Privacy Policy

1. Controller

The controller responsible for processing your data on this website is:

Dx365 GmbH
Hedwig-Porschütz-Str. 14
10557 Berlin, Germany
represented by its managing director (Geschäftsführer) Aleksandr Taran
Email: info@dx365.world

You will find further details in the Impressum. For questions about data protection, or if you wish to exercise your rights, please write to info@dx365.world or by post to the address above.

2. What this policy covers

This privacy policy applies to the website www.igloo.health. It does not apply to the Igloo Health app or to measurements at the pharmacy. The app is covered by the privacy notice for the Igloo Health app.

3. No cookies, no tracking

We set no cookies and use neither local storage nor session storage; as with any website, your browser keeps page content in its cache. Exceptions that come from Cloudflare are described in section 4. We use no analytics, tracking or advertising services, no social media plugins and no embedded videos. We serve fonts, images and map images from our own website; your browser does not connect to Google, the OpenStreetMap Foundation or other providers for them. The website accesses your location only if you expressly ask it to (section 7).

4. Delivering the website: hosting with Cloudflare

When you visit this website, your browser transmits technically necessary data. This includes:

• your IP address,
• the date and time of the request,
• the address (URL) requested – if you search in a “Postcode or city” field, your search term is part of it (for example “?q=10557”); if you search in the field above the pharmacy list, only the name of the file your browser loads for it (for example “/data/plz/10.json”, section 6); for the map images it shows which part of the map you are looking at,
• the page you came from (referrer), if your browser sends it,
• browser, operating system and language setting,
• the amount of data transferred and whether the request succeeded.

We process this data to deliver the website to you, to run it in a stable and secure way and to fend off attacks. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is a secure, fast and reliable website. The data is kept in logs (log files) only as long as necessary for these purposes and is then deleted.

Hosting. The website is hosted on Cloudflare Pages, a service of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Cloudflare delivers the pages and files through its network of data centres, usually from a data centre near you (content delivery network), and protects the website against overload and attacks. Some parts of the website are small programs that Cloudflare runs for us on its servers (Cloudflare Pages Functions): they fetch the map images (section 5) and the current pharmacy list (section 8) and pass messages from the contact form on to our customer system (section 11). For all of this, Cloudflare processes the data listed above and keeps it in logs.

Cloudflare also instructs your browser to remember for up to 7 days that it should report connection errors on requests to this website to Cloudflare (Network Error Logging); such a report contains your IP address, the address requested and details of your browser. If Cloudflare shows a security check in an individual case, a technically necessary cookie may be set. Cloudflare processes the data on our behalf (Art. 28 GDPR). Transfers to the USA are based on the adequacy decision on the EU-U.S. Data Privacy Framework (Art. 45 GDPR), under which Cloudflare, Inc. is certified, and in addition on the EU standard contractual clauses (Art. 46(2)(c) GDPR). More: www.cloudflare.com/privacypolicy.

5. Map (OpenStreetMap)

On the home page we show the pharmacies on a map. The map images (tiles) come from the OpenStreetMap Foundation (OSMF), St John’s Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom. Your browser does not load them from there, however, but from our website, as soon as you open the home page. A Cloudflare Pages Function (section 4) fetches the tiles from the OSMF and keeps them in Cloudflare’s cache for a while. In doing so it passes on neither your IP address nor any other details about you; the OSMF only sees requests from Cloudflare that name our website as their sender.

The address of each tile shows which part of the map you are looking at. Cloudflare processes these addresses like any other request (section 4). We show the map so that you can quickly see where the nearest pharmacy is. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is a clear presentation of the locations.

6. Search by postcode or place

If you enter a postcode or a place in a search field, your browser itself finds the matching point on the map in order to show you the nearest pharmacies – in the field above the pharmacy list already while you type. For this it loads a small file from our website, for a postcode the file for its first two digits, for a place name the one for its first two letters, and searches it. The postcodes and place names in these files come from GeoNames (www.geonames.org, licence CC BY 4.0) and are stored on our website; the search makes no connection to GeoNames or to any other place-search service. Your browser does not send your search term along; Cloudflare only sees which file is loaded (section 4). Terms that match a pharmacy or a city in our list are filtered by your browser without such a file.

If the search comes from a “Postcode or city” field, the search term is part of the address of the page requested (section 4). The legal basis for delivering the files is Art. 6(1)(f) GDPR; our legitimate interest is to show you pharmacies near you.

7. “Near me”

If you click “Near me” above the pharmacy list, your browser asks whether the website may use your location. Only if you agree does your browser determine your location. The website uses it only in your browser, to move the map there; the exact coordinates do not leave your device and are not stored. Your browser loads the map images for the new area from our website (section 5); their addresses show your approximate location (to within a few kilometres).

The legal basis for accessing your device’s location is § 25(2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act), as it is strictly necessary for the function you have expressly requested, or your permission in your browser’s prompt (§ 25(1) TDDDG). You can withdraw the permission at any time in your browser’s settings.

8. Pharmacy details

The name, address, opening hours and location of the pharmacies come from our own system (service.dx365.world). They are already part of the page your browser loads; after that, your browser asks our website once for the current state. A Cloudflare Pages Function (section 4) fetches the list from our system and keeps it in Cloudflare’s cache for up to five minutes. Your browser receives these details from our website, not from third parties. No data about you is transmitted to our system in the process.

9. App Store and Google Play

We link to the Igloo Health app in Apple’s App Store and on Google Play, on larger screens also with QR codes. We serve the icons and QR codes ourselves; as long as you do not follow a link or scan a QR code, Apple and Google receive no data from this website. Only when you open a link or scan a QR code with your phone do you visit the store’s page; Apple’s or Google’s privacy policy then applies.

The address www.igloo.health/get (for example from a QR code on printed material) leads straight to the app: your browser checks from its own identifier whether you use an iPhone or iPad or an Android device and opens the matching store, on other devices this website. This check happens only in your browser; nothing beyond the ordinary page request (section 4) is transmitted.

10. Links to other websites

Links to other websites, such as igloo.today for pharmacies, geonames.org or openstreetmap.org, open them only when you click. The respective provider is responsible for the processing of data there.

11. Contact form

On our contact page you can write to us through a form. We process the details you enter – your name, your email address, the topic you choose and your message – as well as the language of the page you write from and the country your request comes from. Cloudflare derives the country (for example “DE”) from your IP address; we do not store your IP address itself with the request. We need your name, email address and message in order to reply; the form cannot be sent without them.

Your browser sends the form to our website in encrypted form. A Cloudflare Pages Function (section 4) passes the details straight on to our customer management system and does not store them itself. There we create a request from them, which our team deals with. The system is Odoo, a service of Odoo S.A., Chaussée de Namur 40, 1367 Grand-Rosière, Belgium; Odoo processes the data on our behalf (Art. 28 GDPR).

We process this data in order to answer your request; the country helps us to classify the request. The legal basis is Art. 6(1)(b) GDPR if your request concerns or prepares a contract (for example if your pharmacy would like to measure with Igloo), otherwise Art. 6(1)(f) GDPR; our legitimate interest is to answer your request. We delete the data once your request has been dealt with, unless statutory retention obligations prevent this.

Please do not send us health data, such as test results, through the form; we do not need it for your request. If you share such details with us of your own accord, we process them only to deal with your request.

12. Contact by email or phone

If you email or call us, we process your email address or phone number, your name and the content of your message or call in order to deal with your request. The legal basis is Art. 6(1)(b) GDPR if your request concerns or prepares a contract, otherwise Art. 6(1)(f) GDPR; our legitimate interest is to answer your request. We delete the data once your request has been dealt with, unless statutory retention obligations prevent this.

Please do not send us health data, such as test results, by unencrypted email. If you share such details with us of your own accord, we process them only to deal with your request.

13. Your rights

You have the right

• to obtain access to your data processed by us (Art. 15 GDPR),
• to have inaccurate data rectified (Art. 16 GDPR),
• to request the erasure of your data (Art. 17 GDPR),
• to request the restriction of processing (Art. 18 GDPR),
• to receive your data in a commonly used, machine-readable format (Art. 20 GDPR),
• to object to processing (Art. 21 GDPR, see below).

Simply write to us at info@dx365.world.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit), Alt-Moabit 59–61, 10555 Berlin, Germany, www.datenschutz-berlin.de.

14. No obligation, no automated decisions

You are not obliged to provide us with any data. Without the technically necessary data in section 4, however, we cannot deliver the website to you, and without your name, email address and message we cannot answer a request sent through the contact form (section 11). There is no automated decision-making, including profiling (Art. 22 GDPR).

15. Changes

We update this privacy policy when the website or the services we use change. The version published here applies.