Privacy Policy

1. Who we are

Plimr Technologies SL ("Plimr", "we", "our", "us") is the data controller for the personal data described in this policy.

CIF: B88792197
Registered address: Calle Hermosilla 48, 1º dcha, 28001 Madrid, Spain
Contact: hello@tryplimr.com

This policy explains what we collect, why we collect it, who we share it with and what rights you have. It is written to comply with the General Data Protection Regulation (GDPR) and Spanish data protection law.

2. What we collect

Account information. Name, email address, password, date of birth and the contact details you give us.

Health data. This is special category data under the GDPR and we treat it accordingly:

• Laboratory results, including blood biomarkers across glucose metabolism, hormones, inflammation, lipids and nutrients
• Information you give us about your medical history, diagnoses, symptoms, menstrual cycle, medications and supplements
• Daily check-in data, including mood, stress, focus, symptoms and any notes you record
• Activity, sleep, heart rate and related measurements from a wearable, if you choose to connect one
• Height, weight and other physical measurements
• Your plan, and your record of what you completed

Waitlist information. If you join the waitlist before becoming a member, we collect your email address and any optional answers you give us, which may include health information.

Usage and technical data. How you use the service, IP address, browser and device information, and cookies.

How we collect it. Directly from you when you sign up, complete your profile or check in; automatically through cookies and similar technologies; from the laboratory that processes your tests; and from a wearable provider where you connect one.

3. Why we process it, and on what basis

We ask for your explicit consent before processing any health data, and you can withdraw it at any time. If you withdraw it we can no longer provide the membership, and we will tell you what happens to your data.

We do not rely on legitimate interests to process health data.

4. How your plan is made

Your plan is built using automated processing of your health data, including your results, your profile and your daily check-ins. A qualified clinician designs and reviews your protocol, so decisions about your plan are not made by automated means alone.

We do not use your data to make decisions about credit, insurance, employment or access to healthcare.

You can ask us about how your plan was arrived at, and you can contest any decision that affects you, by writing to hello@tryplimr.com.

5. Artificial intelligence

Plimr uses AI-assisted systems to help prepare personalized lifestyle guidance and summaries from information members provide directly, including symptoms, bloodwork, profile information and daily check-ins. These outputs do not make decisions with legal or similarly significant effects.

Data obtained from Garmin is not shared with or processed by external AI providers, and is not disclosed beyond the services required to operate the authorized connection. The same restrictions apply to data from any other device provider whose terms require them.

6. Who we share it with

We do not sell your personal data. Optional website advertising measurement is described in Section 11 and runs only with your marketing-cookie consent. We do not send your screener answers to advertising platforms.

We share it only in these circumstances:

• Clinical services. Clinicians working with Plimr, who design and review your protocol, and the accredited laboratory that carries out your tests and returns the results. You are told which laboratory before any test is arranged.
• Technology providers. Hosting, storage, security and communications providers that operate the service on our behalf.
• Connected devices. Where you choose to connect a wearable, data passes between Plimr and that provider under their terms as well as ours. Connected-device data is handled according to the terms of the originating provider.
• Analytics. Website traffic analysis, subject to your cookie choices.
• Legal. Authorities, where the law requires it.

Every provider that handles personal data on our behalf acts only on our instructions under a data processing agreement, and none of them may use your data for their own purposes.

You can ask us for details of the providers we use at any time by writing to hello@tryplimr.com.

7. Where your data is held

Screener answers are stored in our backend within the European Economic Area. Contact, email and booking data processed by Resend and Cal.com is stored or processed in the United States, as described in section 15. Where a provider processes data outside the EEA, international transfers use applicable safeguards, such as Standard Contractual Clauses or an adequacy decision.

8. How long we keep it

• Account and health data, including laboratory results: we retain these while your membership is active. After you close your account, we delete them from active systems within 30 days, except where retention is required by law or necessary for legal claims. Any retained records are restricted to those purposes and deleted when the applicable retention period ends.
• Waitlist data: until membership opens to you, or until you unsubscribe, whichever comes first
• Records we must keep for legal or accounting reasons: for as long as the law requires

You can ask us to delete your data sooner. See section 9.

9. Your rights

You have the right to:

• Access your personal data and receive a copy
• Correct data that is inaccurate or incomplete
• Delete your data
• Restrict how we use it
• Object to certain processing
• Receive a portable copy in a machine-readable format
• Withdraw consent at any time where we rely on it
• Ask for human review of decisions about your plan

Write to hello@tryplimr.com and we will respond within one month.

You also have the right to lodge a complaint with a supervisory authority. In Spain this is the Agencia Española de Protección de Datos (aepd.es).

10. Security

We protect your data with encryption in transit and at rest, access controls that limit health data to those who need it, and regular security review. No system is completely secure. If a breach occurs that puts your rights at risk, we will tell you and the AEPD without undue delay.

11. Cookies and tracking

We use cookies and similar technologies. You can control them through our cookie banner and your browser settings.

Essential cookies (always active). Necessary for the site to work and cannot be switched off. They are set in response to actions you take, such as logging in, filling in a form or setting your privacy preferences. They cover session management, security and authentication, and your cookie consent choices.

Analytics cookies (optional). These let us count visits and traffic sources so we can measure and improve the site. They cover page view tracking and how visitors move through the site.

Analytics cookies (Google Analytics 4). With analytics consent, we measure check starts and completions, the displayed result tier (A–D), waitlist signups, booking-link clicks and confirmed bookings. We do not send names, emails, individual answers, free text or URL query strings to Google Analytics.

Marketing measurement (Meta Pixel and Conversions API). With separate marketing consent, we send only Lead on check completion and Schedule on confirmed booking, plus an opaque deduplication ID, timestamp, neutral source URL, IP address and browser user-agent. We do not send result tiers, symptoms, health terms, screener answers or campaign parameters to Meta. The browser pixel runs in an isolated frame with a neutral URL. Google and Meta may process measurement data outside the EEA under their published transfer safeguards.

Both optional categories are denied on first load. You can accept or reject each category and change your choice at any time using Cookie settings in the footer or the check. Changing a choice stops future collection for that category; it does not delete previously sent events. Essential storage also preserves campaign parameters during the visit and a signed booking receipt used to verify confirmation. Email-update and health-storage consents are separate choices.

12. Age

Plimr is for adults. We do not knowingly collect data from anyone under 18. If you believe we have, contact us and we will delete it.

13. Changes to this policy

We may update this policy from time to time. We will post any changes here and update the date above. If a change materially affects how we use your health data, we will contact you directly and, where needed, ask for your consent again.

14. Contact

Plimr Technologies SL
Calle Hermosilla 48, 1º dcha, 28001 Madrid, Spain
hello@tryplimr.com

15. Membership screener

The optional screener helps us decide whether to offer a founder conversation or keep you on the waitlist, and helps us prepare that conversation. It uses fixed rules. It does not diagnose a condition or determine clinical eligibility. A founder conversation checks program fit, and the physician responsible for laboratory testing makes any clinical inclusion decision.

The current screener asks about signs you recognize, diagnoses or suspicions, bloodwork context, approaches you have tried, three ranked priorities and your email. One required checkbox confirms that you are 18 or older and explicitly consent to health-data processing; we record that adult declaration without collecting your exact age range. We do not ask for your name on the contact screen. Health answers stay in memory in your browser until you explicitly consent and submit. Leaving before submitting does not save those answers. Only people who confirm they are 18 or older can submit.

We process screener health information with your explicit consent to assess program fit and prepare a call. Email updates use a separate, optional consent. You can withdraw consent or ask us to erase your screener information by emailing hello@tryplimr.com. Existing waitlist email preferences are preserved when you enter from the waitlist confirmation.

Screener answers are stored in Supabase in Frankfurt and accessed through an authenticated internal admin view. Individual answers and free text are not sent to AI providers, advertising platforms or analytics tools. With analytics-cookie consent, the result tier is sent to GA4 as described in Section 11. Retakes create a new record; the latest submission sets your current next step.

Resend processes contact details, language, broad location (Spain or outside Spain), source, screener completion and whether a call was offered or booked. These call flags are derived from screener answers; Resend does not receive the answers themselves. It delivers requested service emails and, if you opt in, Plimr updates. Cal.com processes your name, email, booking details, language, source parameters and an opaque submission identifier to schedule a call and link booking updates back to your record. No result tier, signal groups, individual answers or free-text comments are sent in booking links.

Resend stores service data in the United States; selecting Ireland as our email-sending region does not change that storage location. Cal.com processes scheduling data in the United States and may use subprocessors in other locations. These providers describe their international-transfer safeguards in their privacy and data-processing documents.

The current screener uses a static city list and manual country selection, which do not send location searches to Google. If we introduce Google Places autocomplete, Google will process the city searches you enter; we will update this notice and the service configuration before enabling it.

We record source parameters and anonymous funnel events on our own backend, using only screen numbers, entry door, language, source, result tier and yes/no call status. We do not include answer values in analytics events. Non-member screener submissions are deleted after 12 months. Member records follow the membership retention arrangements described elsewhere in this policy.