Privacy policy

Data controller: JBK Consulting Oy, a company registered in Finland, business ID 3141980-8, registered office: Finland. Life Variable Lab is a service name used by the company; its registration as an auxiliary business name is pending. drklva.com is operated by the company.

Privacy contact: privacy@drklva.com. We have not appointed a data protection officer; for anything about privacy and for any data request, simply email this address.

For consumer contracts, our geographic address and telephone number are given on the payment page, on the Legal notice page (in Chinese) and in the contract confirmation email.

• No registration is needed, and your choices are not stored. The keywords you type into the search box (a brand or product name) are used only to find products. When comparing, Pair Check sends the server the comparison group you chose and the version numbers of the two products, for one calculation; the server reads the product facts from the published product records. After the result is shown, neither the keywords nor the choices of this check are stored.
• Four yes/no questions (whether you are taking medication, have a diagnosed condition, have abnormal lab results, or are pregnant or breastfeeding) concern health information. Your answers are used only in your own browser: if you answer “yes” to any of them, the page advises you to consult a doctor or pharmacist first and does not compare; the answers are not sent to us and are not stored. If you answer “no” to all, the only things sent to the server are the comparison group and the two product version numbers.
• Technical records: our website hosting provider (Cloudflare) processes access data (for example the IP address, browser type and time of the request) for security and operation. We do not use this data to identify individuals or for advertising.
• Approximate amounts on the English pages: to show an approximate amount in your local currency next to a ¥ price, the English pages use the country that Cloudflare determines from your IP address to choose the currency. We use this country only to choose the currency; we do not store it or use it for any other purpose. You still pay the ¥ price. The Chinese pages do not do this.
• Browser storage: see section 12.

You apply on the website after logging in with an email code. We collect only these five items:

1. one overall photo of your cabinet or table (supplements only);
2. roughly how many supplements you use;
3. the one purchase decision you most want to get clear;
4. whether medication, an illness or persistent noticeable discomfort is involved: answered only “yes / no / not sure”, and only with your separate consent; refusing consent does not affect your application;
5. the email address you log in with.

We do not collect: identity documents, your exact date of birth, diagnoses, descriptions of symptoms, names of medicines, lab values, pregnancy status, complete diet, sleep or stress records, or the real names of family members.

Without the consent box ticked, the health screening answers cannot be selected and are not sent to us. Photos are recompressed in your browser and stripped of information such as the location where they were taken before upload; the original never leaves your device. If a photo unexpectedly shows something that should not be in it, we delete that photo and ask you to take it again.

To complete the review we collect: the product names and market versions; label photos of each product (front, ingredient list, directions and warnings); how and how often you use them, in your own words; this purchase event and your non-medical purchase goal; and the consent records. The result of the review is a signed confirmation sheet in PDF format.

These inputs and the confirmation sheet are stored in the website’s database and private storage (Supabase, EU · Ireland), visible only to you and our reviewers. When the signer prepares the confirmation sheet, an encrypted working folder is also used; nothing is copied anywhere else. Notification emails contain only reminders and links, not this content.

Before you confirm your inputs, we show you the full data notice once more and ask for your explicit consent. You can withdraw this consent at any time before the review is completed.

We process your account email, the products you add to the workspace, the workspace settings (for example the pack sizes, daily amounts, prices and product order you confirmed), snapshots, export records, access-right records, and the order and payment records necessary to open, provide, secure and support the workspace. For the four yes/no health questions in the workspace, the answers are used only in your browser; they are not sent to us and are not stored.

Payments are processed by Stripe, which supports bank cards, Alipay and WeChat Pay. We cannot see and do not store your full card number or payment account password; we receive only the order number, amount, currency, payment status, the payment reference number provided by Stripe, and the information needed for invoicing, tax and refunds.

Billing address: when you pay for L3, and when the ¥99 payment page calculates VAT by region, Stripe asks for your billing address. We use its country to determine the applicable VAT (for example, customers in mainland China are not charged Finnish VAT) and keep the billing address as an accounting and tax record, for the period given in section 8, “Payment and invoicing records”. The billing address is not used for marketing or for anything else.

• Photo, number of products, decision and email of an L3 applicationPurpose: reviewing the application, replying, sending the payment linkBasis: steps taken at your request before entering into a contract (GDPR Article 6(1)(b))
• Health screening answers of an L3 applicationPurpose: deciding whether the service suits you and whether you should be referred to a professionalBasis: your explicit consent (GDPR Article 9(2)(a))
• Products, doses and use for L3Purpose: completing the review and issuing the confirmation sheetBasis: performance of a contract (GDPR Article 6(1)(b)); for the health-related parts, your explicit consent (Article 9(2)(a))
• Frozen personal intake structure (12 months)Purpose: so that next time does not start from zero (L4 Delta)Basis: your explicit consent (GDPR Article 9(2)(a)); where applicable, also performance of a contract (Article 6(1)(b)); the retention period is stated separately
• ¥99 account, workspace and service notices (once launched)Purpose: opening and providing the workspace; sending service notices such as payment confirmations and deletion remindersBasis: performance of a contract (GDPR Article 6(1)(b))
• Contract confirmations, withdrawal declarations and withdrawal receipts (once launched)Purpose: confirming the contract on a durable medium, handling your withdrawal and refund, and proving when we received the withdrawalBasis: legal obligation (Finnish Consumer Protection Act, Chapter 6; GDPR Article 6(1)(c))
• Technical logs and securityPurpose: keeping the website secure and running, preventing abuseBasis: our legitimate interests (GDPR Article 6(1)(f))
• Approximate amounts by country on the English pagesPurpose: showing the approximate amount in your local currency next to the ¥ price, to help you understand the priceBasis: our legitimate interests (GDPR Article 6(1)(f))
• Payment and accounting recordsPurpose: collecting payment, bookkeeping and taxBasis: legal obligation (GDPR Article 6(1)(c))

Where processing is based on your consent, you can withdraw it at any time; withdrawal does not affect the lawfulness of processing carried out before it.

We do not currently send marketing messages. Service emails such as payment confirmations, withdrawal receipts and deletion reminders are not marketing; while the service is running, you cannot unsubscribe from them.

• Free Pair CheckYour choices are not stored; the answers to the four health questions are used only in your browser and are not sent to us.
• Applications that do not lead to a purchaseHealth data, photos and application answers are deleted within 30 days of the day we send the review result; only the application number, email address and review result code are kept, for 12 months, to avoid reviewing the same request twice.
• Full input of paying customers12 months after the service is completed, then deleted or anonymised; where a dispute, complaint or legal claim requires longer storage, kept until it is resolved.
• Frozen personal intake structure12 months; you can ask for earlier deletion at any time.
• Payment and invoicing records (including the billing address)Kept for the periods required by the applicable accounting and tax laws; currently: payment records, receipts and other vouchers 6 years, books of account and financial statements 10 years, both counted from the end of the financial year (deletion requests do not apply).
• After you withdraw consentDeletion completed within 30 days and confirmed in writing.
• ¥99 decision workspace: after the access period ends (once launched)After the 90-day access period ends, the workspace is kept for about 30 more days, during which existing snapshots can only be viewed and exported; then the workspace, the products you added (including the pack sizes, daily amounts and prices you confirmed), the snapshots and the export records are deleted. At least 7 days before deletion we send a reminder to your account email (a service notice). The actual deletion may happen slightly later than stated, but never earlier than 7 days after the reminder was sent.
• ¥99 decision workspace: after a refund (once launched)The workspace closes with the refund and can only be viewed, not changed or exported; the workspace data above is deleted about 30 days after the refund. If you received a deletion reminder before the refund, deletion happens no earlier than 7 days after that reminder was sent.
• Withdrawal declarations (once launched)The name, payment email, order number, email for the receipt and explanation you submit on the “Withdraw from the contract here” page, with the time we received them and the outcome: kept for 3 years after the contractual relationship ends (see the “Contract evidence” row below). To prevent abuse, your network address itself is not stored, only a hash of it (with a random value changed daily), and only for the short time reasonably necessary to prevent abuse.
• “Different from my product” feedback (once launched)Deleted once the product issue has been dealt with; kept for at most 12 months; deleted together with the account.
• ¥99 account (login email) (once launched)If you have paid: deleted 12 months after your last access right actually ends (normal expiry, or, for a refund before expiry, the date the refund takes effect), counted again from any new purchase; if you never paid: deleted 30 days after your last successful login. Not deleted while a payment, a customer-service question or a data request is open. No separate notice before deletion.
• Accounts that requested a login code but never logged in (¥99 and L3)If you entered your email and received a code but never logged in, the account is deleted 30 days after it was created; requesting another code does not restart the period. Not deleted while an order, a payment dispute, a customer-service question or a data request is open.
• Accounts that logged in only for L3, without an L3 applicationDeleted 30 days after the last login.
• ¥99 orders and payment recordsNot deleted with the workspace or the account; kept for the periods required by the applicable accounting and tax laws; currently: payment records, receipts and other vouchers 6 years, books of account and financial statements 10 years, both counted from the end of the financial year.
• Contract evidence: ¥99 access-right records, pre-payment confirmation records, contract confirmations, withdrawal declarations and related evidenceKept for 3 years after the contractual relationship ends (the access period expires, or a refund before expiry takes effect), to perform the contract, handle refunds or complaints, prove your confirmations, and establish, exercise or defend legal claims; not deleted with the workspace or the account.

Our own people: employees, managers and contractors of JBK Consulting Oy process personal data only under the company’s authority; only those who must have access to provide the service have it, and they are bound by confidentiality.

Service providers: processors process data on our instructions, to provide the service, under data processing agreements with us; providers that process data as independent controllers are marked with that role below.

• SupabaseProduct database; login accounts; L3 applications, photos, answers and confirmation sheets; the ¥99 workspace (once launched)Role: processorData location: contracting party Supabase Pte. Ltd (Singapore). Data is stored and mainly processed in the EU region we chose (Ireland); where needed to provide the service, Supabase or its sub-processors may process it in other locations
• CloudflareWebsite hosting and network deliveryRole: processorData location: global network: requests are handled by the nearest edge server; where technical records such as logs are processed is determined by Cloudflare's service architecture and the applicable contractual safeguards
• Stripe Payments EuropePayment processingRole: processor; also an independent controller, processing data for legal obligations such as fraud prevention, financial compliance, anti-money laundering and customer identity verificationData location: contracting party Stripe Payments Europe, Limited (Ireland); data may be processed worldwide, including by Stripe, LLC in the United States
• Zoho MailCompany mailbox: customer service and data-rights requests (hello@drklva.com, privacy@drklva.com)Role: processorData location: data is stored in Zoho's data centres in the European Economic Area; Zoho's group company in India may access it remotely for support and troubleshooting (transfer safeguards: see section 10)
• Zoho CPaaS (formerly ZeptoMail)Sending login codes and service emails, such as L3 progress reminders, reminders before ¥99 workspace deletion, payment confirmations and withdrawal receipts: the recipient address and the content of the emailRole: processorData location: data is stored in Zoho's data centres in the European Economic Area; Zoho's group company in India may access it remotely for support and troubleshooting (transfer safeguards: see section 10)

AI services: we do not currently use any AI service to process your label photos or inputs. If we ever do, we will first sign a data processing agreement with the provider and confirm that the data is not used to train models, then update this policy and notify you.

We do not sell or exchange data, or use it for advertising or for training models. We disclose it only where the law compels us to, following the legal procedure.

We operate in Finland. Your data travels from where you are (for example mainland China) to the EU, and some providers (such as Cloudflare, Stripe and Supabase, and Zoho’s group company in India, which may access data remotely) may also process it outside the European Economic Area. For transfers to places outside the EEA without an adequacy decision, we use this safeguard: the EU standard contractual clauses (European Commission Decision (EU) 2021/914) included in the providers' data processing agreements. Some providers may also take part in the EU–U.S. Data Privacy Framework.

You can request a copy of the relevant safeguards by emailing privacy@drklva.com.

The laws of your country may give you additional mandatory rights.

• access your data and get a copy;
• have incorrect facts corrected;
• have your data deleted;
• export it in a common format (the signed confirmation sheet plus structured data);
• withdraw consent; withdrawing is as easy as giving it, and after withdrawal we stop the processing;
• restrict or object to processing.

How: email privacy@drklva.com with your application number or order number; you do not need to give a reason. You can ask for your account to be deleted at any time; unless we must keep some records because of a legal obligation or to establish, exercise or defend legal claims, we delete the account data we no longer need after verifying the request, and tell you which data must be kept and why. Deletion requests, and deletion after a withdrawal of consent, are usually completed within 30 days and confirmed in writing; requests to access, correct or export data are usually answered within 30 days. If a request is complex or there are many requests, we may extend the period and will tell you why within 30 days.

To protect your data, we may ask you to verify your identity in a reasonable way before handling a request, for example by sending the request from the email address you use with us, or by giving the order number.

Complaints: if you believe we have handled your data improperly, you can complain to the Office of the Data Protection Ombudsman in Finland (Tietosuojavaltuutetun toimisto, tietosuoja.fi), or to the competent authority where you live.

This site keeps only these two items in your browser’s local storage, and sets no advertising or tracking cookies:

• Language preference (drk_lang)remembers the website language you chose
• Login session token (¥99 workspace and L3, after login)keeps you logged in

Both are strictly necessary to provide the service. We have no advertising tracking or third-party analytics scripts.

Our services are for adults aged 18 and over. L3 does not review questions about the individual suitability of supplements for minors; for such questions, please consult a doctor or pharmacist. If we learn that personal data was provided by someone under 18, we delete it promptly.