Privacy policy

As of: 24 September 2026

1. Data controller

NOVVIA PHARM GmbH
Am Lohmühlbach 13
85356 Freising
Germany

Phone: +49 (0) 8161 96 99 4-50
Email: info@novvia-pharm.de

LIGHV is a trademark of NOVVIA PHARM GmbH. This privacy policy applies to the websites we operate (including lighv.com / novvia-pharm.de) and to the mobile professionals app LIGHV (iOS and Android, app ID / package de.novvia.lighv.portal). It is the privacy policy URL for publications in the Apple App Store and on Google Play.

2. General information on data processing

We only process personal data to the extent necessary to provide a functional website or app, our content and services, and to handle enquiries, or where there is a legal basis or your consent. The legal bases are, in particular, Art. 6 (1) (a) (consent), (b) (initiation/performance of a contract), (c) (legal obligation) and (f) GDPR (legitimate interest).

Unless otherwise stated, we store personal data only for as long as is necessary for the respective purposes or for as long as statutory retention periods apply.

3. Hosting

This website and the professionals portal server APIs are hosted by all-inkl.com - Neue Medien Münnich (Hauptstraße 68, 02742 Friedersdorf, Germany). The infrastructure and domain assignment may run via the domain lighv.com or associated all-inkl hosting packages. On our behalf, the hosting provider processes server log files and technical data required for operation and security (Art. 6 (1) (f) GDPR).

A data processing agreement pursuant to Art. 28 GDPR is in place with the hosting provider.

4. Server log files

When the website or portal APIs are accessed, information transmitted by your browser or the app is automatically recorded (including IP address, date/time, resource accessed, referrer or user agent, browser/operating system information). This data is stored to ensure technical security and stability. It is not merged with other data sources for advertising purposes. Legal basis: Art. 6 (1) (f) GDPR.

5. Cookies and consent (TDDDG / GDPR)

We use cookies and comparable technologies on the website. Technically necessary cookies are required for the operation of the website (legal basis Art. 6 (1) (f) GDPR in conjunction with Section 25 (2) TDDDG). All other cookies (statistics, marketing) are set only after your express consent (Section 25 (1) TDDDG, Art. 6 (1) (a) GDPR).

Via our cookie banner you can consent, decline or select categories individually. You can revoke or adjust your decision at any time via the “Cookie settings” link in the footer. Revocation does not affect the lawfulness of the processing carried out up to that point.

The mobile app does not set website cookies and does not load the website analytics/marketing pixels described in section 9.

6. Contact form and email

If you contact us via the form or by email, we process the data you provide in order to handle your enquiry (Art. 6 (1) (b) or (f) GDPR). Mandatory fields are marked in the form. The data is deleted once the enquiry has been conclusively processed and no statutory retention obligations apply.

7. Professionals portal (web)

Additional personal data may be processed for access to the protected professionals portal (e.g. registration and master data, authentication, orders). Where membership of the healthcare professions is confirmed via DocCheck, data processing takes place within the scope of the respective DocCheck services and our portal processes. Details are provided during portal onboarding and, where applicable, in separate notices within the portal. Legal bases: Art. 6 (1) (b) and (f) GDPR and, where applicable, consent.

8. LIGHV mobile app (iOS and Android) — store disclosures

The LIGHV app is a B2B professionals client for pharmacies / healthcare professionals. It connects to our servers at lighv.com. The following describes the processing relevant for App Store / Google Play (Data safety / App Privacy).

8.1 Account and authentication data

For registration and login we process in particular: email address, password (stored only in hashed form), name/salutation where provided, association with a pharmacy or organisation, onboarding data (e.g. licence documents where you upload or enter them), and technical session/access tokens.

Purpose: account administration, access control, performance of the professionals portal contract. Legal basis: Art. 6 (1) (b) GDPR.

8.2 DocCheck (professionals verification)

During registration, membership of the healthcare professions may be confirmed once via DocCheck. You are redirected to DocCheck; DocCheck processes data under its own privacy notices. We receive proof/a token that verification succeeded — not your DocCheck password for everyday login. Daily login in the app uses your portal email and password.

Legal basis: Art. 6 (1) (b) and (f) GDPR (access only for authorised professionals).

8.3 LOCATION data (precise / approximate)

The app accesses LOCATION data on your device. This includes in particular precise location and derived approximate location, for example via GPS, Wi‑Fi or network information provided by the operating system.

Purpose: ensuring that the professionals offering is only used from Germany (regulatory geo-restriction). Without location permission, the app cannot be unlocked.

How it is collected: access only while the app is in use in the foreground (location when in use). No continuous background tracking of your movement profile. Coordinates are used for the country check and are not used for advertising, profiling or tracking.

Sharing / sale: we do not sell location data and do not use it for personalised advertising. To determine the country, the operating system may use reverse-geocoding (e.g. Apple or Google); their privacy notices then apply.

Legal basis: Art. 6 (1) (b) and (f) GDPR. You grant or revoke permission in the system settings (revocation may make the app unusable).

8.4 Push notifications

After login and your system permission, the app may deliver push notifications (e.g. notices about orders or portal updates). A device push token (Android: via Firebase Cloud Messaging / Google Play Services; iOS: Apple Push Notification service) is created and stored with your user account on our servers (including platform iOS/Android).

Purpose: informing you about relevant portal events. Legal basis: Art. 6 (1) (b) or (f) GDPR and your system permission. You can disable notifications in the device settings at any time; on logout/deletion the token is removed.

Delivery uses Apple or Google infrastructure; technical metadata may be transferred to third countries (in particular the USA). See Google Privacy and Apple Privacy.

8.5 Orders, invoices and master data

While logged in we may process order data, cart/checkout details, invoice metadata or documents, and pharmacy/customer master data as required for B2B trade and our ERP/NIS systems, via encrypted connections to our servers.

Legal basis: Art. 6 (1) (b) GDPR (contract) and, where applicable, (c) (commercial/tax retention).

8.6 On-device storage

On the device we store locally e.g. access tokens and app settings in protected OS storage (Secure Storage / Keystore). These data support the session and are deleted or invalidated on logout.

8.7 Device and diagnostic data

For troubleshooting and security, technical details may arise (e.g. app version, OS version, device type, error messages in server logs). The app currently does not use a separate advertising or analytics SDK comparable to Google Analytics / Meta Pixel.

8.8 Disclosure, sale and advertising

App personal data are shared only with processors and platform services as required for hosting, push delivery, professionals verification (DocCheck) or ERP connectivity. We do not sell your personal data and do not use app location data for third-party personalised advertising.

8.9 Not for children

The app is intended exclusively for professionals (B2B) and is not directed at children or persons under 16. We do not knowingly collect children’s data.

8.10 Deletion and access

You may request deletion of your portal account or information about stored data at info@novvia-pharm.de. Statutory retention obligations (e.g. for orders/invoices) remain unaffected. App permissions (location, notifications) are controlled in system settings; you may uninstall the app at any time.

9. Web analytics and marketing (website only, consent-based)

The services below are loaded only on the website if you have consented to the respective cookie category. Without consent, no corresponding tracking takes place. The mobile app does not use these website tools.

9.1 Matomo (statistics, self-hosted)

For reach analysis we use Matomo in an instance operated by us / hosted on our behalf. The analysis is carried out with as little data as possible. IP addresses may be shortened. Legal basis: your consent (Art. 6 (1) (a) GDPR, Section 25 (1) TDDDG), cookie category “Statistics”.

9.2 Google Analytics (statistics)

We use Google Analytics (Google Ireland Limited / Google LLC). In doing so, cookies may be set and usage data (including a shortened IP address) may be processed. Transfer to the USA is possible; Google relies on standard contractual clauses, among other measures. Legal basis: consent (Art. 6 (1) (a) GDPR, Section 25 (1) TDDDG), cookie category “Statistics”. Further information: policies.google.com/privacy.

9.3 Google Ads (marketing)

We use Google Ads (conversion/remarketing functions). In doing so, cookies may be set and information about interactions with our website and advertisements may be processed. Legal basis: consent, cookie category “Marketing”. Information from Google: policies.google.com/technologies/ads.

9.4 Meta Pixel (marketing)

We use the Meta Pixel (Meta Platforms Ireland Limited). This allows us to measure the effectiveness of advertising and to build target audiences. Meta may set cookies and link data with your Meta account if you are logged in there. Transfer to third countries (in particular the USA) is possible. Legal basis: consent, cookie category “Marketing”. Information from Meta: facebook.com/privacy.

10. SSL/TLS encryption

Website and app communication with our servers use TLS/SSL encryption to protect the transmission of confidential content.

11. Your rights

Where the legal requirements are met, you have the following rights:

• Access (Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing based on legitimate interests (Art. 21 GDPR)
• Withdrawal of consent with effect for the future (Art. 7 (3) GDPR)

To exercise your rights, please contact info@novvia-pharm.de.

You also have the right to lodge a complaint with a supervisory authority. Competent among others is the Bavarian Data Protection Authority (BayLDA), Promenade 18, 91522 Ansbach, www.lda.bayern.de.

12. No automated decision-making

No automated decision-making including profiling within the meaning of Art. 22 GDPR takes place. The geo check (Germany) is a technical access requirement, not an automated decision with legal effect under Art. 22 GDPR.

13. Currency

We reserve the right to adapt this privacy policy so that it always complies with current legal requirements or reflects changes to our services (including app store requirements). The version in force at the time of your visit applies.