Privacy Policy

Last updated: June 2026 · Deutsche Version

1. Controller

Michael May
Industriestraße 20
40878 Ratingen
Germany

Email: support@getmilo.care

2. What data we process

a) Registration data

• First name
• Email address
• Password (stored encrypted)

b) Treatment data

• Number of aligners and current position
• Wear times and aligner change history
• Jaw selection (upper and/or lower jaw)
• Personal wear-time goal

c) Optional data

• Profile picture (avatar), if you upload one

d) What we do NOT collect

• Location data
• Contacts, or any photos other than your avatar upload
• Health data beyond the wear-time tracking feature
• Advertising IDs, analytics trackers or third-party cookies

A note on progress photos: if you take progress photos in the app, they stay exclusively on your iPhone and in your photo library. They are never uploaded to Milo's servers or processed by us.

3. Purposes and legal bases

a) Providing the app's features

Legal basis: Art. 6(1)(b) GDPR (performance of a contract)
Purpose: without an account and treatment data, the app cannot fulfil its core purpose — tracking your aligner wear time.

b) Sending transactional emails

Legal basis: Art. 6(1)(b) GDPR
Purpose: account confirmation, password reset and similar system-related messages.

c) Consent-based processing

Legal basis: Art. 6(1)(a) GDPR
Purpose: documenting your consent to the terms of use, this privacy policy and the medical disclaimer. You can withdraw your consent at any time — in that case, please delete your account.

4. Recipients and processors

We use the following service providers, who process data on our behalf:

a) Supabase

Supabase Inc., 970 Toa Payoh North #07-04, Singapore 318992
Hosting region: EU (Frankfurt, Germany)
Purpose: authentication, database, avatar storage
A data processing agreement (DPA) pursuant to Art. 28 GDPR is in place.

b) Resend

Resend (Dotagentai, Inc.), 2261 Market Street #4667, San Francisco, CA 94114, USA
Purpose: sending transactional emails (account confirmation, password reset)
Third-country transfer: data is transferred to the USA on the basis of the EU Standard Contractual Clauses and with regard to the EU-US Data Privacy Framework.
Data transferred: only your email address and the content of the transactional email.

Beyond that, we only disclose personal data where we are legally required to do so (e.g. by official order).

5. Storage duration

• Registration and treatment data are stored for as long as your account exists.
• After account deletion, all personal data is irrevocably deleted within 30 days.
• Infrastructure log data (Supabase) is deleted according to the provider's retention policies (typically 7–30 days).
• Transactional email logs at Resend are deleted automatically according to the provider's policies.

6. Your rights under the GDPR

You have the right, at any time, to:

• access the data we store about you (Art. 15 GDPR)
• rectification of inaccurate data (Art. 16 GDPR)
• erasure of your data (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR): you can receive your data in a common format
• object to processing (Art. 21 GDPR)
• withdraw any consent you have given, with effect for the future (Art. 7(3) GDPR)

To exercise your rights, you can reach us at support@getmilo.care.

7. Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint about the processing of your personal data with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
Postfach 20 04 44
40102 Düsseldorf, Germany
Phone: +49 211 38424-0
Email: poststelle@ldi.nrw.de
Web: www.ldi.nrw.de

8. No cookies, no tracking, no analytics

Milo uses no cookies, no analytics or tracking tools, no advertising technologies, no social media plugins and no pixels. Your use of the app is not evaluated for marketing or analytics purposes. The same applies to this website.

9. Data security

• Transmission via TLS encryption
• Encrypted storage on Supabase infrastructure (EU hosting, Frankfurt)
• Passwords are stored exclusively as a hash (bcrypt)
• Row-level security: your data is accessible to you only

10. Privacy contact

For questions about privacy or to exercise your rights:
Michael May, Industriestraße 20, 40878 Ratingen, Germany
Email: support@getmilo.care

11. Changes to this privacy policy

We update this privacy policy when legal requirements or our processing activities change. You will always find the current version in the app under "Settings → Legal → Privacy Policy" and on this page, each with its date. We will inform you of significant changes by email or an in-app notice.

This English version is provided for convenience. In case of doubt, the German version applies.