ocobii Privacy Policy

Stefanie Wöhrle, sole proprietor trading as “ocobii” Bahnhofstr. 12, 71679 Asperg, Germany Email: info@blickwinkel.net (hereinafter “we” or “ocobii”) No data protection officer has been appointed.

We process personal data within our web-based platform for organising and documenting vision-training measures. Legal bases: - Art. 6(1)(b) GDPR: performance of a contract (provision of the platform) - Art. 6(1)(f) GDPR: legitimate interest (security and stability) - Art. 9(2)(a) GDPR: consent for end customers' health data For Swiss customers, the provisions of the revised Swiss Data Protection Act (nFADP, SR 235.1) apply in addition.

Opticians / staff: - Account data: email, practice name, address, VAT ID - Usage data: login, features used, IP address (no tracking cookies) End customers (on behalf of the optician): - Master data: name, date of birth, gender, contact details where applicable - Health data: medical history, findings, vision-training progress, exercise feedback - Authentication data: client ID, QR/claim code, email where applicable

All data is hosted on servers in Germany (Hetzner, Falkenstein/Nuremberg). Sub-processors (all with a data processing agreement under Art. 28 GDPR): - Hetzner Online GmbH: hosting (DE, ISO 27001) - myopia.kids (Andreas Polzer): technical administration (DE) - Sendinblue SAS (Brevo): magic-link emails (EU, ISO 27001) - Stripe Payments Europe Ltd.: payment processing for the optician subscription (IE/EU, PCI-DSS L1) No disclosure to any other third parties.

Optician account data: for the duration of use plus statutory tax retention (6 years). End customers' health data: exportable on request after the optician terminates (120 days), then deleted. Statutory retention obligations (§ 630f German Civil Code, 10 years) remain unaffected. Logs: max. 30 days. Payment data (Stripe): in accordance with Stripe's policies.

You have the following rights: - Access (Art. 15 GDPR / Art. 25 nFADP) - Rectification (Art. 16 GDPR) - Erasure (Art. 17 GDPR) - Restriction (Art. 18 GDPR) - Data portability (Art. 20 GDPR) - Objection (Art. 21 GDPR) - Withdrawal of consent (Art. 7(3) GDPR) End customers: requests primarily via the optician. Opticians: directly to info@blickwinkel.net.

You have the right to lodge a complaint with the competent data protection supervisory authority. For Germany: the competent state authority at ocobii's registered seat. For Swiss customers: the FDPIC (Federal Data Protection and Information Commissioner), www.edoeb.admin.ch.

We employ the following protective measures: - Encryption in transit (TLS 1.3) and at rest (AES-256) - Separate PII layer; pseudonymisation of end-customer IDs - Role-based access control (RLS) and multi-tenancy - Append-only audit trail - Regular backups with off-site storage - Hosting exclusively in German data centres

We use only technically necessary session cookies for authentication. No tracking cookies, no third-party analytics tools, no advertising cookies. A cookie banner is not required.