BESTU

BESTU — PRIVACY POLICY

Updated version • 18 September 2026

This Privacy Policy explains how personal data relating to users of the BESTU website, private area, digital programme and community are processed. BESTU is a project dedicated to wellbeing, personal awareness and habit building. Its content is for informational and educational purposes and does not replace medical diagnosis, healthcare treatment or personalised professional advice.

1. Data Controller

The data controller is Enrica Pizzoferrato, operating under the BESTU / BESTULAB brand.

Professional address: Strecia Du Ja 2, 6921 Vico Morcote, Switzerland.

Privacy and support e-mail: support@bestulab.com

Website: bestulab.com

2. Services and infrastructure used

BESTU uses external technology providers to deliver the service, including:

  • Lovable for the application and the website/private-area interface;
  • Supabase for backend functions, authentication, authorisation, database, storage and access management;
  • Stripe as payment service provider for purchases and payment-related operations;
  • additional technical providers, where activated, for ancillary functions such as e-mail delivery, notifications, hosting, security or support.

Providers may process personal data on behalf of BESTU or, for certain activities of their own, as independent controllers under their respective privacy notices. The list of providers may be updated if BESTU introduces or replaces technical tools.

3. Personal data that may be processed

BESTU processes the data needed to operate the service and the data users choose to provide when using available features. Depending on the features enabled, the following data may be processed:

  • identity and contact data, such as name, display name and e-mail address;
  • account data, technical credentials, language and time-zone preferences, and notification preferences;
  • programme enrolment data, assigned start date, content access, progress and completion data;
  • purchase data, payment status and any refunds; BESTU does not store full card details when payment is handled directly by Stripe;
  • technical, navigation and security data, such as IP address, device, browser, session identifiers and technical logs;
  • profile image, where provided;
  • answers to preparation content, private reflections or notes that the user chooses to save in the private area;
  • comments, questions, reactions, messages and other content that the user voluntarily shares in community spaces;
  • files or attachments that the user chooses to upload, where the relevant feature is available;
  • technical identifiers required for web or push notifications, if the user chooses to enable them;
  • communications sent to support.

A paper checklist, a personal journal or other materials kept solely by the user and not uploaded to the private area are not processed by BESTU.

4. Purposes and legal bases for processing

Personal data are used to:

  • provide access to the website, private area, programme and community;
  • create and manage the account and verify authentication;
  • assign access to the purchased programme and the corresponding start date;
  • make programme content available progressively and record progress;
  • save private reflections, preferences or uploaded files when requested by the user;
  • enable comments, reactions and participation in the community;
  • send service communications and, where enabled by the user, programme-related notifications;
  • manage payments, refunds and administrative requirements;
  • provide customer and technical support;
  • maintain security, prevent abuse and troubleshoot technical issues;
  • comply with applicable legal obligations.

For users subject to the GDPR, the main legal bases are performance of a contract or steps taken before entering into a contract, compliance with legal obligations and, where applicable, legitimate interests in security, abuse prevention and the proper operation of the service. Where optional processing requires consent, consent will be requested separately. For users in Switzerland, processing is carried out in accordance with the Swiss Federal Act on Data Protection (FADP).

5. Health data and other special categories of personal data

BESTU does not require users to provide health data or other special categories of personal data in order to take part in the programme. The service is not designed to function as a medical record, health journal or tool for collecting diagnoses, medical reports or treatments.

Users are asked not to publish in the community, and not to upload unless strictly necessary, medical reports, diagnoses, treatments, detailed health information or other particularly sensitive data. If a user voluntarily shares information of this kind, BESTU will process it only to the extent permitted by applicable law and may moderate, restrict or remove the content where appropriate to protect the user, the community or the service.

BESTU does not use user data to make diagnoses, prescribe treatment or make solely automated healthcare decisions.

6. Private area, private content and community

The private area may contain personal information relating to the programme, including progress, preparation answers, private reflections, preferences and, where the feature is available, files uploaded by the user. This content is not intended to be visible to the community. Technical access may be limited to the controller, authorised personnel and necessary service providers only to the extent required for support, security, maintenance, legal obligations or proper delivery of the service.

Content that the user voluntarily posts in shared community spaces may be visible to other members according to the community settings and structure. Active participation is optional: users can follow the programme without posting content in shared spaces.

Users are asked not to share third-party personal data without authorisation and not to post information they wish to keep confidential. Photographs, testimonials or personal results will not be used by BESTU for external promotion without an appropriate legal basis and, where required, specific consent.

BESTU may in the future use automated or artificial-intelligence tools for support, moderation, translation, message classification or drafting suggested replies. Where these features involve new processing of personal data or additional providers, this Privacy Policy will be updated and the required measures will be implemented before activation. Such tools will not be used to diagnose users or make healthcare decisions about them.

7. Minors

BESTU is intended exclusively for people aged 18 or over. BESTU does not knowingly seek to collect personal data from minors. If the controller becomes aware that personal data have been collected in breach of this rule, reasonable steps will be taken to delete the data or otherwise bring the processing into compliance.

8. Providers and international data transfers

To provide the BESTU service, external technology providers are used, including Lovable, Supabase and Stripe, together with any additional providers required for enabled features. Some providers or their subprocessors may process data outside Switzerland or the European Economic Area.

Where required by applicable law, international transfers are carried out using recognised mechanisms such as adequacy decisions, standard contractual clauses or other safeguards provided for by applicable law.

The list of providers and their functions may be updated when BESTU introduces, changes or replaces tools or services.

9. Cookies, preferences and notifications

The website and private area may use cookies, local storage, session tokens and similar technologies that are necessary for operation, security, authentication and storing preferences such as the selected language.

If the user enables web or push notifications, technical identifiers or subscription data needed to deliver notifications may be processed. Enabling notifications is optional and can be withdrawn through browser or device settings.

If BESTU introduces analytics, marketing tools or other non-essential technologies that require consent, the consent-management system and Cookie Policy will be updated before activation where required by applicable law.

10. Data retention

Personal data are retained only for as long as necessary for the purposes for which they were collected and to comply with applicable legal obligations.

In particular:

  • account, programme and progress data are retained for the duration of the account and for the technical period required for deletion, unless longer retention is required by law or justified by legitimate needs;
  • private reflections, answers and any uploaded files are retained while associated with the account or until deleted, subject to technical backups, security requirements or legal obligations;
  • community content is retained for the duration of the service or until deleted, subject to security, moderation or legal-rights requirements;
  • support requests are retained for as long as necessary to handle the request and protect any related rights;
  • contractual, accounting and tax data are retained for the periods required by applicable law;
  • technical and security data are retained for periods proportionate to technical, security and abuse-prevention needs.

Providers may apply their own retention periods for processing carried out as independent controllers or under their respective agreements with BESTU.

11. Security

BESTU adopts technical and organisational measures that are reasonable and proportionate to the nature of the service, including access-control and data-protection measures, and relies on professional providers for its technology infrastructure. No information system can, however, be guaranteed to be absolutely secure.

In the event of a personal data breach, BESTU will assess and comply with any notification obligations required by applicable law.

12. User rights

To the extent provided by applicable law, users may request access to their personal data, rectification, erasure, restriction of processing, objection, data portability where applicable, and withdrawal of any consent.

Requests may be sent to support@bestulab.com. The controller may request reasonable information to verify the identity of the person making the request.

Users subject to the GDPR may also lodge a complaint with the competent supervisory authority. Users in Switzerland may contact the Federal Data Protection and Information Commissioner (FDPIC).

13. Changes to this Privacy Policy

This Privacy Policy may be updated when BESTU features, providers, processing activities or applicable law change. The current version will be published on the website together with its update date. If material changes are made, users will be informed through appropriate means.

Contact details

E-mail: support@bestulab.com Postal address: Strecia Du Ja 2, 6921 Vico Morcote, Switzerland