Privacy policy

Last updated: August 19, 2026

Preamble

With the following privacy policy, we would like to inform you about the types of your personal data (hereinafter also referred to as "data") we process, for what purposes, and to what extent. This privacy policy applies to all processing of personal data carried out by us, both in the context of providing our services and in particular on our websites, in mobile applications, and within external online presences, such as our social media profiles (hereinafter collectively referred to as the "online offering").

The terms used are not gender-specific.

Controller

Daniela Dwersteg
2 km al este de la escuela de Nosarita
Nicoya, Guanacaste
Costa Rica

Email: hi@immunoroots.com

For further legal information, see our imprint.

General information

We take the protection of your personal data seriously.

This Privacy Policy explains what personal data we process when you use the Immunoroots website, why we process it, and what rights you have regarding your personal data.

We process personal data in accordance with applicable data protection laws, including the EU General Data Protection Regulation (GDPR), where applicable.

Personal Data We Process

name
email address
telephone number
information voluntarily provided in contact forms
membership information
newsletter subscription information
technical information such as IP address, browser type, device information and access times
information relating to newsletter interactions, such as email opens and link clicks
website usage and analytics information

If you voluntarily provide health-related information in a contact form or other communication, we may process such information for the purpose of responding to your inquiry. Please do not provide health information unless it is necessary for your request.

Contact Form

We use Tally to provide our contact form.

When you contact us through the form, we may process the information you provide, including:

name
email address
telephone number
message or notes

We use this information to respond to your inquiry and communicate with you.

Tally is operated by Tally BV, a company based in Belgium. Tally states that form data is stored in Europe.

Legal basis:
Processing is based on Art. 6(1)(b) GDPR where necessary to respond to a request relating to the initiation or performance of a contract. In other cases, processing is based on our legitimate interest in responding to inquiries (Art. 6(1)(f) GDPR).

Where you voluntarily provide special categories of personal data, such as health information, we process such data only where a legal basis under applicable data protection law permits us to do so.

Immunoroots offers free membership.

When you register as a Member, we collect your name and email address. Your membership registration also subscribes you to the Immunoroots newsletter.

The newsletter may contain information about health-related topics, new articles, publications, educational content, and Immunoroots services and offerings.

We process your personal data in order to:

create and manage your Member account;
send you the Immunoroots newsletter;
manage your newsletter subscription;
communicate with you regarding your membership;
provide and improve our content and services.

You can unsubscribe from the newsletter at any time using the unsubscribe link provided in our emails or through the available Member settings.

Legal basis:
Where consent is required, newsletter communications are based on your consent pursuant to Art. 6(1)(a) GDPR. Processing necessary to administer your membership is based on Art. 6(1)(b) GDPR.

We use Ghost's built-in newsletter analytics.

These features allow us to determine whether newsletters are opened and which links within newsletters are clicked.

We use this information to understand whether our content is relevant to our Members and to improve future newsletters.

Legal basis:
Where required by applicable law, newsletter engagement tracking is based on consent pursuant to Art. 6(1)(a) GDPR.

You may stop further newsletter tracking by unsubscribing from the newsletter.

Website Analytics

We use Ghost's built-in, first-party web analytics.

Ghost's native web analytics are designed to be cookie-free and do not use cookies or persistent browser storage to identify visitors across sessions, browsers, or devices.

The analytics help us understand how visitors use Immunoroots and which content is useful to our audience.

We also use Ghost's functionality to understand which sources and content contribute to new Member registrations.

Legal basis:
Art. 6(1)(f) GDPR, based on our legitimate interest in understanding and improving our website and content, to the extent permitted by applicable law.

Outbound Link Tagging

Ghost provides functionality that allows links leading from Immunoroots to external websites to contain additional information that helps the receiving website identify traffic originating from Immunoroots.

We use this functionality to understand and improve the effectiveness of links to external websites.

Hosting and Server Logs

Immunoroots is operated using a self-hosted Ghost installation.

When you visit our website, technical information may be processed by the server infrastructure required to provide and secure the website. This may include:

IP address
date and time of access
requested pages or resources
browser type and version
operating system
referring URL
technical information relating to errors and security events

This information may be processed to:

provide the website;
maintain website security;
detect and prevent abuse;
identify technical problems;
maintain the stability and performance of the website.

Legal basis:
Art. 6(1)(f) GDPR, based on our legitimate interest in providing a secure and reliable website.

Cookies and Similar Technologies

Our Ghost web analytics are cookie-free and do not use cookies or persistent browser storage for visitor tracking.

The website may nevertheless use technically necessary cookies or similar technologies required for functions such as Member authentication, security, and the proper operation of the website.

Such technically necessary technologies are not used for advertising purposes.

Service Providers and Data Recipients

We may use carefully selected service providers to operate Immunoroots and provide technical services.

Depending on the services actually used, this may include providers for:

website hosting and infrastructure;
membership and newsletter functionality;
contact forms;
email delivery;
website analytics.

Where required by applicable law, appropriate data processing agreements and other safeguards are put in place with service providers.

We do not sell personal data.

International Data Transfers

Where personal data is transferred to recipients outside the European Economic Area, we take appropriate measures to ensure that the transfer complies with applicable data protection law.

Such measures may include an adequacy decision, Standard Contractual Clauses, or other legally recognized safeguards.

Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected or as required by applicable law.

Member and newsletter data is generally retained while the membership remains active or until the Member unsubscribes or requests deletion, subject to legal retention obligations.

Business and accounting records may be retained for longer periods where required by applicable tax, accounting, or other legal requirements.

Your Rights

Depending on the applicable legal requirements, you have the following rights:

Right of access – You may request information about the personal data we process about you.
Right to rectification – You may request correction of inaccurate or incomplete personal data.
Right to erasure – You may request deletion of your personal data where the legal requirements are met.
Right to restriction of processing – You may request restriction of processing in certain circumstances.
Right to data portability – You may request certain personal data in a structured, commonly used and machine-readable format.
Right to object – You may object to certain processing based on legitimate interests.
Right to withdraw consent – Where processing is based on consent, you may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

You also have the right to lodge a complaint with a competent data protection supervisory authority.

For questions or requests concerning your personal data, please contact:

dani@immunoroots.com

External Links

Immunoroots may contain links to websites operated by third parties.

We have no control over the privacy practices or content of external websites and are not responsible for their processing of personal data.

We recommend reviewing the privacy policies of external websites before providing personal information.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our website, services, technologies, or applicable legal requirements.

The current version will always be published on this page. The date at the beginning of this Privacy Policy indicates when it was last updated.