursued by AskBefore is maintaining the integrity and security of the user’s account, as well as transparency of result-sharing activity.
11. Logging user actions when a user links to the Exchange Page

We process the following categories of personal data: IP address, user ID, session token, event logs.

We store these data: 48 hours after the link was generated.

The legal basis for processing the data: pursuing a legitimate interest (Art. 6(1)(f) of the GDPR). The legitimate interest pursued by AskBefore is ensuring the Platform security, preventing unauthorised access to STI test results exchanges, detecting misuse or fraudulent activity, and maintaining the integrity of ordering and sharing workflows within the Platform.
12. Providing customer support

We process the following categories of personal data: user email, user ID, support request details.

We store these data: for up to 6 months after the problem is resolved.

The legal basis for processing the data: contract (Art. 6(1)(b) of the GDPR). If we cannot process these personal data, we will not be able to provide you with customer support and resolve the problem you have.
13. Collecting data about how you use the Platform for further optimization of the Platform

We process the following categories of personal data: IP address, events (automatic and custom), heatmaps, device information (browser, OS), inferred geolocation, session recordings (mouse movement, clicks, scroll behaviour), clickstream behaviour.

We store these data: for up to 3 months after the data is collected.

The legal basis for processing the data: consent (Art. 6(1)(a) of the GDPR).

If you are a representative or authorized team member of a partner organization and use the Partner Portal on behalf of that organization, we may process your personal data for the following purposes.

A partner organization may include a testing provider or another service provider that works with AskBefore.

1. Creating a partner organization profile and Partner Admin account

We process the following categories of personal data: name, email address provided for Partner Portal access, partner organization name, assigned role, invitation status, invitation email logs, password in a hashed form, user ID, and technical logs related to account creation.

We use these data to create the partner organization profile in the Partner Portal, assign the Partner Admin role, send the account invitation, activate the account, and provide access to the Partner Portal.

We store these data: until the Partner Agreement is terminated or your Partner Portal access is removed, unless a longer retention period is required or permitted for security, audit, legal, compliance, or legitimate business purposes.

The legal basis for processing the data: contract (Art. 6(1)(b) of the GDPR) and/or our legitimate interests (Art. 6(1)(f) of the GDPR) in providing secure access to the Partner Portal and managing our relationship with partner organizations. If we cannot process these personal data, we will not be able to create an account for you or provide access to the Partner Portal.
2. Inviting team members and managing access

A Partner Admin or another authorized team member may invite other users to the Partner Portal.

We process the following categories of personal data of the invited user: name, email address provided for Partner Portal access, assigned role, partner organization, assigned location or locations, access scope, invitation status, and logs related to the sending, opening, and acceptance of the invitation.

We use these data to send invitations, create Partner Portal accounts, assign roles and permissions, and ensure that each user can only access information relevant to their assigned role and access scope.

We store these data: until the Partner Agreement is terminated or the user’s Partner Portal access is removed, unless a longer retention period is required or permitted for security, audit, legal, compliance, or legitimate business purposes.

The legal basis for processing the data: contract (Art. 6(1)(b) of the GDPR) and/or our legitimate interests (Art. 6(1)(f) of the GDPR) in managing access, maintaining security, and supporting operational transparency in the Partner Portal. If we cannot process these personal data, we will not be able to invite the user, create their account, or assign role-based access.
3. Logging in to the Partner Portal

We process the following categories of personal data: email address provided for Partner Portal access, password in a hashed form, user ID, assigned role, partner organization, assigned location or access scope, login timestamps, session data, IP address, device and browser information, and security event logs.

We use these data to authenticate users, provide secure access to the Partner Portal, prevent unauthorized access, detect misuse, and maintain the security of the Partner Portal.

We store these data: until the Partner Agreement is terminated or the user’s Partner Portal access is removed. Security logs may be retained for a limited additional period where necessary for security, audit, incident investigation, legal, or compliance purposes.

The legal basis for processing the data: contract (Art. 6(1)(b) of the GDPR) and our legitimate interests (Art. 6(1)(f) of the GDPR) in maintaining the security of the Partner Portal. If we cannot process these personal data, we will not be able to provide secure access to the Partner Portal.
4. Password recovery and account access restoration

We process the following categories of personal data: email address provided for Partner Portal access, password in a hashed form, user ID, password recovery email logs, and confirmation logs related to password changes.

We use these data to restore access to your account, allow you to change your password, and protect the account from unauthorized access.

We store these data: until the Partner Agreement is terminated or the user’s Partner Portal access is removed. Password recovery logs may be retained for a limited additional period for security and audit purposes.

The legal basis for processing the data: contract (Art. 6(1)(b) of the GDPR) and our legitimate interests (Art. 6(1)(f) of the GDPR) in protecting account security. If we cannot process these personal data, we will not be able to restore access to your account.
5. Partner Portal activity, submitted information, and History Log

We process the following categories of personal data: user ID, name, email address provided for Partner Portal access, assigned role, partner organization, assigned location or access scope, date and time of action, event type, event details, affected item, submitted content, and, where relevant, before-and-after values.

This may include activity related to account activation, sign-in, team invitations, role and access management, notification settings, locations, services, sample types, testing methods, prices, packages, discounts, availability, booking settings, expected turnaround or result delivery times, payment provider settings, contact details, suggestions, orders, and other operational actions in the Partner Portal.

We use these data to provide and secure the Partner Portal, manage role-based access, maintain the History Log, support users, troubleshoot issues, send service-related notifications, maintain operational transparency, and keep an audit trail of important actions.

The History Log may be available to Partner Portal users depending on their assigned role and access scope. Users can only see activity that is relevant and appropriate for their role, organization, location, or assigned locations.

We store these data: for the duration of the Partner Agreement and for a limited period after termination where necessary for audit, security, legal, compliance, support, or legitimate business purposes.

The legal basis for processing the data: our legitimate interests (Art. 6(1)(f) of the GDPR) in maintaining security, auditability, transparency, and support for the Partner Portal, and, where applicable, contract (Art. 6(1)(b) of the GDPR).
6. Partner Portal email notifications

We process the following categories of personal data: name, email address provided for Partner Portal access, assigned role, partner organization, assigned location or access scope, notification settings, event type, event details, location name, Order ID where relevant, and email delivery logs.

We use these data to send service-related email notifications about activity and updates that are relevant to your role and access scope, unless you have changed your email notification settings or the notification is required for your role.

Some notifications may include another team member’s name, role, and details of the action they performed, where this is relevant to your role and access scope.

Some service-related notifications may be required for certain roles where they are necessary to perform that role, such as new order notifications for reception roles.

We store these data: for a limited period necessary to confirm delivery, provide support, maintain auditability, and protect the security of the Partner Portal.

The legal basis for processing the data: our legitimate interests (Art. 6(1)(f) of the GDPR) in providing operational transparency, security, and service-related communications. For optional product updates or marketing communications, we rely on consent where required by applicable law.
7. Location contact details

Partner organizations may provide a contact email address for their locations that users can use to contact the location about bookings, rescheduling, cancellations, visits, orders, or related questions.

If these contact details relate to an individual person, they may be personal data. The partner organization is responsible for ensuring that the contact details it provides are accurate, current, and appropriate for user communications.

We may show these contact details to AskBefore users where necessary to help them contact the location about an order, booking, or visit.

This location contact email may be shown to users who booked or purchased services related to the respective location in order to enable communication regarding bookings, appointments, cancellations, rescheduling, visits, payments, or related operational questions.

We store these data: for as long as the location remains active in the Partner Portal or until the contact details are changed or removed, unless a longer retention period is required or permitted by law.

The legal basis for processing the data: contract (Art. 6(1)(b) of the GDPR) and our legitimate interests (Art. 6(1)(f) of the GDPR) in enabling communication between users and partner locations.
8. AskBefore Booking

AskBefore Booking is an optional feature that may be made available to partner organizations for evaluation, testing, setup, or operational use. Partner organizations may choose whether to use AskBefore Booking and for which locations, services, or purposes.

When AskBefore Booking is enabled, configured, or tested for a partner organization or location, authorized Partner Portal users may configure booking availability, appointment schedules, capacity, and related booking settings.

We may process Partner Portal activity related to AskBefore Booking, including the user who made the change, assigned role, partner organization, location, date and time of action, booking settings, before-and-after values where relevant, and related operational logs.

We use these data to provide AskBefore Booking, show appointment availability to users, manage bookings, maintain the History Log, provide support, and ensure operational transparency.

We store these data: for the duration of the Partner Agreement and for a limited period after termination where necessary for audit, support, security, legal, compliance, or legitimate business purposes.

The legal basis for processing the data: contract (Art. 6(1)(b) of the GDPR) and/or our legitimate interests (Art. 6(1)(f) of the GDPR) in providing booking functionality, operational support, security, and auditability.
9. Partner contact requests and partnership enquiries

If you contact us through a partner landing page, contact form, or similar partner-facing page, we may process the following categories of personal data: first name, surname, business email address, mobile phone number, message content, date and time of submission, and communication history.

We use these data to receive and respond to your enquiry, contact you about a potential partnership, arrange follow-up communication, assess whether AskBefore may be relevant for your organization, and maintain a record of business communications.

We store these data: for up to 12 months after the last meaningful interaction, unless the enquiry leads to a partnership or another business relationship, in which case the relevant data may be stored for the duration of that relationship and for a limited period afterwards where necessary for legal, compliance, audit, dispute-resolution, or legitimate business purposes.

The legal basis for processing the data: our legitimate interests (Art. 6(1)(f) GDPR) in responding to partner enquiries, developing business relationships, and keeping records of business communications. Where your enquiry concerns steps before entering into a contract, the legal basis may also be contract or pre-contractual steps (Art. 6(1)(b) GDPR).

We do not use the phone number provided through the partner contact form for unrelated marketing calls or messages unless this is permitted by applicable law or you have given any required consent.
10. Payment provider and payment integration settings

Some partner organizations may choose to use an integrated payment provider, such as Stripe Connect or another payment provider supported by AskBefore. In these cases, AskBefore may enable payment provider functionality for that partner organization.

Partner organizations may use different booking and payment flows depending on the setup enabled for them. In some cases, AskBefore may redirect users to a page or link provided by the partner organization, where booking or payment may take place outside AskBefore. In other cases, users may book through the AskBefore Platform and pay directly at the location or through an integrated payment provider supported by AskBefore.

A partner organization’s payment integration setup may change over time, depending on the partner organization’s preferences, operational needs, or agreement with AskBefore.

When payment provider or payment integration settings are configured or changed, we may process Partner Portal activity such as the user who made or requested the change, assigned role, partner organization, location or access scope where relevant, date and time of action, payment provider status, payment integration type, link provided for simplified integration, and related operational logs.

We use these data to manage payment-related settings, provide support, maintain the History Log, ensure operational transparency, and support the correct order and payment flow for users.

We store these data: for the duration of the Partner Agreement and for a limited period after termination where necessary for audit, support, security, legal, compliance, or legitimate business purposes.

The legal basis for processing the data: contract (Art. 6(1)(b) of the GDPR) and/or our legitimate interests (Art. 6(1)(f) of the GDPR) in managing payment-related functionality, support, security, and auditability.

AskBefore is almost here