PRIVACY NOTICE · UPDATED 10 SEPTEMBER 2026

Your details.
Handled with care.

This notice explains how Bernstein Sp. z o.o. processes personal data when you browse the AURA website, join our opening waitlist or contact us. It covers this website and waitlist only. Any future healthcare services will have their own privacy information before health data is collected.

1. Who is responsible for your data

The controller is Bernstein Sp. z o.o., ul. Gwiaździsta 5a/15, 01-651 Warszawa, Poland. NIP: 5252684561; KRS: 0000647561; REGON: 365883212. For questions, withdrawal of consent or any privacy request, email contact@myaura.tech or write to our registered address above.

2. Information we process

For the waitlist, you provide your first name, last name, email address and preferred city or cities (Warsaw and/or Munich). We also record a registration identifier, registration time, the version of the consent wording and notice presented to you, your communication preferences and subscription status, and the status, identifier and acceptance time of a confirmation email where available. If you contact us, we process your message and the contact details you provide.

Our hosting and email providers may process technical information needed to operate and secure their services, such as IP addresses, browser and device information, request timestamps, delivery information and security logs. The waitlist does not ask for health information. Please do not include medical records or other sensitive information in a waitlist enquiry. The hero animation is a concept visualisation, not a scan of a visitor.

3. Purposes and legal bases

• Waitlist and opening emails: with your consent under Article 6(1)(a) GDPR, we register your interest, send a confirmation and contact you about AURA’s opening in your selected city or cities and occasional news about AURA. Consent includes receiving these emails. Registrations made under earlier consent wording remain limited to the purposes accepted at that time; we do not automatically enrol those people in general AURA news. We do not use this consent for unrelated advertising.
• Enquiries: our legitimate interest in responding to requests and communicating with people interested in AURA (Article 6(1)(f)); where a request concerns steps towards a contract, Article 6(1)(b) may apply.
• Security and operation: our legitimate interests in keeping the website reliable, preventing abuse and maintaining necessary delivery records (Article 6(1)(f)). We limit this processing to what is proportionate to these purposes.
• Legal responsibilities: complying with applicable obligations, including responding to data protection requests (Article 6(1)(c)). Where necessary, limited records may be retained for establishing, exercising or defending legal claims based on our legitimate interests (Article 6(1)(f)).

4. Your choice and withdrawal

Joining is voluntary. We need the fields marked as required and your consent to add you to the waitlist; without them, you can still browse the website. Joining does not book an appointment, require payment or create an obligation to purchase.

You can withdraw consent at any time, without giving a reason, by replying to an AURA waitlist email or emailing contact@myaura.tech with “Unsubscribe”. We will remove you from the active waitlist and stop the opening and AURA news emails. Withdrawal is as free as giving consent and does not affect the lawfulness of processing before withdrawal.

5. Who receives your information

Access is limited to authorised people working for Bernstein and service providers needed to operate the website, store registrations and send messages. The website and database use OpenAI Sites and Cloudflare infrastructure. When automated confirmation emails are enabled, Resend processes the recipient’s email address, first name, selected cities and message content to deliver them. Our business email provider processes correspondence sent to our contact address.

We do not sell your details or publish the waitlist. We may disclose limited information to professional advisers or competent authorities where necessary to meet a legal obligation or protect legal rights. Providers’ access must be limited by applicable data protection and confidentiality arrangements.

6. International processing

Our technology providers operate internationally, so information may be processed outside the European Economic Area, including in the United States. Transfers must rely on an applicable GDPR mechanism: an adequacy decision where the recipient and processing are covered, or appropriate safeguards such as the European Commission’s Standard Contractual Clauses, with supplementary measures where needed. You can contact us for details of the arrangements applicable to your information and a copy of the relevant safeguards, subject to necessary redactions.

7. How long we keep information

We retain your registration while the waitlist for your selected opening remains active and your consent remains valid. We review the need for the information when that opening’s waitlist closes. We delete information that is no longer needed, or following withdrawal or a valid erasure request, unless limited retention is necessary for a legal obligation or a specific legal claim. In that case, it is restricted to that purpose and kept only for the applicable obligation or claim period.

Enquiries are kept for the time needed to resolve them and any necessary follow-up. Technical logs and provider copies follow the relevant service’s retention and backup cycles; they are not used to extend the purpose of your waitlist registration. Contact us if you need the retention details that apply to a particular record.

8. Your GDPR rights

Subject to the conditions in the GDPR, you can request access and a copy of your information, correction, erasure, restriction of processing, and portability of data you provided where processing is automated and based on consent or contract. You may object to processing based on legitimate interests for reasons relating to your situation. You can object to direct marketing at any time; we will stop processing your information for that purpose. You can also withdraw consent as explained above.

Send requests to contact@myaura.tech. We normally respond within one month. If the complexity or number of requests requires an extension of up to two further months, we will explain this within the first month. Requests are normally free. If reasonably necessary, we may ask for proportionate information to verify your identity.

You may complain to the President of the Polish Personal Data Protection Office (UODO), or the supervisory authority in the EEA country where you live, work or believe an infringement occurred. You do not have to contact us before making a complaint.

9. Cookies, security and automated decisions

We do not add advertising or audience analytics trackers to this website. Infrastructure providers may use technical mechanisms necessary to deliver or protect the service. We use encrypted connections and restrict access to registration data; no online system can be guaranteed completely secure.

We do not use waitlist data for profiling or decisions based solely on automated processing that produce legal or similarly significant effects. The waitlist is intended for adults and does not collect dates of birth. If you believe a child has provided personal information, please contact us so we can address it.

10. Changes to this notice

We will update this page when our practices change and show the revision date above. If a change materially affects registered visitors, we will provide appropriate notice. A change to this notice does not extend your consent to a new purpose; we will obtain fresh consent where required.