Privacy policy
This privacy policy explains how personal data is processed on www.heyfoot.de, including ordering, paying for and delivering the training package. A separate privacy policy within the HeyFoot app also applies to use of the app. Before enrolment in the clinical study, you receive separate study information and a separate declaration of consent.
1. Controller
Valipes Medical Solutions GmbH Schlierseestr. 10b, 83101 Rohrdorf, Germany Email: info@heyfoot.de
2. Data protection officer
The appointed external data protection officer is: heyData GmbH, Schützenstraße 5, 10117 Berlin, www.heydata.eu, email: datenschutz@heydata.eu.
3. Hosting and server log data
This website is hosted by IONOS SE (Elgendorfer Str. 57, 56410 Montabaur) in Germany. When you visit the website, the host automatically processes technically necessary data (e.g. IP address, date and time of access, page accessed, browser type) to deliver the website and ensure secure operation. The legal basis is our legitimate interest in secure and stable operation (Art. 6(1)(f) GDPR). According to IONOS, this access data is stored only with an anonymised IP address and deleted after eight weeks. A data processing agreement pursuant to Art. 28 GDPR is in place with IONOS.
4. Pre-registration for the clinical study
If you pre-register for the clinical study via the pre-registration form, we process the data you provide: name, email address and phone number, as well as the time and version of your consent and your selected language. The purpose of this processing is to contact you when the study starts, send you detailed information about the study and prepare your possible participation.
Your pre-registration may indicate that you are affected by hallux valgus. This means health data within the meaning of Art. 9 GDPR may be concerned. The legal basis for the processing is your explicit consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR), which you give via the checkbox in the form. You may withdraw your consent at any time with effect for the future, e.g. by emailing info@heyfoot.de; we will then delete your pre-registration. Unless withdrawn, we store the data until study recruitment is completed and delete it afterwards, unless statutory retention obligations apply.
5. Contact form
If you use our contact form, we process your name, email address and message in order to handle and answer your request. Our team is notified of your request by email. The legal basis is your consent (Art. 6(1)(a) GDPR); where your request is aimed at a contract, additionally Art. 6(1)(b) GDPR. We delete contact requests once they have been fully processed, unless statutory retention obligations apply.
6. Promotional materials orders
When a healthcare professional requests promotional materials through our order form, we process practice and contact details, the delivery address and any optional notes to handle and ship the order. The legal basis is consent given through the form checkbox (Art. 6(1)(a) GDPR). We delete the information after processing and shipping unless statutory retention obligations apply.
7. Storage, email dispatch and spam protection
Data submitted through the contact, promotional materials and study forms is transmitted to our server using encryption and stored in a database with our hosting provider IONOS in Germany. Related emails are sent through our hosting provider’s mail servers. To document consent, we record its time and the version of the consent text (Art. 7(1) GDPR). The following sections cover orders, payments and purchase-related emails.
To protect against automated spam submissions, the contact and study forms contain a control field hidden from human visitors. This protection does not use an external CAPTCHA service. Its legal basis is our legitimate interest in preventing abuse (Art. 6(1)(f) GDPR). Security services used by the Stripe payment form are described in the cookies section.
8. Orders, delivery and subscriptions
When you order a training package, we process your name, email address, delivery and billing addresses, and information about your order, amount, payment and subscription. This includes order and payment references and, where required to provide access, the allocation of your access code and its activation status. We use this information to fulfil the contract, provide access, arrange delivery, handle enquiries and manage payments, cancellations and refunds (Art. 6(1)(b) GDPR). Statutory documentation and retention obligations are fulfilled on the basis of Art. 6(1)(c) GDPR.
Before loading the payment form, we document your five confirmations concerning the medical safety check, terms and privacy with the payment session ID, text version and time in our AWS backend. For self-payer registration, we document your repeated confirmations about contraindications and medical clearance separately. These details are not stored in Stripe metadata. The confirmations regarding your diagnosis, contraindications and medical clearance are health data. We process them on the basis of your explicit consent (Art. 9(2)(a) and Art. 6(1)(a) GDPR) to check before purchase whether HeyFoot is suitable for you and to document the safe use of the medical device. Without this consent, we cannot offer you the training package. You can withdraw your consent at any time with effect for the future, for example by email to info@heyfoot.de; this does not affect the lawfulness of processing carried out before the withdrawal. We keep the record of your confirmations only as long as we need it to establish, exercise or defend legal claims (Art. 9(2)(f) GDPR).
The shipping and, where applicable, logistics providers commissioned with delivery receive the recipient and delivery details they need. Payment providers and banks involved in your chosen payment method receive the information necessary to process payment. Not every recipient needs all order data.
Order and contract data are needed for as long as necessary to fulfil the contract and resolve outstanding claims. Records subject to retention requirements are governed in particular by section 257 HGB and section 147 AO: accounting records generally for eight years and commercial and business correspondence for six years, generally starting at the end of the relevant calendar year. Extended statutory periods or ongoing proceedings may require longer retention. Other data must be deleted once their purpose has ended and no retention grounds remain.
9. Withdrawal and reversal of a contract
When you withdraw, we process your name, email address, information identifying the contract or part of it, and your statement. We record its receipt time, a reference and the acknowledgement email status. We use this information to handle and document your withdrawal, provide the legally required acknowledgement and, where applicable, arrange returns and refunds. The legal bases are Article 6(1)(b) and (c) GDPR; establishing and defending legal claims is based on Article 6(1)(f) GDPR.
Your statement is stored on our website server. Authorised staff and our hosting and email providers receive the data needed for their tasks. For refunds or returns, necessary information is shared with the recipients described in the payment and delivery sections. We retain the information only as long as needed for processing, statutory retention requirements, or establishing and defending legal claims, and then delete it. We do not need a reason or health data for a withdrawal.
10. Subscription cancellation
We process your name, email, subscription details, cancellation type, requested termination date and any reason you provide. We record your statement, browser-reported submission time, server receipt time, a reference and email status to process and confirm your cancellation. The legal bases are Article 6(1)(b) and (c) GDPR, and Article 6(1)(f) GDPR for establishing and defending legal claims.
Manually submitted statements are processed on the website server. When automatic cancellation is enabled, we use AWS in the EU for code verification, storage and confirmation, and Stripe to stop automatic renewal. The code is valid for ten minutes; we store only a cryptographically protected verification value. Code and abuse-prevention records have limited retention. A reachable contact email is optional for manual submissions. Authorised staff, hosting and email providers and retention of the statement follow the same criteria described in the withdrawal section. Please do not submit medical documents.
11. Order processing and email delivery through AWS
We use Amazon Web Services (AWS) for technical order processing and purchase-related emails, particularly access codes. Frankfurt am Main, Germany, is the intended location for the order infrastructure. The provider for customers in the European Economic Area is generally Amazon Web Services EMEA SARL, Luxembourg. Processing covers the order and contact details needed for each operation and technical log data; email delivery in particular involves the recipient address, message content and delivery information.
Processing serves contract fulfilment (Art. 6(1)(b) GDPR), secure operation and troubleshooting (Art. 6(1)(f) GDPR). AWS acts as a processor for this processing. Choosing a German server location does not mean that every processing activity associated with the service takes place exclusively in Germany. Please see the section on international transfers, the AWS Privacy Notice and the information on processing customer data.
12. Payment processing through Stripe
Our payment form is provided by Stripe. Depending on their role, Stripe Payments Europe, Limited, Stripe Technology Europe, Limited and Stripe Technology Company, Limited in Ireland are involved in processing in the European Economic Area. Stripe processes data partly on our behalf and partly as a controller in its own right, particularly for fraud prevention and compliance with its own legal obligations.
Your browser connects to Stripe when the payment form loads. Your IP address, browser and device information and technical usage data may be processed at this stage. When paying, your email, delivery and billing addresses, payment and transaction data are transmitted to Stripe. Full card details and card security codes are entered into fields provided by Stripe; they are not sent to our website form endpoints. We receive the payment information needed to identify and process the transaction, such as payment status, amount and references.
Our transmission for payment processing is based on Art. 6(1)(b) GDPR; securing payments and preventing abuse is based on Art. 6(1)(f) GDPR. Art. 6(1)(c) GDPR applies to legally required retention. Stripe’s independent purposes, legal bases, recipients and retention practices are explained in the Stripe Privacy Policy and Stripe Privacy Center. Data Stripe processes as a controller is subject to its own retention practices described there.
13. International data transfers
Using Stripe, AWS and Google Firebase may involve affiliated companies and service providers outside the EU or European Economic Area, particularly in the United States. We therefore do not promise exclusively European processing. According to the providers, international transfers are based, depending on the recipient and processing, on adequacy decisions under Art. 45 GDPR, including the EU-US Data Privacy Framework for appropriately certified recipients, or appropriate safeguards under Art. 46 GDPR such as EU Standard Contractual Clauses.
Information on the safeguards is available in the Stripe data transfer terms and AWS customer data privacy information. You may also contact us or our data protection officer for more information or a copy of the relevant safeguards.
15. Encryption
This website uses TLS encryption (recognisable by “https://” in the address bar). Data you submit via the forms cannot be read by third parties in transit.
16. Your rights
You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You may withdraw any consent you have given at any time with effect for the future (Art. 7(3) GDPR). You may object to processing based on legitimate interests on grounds relating to your particular situation (Art. 21 GDPR). To do so, simply contact info@heyfoot.de or our data protection officer. You also have the right to lodge a complaint with a data protection supervisory authority; the authority responsible for us is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach.
17. Providing data and automated checks
You decide whether to use our forms or order a training package. Without the details required for each process, we cannot handle your enquiry, registration, payment or delivery.
Stripe, participating payment providers and banks may carry out automated security and risk checks during payment. These may require additional authentication or prevent a payment. Each provider’s privacy information explains its checks. If a payment is not possible or you have questions about a decision, you can contact us; we will review your enquiry and help clarify it with the relevant provider.
18. QR link statistics
When a HeyFoot QR link is opened, our Firebase backend processes its code identifier and redirects to the website. If the code is assigned to a medical practice, that practice’s daily counter is incremented. This statistic measures QR link requests, not individual people, fully loaded pages or bookings. Repeated requests and shared links may be counted again.
We store the assignment of codes to practices and aggregated QR link requests per UTC calendar day. These counters contain no visitor IP addresses, browser profiles or health information. Statistics require authorised access. The website sends no additional QR counting request and uses no cookies or persistent browser storage for this purpose. Technical hosting and backend logs are separate from these counters.
The Firebase backend is operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, as our processor. When a QR link is opened, Google processes technically necessary connection data such as the IP address in order to perform the redirect. The legal basis is our legitimate interest in a working redirect and in evaluating through which practices HeyFoot is found (Art. 6(1)(f) GDPR). Data may also be transferred to Google LLC in the USA; see the section on international data transfers.
19. Version and changes
Last updated: 25 October 2026. We update this policy when the processing of personal data on our website changes.