Privacy notice for the Igloo Health app

1. Controller

The controller responsible for the Igloo Health app is:

Dx365 GmbH
Hedwig-Porschütz-Str. 14
10557 Berlin, Germany
represented by its managing director (Geschäftsführer) Aleksandr Taran
Email: info@dx365.world

You will find further details in the Impressum. For questions about data protection, or if you wish to exercise your rights, please write to info@dx365.world or by post to the address above.

2. What this notice covers

This notice applies to the “Igloo Health” app for iPhone and Android. It describes what data the app processes on your phone and what data it exchanges with servers for this – ours and those of other providers.

It describes the app from version 1.5.3. Older versions process data in part differently from what is described here; please update the app to the current version.

Our website is covered by the website privacy policy. The measurement itself is carried out by the pharmacy; how the pharmacy handles your data in doing so you can learn from the pharmacy. Section 5 describes what happens to the data of your measurement on our servers; we answer questions about it at info@dx365.world.

3. No account: what is stored on your phone

You need no account and no sign-in for the app, and we keep no profile of you. What you enter in the app and what the app learns about your measurements is stored in the app’s own storage area on your phone:

• Your profile: biological sex, date of birth and age, your diet and how active you are; if you provide them, details of your cycle (for example regular, contraception, pregnancy or menopause, start of your last period and cycle length). Sex and age determine which reference ranges the app compares your values with. The app also uses sex, age, diet and activity level to highlight and list first those checks you can request from a pharmacy that suit you; it sends nothing for this.
• Your results: for each biomarker the value, unit, reference range, classification, date and time, name of the test and identifier of the biomarker (LOINC code); in addition, where the app knows it, the pharmacy where the measurement was made, for results from the pharmacy the serial number of the reader or the measurement number (section 5) and, if you have provided cycle details, the cycle day and cycle phase on the day of the measurement.
• Values you enter yourself, for example from a laboratory or from your doctor, with the source you state. They stay on your phone; the app does not send them anywhere.
• Your consent with its version, the time, the app’s version and language, and a list of when you consented and withdrew (section 4).
• Measurement numbers the app is still asking a result for, with the time you scanned them or opened their link, the start of the hour of requests and the last request (section 5); which values from the pharmacy you deleted (measurement number and biomarker identifier), so that they do not come back; and, if you have switched on offers, for which results the app has already asked which pharmacy measured them (section 4).
• Your last request to a pharmacy (section 7), the pharmacy you last selected with its distance from where you were at the time, recommendations your pharmacy has noted in your app, which posts from your pharmacy you have already seen, and simple counters of how often you have viewed, opened or dismissed your pharmacy’s offers, products and posts, including for which biomarker you viewed offers. The app does not evaluate these counters, and they do not leave your phone.
• Cached copies of content the app downloads (section 8).

We have no access to the data held only on your phone; results from the pharmacy are also held on our server (section 5). The app does not additionally encrypt the data on the phone; it is protected by your phone: other apps cannot read the app’s storage area, and if device encryption is on, the data is also stored encrypted. Please therefore protect your phone with a screen lock. In the versions from the App Store and Google Play, the app writes no messages of its own to the phone’s system log.

Backups. The app leaves this data out of your phone’s backups in the cloud: on Android, backup to Google is switched off for the app. On the iPhone the app keeps its data in a folder that it excludes from iCloud and computer backups; it moves data of an earlier version there at the first start. If, in exceptional cases, this folder cannot be created or cannot be excluded from backups, the app stores the data in a way that can end up in backups. If you move directly from one phone to a new one, the data may be transferred along. Backups from before version 1.5.3 may still contain the data; you manage those backups in your Google or Apple account or on your computer, and we have no access to them.

The legal basis for processing your health data in the app – results, cycle and profile details, including for the suggestions of suitable checks – is your explicit consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR, section 4).

4. Your consent

When you first start the app, it shows a consent screen. It says: “Igloo Health shows and explains the results of your tests in the pharmacy. To do so, the app processes health data about you. It is for information only and does not replace medical advice.” You can only continue once you have ticked both boxes:

• “I have read the privacy notice.” – “privacy notice” opens this notice;
• “I expressly consent to Igloo Health processing my health data: my test results and my details on sex, age, diet, activity and, if I enter it, my cycle. The app stores and explains them on this phone, suggests suitable checks to book based on my details on this phone, fetches my results for up to one hour after each test from a Dx365 GmbH server in Frankfurt am Main using the measurement number from the QR code, and notifies me when a result is ready.”

Below them it says: “You can withdraw your consent at any time under ‘Your profile’ (person icon, top right) › ‘Privacy’. Withdrawal takes effect for the future.” These are the texts when the app is set to English or to any language other than German; in German the app shows the German texts and opens the German version of this notice.

We rely on the second box as your explicit consent to the processing of your health data in the app (Art. 6(1)(a) and Art. 9(2)(a) GDPR). Before you have consented, the app fetches no results, does not ask whether it may show notifications and sends no details about you; if you open a link with a measurement number before, it only stores the measurement number (section 5).

When you tap “Continue”, the app stores on your phone the version of the consent (currently “2026-10”), the time and the app’s version and language. Under “Your profile” › “Privacy” you can see when and to which version you consented. The app stores no IP address for this. This record stays on your phone; we do not receive it.

If you consented in an earlier version of the app, after the update the app shows “We have updated our privacy notice” and asks you again; until then it fetches no results. It also asks again if we change the consent in future (section 18).

Withdrawal. You can withdraw your consent at any time with effect for the future (Art. 7(3) GDPR); processing up to the withdrawal remains lawful. To do so, tap “Withdraw consent” under “Your profile” › “Privacy”. The app then stops fetching results, removes the measurement numbers it is still asking about, switches off the offers from your pharmacy, removes its notifications and shows the consent screen again; it shows your data again only after a new consent. The data stays stored on your phone until you delete it – on that screen or under “Your profile” › “Privacy” › “Delete all data” (section 14). A withdrawal by email to us does not reach the app on your phone. If you also want us to delete the result file on our server, write to us at info@dx365.world with the measurement number (section 14).

Offers from your pharmacy (optional)

Separately, you can switch on offers: products, services and posts of the pharmacy where you were tested. The function is off until you choose “Enable offers” on a page of its own. There the app says: “This is advertising, selected using your results.” and “Your values stay on this phone; the selection is made here. To find the pharmacy that measured a result, the app asks our server once per result using its measurement number (for a result from a reader, our partner portal using the reader’s device number), and it loads that pharmacy’s pictures from the partner portal. These requests carry your IP address, never a biomarker or value.”

For a result from the pharmacy, the app shows only offers of the pharmacy where the reader that measured it is located; if the app does not know that, it shows no offers for it. For values you entered yourself, the pharmacy you named for them counts, and without one the pharmacy of your request or the one you selected on the map. The app shows posts of the pharmacy you sent a request to or are currently looking at.

The app finds out which pharmacy measured a result only while offers are switched on: for a result it fetched using a measurement number and whose pharmacy it does not know yet, it fetches the result file (section 5) once more and takes over the pharmacy if the file names it; for a result from a QR code with values, it asks our portal for pharmacies using the reader’s serial number. The app selects the offers on your phone; it does not send your values for this.

The app loads pictures of products and posts and pharmacies’ logos only from our portal for pharmacies (AWS, Frankfurt am Main), never from other addresses such as a pharmacy’s online shop; instead of such pictures it shows a placeholder. It loads a pharmacy’s product pictures all together – those of all its products, at most 60 – whichever biomarker and value is being shown. Our portal thereby learns your IP address and from which pharmacy you see offers, but no biomarker and no value.

The app stores when you switched on offers and which version of the text you agreed to. If you had switched them on in an earlier version of the app, the app switches them off once and asks you again. You can switch them off at any time under “Your profile” › “Pharmacy”. The legal basis is your consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR).

5. Getting results from the pharmacy into the app

At your measurement, the Igloo reader in the pharmacy shows a QR code. It contains only a link with a randomly generated measurement number (dx365report.world/m/…), no values and no name. If you scan it with the app – or open the link on a phone on which the app is installed – the app stores the measurement number. It uses it to fetch anything only once you have given your consent in the app (section 4); until then the measurement number waits.

The reader transmits every measurement to our system at Amazon Web Services (AWS) in Frankfurt am Main – whether or not you use the app. From it our system creates a separate file for the app. It contains the measurement number, the name of the test, the time of the measurement and, for each biomarker, the value, unit, reference range and classification. Your name, the identifier the pharmacy enters for your sample, your sex, your age and the reader’s serial number are not in it. If the file names the pharmacy where the reader is located (the pharmacy’s identifier and name), the app stores that with the result. Even without a name, this is health data about you, because the measurement number links it to you.

Once you have consented, the app retrieves this file from AWS in Frankfurt am Main and sends only the measurement number – and, as with any connection, your IP address. It asks automatically for one hour, counted from the scan or from opening the link (or from your consent if the measurement number was stored before): about every 30 seconds for the first 15 minutes, then about every 2 minutes, at most 53 times and only while the app is running. When the result is there, the app stores it and stops asking automatically for that measurement number; only if you have switched on offers and the app does not yet know the pharmacy that measured it does it fetch the file once more for that purpose (section 4). If there is no result after one hour, the app stops: under “Waiting for results” it shows the measurement number with “No result yet”. If you tap “Check again”, it asks once; with “Remove” you delete the measurement number. Because checks with several tests can take longer, the page of a biomarker also has “Check for more results from this measurement”: this too makes the app ask once. If you scan the QR code again, a new hour starts; the same applies if you open the link of a measurement number that is no longer listed under “Waiting for results”.

Deleting. If you delete a value in the app that it retrieved using a measurement number, the app remembers this and does not take it over again in later requests for that measurement. Only if you scan the measurement’s QR code again does it also reload values you had deleted.

The file on our server is not protected by a password: anyone who knows the measurement number can retrieve it. It is protected only by the measurement number being generated at random. Please therefore do not pass on the QR code or the measurement number. There is currently no automatic deletion of these files after a fixed period; we delete a file when you ask us to and tell us the measurement number (section 14).

The legal basis for retrieving your results in the first hour and for storing and displaying them in the app is your explicit consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR, section 4). After that, the app retrieves them only when you trigger it yourself (“Check again”, “Check for more results from this measurement”), or with offers switched on, as the text on offers describes (section 4). Our system creates the file itself at every measurement so that the result can be retrieved in the app – also for measurements whose result nobody retrieves in the app. We answer questions about this, including about our role towards the pharmacy, at info@dx365.world.

The complete record of the measurement

Independently of the app, our system at AWS in Frankfurt am Main also stores the complete record the reader transmits: besides the values, the time and the measurement number, the identifier the pharmacy enters for your sample, your sex, your age, the name of the person who carried out the measurement and the reader’s serial number. We remove the sample identifier, sex and age from this record in a daily run once the measurement is more than 72 hours old; so far we do not delete the rest of the record automatically. A log of our system (Amazon CloudWatch) also contains the complete record, so far without a deletion period. For statistical analyses (such as how values are distributed) we also store, for each biomarker, the value with the time and the reader’s serial number and, without the serial number and without the exact time, the month, sex and age group together with the value.

If a target address is stored for a reader, we forward every measurement made with that reader, with the sample identifier, your sex, the serial number and the values, in the standard format FHIR to that address. With the measurement number we can also find this record (section 14). How the pharmacy itself handles your data you can learn from the pharmacy; we answer questions about this record and about our role towards the pharmacy at info@dx365.world.

QR codes that contain the values themselves

The reader can also show a QR code that contains the values themselves (dx365report.world/report?csv=…), together with the identifier of your sample, the name of the person who carried out the measurement, your sex and your age. If you scan it with the app, the app reads it entirely on your phone, without connecting to any server. It keeps the values, the reader’s serial number, the time and the language; it discards the sample identifier, the name, your sex and your age. The app asks at which pharmacy the reader is located only if you have switched on the offers from your pharmacy (section 4). Please open such a QR code only with the app: opened with your phone’s camera, your browser sends its entire content to the website dx365report.world.

Camera and QR recognition

The app uses the camera only to scan QR codes, and only once you open the scanner and allow access. It analyses the camera images on your phone with a software library that is part of the app; it does not store them, records no sound and sends nothing in doing so – neither to us nor to any other provider. The app processes what a QR code contains as described in this section.

6. Finding pharmacies: list, map and location

The app loads the list of pharmacies from the service service.dx365.world each time you open the map or the pharmacy selection; the connection to it runs through Cloudflare’s network. The app loads details of a pharmacy such as its phone number, website and its settings for requests from our portal for pharmacies (AWS, Frankfurt am Main). In doing so the app sends no details about you; the servers only see your IP address and technical details of the connection. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is to show you pharmacies with up-to-date details.

Location. When you open the map or the selection of a pharmacy, the app asks whether it may use your location. Only if you agree does your phone determine your location, and only while you are using the app. The app uses it exclusively on your phone, to move the map there and to sort the pharmacies by distance. It does not send it to us and does not store it; only the distance to the pharmacy you select is stored. You can withdraw the permission at any time in your phone’s settings. Access to your location is permitted under § 25(2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act), as it is strictly necessary for the function you have requested. The legal basis for using your location on your phone is Art. 6(1)(f) GDPR; our legitimate interest is to show you pharmacies near you.

Map. The app loads the map – map images and their labels – from MapTiler (api.maptiler.com). MapTiler sees your IP address and, from the map sections requested, which area you are looking at – and so, if you have shared your location, also roughly where you are. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is to show you pharmacies near you on a map.

Directions and calls. If you ask for directions to a pharmacy, the app opens Google Maps, Apple Maps, another map app on your phone or the Google Maps website with the pharmacy’s coordinates; if you tap its phone number, your phone app. From then on, the terms of those providers apply.

7. Requests to a pharmacy

In the app you can choose checks and send a request to a pharmacy, with a preferred time if you wish. The app then sends to our portal for pharmacies: the pharmacy, the checks you chose with their name, price and the biomarkers you kept, the time of the request, the preferred time, the version and language of the app and a random number by which the portal recognises requests sent twice. It does not send your name, your phone number, your email address, your profile or your results. The checks you choose may, however, show what you are interested in health-wise. The app sends the request only when you send it yourself, and only so that the pharmacy can handle it.

The portal runs at AWS in Frankfurt am Main. If the pharmacy takes requests through the app and your request fits its settings, the portal stores it there for the pharmacy: with a booking number and booking code, the pharmacy, the checks with the pharmacy’s price and the biomarkers it measures for them (without those you deselected), the time of the request (by the portal’s clock and by your phone’s), the preferred time, the app’s version and language, the random number and the status. The pharmacy sees the request in its access to the portal and can confirm it, mark it as done or cancel it and add a note; the portal records who changed the status. For each new request, pharmacy staff may receive an email with the booking code, the preferred time, the checks with price and biomarkers and a calendar entry; these emails are sent by the service Amazon SES. Our staff with administrator rights in the portal can also see the request when acting for the pharmacy. If the pharmacy does not take requests through the app, or the request does not fit its settings, for example its opening hours or the checks it offers, the portal cancels it straight away and does not store it; the app shows you the cancellation.

How the pharmacy itself handles your request you can learn from it. We answer questions about how we process the request in the portal at info@dx365.world.

The app receives a booking number and a booking code and uses them to ask the portal how the pharmacy has handled your request, including a note from the pharmacy. If you delete the request in the app, only the copy on your phone is deleted; it remains in the portal. To have it deleted there, contact the pharmacy or us with the booking code. The app keeps only your last request: if you delete it in the app or send a new one, the app no longer shows the earlier booking code. So please note it down first if you want the request deleted from the portal. There is currently no automatic deletion of requests in the portal after a fixed period.

If a request is refused, throttled because of too many requests, fails or names a pharmacy the portal does not know, the portal logs this together with your IP address in order to detect and fend off abuse. The legal basis for this log is Art. 6(1)(f) GDPR; our legitimate interest is the secure operation of the portal.

8. Content the app loads

So that biomarkers, explanations, checks and offers are up to date, the app loads content every time it starts – even before the consent screen:

• from our portal for pharmacies (AWS, Frankfurt am Main): the list of checks, settings of the app and pharmacies’ content such as products and posts;
• from the service service.dx365.world (through Cloudflare): explanations of the measured values;
• through AWS’s content delivery network Amazon CloudFront: the directory of biomarkers.

In doing so the app sends no details about you; the servers see your IP address and technical details of the connection. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is an app with up-to-date content. The app fetches results only after your consent (section 5). The app brings its own fonts; it loads none from the internet.

9. Notifications

Once you have consented, the app asks whether it may show you notifications. It uses them only to tell you that a result it fetched automatically has arrived. The app creates the notification itself on your phone; there is no server that sends you messages. It reads “New result” – “A new result is ready. Open the app to view it.” and names neither the test nor a value nor the measurement number. On Android it is marked as private; whether it is visible on the lock screen depends on your phone’s settings. There you can also switch off the app’s notifications altogether. If you withdraw your consent or delete all data, the app removes its notifications.

10. Permissions at a glance

• Camera: scanning QR codes (section 5); the app asks when you open the scanner.
• Location, only while you are using the app: map and distance to pharmacies (section 6); the app asks when you open the map or the selection of a pharmacy.
• Notifications: telling you that a result has arrived (section 9); the app asks once you have consented.

The app does not access Bluetooth, the microphone, photos, contacts or files on your phone.

11. Sharing results and links

You can create a PDF of your latest results – with biomarker, date, value, unit and reference ranges, without name or profile – and pass it on or save it using your phone’s share function. You decide where the PDF goes; we do not receive it.

Links to Instagram, to a pharmacy’s website or its own booking page, to pharmacies’ online shops, to the App Store or to Google Play open only when you tap them, in another app or in the browser. From then on, the terms of those providers apply. The app opens this notice in the browser on www.igloo.health; the website privacy policy applies to that.

12. Recipients and service providers

For the app we use service providers who process data on our behalf (Art. 28 GDPR):

• Amazon Web Services EMEA SARL, Luxembourg: servers and storage in Frankfurt am Main for the result files, the readers’ records and our portal for pharmacies, and the email service Amazon SES.

In addition, data is received, as described in the sections named, by:

• the pharmacy you send a request to (section 7);
• the target address stored for a reader (section 5);
• Cloudflare: the network through which the app reaches the service service.dx365.world (sections 6 and 8);
• Amazon CloudFront, AWS’s content delivery network: the directory of biomarkers (section 8);
• MapTiler: the map (section 6);
• Microsoft (Microsoft 365), our email service: your emails when you write to us at info@dx365.world.

The result files, the readers’ records and our portal for pharmacies are hosted at AWS in Frankfurt am Main.

Cloudflare and Amazon CloudFront operate servers worldwide. Whether data reaches countries outside the European Union or the European Economic Area with them or with the other recipients named above, and on what basis, we will tell you at info@dx365.world.

13. How long data is kept

• On your phone: until you delete the data in the app – one by one or with “Delete all data” – or uninstall the app (section 14); also after a withdrawal, until you delete it. If you delete a single value that the app retrieved using a measurement number, the app keeps the measurement number and the biomarker identifier (at most the latest 500) so that the value does not come back – until you delete all data or scan the QR code again. Measurement numbers without a result yet, until the result arrives, you remove them or you withdraw your consent. Backups of your phone that contain the data (section 3), until you delete them.
• Sample identifier, sex and age in the reader’s record: until the next daily run after the measurement is 72 hours old (section 5).
• Result files, the rest of the readers’ records, requests in the portal and logs of our servers: there is currently no automatic deletion after a fixed period. At your request we delete your data (section 14).

14. Deleting data

On your phone. In the app you can delete individual results (for values the app retrieved using a measurement number, it keeps a marker, section 13), measurement numbers without a result yet (“Remove”), your request to a pharmacy (only the copy on the phone, section 7) and recommendations; you change your profile details under “Your profile”. You delete everything at once under “Your profile” › “Privacy” › “Delete all data” – after a withdrawal or an update of this notice also directly on the consent screen. The app then deletes your results, your profile, measurement numbers, requests, settings, the content downloaded as described in section 8 and your consent with its history, and restarts. Copies of PDFs you have shared (section 11) and map sections the map caches may remain on your phone until you uninstall the app. If you uninstall the app, your phone removes all its data. You delete backups that contain the data (section 3) where you manage them.

On our servers. The app does not delete result files or requests already sent. As the app has no account, we can only match data on our servers to you if you tell us the measurement number or the booking code. With the measurement number we find the result file and the reader’s record of your measurement (section 5). The measurement number is part of the link in the QR code and is shown on the reader’s screen; in the app you see it while it is listed under “Waiting for results”, and before deleting all data the app lists all stored measurement numbers. The app shows the booking code with your request, as long as you have not deleted it or replaced it with a new one (section 7). Please write to us at info@dx365.world and send only the measurement number or the booking code, no values and no photos of the QR code.

15. Your rights

You have the right

• to obtain access to your data processed by us (Art. 15 GDPR),
• to have inaccurate data rectified (Art. 16 GDPR),
• to request the erasure of your data (Art. 17 GDPR),
• to request the restriction of processing (Art. 18 GDPR),
• to receive your data in a commonly used, machine-readable format (Art. 20 GDPR),
• to object to processing (Art. 21 GDPR, see below),
• to withdraw your consents at any time with effect for the future (Art. 7(3) GDPR, section 4).

Simply write to us at info@dx365.world. For data on our servers, please tell us the measurement number or the booking code (section 14); without them we cannot match any data to you (Art. 11 GDPR). You see and change the data on your phone yourself in the app; you withdraw your consent there under “Your profile” › “Privacy”, and for deleting, see section 14.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit), Alt-Moabit 59–61, 10555 Berlin, www.datenschutz-berlin.de.

16. Children and young people

The app asks for your age for the reference ranges but does not check it. If you are under 16, please use the app only with the agreement of a parent.

17. No obligation, no automated decisions

You are not obliged to use the app or to provide us with data. Without the consent on the first screen, however, the app cannot be used. The app shows you how your values relate to the reference range, highlights suitable checks based on your profile (section 3) and, if you have switched this on, selects offers; all of this happens on your phone. The app makes no automated decision that produces legal effects concerning you or similarly significantly affects you (Art. 22 GDPR).

18. Changes

We adapt this notice when the app or the services we use change; you will always find the current version here. If we extend processing that is based on your consent, or change its purpose, the app asks you again; until you have consented, it fetches no results.