MetaboGnostics GmbH
Wienerstraße 180
A – 8051 Graz
Email: office@metabognostic.at
Website: www.metabognostics.at

1. General Information
MetaboGnostics GmbH (hereinafter referred to as ‘MetaboGnostics’) processes data in
accordance with the provisions of the European General Data Protection Regulation (GDPR),
the Data Protection Act (DSG), and the Telecommunications Act 2021 (TKG 2021).
This privacy policy describes how MetaboGnostics GmbH processes your personal data.
2. What are Personal Data?
Personal data refers to all information related to an identified or identifiable natural person
(e.g., name, contact details, address, billing information, IP addresses, etc.). Special
categories of personal data according to Article 9 of the GDPR include, among others, genetic
data, biometric data for uniquely identifying a natural person, and health data.
3. Data Protection Officer
We have appointed a Data Protection Officer.
You can reach our Data Protection Officer using the following contact details:
MetaboGnostics GmbH
Attn: Data Protection Officer
Wienerstraße 180
A – 8051 Graz
Email: datenschutz@metabognostic.at
4. How are your personal data processed by us?
Depending on whether you visit our website, use our services, or enter into another type of
relationship with us, we process your data in different ways. The individual data processing methods
are listed below:
4.1. Scope and purpose of data processing when visiting our website
The information in this section applies to our following website and its subpages:
www.metabognostics.at
4.1.1. Log data on the web servers
Our website provider temporarily collects and stores information on its web servers in so-called log
files, which your browser automatically transmits to us. This is done based on our predominant
legitimate interest (Art. 6 para. 1 lit. f GDPR) for the purpose of system security and operational
stability, and includes the following data categories:
 Domain names
 Browser type and version
 Operating system used
 Referrer URL
 Hostname of the accessing computer
 Time and date of the server request
 IP address of the requesting computer
 HTTP response code
 Amount of data transferred during the connection

Every time a user accesses our pages and retrieves a file, data about this process is stored in a log file.
We reserve the right to evaluate this log file anonymously and use it based on our predominant
legitimate interest (Art. 6 para. 1 lit. f GDPR) for the purpose of improving our online offerings.
These data are not combined with other data sources.
The aforementioned personal data in the log files are stored for a maximum of 3 years.
For the operation of our websites, it may be necessary to disclose your data to the following
recipients:

Recipient:
WebTuga é uma marca registada da Dream Fusion – IT Services, Lda (PT508469058) 
Function: Hosting
LEGAL BASIS: Art 6 Abs 1 lit f DSGVO
Location: Portugal

4.1.2. Technical data in cookies
When you visit our website, the following data may be processed as technical cookies:
 Browser type
 Operating system
 Country
 Date
 Time and duration of access
 IP address and pages visited on our website, including entry and exit pages

The ‘technical’ cookies used are activated as soon as you visit our website. They serve to make our
services more user-friendly and effective. Cookies are small text files that are stored on your
computer and saved by your browser.
You can disable the storage of cookies in your browser or activate a notification when cookies are
sent. If you do not use cookies, this may affect the usability of our website.
Cookies enable an analysis of website usage. They are used for recognizing and storing temporary
data of website visitors. We use cookies only to the minimal extent necessary to communicate with
you via the website.

4.1.3. Links to external providers
Individual pages may contain links to other providers outside of our control, to which this privacy
policy does not apply. This means we cannot assume any liability for such content. We carefully
select the linked content, but if a link is faulty, please inform us, and we will remove it immediately.
4.2. Scope and Purpose of Data Processing on Social Media Platforms
4.2.1. Facebook
Our website includes components of Facebook. The data controller is Meta Platforms Ireland Limited,
4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.
Whenever an individual page of our website containing a Facebook component (Facebook plug-in) is
accessed, the internet browser establishes a connection with Facebook.
If the person is simultaneously logged into Facebook, Facebook recognizes which specific subpage of
our website the person is visiting. This information is collected by the Facebook component and
assigned to the person’s respective Facebook account, potentially transferring it to countries outside
the European Union.
If the user does not want such information to be transmitted to Facebook, they can prevent this by
logging out of their Facebook account before accessing our website.
Facebook's published data policy, which is available at https://de-de.facebook.com/about/privacy/,
provides details on the collection, processing, and use of personal data by Facebook. It also explains
the privacy settings that Facebook offers to protect personal data.
There are also various applications available that allow users to block data transmission to Facebook.
A list of available Facebook plug-ins can be found at https://developers.facebook.com/docs/plugins/.
4.2.2. Instagram
Our website includes components of Instagram. The data controller is Meta Platforms Ireland
Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.
Whenever an individual page of our website containing an Instagram component (plug-in) is
accessed, the internet browser establishes a connection with Instagram.
If the person is simultaneously logged into Instagram, Instagram recognizes which specific subpage of
our website the person is visiting. This information is collected by the Instagram component and
assigned to the person’s respective Instagram account, potentially transferring it to countries outside
the European Union.
If the user does not want such information to be transmitted to Instagram, they can prevent this by
logging out of their Instagram account before accessing our website.
Instagram’s published data policy, available at https://privacycenter.instagram.com/policy, provides
details on the collection, processing, and use of personal data by Instagram. It also explains the
privacy settings that Instagram offers to protect personal data.
Additionally, there are various applications available that allow users to block data transmission to
Instagram.
4.2.3. LinkedIn
Our website includes components from LinkedIn. The data controller is LinkedIn Ireland Unlimited
Company, Wilton Place, Dublin 2, Ireland. Information on what data LinkedIn processes and for what

purposes can be found in LinkedIn's privacy policy, available at
https://www.linkedin.com/legal/privacy-policy.
When visiting our website, LinkedIn may collect your IP address and other information stored in
cookies on your PC. The data collected about you by LinkedIn Ireland Unlimited Company may be
processed and transferred to countries outside the European Union. More information can be found
at https://www.linkedin.com/help/linkedin/answer/62533. LinkedIn's privacy policy also provides
contact details for further information.
Additionally, there are various applications available to block such data transfers to LinkedIn.
4.2.4. Google (Maps and Analytics)
Google Analytics
This website uses Google Analytics, a web analytics service provided by Google, to analyze website
usage. Google Analytics is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin
4, Ireland. Google processes the data regarding website usage on our behalf and is contractually
obligated to ensure the security and confidentiality of the processed data.
Google Analytics uses "cookies," text files stored on your computer that enable analysis of your use
of the website. The information generated by the cookie about your website usage is usually
transferred to a Google server in the USA and stored there. However, if IP anonymization is activated
on this website, Google will truncate your IP address within member states of the European Union or
in other countries that are part of the European Economic Area (EEA) before transferring it. Only in
exceptional cases is the full IP address transmitted to a Google server in the USA and truncated
there.
Please note that the level of data protection in the USA may not be equivalent to that in the EU.
On behalf of the website operator, Google will use this information to evaluate your use of the
website, compile reports on website activities, and provide additional services related to website and
internet usage to the website operator. The IP address transmitted by your browser as part of Google
Analytics will not be combined with other Google data.
You can prevent the storage of cookies by adjusting your browser settings. However, this may limit
your ability to use all features of this website. You can also prevent Google from collecting and
processing the data generated by the cookie related to your website usage (including your IP
address) by downloading and installing the browser plug-in available at
http://tools.google.com/dlpage/gaoptout?hl=de.
Please note that Google Analytics has been extended on this website with the code "anonymizeIp" to
ensure the anonymized collection of IP addresses (IP masking).
Google Maps
Our website uses Google Maps to display map information. Google Maps is provided by Google
Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. When using Google Maps, Google
collects, processes, and uses data related to the use of the Maps features by website visitors. Google
Maps typically sets a cookie in the browser to collect personal data.
For more information on how Google processes data, please refer to Google's privacy notices at
https://policies.google.com/privacy?hl=de&gl=at. In Google's Privacy Center, you can also modify
your settings to manage and protect your data. You can also disable, delete, or manage individual
cookies in your browser, depending on which browser you are using.

Additionally, Google USA has certified its participation in the EU-U.S. Data Privacy Framework (DPF)
with the U.S. Department of Commerce, making it equivalent to data processing within the EU/EEA
under the adequacy decision of the European Commission. This certification applies to the processing
of personal data by Google USA, which may be transferred from the European Economic Area (EEA)
under the DPF.
4.3. Umfang und Zweck der Datenverarbeitung von Patienten*innen im Zusammenhang mit
Fingerschweißanalysen
4.3.1
We conduct fingersweat analyses on your behalf and with your consent, usually via your treating
physician. The necessary health data is provided by you with your explicit consent, which can be
revoked at any time without affecting the legality of the processing carried out up to the point of
revocation.
4.3.2
In line with data protection principles, MetaboGnostics has decided to process health data (such as
lab data and analysis samples) only in a pseudonymized form. Therefore, we have agreed with the
treating physicians that only sufficiently pseudonymized health data will be sent to us for analysis. As
a result, it is usually not possible for us to identify individuals.
In exceptional cases (e.g., payment defaults, official requests, inquiries), we may request that your
treating physician provide us with your other personal data (such as title, name, address, date of
birth, telephone number, gender, social security number, time and type of consultation with the
responsible physician, reason for treatment, special risk factors like allergies, medical history and
corresponding reports, (suspected) diagnoses, description of the course of illness, data on
prescription, delivery, and use of medication, medical aids, and tools). Health data must always be
transmitted in encrypted form.
4.3.3
The data is processed solely for the analysis of the samples for medical diagnosis, billing of laboratory
services, and possibly for legally required evaluations. Additionally, the analysis results may be used
in anonymized form for scientific purposes. The legal basis for processing health data is Art. 9(2) of
the GDPR. Otherwise, contract processing (Art. 6(1)(b) of the GDPR) and any legal obligations (e.g.,
statutory retention in accordance with § 132 of the Austrian Federal Fiscal Code (BAO), § 190, and §
212 of the Austrian Commercial Code (UGB); Art. 6(1)(c) of the GDPR) provide the legal basis.
4.3.4
We only transmit your personal data to third parties if legally permissible.
Recipients of your personal data (analysis results) are the treating physicians who submitted the
sweat samples to us. If necessary, we may transmit your other personal data to private medical
billing services, debt collection agencies, or legal advisers in the event of payment defaults (Art.
6(1)(f) GDPR). Data may also be transmitted to health insurance carriers, authorities, or courts due to
legal obligations (e.g., based on the Epidemic Act, Code of Criminal Procedure, reporting obligations
under the 1998 Medical Practitioners Act).
Otherwise, personal data will not be transmitted to third parties.
4.3.5
Data will be stored in accordance with statutory retention periods. Furthermore, there may be a
legitimate interest in keeping data longer to safeguard our own legal interests (e.g., in the case of
pending or imminent legal proceedings).

4.3.6
All necessary technical and organizational measures (TOMs) are in place to ensure the confidentiality,
integrity, and availability of data, as well as the security of IT systems.
4.3.7
All our physicians, employees, and other involved persons (e.g., employees of contracted service
providers) are bound by (medical) confidentiality or professional secrecy. Our employees are obliged
to comply with these secrecy obligations and receive regular data protection training.
4.4. Scope and Purpose of Data Processing by Physicians in Connection with Finger Sweat Analyses
4.4.1
MetaboGnostics conducts finger sweat analyses on behalf of the patients and with their consent –
typically through referral by their treating physician.
The finger sweat sample is collected by the treating physicians and transmitted to MetaboGnostics in
a pseudonymized form. Once the analysis results are available, we are required to return them to the
respective physician in a pseudonymized form.
There is no data processing on behalf of a third party, as we are directly commissioned by the
respective patients.
4.4.2
In exceptional cases (e.g., payment default, official orders, inquiries, etc.), we may request the
treating physician to provide us with your other personal data (such as title, name, address, date of
birth, phone number, gender, social security number, the time and nature of the use of the
responsible physician or treatment, reason for treatment, specific risk factors [e.g., allergies], medical
history and associated findings, (suspected) diagnoses, description of the course of illness, data
regarding the prescription, dispensing, and application of medicines, medical aids, and devices).
Health data must always be transmitted in an encrypted form.
4.4.3
Data processing is carried out for sample analysis for medical diagnosis, billing of laboratory services,
and, if necessary, for legally required evaluations. Additionally, we may use the analysis results in
anonymized form for scientific purposes. The legal basis for our processing of health data is Article 9,
Paragraph 2 of the GDPR. Otherwise, the legal basis is the fulfillment of the contract (Article 6,
Paragraph 1(b) GDPR) as well as, where applicable, legal obligations (legally required retention in
accordance with §132 BAO and §§190 and 212 UGB; Article 6, Paragraph 1(c) GDPR).
4.4.4
We only transmit your personal data to third parties when it is legally permissible.
Recipients of patients' personal data (analysis results) are the treating physicians who have
transmitted the finger sweat samples to us. Data may also be transmitted to health insurance
providers, authorities, or courts due to legal obligations (e.g., based on the Epidemics Act, the
Criminal Procedure Code, or the reporting obligations according to the Physicians Act 1998).
Otherwise, no personal data will be transmitted to third parties.
4.4.5
The data will be stored according to legal retention periods. Beyond that, there may be a legitimate
interest in longer retention to safeguard our own legal interests (e.g., in the case of pending or
potential legal proceedings).

4.5. Scope and Purpose of Data Processing for Applicants
We process your personal data either for the initiation and execution of pre-contractual measures
(conclusion of a (freelance) service contract, Article 6, Paragraph 1(b) GDPR), based on your explicit
consent (Article 6, Paragraph 1(a) GDPR), if we would like to keep your application on record, or to
fulfill our legal obligations (registration as an employee with social security, Article 6, Paragraph 1(c)
GDPR).
The processing of your personal data is for handling the application process and for registration with
social security if we hire you. If you do not provide your data, we will not be able to process your
application. The specific details regarding the types of data to be collected can be found in the
application documents you have provided or filled out.
We store your personal data either for the duration of the application process or until the withdrawal
of your consent (in cases where you have given consent for us to keep your application on record).
Regardless of this, we store your data as long as there are legal retention obligations and delete
them if you have not provided consent for your data to be kept on record, after seven months.
During the application process, it may be necessary for us to transmit your data to the following
recipients:

Recipient:
WebTuga é uma marca registada da Dream Fusion – IT Services, Lda (PT508469058) 
Function: Hosting
LEGAL BASIS: Art 6 Abs 1 lit f DSGVO
Location: Portugal

5. What rights do you have regarding data processing?
You have the right, provided the legal requirements are met, to:
 Access information free of charge regarding the data processed about you (Art. 15 GDPR).
 Correction or completion of incorrect or incomplete data concerning you (Art. 16 GDPR).
 Deletion of your data (Art. 17 GDPR).
 Restriction of the processing of your personal data (Art. 18 GDPR) if:
o You dispute the accuracy of the personal data, allowing us the time needed to verify
its accuracy.

o The processing is unlawful, but you oppose deletion and request restriction of use
instead.
o We no longer need the data for the intended purpose, but you need it to establish or
defend legal claims.
o You exercise your right to object.

If data processing is required to protect our legitimate interests (Art. 6(1)(f) GDPR), you have the
right to object if your interest in confidentiality outweighs our interest in processing (Art. 21 GDPR).
You also have the right to data portability (Art. 20 GDPR), meaning you can receive the data you
provided to us in a structured, commonly used, and machine-readable format.
If we process your data based on your consent, you have the right to withdraw that consent at any
time via email. The legality of data processing prior to the withdrawal remains unaffected (Art. 7(3)
GDPR).
6. Existence of automated decision-making
We do not engage in automated decision-making or profiling.
7. What are your rights to lodge a complaint?
Should there be, contrary to expectations, a violation of your right to lawful processing of your data,
please contact us via email or postal mail. We will make every effort to address your concern
promptly. However, you also have the right to file a complaint with the data protection authority
responsible for you. In Austria, this is the Data Protection Authority, contact details available at
www.dsb.gv.at.
8. How can you contact us?
If you have further questions regarding data processing, you can reach our legal department at:
MetaboGnostics GmbH
Wienerstraße 180
A – 8051 Graz
Email: office@metabognostic.at
Website: www.metabognostics.at
9. Controller under GDPR and Data Protection Act (DSG)
The controller for processing your data as listed under section 3 is:
MetaboGnostics GmbH
Wienerstraße 180
A – 8051 Graz
Email: office@metabognostic.at
Website: www.metabognostics.at
10. Data Protection Officer Contact Information
MetaboGnostics GmbH
Attn: Data Protection Officer
Wienerstraße 180
A – 8051 Graz

Email: datenschutz@metabognostic.at

Version 1.0 – As of 01.10.2024