English 
Last updated: 11-11-2026
1. Introduction
This Privacy Policy explains how DAVID Health Solutions collects, uses, shares and protects your personal data when you visit our websites, use the DAVID Academy, contact us, attend our events or do business with us. We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and applicable local data protection laws.
Please read this policy together with our Cookie Policy below.
2. Who we are
The controller responsible for your personal data is:
David Health Solutions Oy (DAVID Health Solutions Ltd.) Mannerheimintie 113 00280 Helsinki, Finland. Business ID: 2106629-5 Email: info@davidhealth.com
We have not appointed a Data Protection Officer. For any privacy question or request, please use the contact details above or our Data Privacy Request Form.
3. The personal data we collect
- Identity data: name, organisation, job title, country.
- Contact data: email address, telephone number, postal address.
- Account data (DAVID Academy on Thinkific): login details, training progress, certificates.
- Marketing data (HubSpot): newsletter subscriptions, event registrations, downloads, email and campaign interactions, and your communication preferences.
- Technical data: IP address, browser and device type, operating system, referring website, pages visited, cookie identifiers and advertising identifiers (such as Meta and Google Ads click IDs).
- Transaction data: billing and payment details for courses, training and services.
- Health data: only when you choose to share it with us, for example in a case study or as part of a clinical partnership.
We do not knowingly collect personal data from children under 16.
4. How we collect your data
- Directly from you, when you fill in a form, contact us, register for training or an event, or buy a product or service.
- Automatically, through cookies and similar technologies on our website (see our Cookie Policy).
- From our systems, including HubSpot (CRM and marketing), Thinkific (DAVID Academy) and our WordPress website.
- From our partners, such as authorised DAVID distributors who pass on your enquiry so we can respond to it.
5. Why we use your data and our legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Responding to your enquiry or support request | Legitimate interests (Art. 6(1)(f)) or steps prior to a contract (Art. 6(1)(b)) |
| Providing our products, services and training, including DAVID Academy accounts and certificates | Contract (Art. 6(1)(b)) |
| Sending newsletters, product updates and event invitations | Consent (Art. 6(1)(a)); for existing customers, legitimate interests (Art. 6(1)(f)) |
| Following up with business contacts on relevant products and events | Legitimate interests (Art. 6(1)(f)) |
| Analytics and marketing cookies | Consent (Art. 6(1)(a)) |
| Strictly necessary cookies, website security and fraud prevention | Legitimate interests (Art. 6(1)(f)) |
| Improving our website, products and services | Legitimate interests (Art. 6(1)(f)) |
| Processing health data you choose to share | Explicit consent (Art. 9(2)(a)) |
| Invoicing, accounting, tax and regulatory obligations, including medical device obligations | Legal obligation (Art. 6(1)(c)) |
| Showing our ads on Meta (Facebook, Instagram), Google (Search, YouTube) and LinkedIn, retargeting website visitors and measuring ad performance | Consent (Art. 6(1)(a)) |
| Creating custom and lookalike audiences from hashed email addresses | Consent (Art. 6(1)(a)) |
Where we rely on legitimate interests, we have balanced our interests against your rights. You can object at any time (see section 11).
6. Email marketing
We only send you marketing emails if you have given your consent, or if you are an existing customer or business contact and the email relates to similar products or services. Every email contains an unsubscribe link, and you can change your preferences at any time. Unsubscribing does not affect service messages, such as course or invoice notifications.
Online advertising
With your consent, we use advertising tools from Meta (Facebook and Instagram), Google (Google Ads and YouTube) and LinkedIn. These tools use cookies and pixels to measure how our ads perform, to show our ads to people who have visited our website (retargeting) and to reach people with similar professional interests.
If you have consented to marketing, we may also upload your email address in hashed (encrypted) form to these platforms. We do this to show you relevant ads, or to exclude you from ads you do not need, for example, as an existing customer. The platforms delete the hashed data after matching.
For the Meta Pixel, we and Meta Platforms Ireland Ltd. are joint controllers for collecting and transmitting your data to Meta. Meta is solely responsible for any further processing, as described in the Meta Privacy Policy.
Videos from YouTube are embedded in privacy-enhanced mode. YouTube only sets cookies when you play a video and have accepted marketing cookies.
You can withdraw your consent at any time via Cookie Settings, and manage your ad preferences in your Meta, Google and LinkedIn accounts (see our Cookie Policy).
7. Who we share your data with
We do not sell or rent your personal data. We share it only with:
- Service providers that process data on our behalf under a data processing agreement: HubSpot (CRM and marketing), Thinkific (DAVID Academy), our website hosting provider, Google (analytics) and payment providers. With your consent, we also share data with Meta Platforms Ireland Ltd., Google Ireland Ltd. and LinkedIn Ireland Unlimited Company for advertising (see section 6).
- Authorised DAVID distributors and clinical partners, where needed to respond to your enquiry, deliver training or provide support in your country.
- Authorities, advisers and courts, where required by law or to establish, exercise or defend legal claims.
8. International transfers
Some of our service providers are based outside the European Economic Area, in particular in the United States (HubSpot, Google, Meta, LinkedIn) and Canada (Thinkific). We only transfer personal data outside the EEA where it is adequately protected, for example under the EU–US Data Privacy Framework, a European Commission adequacy decision (such as for Canada) or the European Commission’s Standard Contractual Clauses. You can request a copy of the relevant safeguards by contacting us.
9. How long we keep your data
- Marketing and CRM data: up to 24 months after your last interaction with us, or until you withdraw your consent or unsubscribe.
- DAVID Academy account data: for as long as your account is active, and for up to [12] months afterwards so you can retrieve your certificates.
- Transaction and contract data: for as long as required by Finnish accounting and tax law, generally up to 10 years.
- Health data: only as long as needed for the purpose you agreed to, after which it is deleted or anonymised.
- Cookies: see the retention periods in our Cookie Policy.
10. How we protect your data
We use appropriate technical and organisational measures to protect your personal data, including encrypted connections (SSL/TLS), access controls, encrypted storage and secure hosting. No system is completely secure, but we review our measures regularly.
11. Your rights
Under the GDPR, you have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- have your data erased;
- restrict our processing of your data;
- object to processing based on legitimate interests, and to direct marketing at any time;
- receive your data in a portable format;
- withdraw your consent at any time, without affecting processing that took place before.
To exercise your rights, use our Data Privacy Request Form or email info@davidhealth.com. We will respond within one month.
You also have the right to lodge a complaint with a data protection authority. Our lead supervisory authority is the Office of the Data Protection Ombudsman in Finland (tietosuoja.fi). You can also contact the authority in the country where you live or work.
If you live outside the EEA, you may have similar rights under local law, and we will honour them where applicable.
12. Children
Our websites and services are not intended for children under 16. If we learn that we have collected personal data from a child, we will delete it.
13. Changes to this policy
We may update this policy from time to time. The latest version is always available on this page, with the date of the last update at the top. If we make significant changes, we will let you know by email or through a notice on our website.
14. Contact us
David Health Solutions Oy, Mannerheimintie 113, 00280 Helsinki, Finland, info@davidhealth.com, Data Privacy Request Form