Last updated: August 2026
BoneOS is a project by Netstrada SRL, developed in collaboration with Dr. med. Carl Peter Meschede. Netstrada SRL is the sole controller for the processing of your personal data; Dr. Meschede is a medical collaboration partner and has no access to your data.
The controller within the meaning of the GDPR for data processing via the BoneOS website and the BoneOS app is:
Netstrada SRL
Via Marche 43, 60019 Senigallia (AN), Italy
VAT No.: IT02865850428
Represented by (Managing Director): Manuela Miriam Winter
Contact: hello@netstrada.it
More about the collaboration with Dr. Meschede in the Legal Notice.
This policy covers two separate offerings that process different data: the waitlist on this website, and the BoneOS app itself. Both sections apply independently — what you provide via the waitlist has no bearing on what is stored in the app, and vice versa.
When you sign up for the BoneOS beta, we store your email address and any optional demographic information you voluntarily provide (age range, gender, diagnosis status). We also store a confirmation token and the time of confirmation.
The app does not ask for your name or email address when you first open it. Instead, it creates a random identifier (a technical device identifier) and stores it in your smartphone's protected storage. Everything you enter in the app is linked to that one identifier — not to your name.
Specifically, under that identifier we process:
Diagnosis status, menopause status and T-score are health data within the meaning of Art. 9 GDPR — a special category of personal data subject to a higher standard of protection (see section 5).
Not transmitted to our servers: your daily ticks confirming you took a medication, your chosen language, and the Doctor Summary PDF — that is generated directly on your device and never sent to us.
The app works fully without signing in. If you nonetheless sign in with an email address (Profile → Create account), we link that address to your device identifier so you can find your entries again on a second device or after reinstalling. The sign-in itself is handled by our provider Clerk, Inc. (see section 6).
On the website, we collect anonymized usage data via PostHog (e.g. pages visited, click behavior) with your consent. In the app, usage statistics are off by default and are only collected if you explicitly allow them — when the app asks you, or at any time via the toggle under Profile → Other. Your health entries, your notes and any other app content are never included — only which parts of the app are used.
If the app crashes or a technical error occurs on our servers, a technical error report is automatically sent to our service provider Sentry (see section 6). Such a report contains technical details about the error — such as the error type, program state, device model and operating system version — but no health entries, no notes and no email address. IP addresses are not stored.
Providing the app's core functionality (storing and displaying your entries) is based on the performance of a contract, or steps taken at your request prior to entering one, pursuant to Art. 6(1)(b) GDPR.
Because some of these entries are health data (Art. 9 GDPR), we additionally process them only on the basis of your explicit consent pursuant to Art. 9(2)(a) GDPR, which you give during the app's initial set-up.
The waitlist, the optional email sign-in, and usage statistics (on the website and in the app) each rest on your separately given, explicit consent pursuant to Art. 6(1)(a) GDPR. You may withdraw any of these at any time — usage statistics in the app via the toggle under Profile → Other, all others by contacting hello@netstrada.it.
Sending technical error reports (section 3.E) is based on our legitimate interest in operating the app and our servers in a stable and secure manner pursuant to Art. 6(1)(f) GDPR. These reports contain no health data. You may object to this processing at any time by contacting hello@netstrada.it.
Our servers are located in Germany (Hetzner data center). This is where both the website and all app data (including the health data described in section 3.B) are stored. Privacy information: hetzner.com/legal/privacy-policy
If you sign in to the app by email, Clerk processes your email address and the sign-in flow (sending the verification code, session management). Clerk has no access to the health entries you store in the app.
PostHog stores analytics data in the EU Cloud (Frankfurt). On the website this data is anonymized and only collected after your consent via the cookie banner; in the app, only if you explicitly turn on usage statistics under Profile → Other. Privacy information: posthog.com/privacy
Sentry receives the technical error reports described in section 3.E from the BoneOS app and from our servers. Processing takes place exclusively in Sentry's EU data region (Frankfurt); IP addresses are not stored. Privacy information: sentry.io/privacy
We use Resend to send waitlist confirmation emails. Processing occurs on EU servers. Privacy information: resend.com/privacy
Your entries stored in the app can only be accessed by our own team, through an internal, password-protected tool used solely to run the app and help you when you have a question. Your data is never sold and never passed to insurers, employers or advertisers. As described in section 1, Dr. Meschede has no access to this data.
Your email address and the associated waitlist data are retained until the official app launch or until you request deletion. Website analytics data is automatically anonymized after 90 days.
Your app data remains stored for as long as your account exists. Tapping "Start over" in the app (Profile → Other) creates a new device identifier; your existing entries stay on our server but no longer belong to any device and can no longer be connected to you — this is a disconnection, not a deletion. You can request an actual deletion of your app data at any time by contacting hello@netstrada.it, quoting the device identifier shown in the app under Profile → Other.
Under the GDPR, you have the following rights:
Some of these you can exercise directly in the app: Profile → Other shows you your device identifier, lets you turn usage statistics off, start a new, unlinked device ("Start over"), or — if you're signed in — remove your email sign-in ("Delete account"). For access, rectification, or a full deletion of your data from our database, please contact: hello@netstrada.it
You have the right to lodge a complaint with the competent data protection supervisory authority. As Netstrada SRL is based in Italy, this is primarily the Garante per la protezione dei dati personali (garante.it).
BoneOS does not use persistent tracking cookies without your consent. On the website, PostHog is
only activated after your explicit consent via the cookie banner; your choice is stored in your
browser's local storage (boneos_analytics)
— no server-side cookie. The app has no cookies; usage statistics are controlled by their own
toggle under Profile → Other and are off by default.