Nordic
Health
OS

1. Who we are (data controller)

Nordic Health OS ApS (or successor entity, currently in formation) is a Danish-incorporated company headquartered in Copenhagen, Denmark. For the purposes of the EU General Data Protection Regulation (GDPR), Nordic Health OS is the data controller for personal data collected through this website and (once launched) the Nordic Health OS platform.

Our supervisory authority is Datatilsynet, the Danish Data Protection Agency. You have the right to lodge a complaint with Datatilsynet at any time if you believe we have mishandled your data — see Section 11.

2. Legal basis for processing

Under GDPR Article 6, we process your personal data on one or more of the following lawful bases:

• Consent (Art. 6(1)(a)) — for waitlist sign-up, marketing communications, optional analytics, and any processing of health data once the platform launches.
• Contract (Art. 6(1)(b)) — once you become a paying subscriber, to provide the service you have signed up for.
• Legitimate interest (Art. 6(1)(f)) — for fraud prevention, basic site security, and aggregate, anonymised product analytics.
• Legal obligation (Art. 6(1)(c)) — to comply with Danish tax, accounting, and consumer-protection law.

For special-category health data (GDPR Art. 9), we will rely on your explicit consent at the point you connect a wearable, upload bloodwork, or share any other health-related information once the platform is live. You will be told exactly what you are consenting to and you can withdraw consent at any time.

3. Data we collect today (waitlist)

If you join the waitlist, we collect:

• Your name
• Your email address
• Optionally, your phone number (for launch notification by SMS)
• Technical information automatically logged by your browser and our hosting provider — IP address (truncated), browser type, referring URL, timestamp

We do not collect any health data, identifying numbers (such as CPR), payment information, or sensitive personal information at the waitlist stage. Joining the waitlist requires no card and creates no payment obligation.

4. Data we will collect at launch

Once Nordic Health OS launches, with your explicit consent at each step, we may collect and process:

• Account information — name, email, phone, billing address, password (hashed), language preference.
• Identifiers — your CPR number, only when required to coordinate bloodwork through Danish partner laboratories. CPR is encrypted at rest, validated using modulus-11, and never transmitted to third parties without your explicit consent.
• Health data — bloodwork results from partner labs, wearable telemetry (HRV, sleep, recovery, glucose, etc.), body composition (DEXA, InBody), self-reported information about therapies, peptides, GLP-1 protocols, and lifestyle, plus any AI-generated summaries derived from this data.
• Payment data — handled exclusively by our payment processors (such as Stripe, MobilePay, Klarna). Nordic Health OS does not store full card numbers or bank details on our own servers.
• Communication data — messages you send to OS Chat, customer support tickets, scheduling exchanges with our clinicians or concierge.
• Usage data — pages and features you interact with, in pseudonymised form, to improve the product.

5. How we use your data

We use the data we collect to:

• Operate the waitlist and notify you when Nordic Health OS launches.
• Once you subscribe, deliver the service — coordinate bloodwork, ingest wearable data, generate your OS Score and lifecycle insights, and provide the OS Chat experience.
• Anonymise health data before it is processed by AI models so that no AI provider receives personally identifying information alongside health markers.
• Send you transactional messages (booking confirmations, panel results, billing receipts) and, if you have opted in, occasional product updates.
• Detect and prevent fraud, abuse, and security incidents.
• Comply with our legal and regulatory obligations under Danish and EU law.

We do not use your health data to train third-party AI models, sell it to advertisers, or share it with insurers, employers, or any party who has not been explicitly authorised by you.

6. Who we share data with

We share personal data only with the following categories of recipient, and only to the extent necessary:

• Diagnostic laboratories (such as Valida Health) — to schedule and process your blood draws.
• Telehealth and clinical partners — only with your explicit consent, for clinical consultations or prescriptions you initiate.
• Wearable middleware providers (such as Terra API or Thryve) — to ingest data from your WHOOP, Oura, Apple Watch, Garmin, or CGM.
• Hosting and infrastructure providers — Netlify (this website), and EU-resident cloud providers for the platform once launched.
• Payment processors — Stripe, MobilePay, Klarna and similar, handling your payment data under their own GDPR-compliant terms.
• AI sub-processors — anonymised, de-identified data only. We use Anthropic (Claude) for OS Chat. No personally identifying information is sent.
• Analytics and marketing partners — only if you have consented to analytics cookies. We use Meta Pixel and the Meta Conversions API for advertising attribution. You can disable these in our cookie banner at any time.
• Legal and tax authorities — only when required by Danish or EU law, or when we have a legal obligation to disclose.

We do not sell your personal data. We do not share your health data with insurers, employers, or commercial third parties for their own marketing purposes.

7. Where your data lives

All personal and health data is stored on servers located within the European Union. We do not transfer personal data outside the EU/EEA except where necessary for a service you have explicitly requested (for example, a payment provider that operates internationally). In those cases, transfers rely on Standard Contractual Clauses or other GDPR-compliant safeguards.

8. How we protect your data

We apply industry-standard security controls to protect your data, including:

• Encryption in transit (TLS 1.3) and at rest (AES-256).
• Access on a strict need-to-know basis, with audit logging.
• Pseudonymisation and de-identification before any health data is processed by AI models.
• Regular security testing, dependency monitoring, and incident response procedures.
• Working toward ISO 27001 certification.

No system is perfectly secure. If a personal data breach occurs, we will notify Datatilsynet within 72 hours and notify affected users without undue delay where the breach is likely to result in a high risk to your rights.

9. How long we keep your data

• Waitlist data — kept until 12 months after launch or until you ask us to delete it, whichever is sooner.
• Account and health data — kept for as long as your subscription is active, plus a grace period of 30 days, after which it is permanently deleted unless you specifically ask us to retain it.
• Billing records — kept for 5 years to comply with Danish bookkeeping law.
• Anonymised, aggregated analytics — kept indefinitely as it cannot be linked back to you.

10. Cookies and analytics

Our website uses two categories of cookies:

• Essential cookies — required for the site to work (session, security, consent state). These do not require consent.
• Analytics and marketing cookies — used only with your consent, set via our cookie banner. These include Meta Pixel for advertising attribution and similar tools.

You can change your consent at any time by clicking Cookie Preferences in the footer of the homepage.

11. Your rights under GDPR

You have the following rights with respect to your personal data:

• Right of access — request a copy of the personal data we hold about you.
• Right to rectification — correct inaccurate or incomplete data.
• Right to erasure ("right to be forgotten") — request deletion of your data.
• Right to restriction — ask us to limit how we use your data.
• Right to data portability — receive your data in a structured, machine-readable format.
• Right to object — object to processing based on legitimate interest, including direct marketing.
• Right to withdraw consent — withdraw your consent at any time without affecting the lawfulness of processing before withdrawal.
• Right to lodge a complaint with Datatilsynet (datatilsynet.dk) if you believe your rights have been violated.

To exercise any of these rights, email nordichealthos@gmail.com. We will respond within 30 days.

12. Children's data

Nordic Health OS is intended for adults aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us with personal data, contact us and we will delete it.

13. Changes to this policy

We may update this policy from time to time as the platform evolves and as legal requirements change. Material changes will be communicated to you by email and prominently displayed on the website at least 30 days before they take effect. The "Last updated" date at the top of this page reflects the most recent revision.

14. Contact us

For any privacy-related questions or to exercise your rights:

• Email: nordichealthos@gmail.com
• Postal: Nordic Health OS, Copenhagen, Denmark (full address provided upon company registration completion)

For matters relating to Danish data protection law, you may also contact the supervisory authority directly: Datatilsynet.

1. Acceptance of these terms

By using the Nordic Health OS website (nordichealthos.dk), joining the waitlist, or once available subscribing to the platform, you agree to these Terms of Service together with our Privacy Policy. If you do not agree, please do not use the website or platform.

These terms form a binding contract between you and Nordic Health OS ApS (Danish company in formation, headquartered in Copenhagen, Denmark) — referred to in this document as "Nordic Health OS", "we", or "us".

2. The waitlist

Joining the waitlist is free and creates no payment obligation. You provide your name, email, and optionally your phone number. We use this information solely to notify you when the platform launches and, with your consent, to share product updates.

Joining the waitlist does not:

• Guarantee future service availability or specific pricing
• Lock you in to any subscription or commitment
• Create a contract for service

You can leave the waitlist at any time by emailing nordichealthos@gmail.com or by clicking unsubscribe in any email we send you.

3. Eligibility and account

To use Nordic Health OS once it launches, you must:

• Be at least 18 years old.
• Have legal capacity to enter into a contract under Danish law.
• Provide accurate, current, and complete information at registration and keep it updated.
• Maintain the security of your account credentials and accept responsibility for activity under your account.

We reserve the right to refuse, suspend, or terminate accounts that violate these terms or applicable law.

4. What Nordic Health OS is and is not

Nordic Health OS is a data aggregation, monitoring, and intelligence platform. We connect bloodwork, wearable telemetry, body composition, and self-reported health information into a unified view, and we generate insights from that data using AI and clinical reference ranges.

Nordic Health OS is not:

• A clinic, hospital, or medical practice
• A pharmacy or drug supplier
• A medical device or diagnostic service
• A provider of medical advice, diagnosis, treatment, or prescription
• A substitute for licensed healthcare professionals

Use of Nordic Health OS does not create a doctor-patient relationship between you and Nordic Health OS. All medical decisions remain solely your responsibility, made together with your own licensed healthcare providers.

Where Nordic Health OS displays insights, scores, recommendations, or summaries, these are informational and educational only. They are not clinical advice and must not be used as the basis for stopping, starting, or changing any medical treatment.

5. Subscription pricing and billing

Nordic Health OS offers tiered subscriptions. Current tiers, prices, and features are listed on our pricing page on the homepage. Prices are quoted in Danish kroner (DKK) and are subject to applicable VAT.

Billing cadence

• Monthly subscriptions — billed in advance every month. You may cancel at any time; access continues until the end of your current billing period.
• Annual subscriptions — billed in advance for 12 months, with a 20% discount versus the monthly rate. Annual subscriptions auto-renew unless cancelled.

Payment methods

At launch, accepted payment methods are expected to include MobilePay, Visa, Mastercard, Apple Pay, Google Pay, Klarna, Dankort, and SEPA Direct Debit. Final supported methods may change. Payment processing is handled by third-party providers under their own terms.

Price changes

We may change subscription pricing for new sign-ups at any time. For existing subscribers, we will give at least 30 days' notice before any price increase takes effect on your subscription, and you may cancel before the new price applies.

6. Cancellation, refunds, and right of withdrawal

Monthly subscriptions

You may cancel a monthly subscription at any time. Cancellation takes effect at the end of your current billing period. You retain full access to the platform until that date. We do not provide partial refunds for unused days within a billed month.

Annual subscriptions — 90-day risk-free window

Annual subscriptions include a 90-day risk-free window. If you cancel within the first 90 days of your annual subscription, we will refund you for the unused portion at the prorated annual rate (i.e. you pay only for the months you have used; we refund the remainder).

After 90 days, your annual subscription runs for the full 12 months and is non-refundable. This is how we are able to offer the 20% saving versus the monthly rate. You may cancel auto-renewal at any time before your renewal date so that the subscription ends at the close of the 12-month term.

EU 14-day right of withdrawal

Under EU consumer protection law, consumers have a 14-day right of withdrawal for online purchases. This right applies to your initial subscription purchase. You may exercise it by emailing nordichealthos@gmail.com within 14 days of your first payment. Where you have started using the service within the 14-day window, we may deduct a proportionate amount for the part already supplied. The 90-day risk-free window for annual subscriptions extends beyond and is more generous than the statutory 14-day right.

Already-booked services

If you have a blood draw, telehealth consultation, or other partner service already scheduled at the time of cancellation, we will honour it.

7. Third-party services and partners

To deliver the platform, Nordic Health OS connects with independent third-party providers, including diagnostic laboratories, telehealth services, wearable manufacturers, body-composition imaging centres, payment processors, and AI sub-processors. Each third-party service is provided under its own terms of service, clinical standards, licences, and regulatory obligations.

Nordic Health OS does not control these third parties and accepts no liability for the accuracy, availability, completeness, quality, or outcomes of services provided by them. Where you contract directly with a third-party provider (for example, a clinician for a prescription, or a lab for an additional test), the contract is between you and that provider.

8. Your obligations as a user

When using Nordic Health OS, you agree to:

• Provide accurate health and personal information.
• Use the platform only for your own personal health monitoring, not on behalf of another person without their explicit consent.
• Not attempt to circumvent security, scrape data, reverse-engineer the platform, or use it to build a competing service.
• Not upload illegal content, malware, or content that violates the rights of others.
• Comply with all applicable Danish and EU laws.

You acknowledge that you alone are responsible for your protocols, prescriptions, supplements, peptides, lifestyle choices, and the medical decisions you make based on Nordic Health OS data. Nordic Health OS provides monitoring and intelligence; the choices remain yours.

9. Your data

You retain full ownership of all health and personal data you provide to or generate through Nordic Health OS. We process your data on your behalf in accordance with our Privacy Policy and applicable law, including GDPR.

You may export your data at any time in a structured, machine-readable format. You may request deletion of your account and data at any time by emailing nordichealthos@gmail.com.

10. Intellectual property

All software, design, branding, written content, panel structures, AI models, lifecycle frameworks, and other intellectual property comprising the Nordic Health OS website and platform are owned by Nordic Health OS or licensed to us. We grant you a personal, non-exclusive, non-transferable licence to use the platform for the duration of your subscription, solely for personal, non-commercial purposes.

Trademarks of third parties referenced on the website (WHOOP®, Oura®, Wegovy®, Ozempic®, etc.) are the property of their respective owners. Nordic Health OS is not affiliated with, endorsed by, or sponsored by any of these companies unless explicitly stated.

11. Disclaimer and limitation of liability

Nordic Health OS is provided "as is" and "as available". To the fullest extent permitted by law, we make no warranties, express or implied, regarding the platform, including any warranty of merchantability, fitness for a particular purpose, or non-infringement.

Nordic Health OS does not warrant that:

• The platform will always be available, error-free, or secure.
• The data, scores, or insights generated will be uninterrupted, complete, or free of inaccuracies.
• Specific health outcomes will result from using the platform.

Health outcomes vary based on individual genetics, adherence, lifestyle, and other factors outside our control. No specific health results are guaranteed.

Certain materials within the platform may be generated or enhanced using artificial intelligence. AI-generated content may contain errors and must not be relied upon as medical advice.

To the fullest extent permitted by Danish and EU law, you agree to hold Nordic Health OS, its founders, directors, employees, contractors, affiliates, and partners harmless from any claims, damages, losses, costs, or liabilities arising from your use of the platform. Our maximum aggregate liability to you is limited to the total amount you paid in subscription fees in the 12 months preceding the event giving rise to the claim. Nothing in these terms limits liability that cannot be limited under Danish or EU law (including liability for death or personal injury caused by negligence, or for fraud).

12. Termination

You may terminate your subscription according to Section 6.

We may suspend or terminate your account, with or without notice, if:

• You materially breach these terms.
• You fail to pay subscription fees when due.
• Your conduct exposes Nordic Health OS or other users to legal, regulatory, or security risk.
• We discontinue the service in whole or in part (in which case we will provide reasonable advance notice and a prorated refund where appropriate).

Upon termination, your right to use the platform ends immediately. Sections that by their nature should survive (data ownership, intellectual property, liability, governing law) survive termination.

13. Changes to these terms

We may update these terms from time to time as the platform evolves and as legal requirements change. Material changes will be communicated to you by email and prominently displayed on the website at least 30 days before they take effect. If you do not accept the updated terms, you may cancel your subscription before the changes take effect. Continued use of the platform after the effective date constitutes acceptance.

14. Governing law and jurisdiction

These terms, all use of the Nordic Health OS website and platform, and any disputes arising therefrom are governed exclusively by the laws of Denmark, without regard to conflict-of-laws principles. Any legal proceedings shall be subject to the exclusive jurisdiction of the courts of Denmark, except where applicable consumer-protection law gives consumers the right to bring proceedings in their country of residence.

15. Contact

For any questions about these terms:

• Email: nordichealthos@gmail.com
• Postal: Nordic Health OS, Copenhagen, Denmark (full address provided upon company registration completion)