Privacy Policy

This Privacy Policy forms part of the Terms and Conditions of Norholm, MB, company code 307698646, with our registered office at Girulių g. 10, LT-12112 Vilnius, the Republic of Lithuania (hereinafter referred to as the Company, We, Us or Our). Capitalized terms used in this Privacy Policy carry the same meaning as in the Terms, unless Clause 1 below gives them a different meaning.

This Privacy Policy sets out how We gather, use, store and disclose information about You when You use the Product at zenday.health. We may amend it from time to time by publishing the amended version on the website of the Product, and We will tell You in advance where an amendment materially affects You. The date on which this version was issued appears at the end of this Privacy Policy.

1. Definitions

In this Privacy Policy, the following capitalized terms carry the following meanings:

Automatic Data carries the meaning given in Clause 2.

Health Data means information about Your physical or mental health, symptoms, medication, treatment or wellbeing, whether entered by You or derived from what You enter. Health Data is a special category of personal data under Article 9 of the GDPR.

Non-Personal Information means information that does not relate to an identifiable person and cannot be used to identify one, including aggregated and anonymized statistics.

Payment Information carries the meaning given in Clause 2.

Personal Information means any information relating to an identified or identifiable natural person, as described in Clause 2.

Product means the Zenday website and web application available at zenday.health, together with its features and content.

GDPR means Regulation (EU) 2016/679.

2. What Personal Information do We collect?

We collect Personal Information about You when You use the Product or communicate with Us in any way.

(a) Information You give Us voluntarily. This includes information You submit when You register an account, when You correspond with Our support team, when You respond to questions or surveys, when You purchase a subscription, and when You subscribe to Our newsletter.

The Personal Information We may collect in this way includes, without limitation: Your email address; Your password, which We store only in hashed form; Your account settings, language and time zone preferences; and any other information You choose to supply to Us.

(b) Health Data. The Product exists so that You can keep a record of Your own health. The Health Data We collect is the information You choose to log, which may include symptoms and their severity, moods, medications and supplements, sleep, habits, physical activity, diary entries, notes and any other categories the Product offers.

We process Health Data only on the basis of Your explicit consent, which We request separately from Your acceptance of the Terms and before any tracking feature becomes available to You. Your consent is entirely voluntary; You may decline it, in which case You will not be able to use the tracking features, and You may withdraw it at any time as described in Clause 11. We do not use Health Data for advertising, marketing, profiling or enrichment purposes, and We do not sell it, rent it or lease it to anyone.

(c) Payment Information. The Payment Information We may collect includes the date of purchase, the name of the payment method holder, the subscription plan purchased, the transaction or payment identifier, the billing country and Your VAT status where relevant. We do not receive or store Your full payment card number or security code; these are handled directly by Our payment services provider.

(d) Automatic Data. We automatically collect certain technical information transmitted to Us by the device and browser through which You access the Product (hereinafter referred to as Automatic Data). Automatic Data includes, without limitation, Your internet protocol (IP) address, a unique identifier associated with Your access device or browser, the characteristics of that device and browser, Your operating system, statistics about Your activity within the Product, error and diagnostic logs, and records of the support We have provided to You. Where local law treats IP addresses or comparable identifiers as Personal Information, We treat them the same way.

We collect Automatic Data on the basis of Our legitimate interests in keeping the Product secure, diagnosing faults and understanding in aggregate how the Product is used, as set out in Clause 3. You may object to this processing as described in Clause 11.

(e) Children. The Product is intended for adults. You may not create an account unless You are at least 18 years old, and We do not knowingly collect Personal Information from anyone under that age. If We become aware that We hold information relating to a person under 18, We will delete it. If You believe We may hold information about a child, please contact Us immediately in the manner described in Clause 13.

3. Why do We collect, use and disclose Personal Information?

We collect, hold, use and disclose Your Personal Information for the purposes set out below. Because We are established in the European Union, each purpose is matched with the legal basis on which We rely.

Where We rely on Our legitimate interests, We have weighed those interests against Your rights and freedoms and concluded that Our processing does not override them. You may ask Us for a summary of that assessment at any time.

Certain messages are essential to Our contractual relationship with You — for example, confirmations of purchase, billing notices and notifications of changes to the Terms. Because of their importance, You cannot opt out of receiving them for as long as You hold an account.

You are under no obligation to give Us the Personal Information We request. If You choose not to, however, We may be unable to provide the Product to You or to respond to Your enquiries.

4. Do We use Your Personal Information for direct marketing?

We may send You marketing messages about the Product, including by email. We do so only where You have separately opted in, and Your consent to marketing is never a condition of registering for or using the Product.

You may withdraw Your consent at any time by using the unsubscribe link in any marketing message, or by contacting Us in the manner described in Clause 13. Withdrawing Your consent will not affect the service messages described in Clause 3.

We do not use Health Data to decide what marketing to send You, and We do not disclose Personal Information to third parties for their own marketing or advertising purposes.

5. To whom do We disclose Your Personal Information?

We disclose Your Personal Information only to the following categories of recipient, and only to the extent reasonably necessary:

(a) Service providers acting on Our instructions. These include Our hosting and cloud infrastructure provider, which stores the data held in the Product; Our email delivery and customer support providers; and Our analytics and error-monitoring providers, which receive Automatic Data. Each of them acts as Our processor under a written agreement that obliges it to protect Your Personal Information, to process it only as We instruct, and not to use it for its own purposes. We will tell You the identity of any of these providers on request.

(b) Our payment services provider. Depending on the payment method You select, Your Payment Information will be disclosed to and processed by Our payment services provider so that payments and subscriptions can be collected, processed and administered. That provider handles Your card details as an independent controller under its own privacy notice.

(c) Professional advisers and authorities. We may disclose Personal Information to Our accountants, auditors, insurers and legal advisers where necessary for compliance or for the purposes described in Clause 3, and to public authorities, courts or regulators where We are legally required to do so.

(d) Protection of rights and safety. We may disclose Personal Information where We reasonably believe disclosure is necessary to protect the rights, property or safety of the Company, Our users or others, including for the prevention of fraud. We limit such disclosures to what is strictly necessary.

(e) Corporate transactions. If Our business or any part of it is sold, merged or reorganised, Personal Information may be transferred to the acquiring party, which will remain bound by this Privacy Policy or will give You notice of any change to it.

We do not disclose Your Personal Information to data brokers, advertising networks or any third party for the purpose of combining it with information that party already holds about You. We do not sell, rent or lease Your Personal Information.

6. International transfers

We aim to store and process Your Personal Information within the European Economic Area. Where a service provider referred to in Clause 5 processes Personal Information outside the European Economic Area, We rely on one of the safeguards permitted by Chapter V of the GDPR: an adequacy decision of the European Commission, the European Commission’s Standard Contractual Clauses, or another lawful transfer mechanism. You may request details of the safeguards applying to a particular transfer in the manner described in Clause 13.

7. Using Our website and cookies

We collect information about Your use of the Product’s website, including the pages You visit, the date and time of Your visit and the IP address assigned to Your device.

We also use cookies and comparable technologies. Cookies are small files stored on Your device that allow the party placing them to recognise Your device across sessions.

Cookies that are strictly necessary to operate the Product — for example those that keep You signed in, remember Your preferences and protect the security of Your account — are set without Your consent, as the law permits. Any other cookie, including analytics and performance cookies, is set only if You agree through Our cookie banner. You may change or withdraw Your choice at any time through the cookie settings on the website, and You may delete or block cookies through Your browser, although the Product may then not function as intended.

Where cookies collect Personal Information, We handle it as described elsewhere in this Privacy Policy.

8. Data security

We hold Your Personal Information in electronic form and take appropriate technical and organisational measures to protect it against misuse, loss, interference, and unauthorized access, alteration or disclosure. These measures include encryption of data in transit and at rest, storage of passwords in hashed form, access controls that restrict Our personnel to the data they need in order to do their work, logging of administrative access, and periodic review of Our service providers.

No method of transmission over the internet and no method of electronic storage is entirely secure, and We therefore cannot guarantee the absolute security of Your Personal Information.

The security of Your account also depends on You. You are responsible for keeping Your login credentials confidential and for not sharing them with anyone. We are not responsible for the consequences of Your disclosure of Your credentials or of any information You choose to make available to others.

Where a personal data breach occurs that is likely to result in a high risk to Your rights and freedoms, We will notify You and the competent supervisory authority as required by Articles 33 and 34 of the GDPR.

9. Retention

We do not keep Your Personal Information for longer than is necessary for the purposes for which it is processed. In any event, We apply the following periods:

(a) account data and Health Data are retained for as long as Your account remains active, and are deleted within 30 days of Your account being closed or Your asking Us to delete it;

(b) backup copies are overwritten in the ordinary course of Our backup cycle, within 90 days;

(c) support correspondence is retained for no longer than 24 months following the last message in the exchange;

(d) marketing consent records and messaging data are retained for no longer than 24 months after Your consent is given, or until You withdraw it, whichever comes first;

(e) Automatic Data, including technical and security logs, is retained for no longer than 12 months;

(f) accounting and invoicing records are retained for 10 years, as required by the accounting legislation of the Republic of Lithuania.

At the end of the applicable period, or on Your request where You are entitled to erasure, Personal Information is deleted or irreversibly anonymized.

Notwithstanding the above, We may retain Personal Information for longer where retention is necessary in order to comply with a legal obligation to which We are subject, or to protect Your vital interests or those of another natural person, or for the establishment, exercise or defence of legal claims.

10. Exclusions

The Product may contain links to websites operated by third parties. Those links are provided for convenience, may not be kept current, and are not maintained by Us. We do not control those websites, have no rights in them, and are not responsible for their content or their privacy practices. Their terms and privacy policies may differ substantially from Ours, and We encourage You to read them before use.

This Privacy Policy does not apply to Personal Information You provide to anyone other than Us, whether through the Product or by any other means.

11. Your rights

You have the following rights in relation to Your Personal Information:

(a) Access. You may ask Us to confirm whether We process Personal Information about You and to provide You with a copy of it.

(b) Rectification. If You believe any Personal Information We hold about You is inaccurate or incomplete, You may ask Us to correct or complete it.

(c) Erasure. You may ask Us to delete Your Personal Information, including Your account and all Health Data in it.

(d) Restriction. You may ask Us to restrict Our processing of Your Personal Information in the circumstances set out in Article 18 of the GDPR.

(e) Objection. You may object to processing that We carry out on the basis of Our legitimate interests, including the collection of Automatic Data.

(f) Portability. You may ask Us to provide the Personal Information You have given Us in a structured, commonly used and machine-readable format, or to transmit it to another controller where technically feasible.

(g) Withdrawal of consent. You may withdraw Your consent to the processing of Health Data, and Your consent to marketing, at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal, but We will stop the processing concerned and delete the affected data in accordance with Clause 9.

To exercise any of these rights, contact Us in the manner described in Clause 13. We may need to verify Your identity before acting on a request. We will respond within one month of receiving Your request, and will tell You if a complex request requires up to two further months. Exercising Your rights is free of charge, unless a request is manifestly unfounded or excessive.

Complaints. If You are dissatisfied with how We handle Your Personal Information, please raise it with Us first. You are also entitled to lodge a complaint with the State Data Protection Inspectorate of the Republic of Lithuania (Valstybinė duomenų apsaugos inspekcija, L. Sapiegos g. 17, LT-10312 Vilnius, ada@ada.lt, vdai.lrv.lt), or with the supervisory authority of the country in which You live or work.

12. AI tools

We may use customer support solutions powered by third-party artificial intelligence tools when You contact Us by email or through any in-Product chat function.

(a) Any AI-based assistant We use is supplied by a third-party provider whose technology supports the functionality of the Product.

(b) Where You interact with such an assistant, the data processed may include Your account identifiers, the content of Your query, Your interactions with the assistant and any information You choose to share in the course of the conversation. It is processed in order to understand and respond to Your enquiry.

(c) The scope of what is processed therefore depends on the nature of Your enquiry and on what You include in it. Please do not include Health Data or other sensitive details in a support enquiry unless they are necessary in order for Us to help You.

(d) We process this data in order to provide and improve customer support, on the basis of Our contract with You and Our legitimate interests. We do not use it to train third-party AI models, and Our agreements with these providers prohibit them from doing so.

(e) Data processed by these tools may be disclosed to the third-party provider supplying them, in its capacity as Our processor, subject to the safeguards described in Clauses 5 and 6.

(f) AI-based assistants do not decide subscription, cancellation, refund or data subject rights requests, and do not give final answers on them. Requests of that kind are handled by a member of Our team; contact Us as described in Clause 13.

13. Contact Us

For any question about this Privacy Policy or Our practices, to exercise any of the rights described in Clause 11, or to make a complaint, email Us at support@zenday.health.

You may also write to Us at: Norholm, MB, Girulių g. 10, LT-12112 Vilnius, Republic of Lithuania.

14. Additional rights of residents of the United States

We are established in Lithuania and are not a covered entity or business associate under the United States Health Insurance Portability and Accountability Act (HIPAA); HIPAA does not apply to the information You enter into the Product. Certain laws of individual US states do, however, grant You specific rights, including the California Consumer Privacy Act as amended (the CCPA) and state consumer health data legislation.

To the extent that such laws apply to You, You have the right to know what Personal Information We collect about You and the purposes for which We use it; the right to obtain a copy of that information; the right to have it corrected; the right to have it deleted; the right to withdraw Your consent to the collection of Your Health Data; and the right not to be discriminated against, or receive a different level of service, because You exercised any of these rights.

For the purposes of the CCPA and comparable state laws, We do not sell or share Your Personal Information, We do not disclose it for cross-context behavioural advertising, and We do not use Your Health Data for targeted advertising.

To exercise any of these rights, contact Us as described in Clause 13.

Last updated: 7 August 2026

The content of the Product does not constitute a medical consultation of any kind and is provided for informational purposes only. Consult a certified medical professional for medical advice, diagnosis or treatment.

© 2026 Zenday · Norholm, MB