Privacy Policy
How we process personal data on our websites and through our digital services.
Last updated: August 2026
1. General information
This policy explains how we process personal data when you visit our websites, use our digital insurance and guidance tools, or request information, advice, an insurance assessment or an application. Depending on the activity, the legal basis is in particular Art. 6(1)(a), (b) or (f) GDPR. Health data is additionally subject to Art. 9 GDPR.
2. Data controller
HealthSurance – Mona Anbari
Weilerstr. 19
73635 Rudersberg
Germany
Email: hallo@healthsurance.online
HealthSurance operates healthsurance.online and the English-language service Insurance for Expats at insurance-for-expats.com. “Insurance for Expats” is a service name and not a separate legal entity or controller.
3. Your rights
Subject to the statutory requirements, you have rights of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR). You may withdraw consent at any time with future effect; this does not affect the lawfulness of prior processing.
You may lodge a complaint with a supervisory authority, in particular the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg. To exercise your rights, email hallo@healthsurance.online.
4. Hosting, cookies and contact
Hosting
Our websites are hosted by Hostinger. Technical data such as IP address, time of access, requested pages, browser, operating system, referrer URL and server logs is processed to provide a secure and reliable service (Art. 6(1)(f) GDPR; where applicable, under a processing agreement pursuant to Art. 28 GDPR).
Cookies and consent management
Necessary cookies and similar technologies are used where required for operation. Analytics and marketing technologies are used only after the required consent. Preferences can be changed at any time through the consent tool.
Contact
If you contact us by email, telephone or form, we process your information to handle the enquiry. The legal basis is Art. 6(1)(b), (f) or (a) GDPR depending on its nature.
5. Digital insurance and guidance tools
We provide three tools: the Immigration Tool, Expat Tool and German-language KV Tool. They provide non-binding initial guidance only and do not constitute individual insurance advice, a binding risk assessment or an insurer's decision. They do not make a solely automated decision producing legal or similarly significant effects within the meaning of Art. 22 GDPR.
Non-binding use without transmission
If you use a tool only for guidance and do not request a quotation, consultation, insurance assessment or application, your entries are not transmitted to HealthSurance and are not stored in our internal systems or Google Sheets. Transmission starts only when you actively select a follow-up request.
Immigration Tool
Depending on your selections, data may include name, date of birth, contact details, occupation, income, existing health insurance, nationality, German residence status and information required for initial guidance. If you initiate a further assessment or application, additional information may include address, height, weight, illnesses, conditions, treatments, dental status and other necessary health information.
Expat Tool and KV Tool
If you actively request a quotation or consultation, transmitted data may include name, date of birth, email address, optional telephone number, income, existing health insurance and other assessment information. These two tools do not transmit health data, nationality or residence-status information to HealthSurance.
6. Health data and consent
Health data is processed only where necessary for a further insurance assessment or application explicitly requested by you. Processing is generally based on your explicit consent under Art. 9(2)(a) GDPR, unless another legal basis applies. Consent is voluntary and may be withdrawn for the future at any time. Without required health data, the requested individual assessment may not be possible. Health data is not used for newsletters or general marketing. Using a guidance tool alone does not transmit health data to insurers.
7. Services used
Google Workspace, Google Apps Script and Google Sheets
When you actively submit a request, required data may be technically transmitted through Google Apps Script, recorded in Google Sheets and processed with Google Workspace services such as Gmail and Drive. This supports communication, request handling, advice, insurance assessment, application and documentation. Depending on your chosen process, this may include health data. Processing agreements and international transfers are handled subject to applicable safeguards.
Jotform
We use Jotform for certain forms. Depending on the form, contact, insurance and, where applicable, health data and voluntary information may be processed. The legal bases include Art. 6(1)(b) or (a) and, for health data, Art. 9(2)(a) GDPR.
Calendly
We use Calendly for optional appointment scheduling. This may involve your name, email address, appointment details and voluntary information (Art. 6(1)(b) GDPR). Please do not submit health data in the booking form unless expressly required.
Google Analytics and Meta Pixel
Google Analytics and Meta Pixel are used for audience measurement, usage analysis and advertising optimisation only after your consent (Art. 6(1)(a) GDPR). Consent may be withdrawn through the consent tool. International transfers may occur only subject to the required safeguards.
9. Retention and deletion
We retain personal data for as long as necessary for the relevant purpose, including handling your request, advice, brokerage, contract support or documentation. Where no ongoing business relationship results, data is generally deleted when the purpose ends unless overriding evidentiary, limitation or retention requirements apply. If a business relationship arises or statutory duties apply, data may be retained under commercial, tax, insurance or advisory requirements; applicable periods may be up to ten years. The start and end of a period depend on the type and completion of the process. Entries made solely for guidance without an active request are not transmitted to or stored by us.
10. Data security
We use appropriate technical and organisational measures to protect personal data against loss, unauthorised access, alteration and unlawful disclosure. Our websites use SSL/TLS encryption (HTTPS). Absolute security of electronic communications cannot be guaranteed.
11. Updates
We may update this Privacy Policy if the law, our services or processing activities change. The version published on the website applies.