Privacy Policy

As of: 12 June 2026 · Version 1.3 (initial draft)

This Privacy Policy describes how YUTHI life GmbH (hereinafter “YUTHI”, “we”, “us”) collects, processes and protects the personal data of users of the website www.yuthi.life as well as all associated subdomains and services (hereinafter the “Platform”).

We comply with the revised Swiss Federal Act on Data Protection (revDSG, in force since 1 September 2023) and — where applicable — with the EU General Data Protection Regulation (GDPR/DSGVO).

1. Data controller

The party responsible for data processing within the meaning of the revDSG, i.e. the “controller” pursuant to Art. 4 No. 7 GDPR, is:

YUTHI life GmbH
Kirchgasse 5
6287 Aesch LU
Schweiz

Handelsregister: Kantonales Handelsregisteramt Luzern
UID: CHE-189.596.813

Email: info@yuthi.life

Data protection enquiries

For all enquiries relating to data protection (access, rectification, erasure, objection, data portability) you can reach us at:

📧 info@yuthi.life
Subject: “Data protection enquiry”

We have not currently appointed a data protection officer pursuant to Art. 37 GDPR, as the requirements for a mandatory appointment are not met. Within Switzerland, the revDSG likewise imposes no obligation to designate one.

2. Scope

This Privacy Policy applies to all data processing in connection with:

• the website www.yuthi.life and all its sub-pages,
• contact by email to info@yuthi.life and our further functional addresses (social@yuthi.life, anbieter@yuthi.life, intern@yuthi.life),
• the (currently dormant) newsletter via the Beehiiv platform.

Linked third-party websites (e.g. provider websites, partner links, affiliate destinations) are not subject to this Policy. The respective operators are solely responsible for the data processing that takes place there.

3. Definitions

We use the terms of the GDPR and the revDSG. The most important ones in brief:

• Personal data: any information relating to an identified or identifiable natural person (e.g. name, email address, IP address).
• Processing: any handling of personal data — such as collection, storage, use, alteration, disclosure, archiving, deletion.
• Processor: an entity that processes personal data on our behalf (e.g. our hosting provider).
• Data subject: the person whose data is being processed — usually you as the user.

4. Legal bases

We base the processing of your personal data on the following grounds:

• Consent (Art. 6(1)(a) GDPR; Art. 31(1) revDSG) — e.g. for newsletter sign-up or optional cookies.
• Performance of a contract (Art. 6(1)(b) GDPR; Art. 31(2)(a) revFADP) — e.g. to answer your enquiry by email.
• Legal obligation (Art. 6(1)(c) GDPR) — e.g. commercial and tax retention obligations.
• Legitimate interest (Art. 6(1)(f) GDPR; Art. 31(2)(d) revDSG) — e.g. IT security, abuse prevention, statistical analysis in anonymised form.

5. Hosting & server logs

The Platform is hosted by All-Inkl.com — Neue Medien Münnich, Hauptstr. 68, 02742 Friedersdorf, Germany (hereinafter “All-Inkl”). Server location: Germany (EU).

Each time our website is accessed, the following data is technically and necessarily recorded in server logs:

• IP address (truncated after 7 days)
• date and time of the request
• URL or file accessed
• HTTP status code and volume of data transferred
• referrer URL (if transmitted)
• User-Agent (browser type and version, operating system)

Purpose: IT security, stability, defence against attacks, error analysis.
Legal basis: legitimate interest (Art. 6(1)(f) GDPR; Art. 31(2)(d) revDSG).
Retention: max. 14 days; thereafter automatic deletion. Anonymised analyses may be stored for longer.

A data processing agreement (DPA) pursuant to Art. 28 GDPR has been concluded with All-Inkl. All-Inkl privacy policy: all-inkl.com/datenschutzinformationen/.

Coarse geolocation (Geo-IP): So that we can show you content and providers relevant to your region, we determine the approximate country or region from your IP address — on our own server, using a locally stored database (MaxMind GeoLite2). Your IP address is neither stored nor passed on to third parties; the evaluation only takes place for the individual page view. Legal basis: legitimate interest (Art. 6(1)(f) GDPR; revDSG) in a regionally appropriate presentation.

6. Cookies & similar technologies

We use cookies sparingly and exclusively for specific purposes. Detailed information on each individual cookie can be found in our separate Cookie Policy.

Overview:

• Strictly necessary cookies / local storage: e.g. language choice, cookie settings. No consent required.
• Functional storage: e.g. “country confirmation” (splash modal). Browser LocalStorage.
• Marketing / third-party cookies: only set when you actively use embeds (e.g. Vimeo player, YouTube video). See section 10.
• Consent storage: yuthi_consent_v1 — technically necessary, stores your cookie decision; no tracking.
• Region: yuthi_location — only if you allow “Region & personalisation”; remembers your chosen region.

Non-essential cookies (statistics, marketing) are only set after your consent via our cookie banner; you can revoke them at any time in the footer.

You can prevent cookies from being set at any time in your browser settings or delete cookies that have already been stored. Disabling them may lead to restrictions of individual functions.

7. Processors and service providers used

We engage carefully selected service providers. With every service provider that processes personal data on our behalf, we conclude — where required — a data processing agreement (DPA) and verify appropriate safeguards for data transfers to third countries.

This list is continuously updated. With every new integration of a service, software or tool that processes personal data, we promptly review and supplement this Policy.

8. Data transfer abroad

We prefer service providers based and processing data in Switzerland or the EU. In individual cases, however, a transfer to third countries (in particular the USA) is necessary — namely for Vimeo, YouTube and Beehiiv.

Safeguards for an adequate level of data protection:

• For the USA we rely — where the respective provider is certified — on the EU-US Data Privacy Framework as well as, for Switzerland, on the Swiss-US Data Privacy Framework.
• In addition, EU standard contractual clauses (SCC, 2021/914) as well as supplementary technical and organisational measures (encryption, pseudonymisation) are applied.
• For each third-country transfer we verify the existence of an adequacy decision pursuant to Art. 16 revDSG or Art. 45 GDPR.

On request, we will make the relevant safeguards (e.g. signed SCCs) available to you.

9. Web analytics

We currently do not use any web analytics or tracking tools (e.g. Google Analytics). Should we use such a tool in the future, we will inform you here in advance and obtain — where required — your consent.

10. Video embeds (Vimeo & YouTube)

We embed videos to introduce providers and for our hub showcases. We primarily use Vimeo (Vimeo, LLC, 330 West 34th Street, 5th Floor, New York, NY 10001, USA) as well as, occasionally, YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; parent company: Google LLC, USA).

Important: the embedding takes place — as far as technically possible — in enhanced privacy mode, i.e. with the Do-Not-Track option enabled:

• Vimeo: the player parameter dnt=1 disables third-party tracking.
• YouTube: embedding via youtube-nocookie.com — cookies are only set when the video starts.

When you click on the preview image, data is transmitted to the respective providers, namely IP address, browser, device information and, where applicable, an anonymised usage profile. We have no direct influence over this.

Vimeo privacy: vimeo.com/privacy.
YouTube/Google privacy: policies.google.com/privacy.

Legal basis: consent through click-to-play as well as legitimate interest in an attractive presentation of providers.

11. Stock photos — Pexels

Parts of the visual language are taken from the royalty-free collection of Pexels (Pexels, a Canva service). We use exclusively royalty-free content under the Pexels licence.

The images are stored on our own server and delivered from there. When you visit our pages, no personal data is therefore transmitted to Pexels. Image selection takes place exclusively server-side via the Pexels application programming interface (API). Privacy: pexels.com/privacy-policy.

12. Contact form & email communication

When you contact us by email (info@yuthi.life, social@yuthi.life, anbieter@yuthi.life), we process the following data:

• name (if provided)
• email address
• content of the message
• technical metadata (time, IP, where applicable mail headers)

Purpose: responding to your enquiry, preparing possible contractual relationships.
Legal basis: pre-contractual measure / contract (Art. 6(1)(b) GDPR) or legitimate interest (lit. f).
Retention: until completion of processing, at the latest within the framework of statutory retention obligations (as a rule up to 10 years for business-relevant correspondence, Art. 958f CO).

13. Newsletter (Beehiiv)

For our newsletter we use the platform Beehiiv, Inc. (228 Park Ave S #29976, New York, NY 10003, USA). The newsletter is currently dormant — dispatch only takes place after explicit activation (expected in Q4 2026).

Upon sign-up we process:

• email address
• time of sign-up, IP address, confirmation date (double opt-in)
• open and click statistics (for quality assurance; in aggregated form)

Legal basis: consent (Art. 6(1)(a) GDPR; Art. 31(1) revDSG). Consent can be withdrawn at any time via the unsubscribe link in every newsletter email or by message to info@yuthi.life.

Beehiiv privacy: beehiiv.com/privacy. Beehiiv is listed under the EU-US Data Privacy Framework.

14. Planned future features

As the Platform continues to be expanded, further features will be added. This Policy will be supplemented in advance — the following outlook is informative.

• Face ID, Touch ID and fingerprint: these never leave your device and never reach us. Apple or Google check them on the device only and tell us just whether the check succeeded. All we store for this is a refresh token in your device’s keychain — you can delete it any time in the app settings under “Sign-in”.
• Awin / Webgains: affiliate networks. Click IDs and conversion data for commission settlement.
• HeyGen: AI-avatar-based marketing videos (internal, not user-facing).

Part B — The YUTHI app

The following sections apply to the YUTHI app on iPhone and iPad. They supplement the preceding sections, which relate to the yuthi.life website. Where the two differ, this part governs the app. The sections that follow on data security, retention, your rights and changes apply to both website and app.

B1. What data the app processes

You provide all of this yourself — the app collects nothing in the background that is not listed here.

The app contains no advertising or analytics tools. There is no tracking via services such as Google Analytics or Firebase, no data is passed to advertising networks and no data is sold.

B2. Health data

Medication, blood values, complaints, allergies and the values from Apple Health are sensitive personal data within the meaning of Art. 5 lit. c revFADP and special categories of personal data under Art. 9 GDPR.

We process them solely on the basis of your explicit consent, which you give when first starting the app and can withdraw at any time in the settings. Withdrawal takes effect for the future and does not affect the lawfulness of processing carried out beforehand.

You are not obliged to provide any of this. The app remains usable without it — it can simply support you less precisely.

YUTHI is not a medical device and does not provide diagnoses. All guidance is for general orientation and does not replace medical advice, diagnosis or treatment.

Movement and location data (outdoor sessions): When you record a session in the "Outdoors" section, the app saves your route (GPS positions with timestamp and altitude), the session metrics (distance, duration, pace, calories, elevation gain, sun minutes) and — if authorised — heart rate values. Recording only runs while you have started it. This data is stored in your personal area (see B8), is visible exclusively to you, and is completely removed when your account is deleted.

B3. The AI coach

The coach uses language models from Anthropic PBC, San Francisco, USA. Only what is needed for the respective reply is transmitted: your message, attached images or documents, and an extract from your profile and your entries of recent days.

Your email address and your full name are not transmitted. Anthropic processes the data as a processor, does not use it to train its models and stores it for a maximum of 30 days for abuse detection. The transfer to the USA is based on the European Commission’s standard contractual clauses with the Swiss addendum.

The coach is involved in: chat replies, recognising meals from text and photos, recognising the sport from photos, checking uploaded images, creating daily, weekly and training plans, and wording push notifications.

B4. Photos in the app

You can store a profile picture and attach photos in the chat, for example of meals or a blood test. Before saving, an automated check determines whether an image shows impermissible content; for this it is transmitted once to Anthropic and not stored there. The images then reside in your personal area and are accessible to no one but you.

B5. Apple Health

At your request the app reads values from Apple Health. You grant permission in iOS, not in the app, and can withdraw it there individually at any time (Settings → Privacy & Security → Health). Only the values listed under B1 are read. With your permission the app writes training and drinking data back. Data from Apple Health is not used for advertising and not shared with third parties.

B6. Push notifications

If you consent, YUTHI sends notifications — for example a reply from the coach or a reminder. For this we store a device token from Apple. You can withdraw consent at any time in the iOS settings; the token is then deleted. Delivery takes place via Apple’s push service (APNs); Apple receives the displayed text.

B7. Device permissions

iOS asks for each permission individually. You may decline any of them — the app remains usable, the respective function is simply unavailable.

B8. Storage location and deletion

Your data is held at Supabase on servers in Zurich, Switzerland. Every record is tied to your account; the database technically only returns the rows belonging to your signed-in account. The exception is the coach: for each reply the extracts described under B3 go to Anthropic in the USA.

In the app settings you can delete your account yourself. All entries, your profile, your chat history and your push token are removed — on the server and on the device. Deletion is immediate and cannot be undone.

Part C — Country-specific supplements

The YUTHI app is offered in Europe, Canada, South and Central America, Japan, Australia, New Zealand, Singapore, Israel and South Africa. The yuthi.life website is additionally accessible worldwide. Depending on where you live, the following provisions apply in addition to the parts above. They supplement rather than replace the other information.

C1. Website visitors in the United States

<strong>The YUTHI app is currently not available in the United States.</strong> The yuthi.life website is, however, accessible from there. The following therefore applies additionally to residents of California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana and other states with their own privacy laws.

We do not sell your data and do not share it for advertising purposes — neither for money nor for other consideration. There is no “sale” and no “sharing” within the meaning of the California Consumer Privacy Act (CCPA/CPRA). A right to opt out of sale therefore has no application; we mention it for completeness.

Your rights: you may request disclosure of the categories and specific pieces of data collected, request correction or deletion, obtain a copy in a portable format, and limit the use of sensitive data to what is necessary to provide the service. We will not discriminate against you for exercising these rights. Contact info@yuthi.life; deletion and a copy are also available directly in the app settings.

Health data: we are not a covered entity under HIPAA and YUTHI is not subject to that law. Your health information is nonetheless treated as sensitive data under state laws — in particular under the Washington My Health My Data Act if you reside there.

No use by minors: the app is intended for adults. We do not knowingly collect data from children under 16 and do not sell data of persons under 16.

C2. Users in Canada

We process your data in accordance with Canada’s PIPEDA. Your consent for health data is express and can be withdrawn at any time. Your data is stored outside Canada (Switzerland) and transmitted to the USA for the coach function; it is subject to the respective local law there and may become accessible to authorities under the applicable legal conditions. Complaints may be directed to the Office of the Privacy Commissioner of Canada.

C3. Users in Japan

Under Japan’s APPI we expressly note that your data is stored in Switzerland and transmitted to the USA for the coach function. Switzerland is recognised by the Japanese data protection authority as offering an equivalent level of protection. Health information constitutes “special care-required personal information” in Japan; it is processed solely with your prior consent.

C4. Users in Brazil

We process your data in accordance with Brazil’s LGPD. Health information constitutes “dados sensíveis” and is processed solely on the basis of your express consent. You have rights of access, correction, deletion, portability, withdrawal of consent and complaint to the ANPD. Requests may be sent to info@yuthi.life.

C5. Users in Australia and New Zealand

We act in accordance with the Australian Privacy Principles and New Zealand’s Privacy Act respectively. Health information is “sensitive information” there and is processed only with your consent. Your data is stored overseas (Switzerland) and transmitted to the USA for the coach function. Complaints may be directed to the Office of the Australian Information Commissioner or the New Zealand Privacy Commissioner.

C6. Governing language version

This statement is available in several languages. For users resident in Switzerland, Germany and Austria the German version governs; for all others the English version governs. In the event of discrepancies the respective governing version prevails.

15. Data security

We take technical and organisational measures (TOMs) to protect your data against loss, manipulation and unauthorised access — Art. 8 revDSG, Art. 32 GDPR.

• TLS encryption (HTTPS, at least TLS 1.2) for all data transmissions
• database access only via multi-level authentication & service tokens
• Row-Level Security (RLS) in the Supabase database — users can only read their own data
• regular backups (location EU-Frankfurt)
• strict separation between anonymous, logged-in and administrative access
• staff are bound to confidentiality

16. Retention period

We store personal data only for as long as is necessary for the respective purposes or as statutory retention obligations exist.

• Server logs: 14 days
• Contact enquiries: max. 24 months after completion
• Newsletter sign-up data: until withdrawal
• Provider applications (rejected): 12 months
• Provider applications (accepted): for the duration of the contract + 10 years (Art. 958f CO)
• Business records, invoices: 10 years (Art. 958f CO)

17. Your rights

You have — to the extent provided by law — the following rights vis-à-vis YUTHI:

• Right of access (Art. 25 revDSG; Art. 15 GDPR) — which data we process about you
• Right to rectification (Art. 32 revDSG; Art. 16 GDPR) — correcting inaccurate data
• Right to erasure / “right to be forgotten” (Art. 32 revDSG; Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 28 revDSG; Art. 20 GDPR)
• Right to object (Art. 30(2)(b) revDSG; Art. 21 GDPR) to processing based on legitimate interests
• Right to withdraw consent at any time — with effect for the future

Please address your requests to: info@yuthi.life — subject “Data protection enquiry”.

We will generally respond to your request within 30 days. For identity verification we may request appropriate proof.

18. Profiling & automated individual decisions

We currently carry out no high-risk profiling within the meaning of Art. 5 lit. f revDSG or Art. 22 GDPR. In particular, we make no exclusively automated decisions producing legal effects vis-à-vis you.

A personalised, AI-supported recommendation of providers or content (“Longevity Score”) is planned as a future feature. It will always act in a supporting capacity only — you retain freedom of decision. We will supplement this Policy accordingly upon activation of the feature.

19. Right to lodge a complaint

You have the right to lodge a complaint with a supervisory authority if you believe that the processing of your personal data is unlawful:

• Switzerland: Federal Data Protection and Information Commissioner (FDPIC/EDÖB), Feldeggweg 1, 3003 Bern — edoeb.admin.ch
• EU: the supervisory authority of your member state. Overview: edpb.europa.eu/about-edpb/board/members
• Germany (typically): the Federal Commissioner for Data Protection and Freedom of Information (BfDI) or the state data protection authority of your place of residence.
• Austria: Datenschutzbehörde, Barichgasse 40-42, 1030 Vienna — dsb.gv.at.

20. Changes to this Privacy Policy

We reserve the right to adapt this Privacy Policy in order to keep it up to date in the event of changes to the legal situation or to our offering. The current version is available at www.yuthi.life/datenschutz.html. We recommend that you consult this page regularly.

In the event of material changes (e.g. the addition of new service providers involving a third-country transfer), we will actively inform registered newsletter subscribers and logged-in users.

Initial draft of 26 May 2026 · Marcel Weinsheimer, Aesch LU
This Policy will be finally reviewed before the official launch by a specialised Swiss data protection law firm.