Privacy,
explained.

OMNIMEDICA Group AG is the controller for personal data processed on aeltermann.com. The Swiss Federal Act on Data Protection (FADP) applies and, where users in the EEA are concerned, the General Data Protection Regulation (GDPR). Please send privacy requests to the email address above.

The website and its API are provided through Replit. Requests generate technically necessary connection data, including IP address, time, requested resource, HTTP status, and browser and device information. Our API application logs contain the method, path without query parameters, and status, but not form contents. The hosting provider’s infrastructure logs are separate. Processing is necessary for secure delivery, error diagnosis, and abuse prevention.

The legal basis is our legitimate interest in a secure and functioning service (Art. 6(1)(f) GDPR, where applicable) and the Swiss FADP. Replit receives data as the hosting provider. Processing outside Switzerland or the EEA, particularly in the United States, cannot be excluded. We retain technical logs only according to operational security and error-analysis needs; beyond that, the hosting provider’s retention criteria determine the period.

On OM24 pages linking to the German shop, our API estimates the country from the IP address forwarded by the hosting proxy, using a local IP-to-country database. If Switzerland is detected, the browser automatically redirects to /om24/ch/. The IP address is not sent to an additional geolocation service; neither it nor the inferred country is stored for this feature or recorded in our application logs. No geolocation cookies, user profiles or precise location data are created. The legal basis is our legitimate interest in directing visitors to the appropriate country shop (Art. 6(1)(f) GDPR, where applicable) and the Swiss FADP. Detection may be inaccurate, especially when using a VPN; if the country is unknown or a technical error occurs, the requested page remains accessible.

The contact form processes your name, email address, subject and message, and optionally your organisation and telephone number. It also transmits the language, entry page without query parameters, form context, and technical anti-spam information. The form does not send UTM parameters or advertising click identifiers and does not transmit its contents to analytics or advertising services. Please do not enter sensitive health information.

We use the information solely to review and answer the enquiry. The legal basis is taking pre-contractual steps at your request (Art. 6(1)(b) GDPR) or our legitimate interest in handling general enquiries (Art. 6(1)(f) GDPR), in each case where applicable, together with the Swiss FADP.

On successful submission, the message is sent through the Resend email service to info@omnimedica.com. Resend receives the form contents and email metadata; processing in the United States cannot be excluded. The application does not maintain a database of contact enquiries. If email delivery is unavailable, the request is rejected with an error and is not stored as a contact enquiry.

To prevent abuse, the IP address is converted into a pseudonymised SHA-256 check value and held temporarily in memory. No more than five attempts per check value are permitted within 15 minutes; expired entries are removed on subsequent requests. Successfully delivered emails are retained only as long as necessary to handle the enquiry, document legitimate business interests, or comply with legal obligations.

Your selection in the privacy dialog is stored in your browser’s local storage under the key consent_preferences. It contains the categories “necessary”, “analytics” and “marketing” and a version number, but no identifier assigned by us. This is necessary to apply your choice (Art. 6(1)(f) GDPR, where applicable). It remains until browser data is cleared, the choice is changed through “Privacy settings”, or a new consent version is introduced.

A separately protected project area uses a technically necessary cookie for sign-in. Some inputs and calculation values are held in the browser tab’s session storage; they are not marketing data. This tab storage is cleared when the tab is closed. These necessary functions provide access control and the protected area.

On the German landing page /om24/meine-hautgeschichte/ and the Swiss landing pages /om24/novigel-schweiz/altersflecken/ and /om24/novigel-schweiz/pflegeroutine/, we use PostHog after your express consent to “Analytics & Statistics”. On all three pages we measure visits and shop clicks; on the German skin-story page we additionally measure scroll depth, visible offers, and clicks on product and trial-package links. The legal basis is your consent, in particular Art. 6(1)(a) GDPR and, where required, Section 25(1) TDDDG. Without consent, PostHog is not initialised. Withdrawing consent through “Privacy settings” in the footer stops further collection; it does not automatically delete previously transmitted data.

Transmitted data includes predefined event names, campaign and variant names, the sanitised page path without query parameters, the environment, permitted UTM attribution values, and, on the skin-story page, product and placement identifiers, scroll milestones, and a broad source category. A random identifier for the current page visit is also transmitted. This identifier is held only in memory, not in a tracking cookie or persistent browser storage. We do not transmit form contents, names, email addresses, advertising click identifiers or full URLs with query parameters. Automatic click capture, automatic pageviews, session recordings, person profiles and location enrichment are disabled. This does not mean the data is fully anonymous.

The recipient is PostHog, Inc.; we use its EU project and EU ingestion endpoint. The direct connection necessarily exposes technical connection data, including the IP address, to the provider. Choosing the EU region does not in itself exclude access by the provider or subprocessors outside the EU. Contract, subprocessor and international transfer terms are set out in the provider documents linked below.

PostHog privacy · PostHog data processing agreement

Additionally, on /om24/erst-informieren/, analytics consent enables measurement of visits, video and Google clicks, free-trial intent, trial-section jumps, and trial, product-checkout, product-detail, shop-browse and QS24 link clicks. Only predefined action categories, the environment, the first attributable entry choice after consent (video, Google or unknown), and technical random identifiers for the current visit are transmitted. This instrumentation does not collect URLs, search terms, product identifiers, health data or form contents. Pre-consent clicks are not backfilled; consented clicks may be buffered briefly in memory during loading. Withdrawal discards this buffer. The expanded measurement requires a new choice in the updated consent dialog.

On the OM24 care pages /om24/ and /om24/ch/, we also measure visits, product interest, outbound shop clicks, and video and research interactions only after express analytics consent. The purpose is to compare interest in care products and further information. This does not record completed purchases or activity in the external shop. The restrictions described above apply: predefined events without automatic click capture, session recordings, person profiles or location enrichment. Pre-consent interactions are not backfilled; withdrawal stops further collection. Expanding the scope to both care pages requires a new choice under consent version 6; earlier consent does not activate this measurement.

Google Analytics, Meta Pixel and Taboola Pixel are not loaded. Pages other than the landing pages named above do not send events to this PostHog instrumentation. A click does not establish a purchase, completed Google research or a watched video. Orders and activity in the external shop are not recorded.

Fonts, images, and other media are served locally by this website. Viewing a page therefore does not connect to Google Fonts or external media platforms. Only when you follow an external link does the destination receive standard connection data and, where applicable, the referring page.

Product links to the OM24® shop may carry permitted campaign parameters (UTM) from the current address to attribute a product visit. Only after consent to “Marketing” may an existing campaign click identifier (tblci) also be forwarded through designated German and Swiss shop links. It is not sent to PostHog. Arbitrary query parameters are not forwarded, and no tracker or pixel is loaded for this purpose. Replit development tools are limited to the development environment and are not part of the production build.

External links lead in particular to omnimedica.com, om24shop.de, and ABEL.TV. These independent providers process data under their own privacy notices. Merely linking to them does not make the operator of aeltermann.com the merchant of products offered there.

Subject to applicable law, you may request access, rectification, erasure, restriction of processing, and release or portability of your data. You may object to processing based on legitimate interests. You may withdraw consent at any time with future effect; optional categories can be changed through “Privacy settings” in the footer. Statutory obligations and overriding legitimate grounds may limit individual rights.

You may lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC). Where the GDPR applies, you may also contact a data protection supervisory authority in your EU/EEA Member State. To exercise your rights, email info@omnimedica.com.