Privacy policy

This is a privacy statement for Hormonia Oy. Updated on 29. September 2025.

Hormonia Oy
www.hormonia.fi
tel. +358 (0)40 7480198

Niina Suni, [email protected] tel. +358 (0)40 7480198

Hormonian henkilötietorekisteri (Hormonia’s personal data register)

The data controller may store registered personal data in accordance with the current
legislation. The processing of personal data is based on an agreement or the consent of the data subject.

The purpose of processing personal data is to provide services, maintain customer
relationships, customer communication, marketing, processing of orders and invoicing, etc.

The data is not used for automated decision-making or profiling.

The information stored in the register may include: a person’s name, phone number, address
and email address. Date of birth and health-related information of some customers are also
stored.

Customers share their personal data electronically (booking system, contact form, health
information form, email). Some customers fill out a health information form, which is
completed and sent through an electronic system (or on paper, if so requested by the
customer).

The data subject's data is not regularly disclosed outside the EU or EEA, excluding
PracticeQ, an appointment scheduling and form system intended for the use of operators in the health care sector, which complies with very strict privacy protection regulations in line with the EU GDPR and in many aspects exceeding the requirements of the GDP.

PracticeQ only processes the data. Hormonia is the data controller and can remove the information
from the system at any time. The PracticeQ system stores the customers’ contact details, signed agreements and the information provided in the patient history form. The data of customers located in the European Union is routed through Canada. The European Commission recognises that the Canadian Personal Information Protection and  Electronic Documents Act (PIPEDA) is in line with the GDPR. A separate Data Processing Addendum
has been signed with IntakeQ. Additional information:
https://support.intakeq.com/article/236-intakeq-and-gdpr 

PracticeQ's administrator has access to data stored in the system but has signed an
agreement to not look at the data.

For invoicing purposes, customers’ contact details (name and email address) are stored in the invoicing service included in the Holvi Entrepreneurship service. Additional information (in Finnish): Privacy Notice – Holvin Asiakastukisivut 

For the purpose of ordering DUTCH hormone tests and nutritional supplements from Nordic Laboratories, customers’ details are also stored in the VMS database, which complies with
requirements of the EU GDPR. Additional information:https://nordicvms.com/page-About_us-2.html  

Some services also require that you register with Kajabi, which only stores information
disclosed by the customer. Additional information: https://kajabi.com/policies/privacy 

Personal data can be disclosed to authorities only when required by law.

The register is processed with due diligence, and data processed by information systems is appropriately protected. If the register data is stored on an Internet server, appropriate
physical and digital information security measures are taken to protect the equipment. The
data controller is responsible for ensuring that the stored data, access rights to servers and other information critical to the security of personal data are handled confidentially and only by employees whose work tasks include processing of such data.

In principle, personal data is stored for two years after the end of the customer relationship.

It may be necessary to store the data for a longer period of time to comply with accounting legislation or other mandatory
legislation.

In the case of a personal data breach affecting the customer's personal data, the customer is notified without undue delay and, where feasible, not later than 72 hours after having become aware of it.

A data subject is entitled to the following rights:
- right to be informed about the processing of their personal data
- right to access
- right to rectification
- right to erasure and right to be forgotten
- right to restriction of processing

- right to data portability
- right to object
- right not to be subject to a decision based on automated processing.

Any requests related to the above rights must be made in writing to the data controller.

The
data controller may require the requesting party to verify their identity. The data controller responds to the customer within the time limit specified in the EU GDPR (within a month as a
rule) and executes the request, unless prevented by legislation, open invoices, recovery measures or other reasons.

A data subject is entitled to withdraw their consent to personal data processing. A data subject is entitled to prohibit the use of their data for direct advertising, distance selling and
other direct marketing purposes as well as for conducting market and opinion research.
Requests, withdrawals of consent and prohibitions must be made in writing to the data controller.

We are continuously developing our operations, including data protection. Hormonia reserves the right to amend this privacy statement at any time. Visit our website for an up-to-
date privacy statement.