Privacy Policy
This policy explains what personal data UAB Aivon collects when you use aivonhealth, why, on what legal basis, how long we keep it and what rights you have under the General Data Protection Regulation (GDPR) and Lithuanian data-protection law.
1. Controller
The controller of your personal data is UAB Aivon, company code 307619983, Pelesos g. 17-14, LT-02114 Vilnius, Lithuania. Contact for privacy matters: [email protected].
2. What we collect and why
| When | Data | Purpose | Legal basis (GDPR) | Retention |
|---|---|---|---|---|
| You place an order | Name, email, delivery address, phone (optional), order contents, prices, payment method type, order number | To conclude and perform the contract, deliver the goods, handle returns and guarantee claims, and send order emails | Art. 6(1)(b) contract; Art. 6(1)(c) legal obligation (accounting) | 10 years from the end of the financial year of the order, as required by Lithuanian accounting law |
| You pay | Payment is processed by our payment provider; we receive only a confirmation and the last digits of a card. We never see or store full card numbers. | Payment processing, fraud prevention | Art. 6(1)(b) contract; provider's own legal obligations | Per the provider's policy |
| You subscribe to a product | Order data above plus subscription status, renewal dates and payment token reference | To dispatch and charge recurring deliveries, send renewal reminders and let you skip, pause or cancel | Art. 6(1)(b) contract | Duration of the subscription, then as for orders |
| You use the routine builder | Age, chosen duration, goals and budget | To calculate a proposed routine. Not stored unless you add it to the cart and order. | Art. 6(1)(b) steps prior to a contract | Session only |
| You sign up for the newsletter | Email address, sign-up date and source | To send the welcome code and occasional marketing emails | Art. 6(1)(a) consent; you can withdraw at any time via the unsubscribe link or by emailing us | Until you unsubscribe, then up to 30 days to process |
| You contact us | Name, email, subject, message | To answer your question and keep a record of the correspondence | Art. 6(1)(f) legitimate interest in customer support; Art. 6(1)(b) where related to an order | 12 months after the last message, or as for orders if related to one |
| You browse the Website | Server logs (IP address, time, requested page, browser type), a session cookie, your cookie-consent choice | Security, keeping your cart, respecting your cookie choices | Art. 6(1)(f) legitimate interest in running a secure website; Art. 6(1)(a) for any non-essential cookies | Logs 30 days; cookies as described in the Cookie Policy |
We do not collect health data. The age you enter in the routine builder and the goals you select are used only to calculate the proposal on screen and to add products to your cart; they are not used for profiling.
3. Who receives your data
We share personal data only with service providers who process it on our behalf under data-processing agreements, and only as needed:
- Payment service providers (card acquirer, PayPal) to take payment;
- Delivery carriers to ship your parcel (name, address, phone, email for tracking notices);
- Hosting and IT providers located in the EU that run the Website and store its database;
- Email delivery provider for order, subscription and newsletter emails;
- Accountants and auditors, and public authorities where the law requires it.
We do not sell personal data. Where a provider processes data outside the European Economic Area, we rely on an EU adequacy decision or the European Commission's Standard Contractual Clauses.
4. Marketing
We send marketing emails only if you have subscribed to the newsletter or, as permitted by law, if you are an existing customer and have not objected when we collected your email (in which case you may object at any time). Every marketing email includes an unsubscribe link. We do not use your data for automated decision-making with legal or similarly significant effects.
5. Your rights
You have the right to:
- access the personal data we hold about you and receive a copy;
- rectify inaccurate or incomplete data;
- erase your data, where there is no overriding legal reason to keep it (for example accounting records);
- restrict processing in certain cases;
- data portability for data you provided under a contract or consent;
- object to processing based on legitimate interest, and to direct marketing at any time;
- withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.
To exercise a right, email [email protected]. We reply within one month (extendable by two months for complex requests, in which case we will tell you). You also have the right to lodge a complaint with a supervisory authority. In Lithuania this is the State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija, L. Sapiegos g. 17, LT-10312 Vilnius, vdai.lrv.lt). If you live elsewhere in the EU you may complain to the authority in your own country.
6. Security
The Website is served over HTTPS. Order data is stored in a database accessible only to authorised staff, with access protected by passwords and server-level controls. Payment details are handled entirely by the payment provider. No method of transmission or storage is completely secure, but we take reasonable measures appropriate to the risk and will notify you and the supervisory authority of a personal-data breach where the law requires it.
7. Children
Our products and the Website are intended for adults aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us data, contact us and we will delete it.
8. Cookies
How we use cookies and similar technologies, and how to change your choices, is described in the Cookie Policy.
9. Changes
We may update this policy, for example when we add a new service provider. The date of the latest version is shown at the top. For significant changes we will inform customers with an active subscription by email.