Skip to main content

SANUSIAN

Menu

Privacy Policy

Protecting your data and ensuring transparent service

Last Updated: August 2026

Welcome to Sanusian. This Privacy Policy explains how we collect, use, and protect your information when you use the Sanusian website, mobile application, and related services (collectively, the “Platform”).

As an Austrian company, we process all personal data strictly in accordance with the European General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (DSG).

1. WHO WE ARE (DATA CONTROLLER)

The responsible party for data processing on this website under the General Data Protection Regulation (GDPR) is:

At Sanusian, we believe caring for your pet should come with complete transparency and trust. This Privacy Policy explains how Sanusian OG collects, processes, stores, and protects your personal data when you use our website (sanusian.com), our web app, mobile applications, and software-as-a-service (SaaS) platform (collectively, the “Service” or “Platform“):

  • Data Controller: Sanusian OG
  • Registered Address: Windmühlgasse 22, 1060 Vienna, Austria
  • Commercial Register No. (Firmenbuch): FN 1847362 (Handelsgericht Wien)
  • Authorised Representative: Drazen Pejnovic
  • Data Privacy Contact Email: info@sanusian.com

2. CORE PRINCIPLES & SCOPE

We design all our products with privacy by design and default (Art. 25 GDPR). We collect only what is strictly necessary to deliver intelligent pet health risk assessments, daily logging, and partner clinic routing.

Note on Pet Data: Under European law, information purely relating to an animal (e.g., dog breed, symptoms, weight) is not “personal data” unless it is linked to an identifiable individual (the pet parent/account holder). Once linked to your profile, we treat the entire dataset with high-grade security and confidentiality.

3. WHAT INFORMATION WE COLLECT

Depending on how you interact with Sanusian, we process the following categories of data:

A. Information You Provide Directly

  • Account & Profile Data: First and last name, email address, password (stored in hashed format), country, preferred language.
  • Pet Profile Data: Pet name, species, breed, age, sex, spay/neuter status, weight, existing conditions, microchip number (optional).
  • Daily Logs & Symptom Inputs: Daily observations, behavior logs, mobility/posture notes, symptom frequency, photos/videos uploaded for visual observation, and timeline entries.
  • Partner / Clinic Registration Data (B2B): Business name, contact person, clinic address, veterinary license verification details, business email, and phone number

B. Billing & Payment Information

  • Payments are processed directly via Stripe. We do not collect or store full credit card numbers or CVCs on our servers. We only receive non-sensitive transaction metadata from Stripe (e.g., transaction ID, billing country, subscription status, last 4 digits of the card).

C. Automatically Collected Data & Technical Metadata

    • Device & Connection Data: IP address (anonymized where possible), browser type/version, operating system, device model, time zone setting, and app crash logs.
    • Usage Data: Pages viewed, features accessed, buttons clicked, and session duration.
    • Approximate Location (Optional): Country or city-level location (derived from IP address or postal code entered by you) to help match you with nearby Partner Clinics.

4. PURPOSES AND LEGAL BASES FOR PROCESSING (GDPR)

Under European data protection law (GDPR), we process your personal data under the following lawful bases:

  • Account Creation & Service Delivery: Operating your account, saving daily logs, and generating automated AI Health & Risk Scores. (Legal Basis: Performance of Contract)
  • Pre-Clinical Summaries (“Risk Passports”): Generating structured health summaries to export or share with veterinary partners. (Legal Basis: Performance of Contract)
  • Subscription & Payment Management: Processing monthly/annual subscriptions and managing cancellations via Stripe. (Legal Basis: Performance of Contract & Statutory Tax Compliance)
  • Customer Support & Communication: Responding to inquiries, error reports, and service notices. (Legal Basis: Performance of Contract & Legitimate Interests)
  • Platform Security & Fraud Prevention: Detecting malicious activity, brute-force attempts, and abuse. (Legal Basis: Legitimate Interests in securing our infrastructure)
  • Algorithm Optimization & Research: Aggregating and fully anonymizing pet health datasets for statistical modeling and risk-score validation. (Legal Basis: Legitimate Interests; fully anonymized data falls outside data protection regulations)
  • Marketing & Product Updates: Sending newsletters or promotional product updates. (Legal Basis: User Consent, withdrawable at any time)

5. HOW WE USE AI AND AUTOMATED PROCESSING

Sanusian uses automated algorithms and pattern-recognition models to calculate non-diagnostic Health Care Risk Scores and generate pre-intake triage recommendations from your daily logs.

  • No Legal Effect / Article 22 GDPR: Our AI does not perform automated decision-making that produces legal effects or similarly significantly affects you within the meaning of Art. 22 GDPR. All algorithmic scores are strictly advisory, pre-triage tools intended to support pet owner decisions.
  • No Selling of Personal Data: We never sell your personal data or your pet’s health data to data brokers or third-party advertisers.

6. RECIPIENTS AND DATA DISCLOSURE

We do not disclose your personal data to third parties except in the following limited circumstances:

  1. Third-Party Service Providers (Data Processors – Art. 28 GDPR): We use vetted technical service providers bound by strict Data Processing Agreements (DPAs):
    • Payment Processor: Stripe Payments Europe, Ltd. (Payment handling)
    • Cloud Hosting & Infrastructure: EU-based cloud and database hosting providers (e.g., AWS Frankfurt / Hetzner / Supabase EU) ensuring ISO 27001 compliance.
    • Transactional Email & Notifications: Email dispatch infrastructure for confirmation emails, password resets, and critical alerts.
  2. Partner Clinics & Veterinarians: If you explicitly choose to export or route your pet’s Risk Passport to a Partner Clinic, we will share the relevant structured history with that specific clinic upon your instruction.
  3. Legal Compliance: Where required by mandatory court order, subpoena, or statutory Austrian/EU law enforcement authorities.

7. INTERNATIONAL DATA TRANSFERS

Our core databases and servers are hosted within the European Union (EU) / European Economic Area (EEA).

If any sub-processor processes data in a third country outside the EEA (such as the United States), we ensure an adequate level of data protection by relying on:

  • An Adequacy Decision by the European Commission (e.g., the EU-U.S. Data Privacy Framework); or
  • Standard Contractual Clauses (SCCs) adopted by the European Commission pursuant to Art. 46(2)(c) GDPR, supplemented by technical encryption measures.

8. DATA RETENTION AND ACCOUNT DELETION

We store personal data only as long as necessary to fulfill the purposes set out in this policy or to comply with statutory retention periods:

  • Active Accounts: We retain your account data, pet profiles, and logs as long as your Sanusian account remains active.
  • Account Deletion: You can delete your account at any time in the app settings or by emailing info@sanusian.com. Upon deletion, your personal data will be permanently deleted or anonymized within 30 days, unless retention is required by law.
  • Statutory Retention: Invoices and payment transaction records are retained for 7 years to comply with Austrian accounting and tax obligations (§ 132 BAO).

9. YOUR RIGHTS UNDER THE GDPR

As an individual residing in the EU/EEA, you have the following enforceable statutory rights:

  • Right of Access (Art. 15 GDPR): You have the right to obtain confirmation and a copy of the personal data we hold about you.
  • Right to Rectification (Art. 16 GDPR): You can correct inaccurate or incomplete personal information directly in your profile or by contacting us.
  • Right to Erasure / “Right to be Forgotten” (Art. 17 GDPR): You may request the deletion of your personal data when it is no longer required.
  • Right to Restriction of Processing (Art. 18 GDPR): You can request that we restrict the processing of your data under certain circumstances.
  • Right to Data Portability (Art. 20 GDPR): You have the right to receive your personal data in a structured, commonly used, and machine-readable format (e.g., JSON or CSV export).
  • Right to Object (Art. 21 GDPR): You have the right to object at any time to processing based on legitimate interests (Art. 6(1)(f) GDPR) or direct marketing.
  • Right to Withdraw Consent (Art. 7(3) GDPR): Where processing is based on your consent (e.g., newsletters), you may withdraw it at any time with effect for the future.

How to Exercise Your Rights

To exercise any of these rights, send an email to:
📧 info@sanusian.com

Right to Lodge a Complaint with a Supervisory Authority

If you believe that the processing of your data violates European data protection law, you have the right to lodge a complaint with a competent supervisory authority (Art. 77 GDPR).

In Austria, the competent authority is:

  • Österreichische Datenschutzbehörde (Austrian Data Protection Authority)
  • Barichgasse 40–42, 1030 Vienna, Austria
  • Website: https://www.dsb.gv.at

10. COOKIES AND LOCAL STORAGE

  1. Essential / Necessary Cookies: Required for basic platform operation, user authentication, and session security. These do not require user consent under § 165 Abs. 3 TKG 2021.
  2. Analytical & Functional Cookies: Used only with your explicit consent via our cookie consent banner. You can change or revoke your cookie choices at any time via the settings in the website footer.

11. DATA SECURITY MEASURES (TOMS)

We implement state-of-the-art technical and organizational security measures (TOMs) pursuant to Art. 32 GDPR, including:

    • End-to-end TLS/HTTPS encryption for all data in transit;
    • Industry-standard AES-256 encryption for sensitive data at rest;
    • Role-based access control (RBAC) and strict least-privilege principles for administrative access;
    • Continuous automated database backups and vulnerability scanning.

12. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy periodically to adapt to changes in platform functionality or updated legal requirements. We will notify you of material changes via email or an in-app notice at least 30 days before changes take effect.

13. CONTACT INFORMATION

If you have questions, concerns, or requests regarding this Privacy Policy or your data, please contact:

  • Sanusian OG
  • Windmühlgasse 22, 1060 Vienna, Austria
  • Email: info@sanusian.com
  • Website: https://sanusian.com