At tayp, we believe that privacy should not be treated as an optional feature. Instead, it should be considered a core design principle from the very beginning. We believe that users should be able to access important health and prevention-related tools without being required to disclose more personal information than is necessary. Wherever possible, we seek to reduce the amount of information that is collected, processed, and stored.
Our vision is built around the principle of data minimization. This means that we continuously ask a simple question before implementing any feature: Is this information truly necessary for the functionality we want to provide? If the answer is no, we prefer not to collect it at all. The best way to protect personal information is often not to store it in the first place.
For this reason, tayp has been designed without traditional user registration. We do not require users to create an account with an email address, provide a phone number, or build a public profile in order to use the core functionality of the app. By removing these requirements, we aim to reduce the amount of personally identifiable information associated with app usage and to provide users with a greater degree of autonomy and control.
We recognize that the topics addressed through tayp can be highly personal. Individuals should be able to access prevention resources, testing information, and communication tools without feeling that they must first surrender sensitive personal information. Privacy helps create trust, and trust is essential for effective public health and prevention efforts. People are more likely to use tools that protect their confidentiality and respect their personal boundaries.
Privacy is not only about protecting data from unauthorized access. It is also about limiting unnecessary data collection, reducing digital footprints, and ensuring that users understand how information is processed. Transparency is therefore an important part of our approach. We believe users should be able to understand what information is processed, why it is processed, and what rights they have regarding that information.
At the same time, privacy must be balanced with functionality and security. Certain technical information is necessary to operate a mobile application, protect it against abuse, maintain stability, and provide its services. Whenever such processing is required, we aim to limit it to what is necessary for the specific purpose and to implement appropriate safeguards to protect user information.
In the following, we provide information about the collection of personal data when using our mobile app (hereinafter only "App").
Personal data is any data that can be related to a specific natural person, such as their name or IP address.
The controller within the meaning of Art. 4 (7) EU General Data Protection Regulation (GDPR) is tayp Germany UG (haftungsbeschränkt), Kolonnenstraße 8, Berlin, Germany, email: support@tayp-app.com. We are legally represented by Adrian Reyes von Schönfeld, Paula-Charlotte Möllendorf.
Our data protection officer can be reached via heyData GmbH, Schützenstraße 5, 10117 Berlin, www.heydata.eu, email: datenschutz@heydata.eu.
We detail the scope of data processing, processing purposes and legal bases below. In principle, the following come into consideration as the legal basis for data processing:
Insofar as we transfer data to service providers or other third parties outside the EEA, the security of the data during the transfer is guaranteed by adequacy decisions of the EU Commission, insofar as they exist (e.g. for Great Britain, Canada and Israel) (Art. 45 para. 3 GDPR).
In the case of data transfer to service providers in the USA, the legal basis for the data transfer is an adequacy decision of the EU Commission if the service provider has also certified itself under the EU-US Data Privacy Framework.
In other cases (e.g. if no adequacy decision exists), the legal basis for the data transfer is usually, i.e. unless we indicate otherwise, standard contractual clauses. These are a set of rules adopted by the EU Commission and are part of the contract with the respective third party. According to Art. 46 para. 2 lit. b GDPR, they ensure the security of the data transfer. Many of the providers have given contractual guarantees that go beyond the standard contractual clauses to protect the data. These include, for example, guarantees regarding the encryption of data or regarding an obligation on the part of the third party to notify data subjects if law enforcement agencies wish to access the respective data.
Unless expressly stated in this privacy policy, the data stored by us will be deleted as soon as they are no longer required for their intended purpose and no legal obligations to retain data conflict with the deletion. If the data are not deleted because they are required for other and legally permissible purposes, their processing is restricted, i.e. the data are blocked and not processed for other purposes. This applies, for example, to data that must be retained for commercial or tax law reasons.
Data subjects have the following rights against us with regard to their personal data:
Data subjects also have the right to complain to a data protection supervisory authority about the processing of their personal data. Contact details of the data protection supervisory authorities are available at bfdi.bund.de.
Within the scope of the business or other relationship, customers, prospective customers or third parties need to provide us with personal data that is necessary for the establishment, execution and termination of a business or other relationship or that we are legally obliged to collect. Without this data, we will generally have to refuse to conclude the contract or to provide a service or will no longer be able to perform an existing contract or other relationship.
Mandatory data are marked as such.
As a matter of principle, we do not use a fully automated decision-making process in accordance with Article 22 GDPR to establish and implement the business or other relationship. Should we use these procedures in individual cases, we will inform of this separately if this is required by law.
When contacting us, e.g. by email or telephone, the data provided to us (e.g. names and email addresses) will be stored by us in order to answer questions. The legal basis for the processing is our legitimate interest (Art. 6 para. 1 s. 1 lit. f GDPR) to answer inquiries directed to us. We delete the data accruing in this context after the storage is no longer necessary or restrict the processing if there are legal retention obligations.
Our app is available for download in the Apple App Store and the Google Play Store (hereinafter referred to as the 'Stores'). When users download the app, the necessary information is transmitted to the stores, i.e. in particular username, email address and customer number of the account, time of download, payment information and the individual device identification number. We have no influence on this data collection and are not responsible for it. We process the data only insofar as it is necessary for downloading the mobile app to the user's mobile device.
Our app is hosted by Firebase (Google Cloud). The provider thereby processes the personal data transmitted via the app, e.g. on content, usage, meta/communication data or contact data. It is our legitimate interest to provide an app, so that the legal basis of the data processing is Art. 6 para. 1 s. 1 lit. f GDPR.
When users use our app, we collect the data that is technically necessary for us to offer users the functions of our app and to ensure stability and security. This is our legitimate interest, so that the legal basis is Art. 6 para. 1 s. 1 lit. f GDPR.
The data processed to this extent are:
The app requests the user's access to functions of the end device or to data of the device in order to be able to execute functions of the app. By allowing access, the user gives consent to the associated data processing, so that the legal basis is Art. 6 para. 1 s. 1 lit. a GDPR. Users can revoke their consent at any time by terminating access in the settings of their end device. The revocation does not affect the lawfulness of the processing until the revocation.
The data processed or access functions used in this respect are:
The app requests access to the camera (to scan QR codes) and Bluetooth. These access permissions are used exclusively for the purpose of establishing a local connection between the end devices of users in order to establish a User-Initiated Pairing. By allowing access, the user gives consent. No health-related data or communication contents are transmitted over these local interfaces.
In the app, we process data in order to provide the user with functions of the app. The legal basis for the processing is the usage agreement concluded with the user via the app.
The data processed to this extent are:
We offer users the ability to purchase goods or services via our app. In the ordering process or shipping, we involve the following service providers, who receive only the personal data required in each case to provide a service. The processing of the data takes place for the performance of the contract concluded with the respective user (Art. 6 para. 1 s. 1 lit. b GDPR).
We use Shopify to maintain an online store. The provider is Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland. The provider processes master data (e.g. names, addresses), payment data (e.g. bank details, invoices, payment history), meta/communication data (e.g. device information, IP addresses) in the EU.
The legal basis for the processing is Art. 6 para. 1 s. 1 lit. f GDPR. We have a legitimate interest to make our products easily accessible to interested parties.
The data will be deleted when the purpose for which it was collected no longer applies and there is no obligation to retain it. Further information is available in the provider's privacy policy at shopify.com/legal/privacy.
We use Firebase Cloud Messaging to communicate with users. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The provider processes meta/communication data (e.g. device information, IP addresses), usage data (e.g. app usage data, interest in content, access times) in the EU.
The legal basis for the processing is Art. 6 para. 1 s. 1 lit. a GDPR. The processing is based on consent. Data subjects may revoke their consent at any time by contacting us, for example, using the contact details provided in our privacy policy. The revocation does not affect the lawfulness of the processing until the revocation.
The data will be deleted when the purpose for which it was collected no longer applies and there is no obligation to retain it. Further information is available in the provider's privacy policy at firebase.google.com/support/privacy.
We use Firebase App Check to protect the app against misuse and unauthorized access, to track errors in the app. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Dublin, D04e5w5, Ireland. The provider processes usage data (e.g. web pages visited, interest in content, access times), meta/communication data (e.g. device information, IP addresses) in the EU.
The legal basis for the processing is Art. 6 para. 1 s. 1 lit. f GDPR. We have a legitimate interest in adequately monitoring the functionality of our applications.
The data will be deleted when the purpose for which it was collected no longer applies and there is no obligation to retain it. Further information is available in the provider's privacy policy at policies.google.com/privacy.
We use Firebase Crashlytics to analyze errors and improve app stability, to track errors in the app. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Dublin, Ireland. The provider processes usage data (e.g. web pages visited, interest in content, access times), meta/communication data (e.g. device information, IP addresses) in the EU.
The legal basis for the processing is Art. 6 para. 1 s. 1 lit. a GDPR. The processing is based on consent. Data subjects may revoke their consent at any time by contacting us, for example, using the contact details provided in our privacy policy. The revocation does not affect the lawfulness of the processing until the revocation.
The data will be deleted when the purpose for which it was collected no longer applies and there is no obligation to retain it. Further information is available in the provider's privacy policy at policies.google.com/privacy.
We use Firebase Authentication to manage authentications. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Dublin, D04e5w5, Ireland. The provider processes meta/communication data (e.g. device information, IP addresses), contact data (e.g. email addresses, telephone numbers) in the USA.
The legal basis for the processing is Art. 6 para. 1 s. 1 lit. f GDPR. We have a legitimate interest in sufficiently authenticating users of our applications.
The legal basis for the transfer to a country outside the EEA is an adequacy decision. The security of the data transferred to the third country (i.e. a country outside the EEA) is guaranteed because the EU Commission has decided as part of an adequacy decision in accordance with Art. 45 para. 3 GDPR that the third country ensures an adequate level of protection.
The data will be deleted when the purpose for which it was collected no longer applies and there is no obligation to retain it. Further information is available in the provider's privacy policy at policies.google.com/privacy.
We have integrated a data protection seal in our app. The provider is heyData GmbH, Schützenstraße 5, 10117 Berlin, Germany. The provider processes meta/communication data (e.g. IP addresses) in the EU.
The legal basis of the processing is Art. 6 para. 1 s. 1 lit. f GDPR. We have a legitimate interest in providing users of the app with confirmation of our data privacy compliance. At the same time, the provider has a legitimate interest in ensuring that only customers with existing contracts use its seals, which is why a mere image copy of the certificate is not a viable alternative as confirmation.
As the data is masked after collection, there is no possibility to identify website visitors. Further information is available in the privacy policy of the provider at heydata.eu/en/privacy-policy.
We reserve the right to change this privacy policy with effect for the future. A current version is always available here.
If you have any questions or comments regarding this privacy policy, please feel free to contact us using the contact information provided above.
This Addendum is intended to supplement, and must be read in conjunction with, the main Privacy Policy. In the event of any direct contradiction or inconsistency between the provisions of this Addendum and the main Privacy Policy regarding data processing activities within the European Economic Area (EEA), the provisions of the main Privacy Policy shall prevail. For users outside the EEA, the provisions of this Addendum shall apply to the extent necessary to comply with applicable local data protection laws (including the CPRA and India's DPDP Act 2023), without otherwise invalidating the core privacy obligations established in the main Privacy Policy.
This Addendum implements the same privacy-by-design and data minimization principles described in the main Privacy Policy. All processing of personal data, including sensitive personal data, is strictly limited to what is necessary to provide user-initiated functionality, maintain system security, and ensure service integrity.
Wherever possible, we design our systems to avoid collecting or storing personal data. Where processing is required for functionality, it is limited in scope, purpose, and retention.
This Addendum applies to users located outside the European Economic Area and supplements the main Privacy Policy. It provides additional disclosures required under applicable non-EEA data protection laws, including the California Consumer Privacy Act (CPRA), and the India Digital Personal Data Protection Act 2023.
For users outside the EEA, tayp Germany UG (haftungsbeschränkt) acts as the data controller for the processing described in this Addendum, unless otherwise stated for specific third-party services acting as independent controllers.
We process only the categories of personal data necessary to provide the app's functionality:
(A) Identifiers
(B) Technical Information
(C) Usage and Security Data
(D) User-Provided Data
(E) Connection Data
(F) Health-Related Event Data (Sensitive Data)
This data is processed solely to enable the specific user-requested functionality and is not used for profiling, advertising, or marketing.
Personal data is processed according to the following lifecycle:
We process personal data only for the following purposes:
We do not use personal data for advertising, marketing, profiling, or sale.
Depending on the jurisdiction, processing is based on:
Where required by law, explicit consent is obtained prior to processing sensitive personal data.
Sensitive personal data is processed only where explicitly initiated by the user and only for the purpose of enabling the requested functionality.
Such data is strictly limited to:
Sensitive personal data is not:
Where required by applicable law, users are provided with controls to limit the use of sensitive personal data, except where such limitation would prevent core functionality.
Where processing is based on consent, users may withdraw consent at any time. Withdrawal does not affect prior processing and may limit or disable certain features.
Consent mechanisms are designed to be as simple as providing consent.
Depending on applicable law, users may have rights to:
Users in the United Kingdom may also contact the Information Commissioner's Office (ICO). Users may exercise their rights to access or request correction or deletion of data directly through the self-service controls provided within the app's settings. We do not maintain identifiable records (such as names or emails) linking user support requests to specific in-app data; therefore, manual processing of deletion requests via email is not technically feasible. If you require guidance or assistance on using our in-app privacy tools, you may contact support@tayp-app.com.
We do not sell personal data.
We do not share personal data for cross-context behavioral advertising or targeted advertising purposes.
We use third-party service providers, including Firebase services, strictly for hosting, authentication, messaging, security, and system functionality.
Where users access third-party laboratory services:
We retain personal data only for as long as necessary to provide the app's functionality and ensure security and system integrity.
Retention is determined based on strict necessity and is regularly reviewed to ensure data is not stored longer than required.
Data is deleted or irreversibly anonymized when no longer required.
Personal data may be processed outside the user's jurisdiction, including in the European Union and the United States.
Where required, appropriate safeguards are implemented, including contractual protections and technical security measures.
We implement appropriate technical and organizational measures, including:
The service is intended for users aged 18 years and older. We do not knowingly collect personal data from individuals under 18.
We may update this Addendum from time to time. Continued use of the app constitutes acceptance of the updated version.
We collect the following categories of personal information:
We retain these categories of information only for as long as necessary to provide core app functionality and maintain security, as detailed in Section 5.12.
We use this information solely to:
We do not sell or share personal information.
Sensitive personal information is used only for:
Sensitive personal information is not used for profiling, advertising, or cross-context behavioral advertising.
California residents have the right to:
We may require reasonable verification before responding to requests to protect user privacy and security.
California residents may designate an authorized agent to submit requests, subject to verification.
We do not sell personal information.
We do not share personal information for cross-context behavioral advertising.
Personal information is retained only as long as necessary to provide functionality, ensure security, and maintain system integrity, and is deleted or anonymized when no longer required.
This section applies to users located in India and supplements the Global Privacy Addendum. tayp Germany UG (haftungsbeschränkt), Kolonnenstraße 8, Berlin, Germany acts as the Data Fiduciary under applicable Indian law.
We provide notice of data processing at or before collection, including categories of data and purposes of use. Processing is based on user consent obtained at app download and at the point of specific feature use including pairing and sending notifications. Consent may be withdrawn at any time via in-app settings (such as by deleting your user profile). Because we do not link app usage to real-world identifiers like your name or email, data erasure must be initiated directly within the app. For guidance on how to navigate these settings or withdraw consent, users may contact support@tayp-app.com.
We process only data necessary to operate the service, including device and technical identifiers, authentication and security data, system logs required for stability and abuse prevention, user-generated inputs and actions, and user-selected health-related categories chosen from a predefined list when sending a testing recommendation.
The service is a user-initiated communication tool. It does not provide medical advice, diagnosis, screening, or treatment. The system does not determine, verify, infer, or validate any medical or health condition. All health-related categories are selected by the user and transmitted without interpretation or modification.
Personal data is processed only to provide core functionality, enable user-initiated pairing, deliver notifications including testing recommendations, maintain security, prevent abuse, and ensure system stability. Personal data is not used for advertising, profiling, or automated decision-making.
Users in India may request access, correction, or deletion of personal data and may withdraw consent at any time by contacting privacy@tayp-app.com.
Users may contact privacy@tayp-app.com for any grievance relating to personal data processing.
Data is retained only as long as necessary for service provision. Connection and event data are deleted upon user request. Technical logs are retained only for security and system integrity.
Data may be processed outside India, including in the European Union, with appropriate safeguards.
We apply reasonable technical and organizational security measures including encryption, access controls, and abuse prevention systems.
The service is intended for users aged 18 and older. We do not knowingly collect data from individuals under 18.
We may update this section from time to time. Continued use of the service constitutes acceptance of the updated version.