Privacy Policy

Last updated: August 26, 2026

This Privacy Policy explains how NOVALISM, operated by Huppert & Huppertová GbR, collects and processes personal data when you visit this website, contact us, join a community or membership, book a call, purchase a service, participate in a recorded session or otherwise interact with NOVALISM.

This Privacy Policy provides information required under the General Data Protection Regulation (“GDPR”) and applicable German data-protection law. It is not a request for consent. Where consent is required, it is requested separately before the relevant processing begins.

1. Controller

The controller responsible for processing personal data is:

Huppert & Huppertová GbR
Alte Landsberger Str. 9A
82266 Inning am Ammersee
Germany

Email: neurochange@novalism.com

2. Scope of this Privacy Policy

This Privacy Policy applies to:

the NOVALISM website;
the website contact form;
communications sent to NOVALISM;
the NOVALISM community, memberships and other products offered through WithMe;
applications and bookings made through WithMe;
payments processed through Stripe;
email communication sent through WithMe;
booked and recorded video sessions;
Google Calendar scheduling connected to WithMe;
and WhatsApp communication used for Private Deliberate Reconstruction.

When you follow a link to an external platform, that platform’s own privacy information also applies.

3. Personal data we process

Depending on how you interact with NOVALISM, we may process:

your name;
your email address;
your postal address, where required for a contract or invoice;
your billing and transaction information;
your membership, product and booking information;
your application or questionnaire responses;
your messages and contact inquiries;
your community profile, posts, comments and direct messages;
your session participation and recording consent;
audio and video contained in a session recording;
communication sent through WhatsApp;
email delivery, opening and link-interaction data where supplied by WithMe;
your IP address;
browser, device and operating-system information;
requested pages, access times, referring pages and technical log information;
and other information you choose to provide.

NOVALISM does not receive or store your complete payment-card number.

4. Website hosting and technical delivery

The NOVALISM website is created and hosted through Tailor Brands. Tailor Brands and its infrastructure providers may process technical data required to deliver and protect the website, including:

IP address;
date and time of access;
requested page or file;
referring page;
browser and device information;
operating system;
and technical error and security information.

This processing is necessary to display the website, maintain its stability, prevent misuse and protect its security.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interests are the reliable, secure and efficient operation of the NOVALISM website.

Technical server and security logs are retained only for as long as required for operation, troubleshooting and security, unless longer retention is necessary to investigate misuse or comply with a legal obligation.

Tailor Brands provides further information in its Privacy Policy.

5. Contact form and email inquiries

When you use the website contact form or contact us by email, we process the information you submit, including your name, email address and message.

The contact form is provided through Tailor Brands. The NOVALISM email address is operated using Tailor Brands and Google services. These providers may process the technical and communication data required to transmit, store and protect your message.

If your inquiry concerns a possible booking, membership, purchase or service, the legal basis is Article 6(1)(b) GDPR, including steps taken before entering into a contract.

For general questions and ordinary business communication, the legal basis is Article 6(1)(f) GDPR. Our legitimate interest is responding to inquiries and maintaining professional communication.

General inquiries are normally deleted within 12 months after the matter has been resolved unless they become part of a contractual relationship or must be retained for legal reasons.

Please do not include medical records, diagnoses, therapeutic histories or other unnecessary sensitive information in the contact form.

6. WithMe community, memberships, products and bookings

NOVALISM uses WithMe, available through withme.so, to provide:

the free NOVALISM community;
Neurochange Membership;
digital content and products;
applications;
coaching and Orientation Call bookings;
member accounts;
community communication;
email broadcasts and automated messages;
and access to recordings and program materials.

When you register, join, apply, book or purchase through WithMe, WithMe may process:

your name and email address;
account and profile information;
login and technical usage data;
product, membership and access information;
booking information;
billing and transaction information;
community posts, comments and messages;
email-delivery and interaction data;
and content you upload or submit.

NOVALISM receives access to the information required to administer your account, provide the selected service, communicate with you, manage your access and fulfill contractual obligations.

The legal basis for registrations, bookings, memberships and purchased services is Article 6(1)(b) GDPR.

The legal basis for community moderation, platform security, preventing misuse and improving the organization of NOVALISM services is Article 6(1)(f) GDPR. Our legitimate interests are maintaining a safe, functional and coherent community and protecting NOVALISM content and services.

Information required for invoices, tax records or other statutory obligations is processed under Article 6(1)(c) GDPR.

Community contributions

Information you publish in a WithMe community may be visible to other members of that community. Please decide carefully what you share and do not publish personal information about another person without authorization.

Community contributions may remain visible while the relevant community or account exists. You may request deletion of your contributions, subject to legal obligations and the technical operation of conversations involving other members.

7. Payments through Stripe

Payments for NOVALISM products, memberships and services are processed through Stripe, connected to the WithMe platform.

Stripe may process:

your name;
billing address;
email address;
payment method;
transaction amount and currency;
payment status;
device and technical information;
and information required for fraud prevention and regulatory compliance.

NOVALISM does not store complete card details. We receive transaction confirmation and the information required to administer your purchase and maintain accounting records.

The legal basis for payment processing is Article 6(1)(b) GDPR. Processing required for invoices, tax and accounting obligations is based on Article 6(1)(c) GDPR.

Stripe may also process certain information as an independent controller for fraud prevention, financial regulation and legal compliance.

Further information is available in the Stripe Privacy Policy.

8. Scheduling and Google Calendar

Bookings are made through WithMe and synchronized with Google Calendar.

The information transferred to the calendar may include:

your name;
email address;
selected service;
appointment date and time;
time zone;
and information needed to administer the appointment.

The legal basis is Article 6(1)(b) GDPR because calendar processing is required to arrange and provide the requested appointment or service.

Google may process account, device and technical information according to its own policies. Further information is available in the Google Privacy Policy.

9. Service emails and marketing communication

WithMe is used to send operational and, where requested, promotional emails relating to NOVALISM.

Service communication

We may send messages required to:

confirm a registration, purchase or booking;
provide access to a community, membership or product;
communicate changes affecting an active service;
send session links or materials;
respond to support questions;
and administer the contractual relationship.

The legal basis is Article 6(1)(b) GDPR.

Marketing communication

Promotional emails, newsletters and general NOVALISM updates are sent only where you have requested or consented to receive them, unless another legal basis expressly permits the communication.

The legal basis is Article 6(1)(a) GDPR.

You may withdraw your consent at any time by using the unsubscribe link contained in the email or by contacting neurochange@novalism.com.

Withdrawal applies to future communication and does not affect the lawfulness of processing carried out before withdrawal.

Records of consent and withdrawal may be retained for the duration of the communication and for up to three years afterward to demonstrate compliance.

10. Video calls and recordings

Video sessions may be provided and recorded through WithMe.

A recording may contain:

your name or profile information;
your voice;
your image;
contributions made during the session;
chat messages;
and information visible or audible in your surroundings.

Recording begins only after participants have been informed about the recording and consent has been requested. The legal basis is Article 6(1)(a) GDPR.

Where a recording is expected to contain health information or another special category of personal data, explicit consent under Article 9(2)(a) GDPR is requested where required.

NOVALISM does not provide therapy, diagnosis, crisis intervention or medical treatment and does not request medical records or therapeutic histories. Participants should avoid disclosing unnecessary medical, psychological or other highly sensitive information during recorded sessions.

Before consent is given, participants are informed about:

the purpose of the recording;
who will have access;
whether a replay will be made available;
and the intended availability or retention period.

Recordings are used only for the purpose communicated before recording. Access is limited to the relevant participants, members or authorized service providers.

Where a membership recording is provided as a replay, its availability may be limited to the period stated for that membership or program. Recordings and technical copies are deleted when they are no longer required for the communicated purpose, subject to necessary technical backup periods and legal obligations.

Consent may be withdrawn for future processing by contacting neurochange@novalism.com. Withdrawal does not affect processing that occurred before the withdrawal. Where a recording includes several participants, deletion requests must also be assessed in relation to the rights of the other participants and any applicable legal obligations.

11. WhatsApp communication

WhatsApp is used only where agreed as part of Private Deliberate Reconstruction.

When communicating through WhatsApp, the following information may be processed:

your telephone number;
profile name and image;
message content;
attachments;
communication dates and times;
and technical communication metadata.

The legal basis is Article 6(1)(b) GDPR because WhatsApp communication forms part of the agreed service. Where separate consent is required, the legal basis is Article 6(1)(a) GDPR.

WhatsApp is provided by Meta Platforms Ireland Limited. WhatsApp and other Meta companies may process communication metadata and other information under their own privacy terms, including outside the European Economic Area.

Do not use WhatsApp to send medical records, diagnoses or other unnecessary highly sensitive information.

Further information is available in the WhatsApp privacy information applicable to users in the European Economic Area.

12. Cookies and similar technologies

The NOVALISM website may use cookies, local storage and similar technologies that are technically necessary to:

deliver the website;
maintain security;
remember essential settings;
and provide functions specifically requested by the visitor.

Where storage or access is strictly necessary to provide the requested website function, it is based on §25(2) TDDDG. Related processing of personal data is based on Article 6(1)(f) GDPR. Our legitimate interests are the secure and functional operation of the website.

NOVALISM does not independently install Google Analytics, Meta Pixel or comparable advertising trackers on the website at the time of this Privacy Policy. Tailor Brands and its infrastructure providers may process technical logs and provide aggregate website-performance or usage information.

If optional analytics, marketing technologies or externally embedded media are activated in the future, they will be loaded only after consent where consent is legally required. The legal basis for the related storage or access is §25(1) TDDDG and for the processing of personal data Article 6(1)(a) GDPR.

Where optional technologies are active, a cookie-preference or consent option will be provided. Consent may be refused or withdrawn without affecting access to functions that do not require those technologies.

You may also configure your browser to block or delete cookies. Blocking technically necessary storage may affect website functionality.

13. YouTube and embedded content

At the time of this Privacy Policy, NOVALISM does not intentionally embed YouTube videos directly on the website.

If YouTube videos or other third-party media are embedded in the future, the relevant content will be configured so that it does not load before consent where consent is required. Loading embedded content may transmit your IP address, device information and viewing activity to the provider.

The legal basis would be your consent under §25(1) TDDDG and Article 6(1)(a) GDPR.

This Privacy Policy and the website’s consent information will be updated when embedded services are added.

14. External links and social media

The NOVALISM website contains links to external websites and social-media platforms.

A link does not transmit your data to the external provider merely because it appears on the NOVALISM website. When you select the link, you leave the NOVALISM website and the external provider may process information according to its own privacy policy.

NOVALISM maintains profiles or content on social-media platforms. If you communicate with NOVALISM through a social platform, we may process your username, message and other information you make available for the purpose of responding and maintaining the professional relationship.

The legal basis is Article 6(1)(f) GDPR, or Article 6(1)(b) GDPR where the communication concerns a requested or existing service.

15. Legal bases for processing

Depending on the activity, NOVALISM processes personal data under:

Article 6(1)(a) GDPR — consent, including marketing communication and recordings;
Article 6(1)(b) GDPR — contracts and steps requested before entering into a contract;
Article 6(1)(c) GDPR — legal obligations, including tax and accounting requirements;
Article 6(1)(f) GDPR — legitimate interests, including website security, communication, community moderation, fraud prevention and efficient business administration;
and, where applicable, Article 9(2)(a) GDPR — explicit consent to process special-category information.

Where processing is based on consent, you may withdraw that consent at any time for the future.

Where processing is based on legitimate interests, you may object for reasons arising from your particular situation.

16. Recipients and service providers

Personal data is disclosed only where necessary to operate the website, provide a requested service, fulfill a contract, meet a legal obligation or protect legitimate interests.

Depending on your interaction with NOVALISM, recipients may include:

Tailor Brands and its website infrastructure providers;
WithMe and its platform infrastructure providers;
Stripe and its payment infrastructure providers;
Google, including Google Calendar and email-related services;
Meta Platforms Ireland Limited through WhatsApp;
tax, accounting and professional advisers;
technical support providers;
and public authorities where disclosure is legally required.

Service providers acting on our behalf receive only the information required to perform their assigned function and are subject to contractual or legal data-protection obligations.

Some providers may also act as independent controllers for parts of their processing, particularly payment, fraud-prevention, platform-security and regulatory functions.

17. International data transfers

Some service providers may process personal data outside Germany or the European Economic Area, including in Israel, the United Kingdom and the United States.

Depending on the provider and destination, transfers are based on:

an adequacy decision adopted by the European Commission;
certification under the EU–US Data Privacy Framework where applicable;
Standard Contractual Clauses approved by the European Commission;
or another transfer mechanism permitted under Articles 44–49 GDPR.

Tailor Brands states that it uses service providers and infrastructure in several jurisdictions, including the European Union, Israel, the United Kingdom and the United States.

Google, Stripe, Meta and other platform providers describe their applicable international-transfer safeguards in their own privacy information.

You may contact neurochange@novalism.com to request further information about the safeguards relevant to a particular service.

18. Retention periods

Personal data is retained only for as long as required for the relevant purpose or legal obligation.

Unless a different period is stated at the time of collection:

general inquiries are normally retained for up to 12 months after resolution;
unsuccessful applications are normally retained for up to 6 months after the decision;
coaching communications and working records are normally retained for up to 3 years after the service ends;
community, membership and account information is retained while the account or service remains active and afterward for the period required to resolve contractual matters or comply with legal obligations;
booking information may be retained for up to 3 years after the end of the relevant contractual relationship;
consent and withdrawal records may be retained while the consent is relied upon and for up to 3 years afterward;
session recordings are retained according to the period communicated when consent is requested and are deleted when no longer required for that purpose;
invoices, payment records and tax-relevant documents are retained for the statutory periods required under German law;
and security information may be retained longer where necessary to investigate misuse, fraud or a legal claim.

When personal data is no longer required, it is deleted or anonymized unless continued retention is legally required.

19. Your rights

Subject to the conditions of the GDPR, you have the right to:

request access to your personal data under Article 15 GDPR;
request correction of inaccurate or incomplete data under Article 16 GDPR;
request deletion under Article 17 GDPR;
request restriction of processing under Article 18 GDPR;
receive data you provided in a structured, commonly used and machine-readable format under Article 20 GDPR;
object to processing based on legitimate interests under Article 21 GDPR;
withdraw consent at any time for future processing under Article 7(3) GDPR;
and lodge a complaint with a competent data-protection authority under Article 77 GDPR.

To exercise your rights, contact:

neurochange@novalism.com

We may request information necessary to verify your identity before responding.

Right to object

Where personal data is processed on the basis of Article 6(1)(f) GDPR, you have the right to object at any time for reasons arising from your particular situation.

Where personal data is processed for direct marketing, you may object at any time without providing a reason.

20. Supervisory authority

You have the right to lodge a complaint with a data-protection supervisory authority.

The authority responsible for private businesses based in Bavaria is generally:

Bavarian State Office for Data Protection Supervision
Bayerisches Landesamt für Datenschutzaufsicht
Promenade 18
91522 Ansbach
Germany

Website: https://www.lda.bayern.de

You may also contact another competent supervisory authority, particularly in the EU member state of your habitual residence, place of work or the place of the alleged infringement.

21. Automated decision-making

NOVALISM does not use automated decision-making or profiling that produces legal effects or similarly significant effects concerning you.

External providers may use automated systems for security, fraud prevention, payment processing or platform operation under their own responsibility and privacy terms.

22. Children

NOVALISM services are intended for adults aged 18 and over.

We do not knowingly offer services to or collect personal data from people under 18. If we learn that personal data from a person under 18 has been collected unintentionally, we will take reasonable steps to delete it.

23. Data security

NOVALISM uses reasonable technical and organizational measures intended to protect personal data from:

unauthorized access;
accidental or unlawful loss;
alteration;
disclosure;
misuse;
and destruction.

Access is limited to people and service providers who require the information for an authorized purpose.

No internet transmission or electronic-storage system can be guaranteed completely secure. You should avoid sending unnecessary sensitive information through ordinary email, community messages, contact forms or WhatsApp.

24. Changes to this Privacy Policy

This Privacy Policy may be updated when:

NOVALISM services change;
service providers change;
new website functions are added;
legal requirements change;
or processing practices are modified.

The current version will be published on this website with the revised “Last updated” date.

Material changes affecting existing members or clients may also be communicated through WithMe or email where appropriate.

25. Privacy contact

For questions about this Privacy Policy or the processing of your personal data, contact: