Privacy Policy

Last updated: July 2025

1. Data Controller

The entity responsible for the processing of your personal data is the healthcare team behind TrueWeight. For all privacy-related inquiries, you can contact us at:
Email: contact@trueweight.org

2. What Data We Collect

We collect the following categories of personal data:

2.1 Identity and Contact Data

• Full name
• Email address
• Phone number (optional)
• Country of residence

2.2 Special Categories of Data (Health Data)

• Anthropometric measurements (height, weight, waist circumference, BMI)
• Ethnic origin (for adjusted BMI risk thresholds)
• Medical history and comorbidities (diabetes, hypertension, cardiovascular disease, etc.)
• Mental health information (mood, eating behavior)
• Current medications and previous treatments
• Contraindications (pregnancy, thyroid history, etc.)
• Laboratory results (blood glucose, HbA1c, lipid profile, etc.)
• Treatment progress (weight evolution, side effects, dose adjustments)

Legal basis for processing health data: Article 9(2)(h) of the GDPR — processing is necessary for the purposes of preventive or occupational medicine, medical diagnosis, the provision of health care, treatment, or the management of health systems. We also rely on your explicit consent (Article 9(2)(a)), which you provide when completing the medical questionnaire.

3. Purposes of Processing

Your data is processed for the following purposes:

1. Medical assessment and diagnosis: Evaluating your eligibility for obesity treatment based on European clinical guidelines (EASO).
2. Treatment provision: Prescribing medications, issuing private prescriptions, and monitoring treatment progress.
3. Follow-up care: Asynchronous messaging with your doctor, periodic reviews, and dose adjustments.
4. Safety monitoring: Tracking side effects, laboratory results, and treatment response.
5. Billing and payment processing: Managing subscriptions, one-time payments, and issuing invoices.
6. Communication: Sending appointment reminders, treatment updates, and administrative notifications.
7. Compliance with legal obligations: Maintaining medical records as required by Spanish and EU law.

4. Data Storage and Security

All your clinical data is hosted on high-security servers physically located in the European Union and Switzerland. We implement the following technical and organizational security measures:

• Military-grade encryption (SSL/TLS) for all data in transit
• AES-256-GCM encryption for all health data at rest
• Multi-factor authentication for medical staff accessing patient data
• Regular security audits and penetration testing
• Strict access controls based on the principle of least privilege
• Pseudonymization where possible for non-clinical operations

5. Data Retention

We retain your personal data for the duration of your treatment and for the period required by applicable law thereafter. Spanish regulations require medical records to be kept for a minimum of 5 years after the end of treatment. After this period, your data will be securely deleted or anonymized for statistical purposes.

6. Data Sharing and Third Parties

We do not sell, rent, or share your personal data with third parties for marketing purposes. We may share data with:

• Medical professionals involved in your care (endocrinologists, nutritionists, psychologists) when referrals are necessary.
• Stripe (payment processing) — your payment data is processed directly by Stripe, and we only store references to transactions.
• SendGrid (email delivery) — for sending transactional emails with end-to-end encryption in transit.
• Competent health authorities when required by law.

All third-party processors are contractually bound to comply with the GDPR and are located within the European Economic Area or in countries with an adequacy decision.

7. Your Rights (GDPR Articles 15–22)

Under the GDPR, you have the following rights regarding your personal data:

1. Right of access (Art. 15): Request a copy of all data we hold about you.
2. Right of rectification (Art. 16): Correct inaccurate or incomplete data.
3. Right of erasure / "Right to be forgotten" (Art. 17): Request deletion of your data, subject to legal retention obligations.
4. Right to restriction of processing (Art. 18): Limit how we use your data.
5. Right to data portability (Art. 20): Receive your data in a structured, machine-readable format (JSON/CSV).
6. Right to object (Art. 21): Object to processing for direct marketing or legitimate interests.
7. Rights related to automated decision-making (Art. 22): Not to be subject to decisions based solely on automated processing.

To exercise any of these rights, contact us at contact@trueweight.org. We will respond within 30 days. You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD).

8. Consent

By completing the medical questionnaire, you explicitly consent to the processing of your health data for the purposes described in this policy. You may withdraw your consent at any time, although this may affect our ability to provide you with medical services. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

9. Cookies and Analytics

This website does not use tracking cookies or third-party analytics services that require consent. We may use privacy-friendly analytics tools (such as Plausible or Umami) that do not collect personal data or use cookies. These tools provide aggregate statistics without identifying individual users.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or through a prominent notice on our website. The "Last updated" date at the top of this page indicates when the policy was last revised.

11. Contact and DPO

For any questions, concerns, or requests regarding your privacy, please contact us:
Email: contact@trueweight.org