Last updated: 07.05.2026
This Privacy Policy explains how PRIMESOLES GmbH processes personal data when you use the Primesoles 3D foot scan app (hereinafter the “Primesoles App”).
The Primesoles App lets customers create digital foot profiles, capture their existing insoles, and, on that basis, order individually customized orthopedic insoles. This involves processing 3D scan data, body measurements, health information, order information, and account data, among other things.
This Privacy Policy supplements the general privacy policy for our website and online store at primesoles.de/datenschutz.
1. Controller
The controller responsible for processing personal data within the meaning of the General Data Protection Regulation (GDPR) is:
Prequalified orthopedic shoemaker workshop
PRIMESOLES GmbH
Gewerbering 5
D - 14656 Brieselang
Email: m.sander@primesoles.de
Phone: 0152-29244588
Website: https://primesoles.de
2. Scope
This Privacy Policy applies to the use of the Primesoles App on iPhone and iPad.
It applies in particular to:
creating 3D foot scans,
scanning existing insoles,
recording body, shoe, and health information,
creating a digital foot profile,
recommending suitable Primesoles insoles,
ordering individually customized insoles,
use as a guest customer,
use by logged-in business customers and B2B partners,
technical authentication, order processing, and customer management.
3. What Data We Process
3.1 Data for Creating Custom Insoles
To design, recommend, and manufacture individually customized insoles, we process the following data in particular:
3D foot scans,
scans of existing insoles,
measurements and foot profiles derived from the scans,
name,
age,
gender,
shoe size,
height,
body weight,
information on the intended use of the insoles, for example everyday wear, work, sports, or prolonged standing and walking,
information on whether you have worn insoles before,
information on diabetes,
information on hallux valgus in the left or right foot,
information on heel spurs in the left or right foot,
information on leg length discrepancies,
information on pain in the legs or feet,
information on pain in the upper body,
additional information you voluntarily provide in the free-text field.
This data may allow conclusions to be drawn about your physical condition, orthopedic needs, or health limitations. Where this data constitutes health data within the meaning of Art. 9 GDPR, we process it only on the basis of your explicit consent or another applicable legal basis.
3.2 Scan and Camera Data
Depending on the device, the app uses the camera, TrueDepth, and/or LiDAR features of your iPhone or iPad to capture your feet and existing insoles.
The following may be processed in this context:
image data,
depth data,
3D scan data,
surface and contour data,
measurement points,
measurements and profile information derived from them.
This data is used to create a digital foot profile, take existing insoles into account, and recommend and manufacture suitable Primesoles insoles.
Data captured using TrueDepth or LiDAR technology is not shared with Apple. Apple receives no foot scan, insole scan, or health data from us.
3.3 Account, Identity, and B2B Data
For logged-in business customers and B2B users, we process data for authentication and access management.
This includes in particular:
user ID,
name,
email address,
company,
customer number,
roles and permissions,
login status,
technical authentication information,
assignment to business partners or customer accounts.
Authentication is handled through a Microsoft Azure–based identity solution using the Microsoft Authentication Library for iOS (MSAL). Identity data may be synchronized with business partners and Microsoft Business Central to the extent necessary for user management, order processing, customer management, or B2B processes.
3.4 Order and Customer Data
To process and fulfill your insole orders, we process in particular:
name,
email address,
billing address,
shipping address,
products ordered,
selected activities or areas of use,
order number,
payment method,
order status,
shipping and delivery information,
customer history,
business customer assignment, where relevant.
Order and customer data is processed in particular in Shopify and Microsoft Business Central. Payments are processed via Shopify and the payment service providers integrated there. Complete payment data, in particular complete credit card data, is not stored in the Primesoles App or in our own Azure backend when payment is made via Shopify or the payment providers integrated there.
3.5 Technical and Diagnostic Data
When you use the app, technical data may be processed, for example:
device type,
operating system version,
app version,
language settings,
technical log data,
error messages,
crash reports,
timestamps of technical events,
network and connection information.
This data is used to provide the app securely, reliably, and in working order, to analyze errors, and to improve the app's technical quality.
4. Purposes of Processing
We process personal data for the following purposes:
creating a digital foot profile,
analyzing foot and insole scans,
recommending suitable Primesoles insoles,
tailoring the insoles to your physical information, complaints, and intended uses,
manufacturing individually customized insoles,
processing orders,
payment, shipping, and invoicing,
customer service and support,
complaint, warranty, and adjustment processes,
managing B2B accounts and business partner processes,
synchronization with Microsoft Business Central,
technical provision and security of the app,
error analysis and quality assurance,
compliance with statutory retention and documentation obligations.
5. Legal Bases for Processing
We process personal data on the following legal bases:
5.1 Performance of a Contract
Where processing is necessary to enable your order, manufacture individually customized insoles, handle delivery, or provide customer service, it is based on Art. 6(1)(b) GDPR.
This applies in particular to:
name,
contact details,
shipping and billing address,
order data,
selected products,
foot and insole information required to manufacture the product.
5.2 Explicit Consent for Health Data
Where we process health data or particularly sensitive body-related information, we do so on the basis of your explicit consent pursuant to Art. 9(2)(a) GDPR in conjunction with Art. 6(1)(a) GDPR.
This applies in particular to information on:
diabetes,
hallux valgus,
heel spurs,
leg length discrepancy,
pain in the legs or feet,
pain in the upper body,
other health information you voluntarily provide,
health- or complaint-related information that may result from the foot profile or the scans.
You may withdraw your consent at any time with effect for the future. This does not affect the lawfulness of processing carried out before the withdrawal. If you withdraw your consent, we may no longer be able to offer certain app features or the manufacture of individually customized insoles, or only to a limited extent.
5.3 Legitimate Interests
We process certain data on the basis of legitimate interests pursuant to Art. 6(1)(f) GDPR.
Our legitimate interests include in particular:
ensuring technical functionality,
error analysis,
IT security,
prevention of misuse and fraud,
quality assurance,
internal process optimization,
customer service,
traceability of order and support processes.
5.4 Legal Obligations
We process certain data to comply with legal obligations pursuant to Art. 6(1)(c) GDPR.
This applies in particular to:
tax-law retention obligations,
commercial-law retention obligations,
accounting,
documentation obligations,
the defense or enforcement of legal claims.
6. Consent in the App
Before foot scans, insole scans, physical information, and health-related information are processed, the app may ask for your explicit consent.
Such consent may read, for example, as follows:
I consent to Primesoles processing my foot scans, insole scans, body measurements, and health-related information in order to create my digital foot profile, recommend suitable insoles, manufacture individually customized insoles, process my order, and carry out related support and adjustment processes.
Consent is voluntary. Without this consent, certain app features and the individual insole recommendation may not be available.
7. Storage in the Microsoft Azure Backend
The data required to create optimally fitted insoles is stored in a Microsoft Azure backend used by Primesoles.
This includes in particular:
3D foot scans,
insole scans,
measurement data derived from scans,
foot profiles,
physical information,
health-related information,
recommendations,
technical data linked to the order.
Microsoft processes this data as a technical service provider and processor on behalf of Primesoles. Microsoft provides data protection and data processing terms for Azure services, including through the Microsoft Products and Services Data Protection Addendum.
Azure region: Germany
Retention period: For as long as your app account exists. Scans and profile data without an order are deleted no later than 24 months after your last activity. Scan and manufacturing data for insoles we have produced are kept for 10 years as documentation for custom-made medical devices. Backups are overwritten after 7 days. See section 13 for details.
8. Shopify Checkout and Payment Processing
The app uses Shopify Checkout Sheet Kit to process orders via Shopify. Shopify Checkout Kit makes it possible to provide Shopify Checkout within a mobile app.
When you place an order, the following data in particular may be processed in Shopify:
name,
email address,
shipping address,
billing address,
products ordered,
order number,
payment method,
shipping information,
discount or business customer information, where relevant.
Payments are processed via Shopify and the payment service providers integrated there. Depending on the payment method, Primesoles does not receive complete payment data, and in particular no complete credit card data, where such data is processed exclusively by the payment service provider.
For processing in Shopify Checkout, the privacy policies of Shopify and the respective integrated payment service providers also apply.
9. Microsoft Business Central and Business Partners
Data may be processed in Microsoft Business Central to manage orders, customers, business partners, invoices, and internal business processes.
This includes in particular:
customer data,
order data,
billing and delivery data,
product and order information,
business customer assignments,
B2B partner information,
status information on production and delivery.
In B2B processes, certain data may be synchronized with or made accessible to authorized business partners to the extent necessary for ordering, manufacturing, adjustment, delivery, support, or billing.
The scope of data sharing depends on the respective business partner process. Primesoles ensures that business partners only access data that is necessary for their respective role.
10. MSAL and Microsoft Authentication
For B2B user sign-in, the app uses the Microsoft Authentication Library for iOS (MSAL).
The following data in particular may be processed in this context:
user ID,
email address,
name,
company,
roles and permissions,
authentication tokens,
login times,
technical security information.
This data is used to securely authenticate users, manage access rights, and provide B2B features.
11. Recipients and Service Providers
We may transfer personal data to the following categories of recipients:
Microsoft Azure as hosting and backend service provider,
Microsoft Entra ID / Azure identity services,
Microsoft Business Central,
Shopify,
payment service providers in Shopify Checkout,
shipping and logistics providers,
authorized business partners and B2B partners,
orthopedic or manufacturing partners, to the extent necessary for manufacturing or adjustment,
IT service providers,
support and maintenance service providers,
tax advisors, legal advisors, or authorities, where required by law.
Data is shared only to the extent necessary for the purposes stated above, where a legal basis exists, or where you have given your consent.
12. Data Transfers to Third Countries
We strive to process personal data primarily within the European Union or the European Economic Area.
Where service providers such as Microsoft, Shopify, or payment service providers process data outside the EU or EEA, this is done on the basis of appropriate safeguards, in particular EU Standard Contractual Clauses, adequacy decisions, or other legally provided mechanisms.
Please note that some technical service providers are international companies, and data processing or support access outside the EU/EEA cannot be completely ruled out.
13. Retention Period
We store personal data only for as long as necessary for the respective processing purposes or as required by statutory retention obligations. The retention period depends in particular on the purpose of processing, the status of an order, statutory retention obligations, any warranty, adjustment, complaint, and support processes, and customers' interest in reorders or follow-up adjustments.
Where data is no longer required and there are no statutory retention obligations or legitimate reasons for further storage, it is deleted or anonymized.
Website and Technical Log Data
Technical data generated when you visit the website or use the app is stored only for as long as necessary for technical provision, security, error analysis, and abuse prevention. Where possible, technical log data is deleted or anonymized once the applicable period has expired.
Incomplete Scans, Inquiries, or Orders
Data from incomplete scans, inquiries, or orders is stored only for as long as necessary to continue the process, analyze errors, support customers, or resolve technical issues. After that, this data is deleted or anonymized unless legal obligations or legitimate reasons require further storage.
Foot Scan, Insole Scan, Body Measurement, and Health Data
Foot scan, insole scan, body measurement, and health-related data is stored for as long as necessary to:
create a digital foot profile,
recommend suitable Primesoles insoles,
manufacture individually customized insoles,
process orders,
handle adjustments, complaints, and support cases,
enable reorders or follow-up adjustments,
establish, exercise, or defend legal claims.
Where processing is based on your consent, you may withdraw that consent at any time with effect for the future. After consent is withdrawn, the data concerned is deleted or anonymized unless it is still required for contract performance, legal obligations, or complaint, warranty, documentation, or legal defense purposes.
Order, Billing, and Payment Data
Order, billing, payment, and accounting data is stored for the duration of statutory commercial and tax retention obligations. This applies in particular to data required for invoicing, accounting, tax records, payment processing, shipping, complaints, or compliance with legal obligations.
B2B Account and Business Partner Data
B2B account, business partner, and access management data is stored for as long as the respective business customer account or business partner relationship exists and to the extent storage is necessary for user management, permissions, order processing, billing, support, or statutory documentation obligations.
After the business relationship ends, the data is deleted, anonymized, or subject to restricted further processing, unless statutory retention obligations or legitimate reasons require further storage.
Data in Microsoft Azure
The scan, profile, questionnaire, and technical data required for the app is processed in Microsoft Azure in Germany.
The Azure SQL database is currently configured with point-in-time recovery backups for 7 days. Long-term retention of SQL backups is not currently set up.
Scan files and associated files are stored in Azure Blob Storage in the Germany West Central region. For Azure Blob Storage, soft delete for blobs and soft delete for containers are each enabled for 7 days. Blob versioning and change feed are not currently enabled.
The 7-day periods mentioned for database backups and soft delete relate to technical recovery and security features. They do not mean that all live data is automatically deleted after 7 days. Live data remains stored until it is deleted by Primesoles, by the application, through a configured deletion rule, or as part of a deletion or anonymization process.
After deletion, data may, for technical reasons, remain in backups or recovery mechanisms for a limited period until those backups are routinely overwritten or deleted.
Shopify and Microsoft Business Central
Order, customer, billing, and business partner data is processed in Shopify and Microsoft Business Central. This data is stored for as long as necessary for contract performance, customer support, reorders, complaints, billing, and commercial and tax retention obligations.
Where deletion is not possible due to statutory retention obligations, processing is restricted wherever possible.
Deletion Requests
You may request the deletion of your personal data at any time. To do so, please contact us at:
We review each deletion request individually. Unless statutory retention obligations or ongoing contractual, complaint, warranty, documentation, or legal defense purposes prevent it, the data concerned is deleted or anonymized.
14. Security
We take technical and organizational measures to protect personal data against loss, misuse, unauthorized access, disclosure, alteration, or destruction.
These may include in particular:
encrypted transmission,
access restrictions,
role-based permissions,
logging of administrative access,
secure authentication methods,
regular technical maintenance,
security measures in Microsoft Azure,
separate processing of app, order, and identity data, where technically appropriate.
Please note that no electronic transmission or storage is completely risk-free.
15. No Sharing of Scan Data with Apple
The app uses features of your iPhone or iPad, in particular camera, TrueDepth, and/or LiDAR technology, to create foot and insole scans.
Foot scan, insole scan, depth, body, or health data captured by the app is not shared with Apple by Primesoles.
Apple provides the device and operating system features but does not receive from Primesoles any foot profiles, health information, or insole information created with the app.
16. Use by Children
The app is not intended for children under the age of 13 unless it is used with the consent of a parent or legal guardian.
Health and body data of minors is processed only if appropriate consent or a legal basis exists.
17. Your Rights
Subject to the applicable legal requirements, you have the following rights:
right of access,
right to rectification,
right to erasure,
right to restriction of processing,
right to data portability,
right to object to certain processing,
right to withdraw consent given, with effect for the future,
right to lodge a complaint with a data protection supervisory authority.
To exercise your rights, you can contact us at:
info@primesoles.de
18. Withdrawal of Consent
Where processing is based on your consent, you may withdraw that consent at any time with effect for the future.
Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
If you withdraw your consent to the processing of foot scan, body, or health data, we may no longer be able to provide certain services, in particular the creation, recommendation, adjustment, or reordering of individually customized insoles.
19. Deleting Your App Account and App Data
If you have created a user account in the app, you can request the deletion of your account and the associated personal data or, where available in the app, initiate the deletion directly within the app.
Apple requires apps that support account creation to let users initiate the deletion of their account within the app.
You can also request the deletion of your data by email:
info@primesoles.de
Please note that certain data cannot be deleted, or can only be deleted after statutory periods have expired, in particular billing, tax, and accounting data, or data required to establish, exercise, or defend legal claims.
Where data cannot be deleted, processing is restricted wherever possible.
20. Automated Recommendations
The app may generate recommendations for suitable Primesoles insoles based on your scans, physical information, activity information, and health-related information.
These recommendations are intended to support the ordering and adjustment process. Where necessary, Primesoles employees or authorized partners may review the information to support the manufacturing, adjustment, or quality assurance of the insoles.
No decisions based solely on automated processing that produce legal effects or similarly significantly affect you within the meaning of Art. 22 GDPR are made, unless expressly stated otherwise.
21. Free-Text Information
If you voluntarily provide further details in the “Additional information” field, they may contain sensitive or health-related information.
Please only provide information that is necessary for recommending, manufacturing, or adjusting your insoles.
We process this information exclusively for the purposes described.
22. Mandatory and Voluntary Information
Some information is required so that we can recommend, manufacture, and deliver your insoles. Other information is voluntary but can help improve the recommendation and fit of the insoles.
If required information is not provided, certain app features or the ordering of individually customized insoles may not be available.
23. Changes to This Privacy Policy
We may update this Privacy Policy if the app, our data processing, our technical service providers, or legal requirements change.
The current version is available at any time at the following address:
https://primesoles.de/datenschutz-app