HORIXON HEALTH POLICY

1. Introduction and Commitment to Health Privacy

This Privacy Policy governs the processing of personal data carried out by NEW WELLNESS CONCEPT S.L. (hereinafter, “Horixon”) through its digital ecosystem, which includes:

  • The Horixon website
  • The Horixon Health mobile application
  • Interactions with the Horixon Trainer device

At Horixon, we understand that male intimate health is an area of the highest sensitivity. For this reason, we have designed our platform according to the principles of Privacy by Design and Privacy by Default, complying not only with:

  • The General Data Protection Regulation (GDPR)
  • The Spanish Data Protection and Digital Rights Guarantee Act (LOPDGDD)
  • International ISO 27001 security standards
  • Class I Medical Device regulations

2. Types and Categories of Data Processed

In compliance with the principle of transparency, Horixon informs users that it processes the following categories of data, adapted to each user’s interaction with the platform.

2.1. Identifying and Contact Data

This includes:

  • Name and surname
  • Email address
  • Postal address for physical shipments
  • Optional pseudonymous nickname for use within the App

This approach helps minimize the direct link between the user’s platform profile and their civil identity.

2.2. Profile and Context Data

Information related to:

  • Age
  • Gender
  • Weight
  • Sleep quality
  • General wellness habits

These data are necessary for segmentation and personalization of the user experience.

2.3. Special Categories of Data: Health and Sexual Life

These constitute the core of the digital therapy and include:

  • Responses to validated clinical questionnaires (e.g., IELT and TLEI)
  • Levels of sexual satisfaction
  • Perception of ejaculatory control
  • Sexual orientation

2.4. Telemetry and IoT Data

Information captured by the sensors of the Horixon Trainer device during use, such as:

  • Acceleration
  • Speed
  • Temperature
  • Vibration patterns

These data are essential for objectively measuring treatment adherence and progress.

3. Detailed Analysis of Data Processing Activities

Below is a detailed explanation of the governance of your data, including purposes, lawful bases and retention periods.

A. Digital Therapy and Use of the Horixon Health App

Purpose

Provision of a personalized intimate health service, clinical monitoring of progress and dynamic adaptation of therapeutic programs.

Lawful Basis

  • Identifying data: performance of the contract (Article 6.1.b GDPR)
  • Health, sexual life and telemetry data: explicit consent (Article 9.2.a GDPR)

Retention Period

  • Account data: retained while the contractual relationship remains active
  • Health data: retained for five years after the last activity and subsequently legally blocked

B. Purchase and Logistics Management

Purpose

  • Processing orders
  • Invoicing
  • Shipment of physical devices
  • Warranty management

Lawful Basis

  • Performance of the contractual relationship (Article 6.1.b GDPR)
  • Compliance with tax and commercial obligations

Retention Period

  • Delivery-related data: retained as necessary to complete the service
  • Commercial records: 6 years
  • Tax records: 4 years

C. Newsletter Subscription and Communications

Purpose

Sending:

  • News and updates
  • Health studies
  • Commercial offers related to the Horixon ecosystem

Lawful Basis

Consent (Article 6.1.a GDPR).

Retention Period

Until consent is withdrawn. Every communication includes an immediate unsubscribe option.

4. Advanced Digital Health and Governance Clauses

4.1. Scientific Research and Bioethics (R&D)

Horixon is committed to advancing medical science in sexual health.

For this purpose, telemetry and health data may be used to create anonymized datasets.

This process follows a strict Cohort Threshold Policy (N ≥ 20), ensuring that users cannot be re-identified.

These anonymized datasets may be shared with:

  • Academic institutions
  • Clinical research organizations

Such processing is carried out in accordance with Recital 26 of the GDPR.

4.2. Artificial Intelligence (AI) Governance

Our platform uses AI exclusively for:

  • Analytical functions
  • Interface personalization

Horixon guarantees that:

  • No automated AI-based diagnoses are performed
  • No automated decisions with legal or significant effects are made without human supervision

All therapeutic recommendations are based on predefined and validated medical protocols.

4.3. Interaction with Health Ecosystems (Apple Health / Google Fit)

Currently, Horixon Health operates independently to maximize the isolation of intimate health data.

We do not:

  • Share data with Apple Health or Google Fit
  • Import data from external health aggregators

This prevents intimate health information from being combined with broader activity profiles without the user's explicit control.

5. Processing Security, Technical Resilience and Cybersecurity Culture

In compliance with Article 32 GDPR, Horixon has implemented a hospital-grade security ecosystem designed to protect the:

  • Integrity
  • Confidentiality
  • Availability

of all health information processed.

Our infrastructure is deployed within the AWS Ireland Region (European Union) and is based on the following security pillars.

5.1. Military-Grade Data Encryption

We apply encryption throughout the entire data lifecycle.

Data at Rest

Protected through:

  • AES-256 encryption
  • AWS KMS key management

Data in Transit

Protected through:

  • TLS 1.2 or higher
  • Secure communication channels between the App and our servers

5.2. Identity Governance and Granular Access Control

We implement the principle of Least Privilege through highly restrictive Identity and Access Management (IAM) controls.

Security measures include:

  • Mandatory Multi-Factor Authentication (MFA)
  • Strict segregation of duties
  • Confidentiality agreements
  • Continuous auditing

Only essential technical personnel may access production systems.

5.3. Resilience, Availability and Disaster Recovery

Horixon guarantees continuity of service through:

  • Automated daily backups
  • Geographical replication within EU availability zones
  • Monthly restoration testing
  • Disaster Recovery Plans (DRP)

These measures ensure rapid recovery of therapeutic histories in the event of incidents.

5.4. Proactive Monitoring and Continuous Auditing

Our platform incorporates:

  • Real-time observability tools
  • Security audits
  • Penetration testing exercises

This cybersecurity culture is reinforced through:

  • Continuous staff training
  • Adoption of ISO 27001 standards

6. Deletion of Personal Data and Account Cancellation

Users may request the deletion of personal data and/or the permanent cancellation of their Horixon account at any time.

This request constitutes the exercise of the right to erasure under the GDPR, subject to any legal obligations requiring data retention.

6.1. Available Channels to Request Deletion

Users may request deletion through:

  • Email to the Data Protection Officer:

    info@horixon.health


  • Privacy, account settings or support functionalities available within the App

The request should include:

  • The email address associated with the account
  • A clear description of the requested action

Horixon may request additional information to verify identity and prevent unauthorized deletion.

6.2. Scope of Deletion and Effects on the Service

Once validated, Horixon will delete or anonymize personal data where no legal basis exists for retention.

This may include:

  • Identifying data
  • Profile data
  • Usage data
  • Therapeutic monitoring data

Following account cancellation, users will lose access to:

  • Historical records
  • Programs
  • Metrics
  • Settings
  • Associated functionalities

Certain information may be retained where legally required, including:

  • Purchase records
  • Invoices
  • Warranties
  • Fraud prevention records
  • Regulatory compliance data

6.3. Blocked Data, Backups and Anonymized Data

Where retention is legally required:

  • Data will be blocked
  • Access will be restricted to legally authorized purposes

After the applicable retention periods expire, data will be permanently deleted.

Backup Copies

Deletion from backups may not be immediate due to technical and disaster recovery requirements. However:

  • Backup data remain protected
  • Data are not restored for ordinary processing purposes
  • Deletion requests will be re-applied if restoration occurs

Anonymized Data

Irreversibly anonymized datasets used for:

  • Statistics
  • Research
  • Service improvement

cannot be linked back to an individual user and therefore cannot be subject to individual deletion.

6.4. Response Deadlines and Confirmation

Horixon will respond within one month of receiving the request.

This period may be extended by up to two additional months where:

  • Requests are particularly complex, or
  • A high volume of requests has been received

Users will be informed of any extension within the first month.

Upon completion, confirmation will be sent through:

  • The same communication channel used for the request, or
  • The email associated with the account

Where a request cannot be fully satisfied, Horixon will provide:

  • The legal justification
  • The data affected
  • The retention purpose
  • The applicable retention period
  • Information on available remedies before the Spanish Data Protection Agency

7. Changes to This Privacy Policy

Horixon may update this Privacy Policy to reflect:

  • Technical changes
  • Legal developments
  • Product modifications

Any substantial change will be communicated through:

  • The App, and/or
  • Email notifications

Continued use of the service after notification constitutes acceptance of the updated terms, without prejudice to the user's right to request deletion of their data.

8. Rights and Contact

You may exercise your rights of:

  • Access
  • Rectification
  • Erasure
  • Restriction of processing
  • Portability
  • Objection

by contacting our Data Protection Officer at:

info@horixon.health