Privacy Policy

Your privacy is important to us. This Privacy Policy applies to our website. It describes how Aorta Oy processes the personal data of its site visitors: what data is collected, for what purposes it is used, to whom it may be disclosed, and how you can influence the processing. The Privacy Policy also provides information about the obligations that Aorta Oy follows when processing personal data.

Aorta Oy protects the privacy of the data subjects and complies with the General Data Protection Regulation (EU) 2016/679 as well as other applicable data protection legislation and good data processing practices. Accordingly, this Privacy Policy governs exclusively the processing operations wherein Aorta Oy serves as a data controller. It does not extend to our data processing activities as a data processor, which are set forth in a separate document.

Any information gathered is kept securely and not shared with third parties unless required by law. You have the right to request, update, or delete your information at any time by contacting us directly.

1. Data Controller and Contact Information

2. General Principles

Aorta Oy respects the privacy of its website users. This policy outlines how we collect, use, store, and disclose the personal data you provide us, adhering to the General Data Protection Regulation (GDPR) (EU 2016/679).

3. Data Processing Activities

We collect and process personal data for the following purposes and legal bases:

Data Collected Via Demo Booking

When you book a demo through our website, your name, email address and selected time are collected by a third-party scheduling service. Purpose: to schedule and conduct product demonstrations. Legal basis: Art. 6(1)(b), Performance of a Contract. Data is retained for the duration of the business relationship.

Data Collected Via Early Access List

We collect email addresses from visitors who join our early access list. Purpose: to notify about product updates. Legal basis: Art. 6(1)(a), Consent. Data is retained until the user unsubscribes or requests deletion.

Data Collected Via Product Feedback

When you submit feedback through the Sohvi application, we collect your email address and feedback content. Purpose: to improve the service. Legal basis: Art. 6(1)(f), Legitimate Interest. Data is retained for 12 months.

Cookies and Tracking Technologies

Our website does not currently use cookies or similar tracking technologies. If this changes in the future, we will update this policy and, where required, obtain your consent before placing any cookies on your device.

Processing of Third-Party Data

When veterinarians use Sohvi to document consultations, the audio and resulting transcriptions may contain personal data of third parties, such as animal owners (e.g. names, contact details). In this context, the veterinarian or their clinic is the data controller for such third-party data, and Aorta Oy acts as a data processor on their behalf. Veterinarians are responsible for ensuring they have an appropriate legal basis to record and process consultation data using Sohvi. The specific terms, security measures, and our obligations as a data processor for the Sohvi service are governed by a separate document (Data Processing Agreement) and are not covered by this website Privacy Policy.

4. Data Storage and International Transfers

A. Data Processors and Service Locations

We use the following categories of third-party service providers. Their processing locations are indicated below:

• Cloud hosting and infrastructure (EU)
• Database, authentication and storage (EU)
• Domain registration and DNS (Finland)
• Online scheduling and booking (EU/US)

B. Transfers Outside the EU/EEA

Our handling of personal data is primarily limited to the European Economic Area (EEA). Some of our service providers, such as our online scheduling service, may operate from outside the EEA. In such cases, any transfer of personal data will take place only with appropriate safeguards in line with applicable data protection legislation.

5. Your Rights as a Data Subject

Under the GDPR, you have the following rights regarding your personal data:

• Right of Access (Article 15): You have the right to obtain confirmation about whether your personal data is being processed and to receive a copy of that data.
• Right to Rectification (Article 16): You have the right to request the correction of inaccurate or incomplete personal data.
• Right to Erasure (Right to be Forgotten) (Article 17): You have the right to request the deletion of your personal data under certain conditions.
• Right to Restriction of Processing (Article 18): You have the right to request that we limit the processing of your data.
• Right to Data Portability (Article 20): You have the right to receive your personal data in a structured, commonly used, and machine-readable format.
• Right to Object (Article 21): You have the right to object to the processing of your data, particularly for direct marketing purposes.
• Right to Withdraw Consent: If processing is based on your consent, you may withdraw your consent at any time.

To exercise any of these rights, please contact the Data Controller using the contact information provided in Section 1.

6. Right to Lodge a Complaint

You have the right to lodge a complaint with the relevant supervisory authority if you believe your rights under applicable data protection laws have been violated. In Finland, complaints can be submitted to the Office of the Data Protection Ombudsman. Further information is available on the authority’s website.

We would appreciate the opportunity to address your concerns directly. If you have any complaints or concerns about our processing of your personal data, we kindly ask that you contact us first using the details in Section 1. This allows us to investigate and resolve your issue efficiently and promptly. You always retain the right to lodge a complaint with the supervisory authority.

7. Changes to This Policy

Aorta Oy reserves the right to update this Privacy Policy at any time. Any material changes will be reflected in an updated version of this policy published on this page.

Last updated: March 16, 2026