Privacy Policy

Last Updated: 13 August 2026

Introduction

This Privacy Policy (“Privacy Policy”) describes and governs the manner in which the Zura team (“we”, “us”, “our” or the “Company”) collects, uses, maintains and discloses information about you when you visit our website and use our mobile application Zura Health OS (“Zura”) and other online services (the “Services”).

The Zura team currently operates under the Lehrstuhl für Sport- und Gesundheitsdidaktik at Technische Universität München (TUM), Am Olympiacampus 11, 80809 München, Germany. The legal entity responsible for the Services is being formalised. This Privacy Policy will be updated with the final entity details before any material change to the Services. The contact email for all matters relating to the Services is info@zurahealthos.com.

The Services are currently being made available as part of a closed pilot programme, beginning on or around 20 May 2026, to a limited group of invited participants prior to public release. This Privacy Policy applies to the pilot and will continue to apply, with updates, to the public release of Zura.

Please read this Privacy Policy carefully before you start to use the Services. By accessing and/or using the Services, you accept and agree to be bound and abide by this Privacy Policy and our Terms of Use, incorporated herein by reference, and to comply with all applicable laws, rules and regulations (collectively, “Applicable Law”), including the General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and the EU Artificial Intelligence Act (Regulation (EU) 2024/1689, “EU AI Act”). If you do not want to agree to this Privacy Policy and the Terms of Use, you must not access or use the Services.

Personal Information We Collect

We collect information that identifies, relates to, describes, or could reasonably be linked to you (“Personal Information”, also “personal data” within the meaning of the GDPR) in a variety of ways when you interact with our Services. The Personal Information we collect depends on how you interact with us and may include the following categories.

Information You Provide to Us

This may include the following:

• Contact information and profile data: first and last name, email address, username, password (stored in hashed form), and any photographs or information you choose to include in your profile.
• User-generated information: information you provide directly through the Services, such as workout logs, dietary information, food images submitted for AI analysis, body images submitted for body composition tracking, and activity history.
• Health and biometric information: see “Third-Party Health Information” and “Special Category Data” below.
• Conversations with Zuri: messages you exchange with our AI conversational assistant, Zuri. See “Zuri and Zura AI Features” below for further details.
• Feedback data: responses to surveys, bug reports, interview contributions, and any other feedback you choose to share with us during the pilot.

Information Collected Automatically

When you access or use the Services, we may automatically collect certain information, including:

• device and usage information, such as your IP address, device type, operating system, app version, referring URLs, features accessed, and the date and time of your interactions;
• technical logs, including error reports and crash diagnostics generated by the application and our infrastructure, used for security and troubleshooting;
• Health Information delivered through background synchronisation and webhook events from our wearable integration partner Open Wearables once you have authorised the connection. This means that Health Information may be received and processed by our systems on an ongoing basis, even when you are not actively using the application.

During the pilot we do not use third-party analytics, advertising, or behavioural tracking technologies that profile your activity within the application. We use Firebase App Distribution (operated by Google) solely to distribute pre-release builds of the application to pilot participants; this service does not collect behavioural data about your use of the application. We rely on the technical logging built into our cloud infrastructure (Amazon Web Services) to operate the Services. We may add analytics or performance monitoring tools after the pilot, in which case this Privacy Policy will be updated accordingly.

Special Category Data (Biometric and Health Data)

Some of the Personal Information processed by Zura constitutes “special category data” under Article 9 of the GDPR, including:

• body images you submit for body composition tracking;
• health and biometric data received from your connected wearable device, including heart rate, heart rate variability, sleep metrics, blood oxygen saturation, and physical activity data;
• information you share with Zuri relating to your health, body, or wellbeing;
• health documents you choose to upload, such as blood work, laboratory results, or notes and letters from your doctor, together with any laboratory values and text we obtain from reading them;
• body composition estimates and other health-related outputs generated by our AI features.

We process this category of data only on the basis of your explicit consent under Article 9(2)(a) of the GDPR. Your consent is collected through a specific, informed, and clearly worded mechanism in the application before any such data is processed. You may withdraw your consent at any time through the application’s settings, in which case we will cease the related processing. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Health Documents You Upload

You may upload health documents — blood work, laboratory results, or notes and letters from your doctor — to the “My Records” area of the application. Uploaded documents are stored on our servers in the European Union. They remain available to you until you delete them, and they are never used for advertising or to train AI models.

Automated reading of these documents is optional and requires its own explicit consent, given through a separate control in the application. Only if you enable it is the document transmitted to Google Vertex AI (European Union region), our AI processing partner, to be read; we send the document as you uploaded it rather than a summary of it. From that reading we retain the laboratory values it contains, together with the reference ranges, dates and any markings printed on the report itself, and a searchable transcription of its text so that you can ask Zuri what a document says.

This feature is intended to help you keep your documents in one place and to read them back to you. It is not intended to diagnose, treat, monitor or predict any disease or condition, and Zuri is instructed to report what a document says rather than to interpret it and to direct you to your doctor for the meaning of any result. It is not a substitute for professional medical advice — see “Wellness Information Disclaimer” below. Whether Zuri additionally remembers a value and may refer to it later is governed by a separate Health memory consent; enabling document reading does not enable memory.

You may withdraw document-reading consent at any time in the application. Withdrawal erases everything produced by reading your documents, while your uploaded files themselves remain until you delete them. Deleting a document also deletes the values and text obtained from it. Retention periods are set out in “How Long We Keep Your Information” below.

Third-Party Health Information

With your permission, our Services connect to third-party applications and services (the “Third-Party Applications”) to import certain health and fitness information about you. We use a single integration provider for this purpose:

• Open Wearables, an open-source wearable integration platform that we self-host on our own cloud infrastructure (Amazon Web Services, EU region).

Depending on which device you connect, Open Wearables accesses health data either via your device’s native health platform (Apple HealthKit on iOS, operated by Apple Inc.; Google Health Connect on Android, operated by Google LLC), which in turn aggregates data from your connected wearable device(s) and from any other health or wellness applications you have authorised to feed data into those platforms, or directly via the wearable provider’s API (for example, Garmin Connect, Whoop, Oura, Polar, Suunto, Strava, Samsung Health, or Ultrahuman).

Through these integrations, our Services may import the following categories of information:

• heart rate and heart rate variability;
• sleep duration, stages, and quality metrics;
• movement and physical activity data, including step counts and active energy;
• blood oxygen saturation (SpO2);
• respiratory rate;
• derived biomarkers and health scores computed from the above.

The information accessed through these integrations is collectively referred to as “Health Information.” See “Where Your Information Is Stored” below for information regarding where your Health Information is stored, including international transfer considerations.

Connection of a wearable device or third-party health app is optional. Participants who do not connect any wearable or third-party app can still use the rest of the application.

Important: The Zura team is not a “covered entity” under U.S. health privacy law (HIPAA) and your Health Information is not protected health information under HIPAA. The Services are not a medical device under EU Medical Device Regulation (Regulation (EU) 2017/745). Your Health Information is governed by this Privacy Policy and is processed solely for wellness and personal fitness purposes.

How We Collect Your Personal Information

We collect Personal Information from the following sources:

• Directly from you: when you register for the Services, complete onboarding, submit information in an in-app form, contact our team, provide feedback, or otherwise communicate with us.
• From Third-Party Applications: when you grant us permission, we collect Health Information from your connected wearable device or fitness app through Open Wearables, as described in the “Third-Party Health Information” section above. The data may originate from your device’s native health platform (Apple HealthKit, Google Health Connect), from the wearable provider’s API directly, or from other wellness applications you have authorised to feed data into those platforms.
• Automatically: through standard server logs and the operational telemetry of our cloud infrastructure when you use the Services, and through background synchronisation and webhook events from our wearable integration partners that deliver Health Information to our systems on an ongoing basis once you have authorised the connection.

By providing us with this information or authorising access to a Third-Party Application, you consent to your information being collected, used, disclosed, processed, and stored by us in accordance with this Privacy Policy. Where the legal basis for our processing is your consent under Article 6(1)(a) or Article 9(2)(a) of the GDPR, you may withdraw consent at any time as described in “Your Rights” below.

Where Your Information Is Stored

Account data and user-generated content (non-image)

Contact information (name, email address, profile data), Zuri conversation history, workout and nutrition logs, dietary information, and other non-image user-generated data are stored using Amazon Web Services (“AWS”) in the EU region (eu-central-1, Frankfurt, Germany). This data is encrypted at rest and in transit and is held within the European Economic Area.

Body and food images

Body images and food images submitted to the application are stored in Google Cloud Storage as part of the Google Vertex AI service, in a private, access-controlled bucket hosted in the Google Cloud europe-west region (European Union). Images are encrypted at rest and in transit, and access is restricted via service-managed authentication keys within the Vertex AI environment.

AI processing of submitted content

Body images, food images, Zuri conversation inputs, and wearable-derived context are processed through Google Vertex AI in the European Union. Google Ireland Limited acts as our data processor under a written agreement. AI processing is performed solely to deliver the wellness features requested by you. Our agreement with Google prohibits the use of your data to train Google’s AI models.

Wearable Health Information via Open Wearables

Where you choose to connect a wearable device via Open Wearables, your Health Information is processed by our self-hosted Open Wearables instance, which runs on our own Amazon Web Services infrastructure in the EU region (eu-central-1, Frankfurt, Germany). Health Information processed via Open Wearables therefore remains within the European Economic Area on our infrastructure.

However, the connection between Open Wearables and the underlying wearable provider (for example, Garmin Connect, Whoop, Oura, Polar, Suunto, Strava, Samsung Health, or Ultrahuman) involves data being fetched from the wearable provider’s own servers, which may be located outside the European Economic Area. The location of each provider’s servers, and the safeguards that apply, are governed by that provider’s own terms and privacy policy. We recommend that you review the privacy policies of any wearable provider you connect.

International transfers in general

Apart from the wearable provider APIs described above, our primary data processors operate within the European Economic Area. Where data may be accessed from outside the EEA — for example, where our service providers’ parent companies are located in the United States or where technical support may be provided from non-EEA locations — such transfers are governed by Standard Contractual Clauses and supplementary measures as appropriate. You may request a copy of the safeguards in place for international transfers by contacting us at info@zurahealthos.com.

How We Use Collected Information

We process your Personal Information for the following purposes:

• To provide the Services: we use your account data, user-generated content, and Health Information to operate the application and deliver the features you have signed up for, including food recognition, body composition tracking, wearable integration, AI-generated workout and nutrition plans, and the Zuri assistant.
• To process data through AI features: we process user-submitted images, conversational inputs, and wearable-derived context through AI models to generate the outputs requested by you. See “Zuri and Zura AI Features” below for full details.
• To respond to your inquiries and provide support: we use your contact information and account data to respond to questions, bug reports, feedback, and support requests during the pilot.
• To send administrative communications: we use your account information to send service-related notifications, such as email verification, password resets, security notices, pilot updates, and changes to our Terms of Use or Privacy Policy.
• To evaluate and improve the Services: during the pilot, we analyse usage patterns, review AI outputs, and assess feedback to identify issues and refine features before public release. This analysis is conducted on aggregated and pseudonymised data wherever possible.
• To protect the Services: we process account, log, and security data to monitor for unauthorised access, abusive behaviour, fraud, and technical errors.
• To comply with legal obligations: we may process Personal Information where required to comply with applicable laws, court orders, or regulatory requirements.

Restrictions. We do not use Personal Information for advertising or marketing purposes. We do not use AI to make automated decisions that produce legal effects or similarly significantly affect you within the meaning of Article 22 of the GDPR. We do not use voice characteristics, facial features, or other biometric data to infer emotional states for the purpose of influencing your decisions.

AI model training

During the closed pilot programme, we do not use your Personal Information to train or fine-tune AI models. Our third-party AI service providers are contractually prohibited from using your data to train their models.

After the pilot, we may wish to use Personal Information (including pilot-collected data, where you separately consent at that time) to train, fine-tune, or evaluate AI models, in order to improve the accuracy and personalisation of features such as food recognition, body composition tracking, and the Zuri AI assistant. We will not do so without first:

• obtaining your separate, specific, freely-given consent through a clearly worded opt-in mechanism in the application, which you may decline without losing access to the Services;
• updating this Privacy Policy to describe the training purpose, the categories of data used, and the safeguards in place;
• honouring your right to withdraw training consent at any time, and your right to request that we remove your data from training datasets going forward.

You may indicate in advance that you do not wish your data to be used for any future AI training, by contacting us at info@zurahealthos.com. We will record this preference and apply it to any future training opt-in flow.

Our Legal Bases for Processing

We process Personal Information only when we have a lawful basis to do so under the GDPR. Depending on the context and purpose of processing, our lawful bases may include:

• Contractual necessity (Art. 6(1)(b)): processing necessary to provide the Services that you have signed up for, including account creation, authentication, and delivery of features.
• Consent (Art. 6(1)(a)): where we ask for your specific consent for a particular processing activity, such as connecting a wearable device or enabling certain optional features.
• Explicit consent for special category data (Art. 9(2)(a)): for the processing of biometric and health data, we rely on your separate, explicit consent collected through a clearly worded in-app mechanism.
• Legitimate interests (Art. 6(1)(f)): for purposes such as analysing usage to improve the Services, evaluating AI output quality, securing our systems, preventing fraud, and meeting our obligations under the EU AI Act regarding post-market monitoring of AI systems. We balance our legitimate interests against your rights and freedoms and offer you the right to object.
• Compliance with legal obligations (Art. 6(1)(c)): where processing is necessary to comply with a legal obligation to which we are subject.

Where processing is based on consent, you may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing prior to withdrawal.

To Whom We Share Your Personal Information

We share Personal Information with the following categories of recipients. The first group act as our data processors under written data processing agreements:

• Amazon Web Services EMEA SARL: cloud hosting and storage for all account data, non-image user-generated content, operational logs, and our self-hosted Open Wearables instance (EU region: Frankfurt, Germany).
• Google Ireland Limited (Google Vertex AI, including Google Cloud Storage): AI processing of submitted images and conversational inputs, and storage of body and food images (EU region: europe-west).
• Google LLC (Firebase App Distribution): distribution of pre-release application builds to pilot participants. This service does not process behavioural data about your use of the application.

In addition, when you authorise a wearable or third-party health app connection, Personal Information may be exchanged with the following independent third-party controllers, whose processing is governed by their own privacy policies:

• Apple Inc. (operator of Apple HealthKit on iOS);
• Google LLC (operator of Google Health Connect on Android);
• Wearable device providers you choose to connect, including but not limited to Garmin International Inc., WHOOP, Inc., Oura Health Oy, Polar Electro Oy, Suunto Oy, Strava, Inc., Samsung Electronics, and Ultrahuman Healthcare Pvt Ltd. We recommend that you review the privacy policy of any provider you connect.

In addition to the processors and third parties above, we may disclose Personal Information in the following limited circumstances:

• With your consent: where you direct us to share your information with a specific third party.
• As required by law: where disclosure is necessary to comply with a legal obligation, court order, or lawful request by a public authority, including for national security or law enforcement purposes.
• To protect rights and safety: where we have a good-faith belief that disclosure is necessary to protect our rights, your safety, or the safety of others, or to investigate fraud or security incidents.
• In corporate transactions: in the event of a financing, reorganisation, merger, acquisition, or sale of the Company or its assets, Personal Information may be transferred to the parties involved in the transaction, subject to applicable data protection law.

Zuri and Zura AI Features

Zura includes a number of features powered by artificial intelligence (“AI Features”), including:

• food recognition from photos, returning estimated nutritional information;
• body composition tracking from user-submitted body images;
• AI-generated personalised workout and nutrition recommendations;
• Zuri, our conversational AI assistant, which answers your questions and can update your workout or nutrition plans on your instruction.

To deliver these features, we transmit the minimum necessary information to Google Vertex AI, our AI processing partner hosted in the European Union. Our agreement with Google prohibits the use of your data to train Google’s AI models, and Google does not retain your inputs beyond the period necessary to deliver the response.

In accordance with Article 50 of the EU AI Act, we provide the following transparency information regarding our use of AI:

• Zuri is an AI system. You are interacting with an AI, not a human.
• AI-generated outputs, including food analysis, body composition estimates, and Zuri responses, may contain errors or inaccuracies and should not be relied upon as medical advice, diagnosis, or treatment.
• We do not use AI to make automated decisions that produce legal effects or similarly significantly affect you within the meaning of Article 22 of the GDPR.
• We do not use voice characteristics, facial features, or other biometric data to infer emotional states for the purpose of influencing your decisions.
• During the pilot programme, we do not use your Personal Information to train AI models. Our third-party AI service providers are contractually prohibited from using your data to train their models. See “AI model training” above for information about our intentions for post-pilot model training and your rights in connection with it.

You retain control over AI-driven changes in the application. Where Zuri makes changes to your workout or nutrition plans on your instruction, you can review and reverse those changes at any time.

Important: Zura’s AI Features generate responses based on your inputs and may produce outputs that are inaccurate, incomplete, or inconsistent. Zura does not provide medical advice and should never be relied upon as a substitute for professional medical care, diagnosis, or treatment. You should always consult a qualified physician or other licensed healthcare provider with any questions you may have regarding your health, medical conditions, or wellness decisions.

Retention of AI-related data

Conversations with Zuri are retained as part of your account so that you can review past exchanges and so that Zuri can provide continuity and context in future interactions. You may delete individual conversations or your entire conversation history at any time through the application.

AI-generated outputs (food analyses, body composition estimates, plans) are retained alongside your account data, on the same retention schedule. See “How Long We Keep Your Information” below.

Closed Pilot Programme

The Services are currently being made available as part of a closed pilot programme conducted prior to public release. By accepting an invitation to participate, you acknowledge the following:

• participation in the pilot is voluntary, and you may withdraw at any time without giving reasons and without negative consequence;
• the application is pre-release software and may contain errors, incomplete features, or unexpected behaviour;
• we may use information collected during the pilot, including feedback, usage data, and AI output reviews, to improve the application before public release. Wherever possible, this analysis is conducted on aggregated and pseudonymised data;
• we may contact you during the pilot to invite feedback through surveys, interviews, or other channels. Participation in such feedback activities is optional;
• at the end of the pilot, your account and personal data will be handled in accordance with the retention periods set out in this Privacy Policy. You will be notified of any material changes to data handling at the conclusion of the pilot.

Wellness Information Disclaimer

Zura is a wellness and personal fitness tracking application. The information and outputs provided by Zura, including AI-generated food analyses, body composition estimates, workout recommendations, nutrition suggestions, and responses from Zuri, are intended for general wellness and personal tracking purposes only.

Zura is not a medical device. The application does not diagnose, treat, cure, or prevent any disease or medical condition, and its outputs are not a substitute for professional medical advice, examination, diagnosis, or treatment. You should always consult a qualified healthcare professional regarding any questions you may have about your health, before starting any exercise or nutrition programme, and before relying on any information presented by Zura for health-related decisions.

We Do Not Sell Your Data and We Do Not Use It for Advertising

We do not sell your Personal Information. We do not share your Personal Information for monetary or other valuable consideration with any third party. We do not use your Personal Information for advertising or marketing purposes, including targeted advertising, retargeting, or behavioural profiling for commercial communications.

We work with trusted third-party data processors (such as cloud hosting and AI service providers) who process data solely on our behalf to operate and deliver the Services, under written data processing agreements that restrict them from using your data for their own purposes.

Third-Party Links and Services

Our Services may contain links to websites or services operated by third parties (collectively, the “Third-Party Services”), including the websites of our partners and providers. We do not control the content of these Third-Party Services and are not responsible for their privacy practices. Third-Party Services have their own privacy policies, and your interactions with them are subject to those policies. Any visit you make to those services is at your own risk.

Information Security

We use commercially reasonable security technologies and procedures to help protect your Personal Information from unauthorised access, use, alteration, or disclosure. These include:

• encryption of Personal Information in transit (TLS) and at rest;
• strict access controls and authentication for our personnel and systems;
• the use of managed cloud services (AWS, Google Cloud) hosted in the European Union, with built-in security and isolation;
• contractual security obligations on all our data processors.

While we use commercially reasonable security measures to protect your Personal Information, no internet-based system can be guaranteed to be completely secure. You also play an important role in keeping your account safe — please keep your login credentials confidential and notify us promptly of any suspected unauthorised access.

Security Incident Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify you in accordance with our obligations under Article 34 of the GDPR. We will also notify the competent supervisory authority within 72 hours of becoming aware of the breach where required by Article 33 of the GDPR. If you believe your account has been compromised, please contact us immediately at info@zurahealthos.com.

How Long We Keep Your Information

We retain your Personal Information only for as long as necessary for the purposes set out in this Privacy Policy, in accordance with the following criteria:

• Account data (name, email, username, password hash): for the duration of your participation in the pilot, and for a maximum of 90 days after pilot conclusion or account deletion, whichever is sooner.
• Body images and food images: retained for the duration of your account, unless you request earlier deletion. You may delete individual images at any time through the application. Upon account deletion, all your images are deleted within 30 days, including from routine backups.
• Wearable Health Information: retained for the duration of your participation in the pilot. Deleted within 30 days of pilot conclusion or account deletion.
• Zuri conversation history: retained for the duration of your account. You may delete individual conversations or your entire conversation history at any time through the application.
• Uploaded health documents: retained for the duration of your account, unless you delete them earlier. You may delete individual documents at any time through the application.
• Data obtained by reading your health documents (laboratory values, searchable text, and any values kept in Zuri’s memory): deleted 10 days after it is extracted, and immediately if you delete the source document or withdraw your document-reading consent. Your uploaded file is not affected, and a document can be read again from it at any time.
• AI-generated outputs (food analyses, body composition estimates, plans): retained alongside the related account data, on the same retention schedule.
• Server logs and security logs: retained for up to 90 days for security and troubleshooting purposes.
• Pilot feedback and survey responses: retained in pseudonymised form for up to 12 months after pilot conclusion to support product improvement.
• Aggregated and anonymised data: may be retained indefinitely for product improvement and analytics, as it cannot reasonably be used to identify you.

Where we are required to retain data for longer periods to comply with legal obligations, we will do so only for the minimum period required and will isolate the data from active processing.

Minor Users and Children

Our Services are intended for users aged 16 and over. We do not knowingly collect Personal Information from children under 16 years of age, in accordance with Article 8 of the GDPR and § 25 of the German Data Protection Act (BDSG).

Participation in the closed pilot programme is further restricted to users aged 18 and over, as set out in our Terms of Use and the Participant Information Sheet.

If we learn that Personal Information of a child under 16 has been collected without verifiable parental consent, we will deactivate the account and delete the data without undue delay. If you become aware of any such data, please contact us at info@zurahealthos.com.

Your Rights

Under the GDPR, you have the following rights in relation to your Personal Information:

• Right of access (Art. 15): to request a copy of the Personal Information we hold about you.
• Right to rectification (Art. 16): to request correction of inaccurate or incomplete Personal Information.
• Right to erasure (Art. 17): to request deletion of your Personal Information, subject to legal exceptions.
• Right to restriction of processing (Art. 18): to request that we limit how we process your data in certain circumstances.
• Right to data portability (Art. 20): to receive your Personal Information in a structured, commonly used, machine-readable format and, where feasible, to have it transmitted to another controller.
• Right to object (Art. 21): to object to processing based on our legitimate interests, including profiling.
• Right to withdraw consent (Art. 7(3)): where processing is based on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
• Right not to be subject to automated decision-making (Art. 22): to not be subject to a decision based solely on automated processing that produces legal effects or similarly significantly affects you. We do not engage in such automated decision-making.
• Right to lodge a complaint (Art. 77): with a data protection supervisory authority. The competent authority for processing connected with the TUM Lehrstuhl is the Bayerischer Landesbeauftragter für den Datenschutz (https://www.datenschutz-bayern.de). You may also complain to the supervisory authority of your country of residence.

AI-specific clarifications

In addition to the rights above, the following clarifications apply specifically to the AI Features of Zura:

• you may at any time decline or stop using individual AI Features (food scan, body analysis, Zuri assistant, wearable integration) without affecting your access to other features of the application;
• you may request that we cease processing your special category data (body images, wearable Health Information) by withdrawing your explicit consent. This will disable the corresponding AI Features for your account but will not affect data processed before your withdrawal;
• you may request information about how a specific AI-generated output was produced, to the extent we are able to reconstruct it, by contacting us at info@zurahealthos.com;
• you may request the deletion of conversations with Zuri, AI-generated outputs associated with your account, and any data shared with our third-party AI processors on your behalf;
• you may register a preference that your data not be used for any future AI model training, as described in the “AI model training” section above.

How to exercise your rights

To exercise any of the rights above, please contact us at info@zurahealthos.com. We will respond to verified requests within one month of receipt, in accordance with Article 12 of the GDPR. If your request is particularly complex or you have made multiple requests, we may extend this period by a further two months and will notify you of the extension and the reasons for the delay.

To verify your identity prior to responding to a request, we may ask you to confirm information that we have on file about you or your interactions with us. Where we ask for additional Personal Information to verify your identity, we will only use it for that purpose. You may also authorise a representative to submit a request on your behalf, provided they can demonstrate authorisation.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. The updated version will be indicated by an updated “Last Updated” date at the top of this Privacy Policy. If we make material changes, we will notify you either by prominently posting a notice in the application or by sending you a notification by email. We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your information.

Contact Us

If you have questions, comments, or complaints about this Privacy Policy or our handling of your Personal Information, please contact us:

Email: info@zurahealthos.com

Postal address: Zura Health OS, c/o Technische Universität München, Lehrstuhl für Sport- und Gesundheitsdidaktik, Am Olympiacampus 11, 80809 München, Deutschland

If you are not satisfied with our response, you may lodge a complaint with the Bayerischer Landesbeauftragter für den Datenschutz (https://www.datenschutz-bayern.de) or with the supervisory authority of your country of residence.