Privacy Policy.

The responsible party for data processing under the General Data Protection Regulation (GDPR) is:

Sanusian GmbH
Windmühlgasse 22, 1060 Vienna, Austria
Commercial Register No. (Firmenbuch): FN 1847362, Handelsgericht Wien
Authorised representatives: Drazen Pejnovic; Marcus Berger, Chief Executive Officer (CEO)
Data privacy contact: info@sanusian.com

As an Austrian company, we process all personal data strictly in accordance with the European General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (DSG).

We design all our products with privacy by design and by default (Art. 25 GDPR). We collect only what is strictly necessary to deliver animal-health risk assessments and Resolution Intelligence guidance.

A note on pet data: under European law, information purely relating to an animal (such as breed, symptoms or weight) is not personal data unless it is linked to an identifiable individual, such as the pet parent or account holder. Once linked to your profile, we treat the entire dataset with high-grade security and confidentiality.

Depending on how you interact with Sanusian, we process the following categories of data:

• Account and profile data: first and last name, email address, password (stored in hashed format), country and preferred language.
• Pet profile data: pet name, species, breed, age, sex, spay/neuter status, weight, existing conditions and microchip number (optional).
• Daily logs and symptom inputs: daily observations, behaviour logs, mobility and posture notes, symptom frequency, photos or videos uploaded for visual observation, and timeline entries.
• Partner registration data (B2B): business name, contact person, business address, professional license verification details, business email and phone number.
• Billing and payment information: payments are processed directly via Stripe. We do not collect or store full credit card numbers or CVCs on our servers. We only receive non-sensitive transaction metadata from Stripe, such as transaction ID, billing country, subscription status and the last four digits of the card.
• Automatically collected data: IP address (anonymized where possible), browser type and version, operating system, device model, time zone setting, app crash logs, pages viewed, features accessed and session duration.
• Approximate location (optional): country or city-level location derived from your IP address or a postal code you enter, used to help match you with nearby partner services.

We process your personal data under the following lawful bases:

• Account creation and service delivery: operating your account, saving daily logs and generating automated S-Risk Scores™. Legal basis: performance of contract.
• Risk Passports™: generating structured health summaries to export or share with veterinary partners. Legal basis: performance of contract.
• Subscription and payment management: processing subscriptions and managing cancellations via Stripe. Legal basis: performance of contract and statutory tax compliance.
• Customer support and communication: responding to inquiries, error reports and service notices. Legal basis: performance of contract and legitimate interests.
• Platform security and fraud prevention: detecting malicious activity, brute-force attempts and abuse. Legal basis: legitimate interests in securing our infrastructure.
• Algorithm optimization and research: aggregating and fully anonymizing animal-health datasets for statistical modeling and risk-score validation. Legal basis: legitimate interests; fully anonymized data falls outside data protection regulations.
• Marketing and product updates: sending newsletters or promotional product updates. Legal basis: your consent, withdrawable at any time.

Sanusian uses automated algorithms and pattern-recognition models to calculate non-diagnostic S-Risk Scores™ and generate Resolution Intelligence guidance from daily logs and observed signals.

• No legal effect (Art. 22 GDPR): our models do not perform automated decision-making that produces legal effects or similarly significantly affects you within the meaning of Art. 22 GDPR. All scores are strictly advisory, pre-triage tools intended to support pet owner and partner decisions.
• No selling of personal data: we never sell your personal data or your pet's health data to data brokers or third-party advertisers.

We do not disclose your personal data to third parties except in the following limited circumstances:

• Third-party service providers (data processors, Art. 28 GDPR): vetted technical service providers bound by strict data processing agreements, including our payment processor (Stripe Payments Europe, Ltd.), EU-based cloud and database hosting providers, and transactional email infrastructure for confirmation emails, password resets and critical alerts.
• Partner clinics and veterinarians: if you explicitly choose to export or route your pet's Risk Passport™ to a partner, we share the relevant structured history with that specific partner upon your instruction.
• Legal compliance: where required by mandatory court order, subpoena or statutory Austrian or EU law enforcement authorities.

Sanusian builds risk intelligence infrastructure for animal health. The Risk API enables partners to bring the S-Risk Score™ into their own products and workflows. SDKs are under development to simplify integration; their availability and scope are not yet confirmed.

• Roles under the GDPR: when a partner sends animal-health data to the API, the partner acts as the data controller and Sanusian acts as a data processor (Art. 28 GDPR), processing that data strictly on the partner's documented instructions under a data processing agreement. The partner is responsible for its own lawful basis, transparency and consent toward its users.
• Data minimization in integrations: the API is designed to work from structured animal-health signals. Partners are required to send only the data the scoring call needs and, where possible, pseudonymous identifiers rather than directly identifying information about their users.
• No secondary use: data submitted through the API or the future SDK is used only to compute and return the risk response for that partner. It is not used to advertise, is not sold, and is not shared with other partners. Aggregated and fully anonymized datasets may be used for statistical modeling and risk-score validation; fully anonymized data falls outside data protection regulations.
• SDK data handling: the future SDK will act purely as an integration layer. It will transmit data to the Sanusian API over encrypted connections and will not introduce additional tracking, analytics or third-party data collection into partner applications.
• Retention in API processing: API request payloads are retained only as long as needed to deliver, secure and audit the service, and are deleted or anonymized in line with each partner's data processing agreement.

Our core databases and servers are hosted within the European Union (EU) and European Economic Area (EEA). If any sub-processor processes data in a third country outside the EEA, we ensure an adequate level of data protection by relying on an adequacy decision by the European Commission (such as the EU-U.S. Data Privacy Framework) or on Standard Contractual Clauses adopted by the European Commission pursuant to Art. 46(2)(c) GDPR, supplemented by technical encryption measures.

• Active accounts: we retain your account data, pet profiles and logs as long as your Sanusian account remains active.
• Account deletion: you can delete your account at any time in the app settings or by emailing info@sanusian.com. Upon deletion, your personal data will be permanently deleted or anonymized within 30 days, unless retention is required by law.
• Statutory retention: invoices and payment transaction records are retained for 7 years to comply with Austrian accounting and tax obligations (§ 132 BAO).

As an individual residing in the EU/EEA, you have the following enforceable statutory rights:

• Right of access (Art. 15 GDPR): obtain confirmation and a copy of the personal data we hold about you.
• Right to rectification (Art. 16 GDPR): correct inaccurate or incomplete personal information directly in your profile or by contacting us.
• Right to erasure (Art. 17 GDPR): request the deletion of your personal data when it is no longer required.
• Right to restriction of processing (Art. 18 GDPR): request that we restrict the processing of your data under certain circumstances.
• Right to data portability (Art. 20 GDPR): receive your personal data in a structured, commonly used and machine-readable format, such as a JSON or CSV export.
• Right to object (Art. 21 GDPR): object at any time to processing based on legitimate interests (Art. 6(1)(f) GDPR) or to direct marketing.
• Right to withdraw consent (Art. 7(3) GDPR): where processing is based on your consent, such as newsletters, you may withdraw it at any time with effect for the future.

To exercise any of these rights, send an email to info@sanusian.com.

If you believe that the processing of your data violates European data protection law, you have the right to lodge a complaint with a competent supervisory authority (Art. 77 GDPR). In Austria, the competent authority is the Österreichische Datenschutzbehörde (Austrian Data Protection Authority), Barichgasse 40–42, 1030 Vienna, Austria, www.dsb.gv.at.

• Essential cookies: required for basic platform operation, user authentication and session security. These do not require user consent under § 165 Abs. 3 TKG 2021.
• Analytical and functional cookies: used only with your explicit consent via our cookie consent banner. You can change or revoke your cookie choices at any time via the settings in the website footer.

We implement state-of-the-art technical and organizational security measures pursuant to Art. 32 GDPR, including end-to-end TLS/HTTPS encryption for all data in transit, industry-standard AES-256 encryption for sensitive data at rest, role-based access control with strict least-privilege principles for administrative access, and continuous automated database backups and vulnerability scanning.

We may update this Privacy Policy periodically to adapt to changes in platform functionality or updated legal requirements. We will notify you of material changes via email or an in-app notice at least 30 days before changes take effect.

If you have questions, concerns or requests regarding this Privacy Policy or your data, please contact:

Sanusian GmbH
Windmühlgasse 22, 1060 Vienna, Austria
Email: info@sanusian.com
Website: sanusian.com