In this section we describe each and every purpose, for which we process personal data.

If you are an individual using the Platform for your own personal life, we may process your personal data for the following purposes:

1. Account creation

We process the following categories of personal data: password (in a hashed form), user ID, user email, age verification data (whether you are above 18), verification email logs (whether we have sent you the registration confirmation email and whether you have confirmed the registration).

We store these data: for 1 year after your last authorization.

The legal basis for processing the data: contract (Art. 6(1)(b) of the GDPR). If we cannot process these personal data, we will not be able to create an account for you.
2. Logging in to the user account

We process the following categories of personal data: password (in a hashed form), user ID, user email.

We store these data: for 1 year after your last authorization.

The legal basis for processing the data: contract (Art. 6(1)(b) of the GDPR). If we cannot process these personal data, we will not be able to provide you with access to your account.
3. Password recovery and account access restoration

We process the following categories of personal data: password (in a hashed form), user ID, user email, verification email logs (whether you have confirmed password change).

We store these data: for 1 year after your last authorization.

The legal basis for processing the data: contract (Art. 6(1)(b) of the GDPR). If we cannot process these personal data, we will not be able to restore your access to your account.
4. Changing account email address

We process the following categories of personal data: user ID, user email, verification email logs (whether you have confirmed change of your account email).

We store these data: for 1 year after your last authorization.

The legal basis for processing the data: contract (Art. 6(1)(b) of the GDPR). If we cannot process these personal data, we will not be able to change the email you use to access your account.
5. STI test result sharing (creation and use of the Exchange Page, including uploading STI tests results, requesting STI tests results and QR code sharing – and QR code scanning and partner verification)

We process the following categories of personal data: encrypted STI test results document, encrypted STI test results requested from the partner, QR code linking to the Exchange Page, personal message (if a custom message is added, it is also end-to-end encrypted), passphrase*, link between members’ profiles and the Exchange Page, Exchange Page ID, Exchange Page interaction status, the partner’s decision to share her STI test results, user ID.

*To access the Exchange Page, the passphrase is used locally on the user’s device to unlock the content. The Company does not receive, store, or hash the passphrase. Only encrypted content and limited technical parameters are stored on our servers, and the Company cannot access the underlying content without the passphrase.

We store these data: either until both parties have viewed the STI test results of each other (in this case the Exchange Page is deleted automatically once the person having created the Exchange Page has viewed the STI test results of the partner) or until the Exchange Page is deleted. The Exchange Page is deleted either manually by the user having created it or automatically 3 months after it was created.

The legal basis for processing the data: contract (Art. 6(1)(b) of the GDPR) and explicit consent (Art. 9(2)(a) of the GDPR). If we cannot process these personal data, we will not be able to provide you with this type of service – sharing your STI test results with your partner. Since we process special categories of personal data for this particular purpose, the additional legal basis is your explicit consent to processing your health data (Art. 9(2)(a) of the GDPR).
6. Generating personal message with the help of AI technologies

We process the following categories of personal data: description of emotions as provided by the user, custom message generated, user ID.

We store these data: as a part of the Exchange Page either until both parties have viewed the STI test results of each other (in this case the Exchange Page is deleted automatically once the person having created the Exchange Page has viewed the STI test results of the partner) or until the Exchange Page is deleted. The Exchange Page is deleted either manually by the user having created it or automatically 3 months after it was created. For the purpose of generating the optional AI-assisted custom message, certain user-provided input data are temporarily processed and stored in our internal systems for up to 30 days. After this period, such operational data are permanently deleted and no longer retained outside the Exchange Page.

The legal basis for processing the data: contract (Art. 6(1)(b) of the GDPR). Please, be informed that this feature is turned on only by you clicking on the respective button. WE DO NOT USE AI FEATURES BY DEFAULT. If we cannot process these personal data, we will not be able to provide you with this type of service – generating a personal message with the help of AI technologies.
7. Purchasing medical tests

We process the following categories of personal data: user email, appointment details (services booked, selected medical tests and/or test package in a pseudonymized format (e.g. internal reference codes), appointment date and time, clinic address), order ID, clinic name, package price, user ID.

We store these data: for 6 months after the tests were ordered.

The legal basis for processing the data: contract (Art. 6(1)(b) of the GDPR). If we cannot process these personal data, we will not be able to provide you with this type of service – ordering and paying for medical tests.
8. Displaying the nearest clinics using map services

We process the following categories of personal data: geolocation, IP address, medical tests chosen (this piece of data is needed to ensure that only those clinics are visible on the map that provide the medical services you need).

We store these data: up to 1 week after the data were collected.

The legal basis for processing the data: contract (Art. 6(1)(b) of the GDPR). If we cannot process these personal data, we will not be able to show you the map with the partner clinics providing the services you need.
9. Saving medical tests purchasing history

We process the following categories of personal data: user email, appointment details (services booked, selected medical tests and/or test package in a pseudonymized format (e.g. internal reference codes), appointment date and time, clinic address), order ID, clinic name, package price, user ID.

We store these data: for 6 months after the tests were ordered.

The legal basis for processing the data: contract (Art. 6(1)(b) of the GDPR). If we cannot process these personal data, we will not be able to provide you with information about the tests you have ordered and paid for.

For legal, accounting, and compliance purposes, we may retain a limited subset of transaction-related information for a longer period where required or permitted by applicable law. In such cases, the legal basis for processing is compliance with a legal obligation (Art. 6(1)(c) GDPR).

Such information is stored exclusively in a neutral, non-medical coded form and does not contain direct references to specific medical tests (e.g. their exact names). The conversion of such codes into human-readable names is performed solely in the user interface for display purposes.
10. Sending order confirmation emails

We process the following categories of personal data: user email, appointment details (appointment date and time, clinic address), order ID, clinic name, package price, user ID.

We store these data: for 3 months after the order confirmation was sent.

The legal basis for processing the data: contract (Art. 6(1)(b) of the GDPR). If we cannot process these personal data, we will not be able to provide you with order confirmation information.
11. Sending notification emails about actions taken by the user within the Platform and actions taken by the user’s partner with regard to the Exchange Page

We process the following categories of personal data: user email, Exchange Page interaction status, actions taken within the account (e.g., account deletion request), user ID.

We store these data: for 3 months after the email notification was sent.

The legal basis for processing the data: pursuing a legitimate interest (Art. 6(1)(f) of the GDPR). The legitimate interest pursued by AskBefore is maintaining the integrity and security of the user’s account, as well as transparency of result-sharing activity.
12. Logging user actions when a user links to the Exchange Page

We process the following categories of personal data: IP address, user ID, session token, event logs.

We store these data: 48 hours after the link was generated.

The legal basis for processing the data: pursuing a legitimate interest (Art. 6(1)(f) of the GDPR). The legitimate interest pursued by AskBefore is ensuring the Platform security, preventing unauthorised access to STI test results exchanges, detecting misuse or fraudulent activity, and maintaining the integrity of ordering and sharing workflows within the Platform.
13. Providing customer support

We process the following categories of personal data: user email, user ID, support request details.

We store these data: for up to 6 months after the problem is resolved.

The legal basis for processing the data: contract (Art. 6(1)(b) of the GDPR). If we cannot process these personal data, we will not be able to provide you with customer support and resolve the problem you have.
14. Collecting data about how you use the Platform for further optimization of the Platform

We process the following categories of personal data: IP address, events (automatic and custom), heatmaps, device information (browser, OS), inferred geolocation, session recordings (mouse movement, clicks, scroll behaviour), clickstream behaviour.

We store these data: for up to 3 months after the data is collected.

The legal basis for processing the data: consent (Art. 6(1)(a) of the GDPR).

If you are a representative of a medical clinic or laboratory and use the Platform to on behalf of this clinic or laboratory, we may process your personal data for the following purposes:

1. Clinic account creation

We process the following categories of personal data: password (in a hashed form), account email, verification email logs (whether we have sent you the registration confirmation email and whether you have confirmed the registration).

We store these data: until the agreement between AskBefore and the clinic is terminated.

The legal basis for processing the data: contract (Art. 6(1)(b) of the GDPR). If we cannot process these personal data, we will not be able to create an account for you.
2. Logging in on the clinics portal

We process the following categories of personal data: password (in a hashed form), account email.

We store these data: until the agreement between AskBefore and the clinic is terminated.

The legal basis for processing the data: contract (Art. 6(1)(b) of the GDPR). If we cannot process these personal data, we will not be able to provide you with access to the account you use.
3. Password recovery and account access restoration

We process the following categories of personal data: password (in a hashed form), account email, verification email logs (whether you have confirmed password change).

We store these data: until the agreement between AskBefore and the clinic is terminated.

The legal basis for processing the data: contract (Art. 6(1)(b) of the GDPR). If we cannot process these personal data, we will not be able to restore your access to your account.

Legal Notice (Imprint)