Privacy Notice
Avara Health Oy
We at Avara Health Oy ("we", "us", "our") respect your concerns about privacy. This Privacy Notice explains how we use any personal data we collect about you and your rights in relation to that information. "Personal data" means any information that identifies you as an individual or is capable of identifying you as an individual.
For the purpose of applicable data protection laws, including the General Data Protection Regulation (the "GDPR") and the Finnish Data Protection Act (Tietosuojalaki 1050/2018), the data controller is:
Avara Health Oy
Business ID (Y-tunnus): 3609832-9
Finland
Email: info@avarahealth.fi
Medical services are provided by our partner TerveysProfiili Oy (Business ID: 3485813-6), trading as MediLux. The responsible physician is Rishat Yarullin (info@medilux.fi). TerveysProfiili Oy acts as an independent data controller for patient records and all medical data arising from those services.
If you have any questions about this Privacy Notice or about how we handle your personal data, please contact us at info@avarahealth.fi.
Information covered by this Privacy Notice
This Privacy Notice covers all personal data collected and used by us in connection with our coaching and wellbeing services.
Avara Health collects and processes wellbeing data solely in the context of lifestyle coaching. We do not process patient data or other special-category health data. Medical services and all associated patient data are handled exclusively by our partner TerveysProfiili Oy (MediLux) under their own privacy notice, and TerveysProfiili Oy acts as the independent data controller for those records.
The personal data we collect includes your name, age, date of birth, postal address, email address, phone number, payment details, the preferences you express to us, your comments and questions, and technical information from the devices you use to access our website and app.
In connection with our coaching service, we also collect wellbeing data that you choose to share with us, such as your height, weight, workouts and physical activity, meals, nutrition, and any other wellbeing information you voluntarily provide. This data is used solely for the purposes of lifestyle coaching and is not used for medical diagnosis or clinical decision-making. It also includes any pictures (including progress or body images) that you choose to share with us.
Summarising overview
| Processing purpose | Legal basis | Retention period |
|---|---|---|
| Management of your account | Article 6(1)(b) GDPR (performance of a contract) | 36 months after your last activity |
| Delivery of coaching and wellbeing services, including personalised coaching profiling | Article 6(1)(b) GDPR | 36 months after your last activity |
| Improving and developing our services, and customer satisfaction surveys | Article 6(1)(f) GDPR (legitimate interests) | 6 months after your last activity |
| Marketing communications and marketing-related profiling tailored to your needs | Article 6(1)(a) GDPR (consent) | 6 months after your last activity, or until you withdraw your consent |
| Payment processing | Article 6(1)(b) GDPR | For the duration of your contractual relationship with us. Payment data needed for statutory bookkeeping is retained as set out in the recordkeeping row below |
| Mandatory recordkeeping (accounting) | Article 6(1)(c) GDPR, as we are required to store e.g. bookkeeping material that may include personal data, under the Finnish Accounting Act (Kirjanpitolaki 1336/1997) | For the period required by the Finnish Accounting Act, generally at least 6 years from the end of the calendar year in which the financial year ends |
Personal data we obtain
We (and our service providers) collect this personal data from you when you:
- purchase products or services from us, including a coaching subscription;
- submit any information through our website;
- create an account with us, or otherwise sign up for our services;
- complete a wellbeing questionnaire or start coaching with us;
- opt in to or otherwise receive marketing from us or our representatives;
- choose to participate in our customer feedback surveys;
- communicate with us via third-party social media websites;
- contact us, correspond with us, or otherwise provide information to us.
We may also receive personal data about you from third parties, including our payment provider Stripe (for example payment confirmation and fraud-screening results), and any partner or coach who referred you to us. We will only use such data for the purposes described in this Notice.
When you visit our website and app, we (and our service providers) may use cookies and similar technologies to automatically collect the following information:
- technical information, including your IP address, login information, browser type and version, device identifier, location and time-zone setting, browser plug-in types and versions, operating system and platform, page response times and download errors;
- information about your visit, including the pages and products you view or search for, and the websites you visit before and after ours;
- length of visits to certain pages, page interaction information (such as scrolling, clicks and mouseovers) and the methods used to browse away from the page.
Within our app you may choose to:
- record a fitness activity, for example a walk or a run. To do this you first allow the app to access your location, after which the app accesses your location data from the moment you start recording until the moment you stop. You can remove this permission at any time in your device settings;
- import your history of fitness activities from Apple Health or Google Health Connect. You can remove this permission at any time in your app or device settings.
While you are generally free to choose how much personal data you share with us, please note that choosing not to share certain personal data may limit our ability to provide our service and to perform the contract you have entered into with us.
How we use the information we obtain
We use the personal data we collect from and about you for the following purposes:
- to set up and manage your online account;
- to provide our coaching and wellbeing services to you, which may include:
- designing tailored meal, nutrition and workout plans;
- monitoring changes or adaptations in your body to improve your coaching, and combining the information we receive and collect to give you a more personalised experience;
- keeping a history of your fitness activities, including (where available) duration, distance, speed, activity type and heart rate, and an overview of your progress;
- giving you access to chat functionality, including any group chat with other clients;
- to send you marketing communications about our products and services, where you have consented to this;
- to send you invitations to take part in customer satisfaction surveys;
- to process your payments;
- to notify you of any changes to our services that may affect you;
- to comply with our legal obligations, including keeping internal financial records.
Pictures that you choose to share with Avara Health Oy are used by us solely for tracking your progress and supporting your coaching, and will never be shared on our website or social media unless you give your explicit consent.
Automated decision-making and profiling
We use profiling to personalise your coaching and, where you have given your consent, to tailor marketing communications to your needs. We do not make decisions that produce legal effects concerning you, or similarly significantly affect you, based solely on automated processing within the meaning of Article 22 GDPR. If this ever changes, we will tell you, explain the logic involved and the significance and likely consequences of such processing, and put in place appropriate safeguards.
Third parties, including our platform provider
The security of your personal data is extremely important to us. We do not sell your personal data to any third parties, and we never will.
Access to your personal data is only provided to carefully selected third parties, including:
- Our service providers who help us deliver our services to you, such as our coaching platform Coachway (Coachway ApS, Denmark), hosting and infrastructure providers (Railway and Northflank), error monitoring (Sentry), product analytics (PostHog) and payment processing (Stripe). Each of these providers is bound by a data processing agreement.
- TerveysProfiili Oy (MediLux), our medical services partner, who receives only the referral information necessary to book your appointment. TerveysProfiili Oy acts as an independent data controller for all patient records and medical data.
- Regulators, law enforcement agencies or other public authorities where we are required to disclose your personal data by law.
- Potential buyers and their advisers in the event of a business transfer, provided that the receiving party agrees to treat your personal data in a manner consistent with this Privacy Notice.
How long we retain your personal data
| Processing purpose | Retention period |
|---|---|
| Management of your account | 36 months after your last activity |
| Delivery of coaching and wellbeing services | 36 months after your last activity |
| Marketing and marketing-related profiling, and customer satisfaction surveys | 6 months after your last activity, or until you withdraw your consent |
| Payment processing and mandatory recordkeeping (accounting) | For the period required by the Finnish Accounting Act, generally at least 6 years from the end of the calendar year in which the relevant financial year ends |
Third-country data transfers
The personal data we collect from you may be transferred to, and stored at, a destination outside the European Economic Area ("EEA"), including the USA. We take all steps reasonably necessary to ensure that your personal data is treated securely and in accordance with this Privacy Notice and applicable data protection laws, including entering into the European Commission's Standard Contractual Clauses with the party outside the EEA receiving the personal data, in accordance with Article 46(2)(c) GDPR. You can request a copy of the safeguards we use by contacting us at info@avarahealth.fi.
Keeping your information secure
We have implemented technical and organisational security measures to safeguard the personal data in our custody and control. These measures include limiting access to personal data to those employees and authorised service providers who need it for the purposes described in this Privacy Notice.
Certain personal data stored in your online account is only accessible using your username and password. You are responsible for keeping your account credentials confidential. Please notify us immediately of any unauthorised use of your account credentials or any other suspected security breach.
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Office of the Data Protection Ombudsman without undue delay and, where the breach is likely to result in a high risk, inform you directly, in line with Articles 33 and 34 GDPR.
Children
Our service is intended for adults (18 years and older). We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us with personal data, please contact us at info@avarahealth.fi.
Your personal data rights
You have a number of rights in connection with our processing of your personal data:
- Access. You have the right to request a copy of the personal data we process about you, which we will provide to you in electronic form.
- Rectification. You have the right to have any incomplete or inaccurate personal data we process about you corrected.
- Erasure. You have the right to ask us to delete personal data we process about you, except where we need to retain it to comply with a legal obligation or to establish, exercise or defend legal claims.
- Restriction. You have the right to restrict our processing of your personal data in certain circumstances.
- Objection. Where the legal basis for our processing is our legitimate interest, you have the right to object to that processing. You may object to direct marketing at any time.
- Portability. Where we process your personal data on the basis of consent or a contract and by automated means, you have the right to receive that data in a structured, commonly used and machine-readable format.
- Withdrawing consent. Where we process personal data on the basis of your consent, you have the right to withdraw that consent at any time.
- Automated decision-making. You have the right not to be subject to a decision based solely on automated processing that produces legal effects concerning you. As explained above, we do not carry out such decision-making.
To exercise any of these rights, please contact us at info@avarahealth.fi and include your name, email and postal address, and your specific request. We will respond within one month of receipt.
You also have the right to lodge a complaint with the supervisory authority:
Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto)
Postal address: PL 800, 00531 Helsinki, Finland
Visiting address: Lintulahdenkuja 4, 00530 Helsinki, Finland
Telephone: +358 29 566 6700
Email: tietosuoja@om.fi
Website: tietosuoja.fi
Cookies
We use cookies and similar technologies on our website and app. Cookies fall into the following categories:
- Strictly necessary cookies, which are required for the website and app to function and for which we do not need your consent;
- Analytics cookies, which help us understand how our website and app are used so that we can improve them (for example through our product analytics provider PostHog);
- Marketing cookies, which are used to deliver and measure marketing that is relevant to you.
We only set analytics and marketing cookies with your consent, which you give through our cookie banner and can change or withdraw at any time through your browser settings or our cookie preferences.
Changes to this Privacy Notice
We may update this Privacy Notice from time to time to reflect changes in our services, technology or legal obligations. We will post the updated version here and revise the "Last updated" date below. Where changes are material, we will notify you directly (for example by email or in the app) and, where required, ask for your renewed consent before the change takes effect.
How to contact us
If you have any questions about this Privacy Notice or about our privacy practices or those of our service providers, please contact us at info@avarahealth.fi.
Last updated: 10 June 2026
