Privacy notice — waitlist & quiz
1. Who is responsible
The data controller is Huoma / Onalfa sp. z o.o. ("Huoma", "we"), [registered address — TO BE COMPLETED], [KRS / NIP — TO BE COMPLETED]. You can reach us about privacy at health@gethouma.com.
2. What we collect and why
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Email address, first name (optional) | Send you your quiz result; tell you when Neo launches; occasional pre-launch updates | Consent — Art. 6(1)(a). You tick a box; you can withdraw any time. |
| Quiz answers (goal, how you sleep, energy, stress level, wearables you use, supplement habits) and the resulting archetype / recommended product | Compute and remember your starting protocol; understand which starting points our early audience needs most | Consent — Art. 6(1)(a). Answers describe lifestyle preferences and are not used for any medical purpose. |
| Founding deposit (€1) — payment handled by Stripe | Reserve your founding place and price | Contract — Art. 6(1)(b). We receive only a confirmation, your email and a reference ID; we never see card details. |
| Technical & marketing data: campaign parameters (UTM), referring site, landing page, browser type, approximate time of visit, ad click identifiers | Measure which channels bring people to Neo and whether the site works | Legitimate interest — Art. 6(1)(f) for basic, first-party measurement; consent — Art. 6(1)(a) for any third-party advertising pixels (see section 5). |
We do not ask for, and ask you not to send us, health data such as diagnoses or medication. The quiz is about routines and preferences, not medical status.
3. Where your data goes
We use a small number of processors under GDPR-compliant agreements:
- Vercel (hosting and the form endpoint) — EU/US, Standard Contractual Clauses.
- Google Sheets and/or Klaviyo (waitlist storage and email sending) — depending on configuration; both operate under SCCs / EU–US Data Privacy Framework.
- Stripe (payment for the founding deposit) — Stripe is an independent controller for payment data; see Stripe's privacy policy.
- Analytics and advertising providers (Google Analytics, Meta, TikTok) — only if enabled and only after your consent, see section 5.
We never sell your data and never share it with anyone for their own marketing.
4. How long we keep it
- Waitlist data (email, name, quiz answers, result): until you unsubscribe or ask us to delete it, and at most 24 months after our public launch, after which it is deleted or anonymised unless you have become a customer.
- Deposit records: for as long as required by accounting law (in Poland generally 5 years from the end of the tax year).
- Technical logs on the hosting platform: up to 30 days.
5. Cookies, pixels and local storage
The site uses browser local storage (not a cookie) to remember campaign parameters you arrived with and your quiz progress within a session. This is first-party and not shared. If we enable third-party analytics or advertising pixels (Google Analytics 4, Meta Pixel, TikTok Pixel), they only load after you accept them in the consent banner shown on your first visit. Nothing is set before you choose. Change your choice — the banner will be shown again.
6. Your rights
Under the GDPR you can at any time:
- Access the data we hold about you and get a copy;
- Correct anything inaccurate;
- Delete your data ("right to be forgotten");
- Restrict or object to processing based on legitimate interest;
- Withdraw consent — with immediate effect for the future; every email has an unsubscribe link, or just reply "delete me";
- Port your data to another provider in a machine-readable format;
- Complain to a supervisory authority. In Poland this is the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl. You may also complain to the authority in your own EU country.
To exercise any right, email health@gethouma.com. We respond within one month.
7. Is providing data mandatory?
No. You can browse the site without giving us anything. To receive your quiz result by email or join the waitlist we need an email address and your consent; without them we simply can't contact you.
8. Automated decisions
The quiz uses a simple, transparent scoring rule to suggest one of three starting products. It is a lifestyle recommendation, not a decision with legal or similarly significant effect, and you can ignore it. There is no profiling beyond this.
9. Children
Neo is for adults. We do not knowingly collect data from anyone under 18. If you believe a minor has signed up, tell us and we will delete the record.
10. Changes
We will update this notice as Neo moves from pre-launch to a live platform. Material changes will be announced by email to waitlist members before they take effect.