Last updated: 1 October 2026
This Privacy Policy explains how EHS Group collects and uses personal data when you visit ehsghealth.com (the “Website”), contact us, or request information about our products.
1. Who we are
The controller responsible for your personal data is:
EHS d.o.o.
Bulevar Meše Selimovića 17a
71000 Sarajevo
Bosnia and Herzegovina
Email for privacy requests: szlp@ehsghealth.com
2. What personal data we collect and why
2.1 Demo and contact requests
When you use the “Request a demo” form we collect your full name, company name, email address, country/region, the role you select, and your message.
- Purpose: to answer your enquiry, arrange a demo and follow up about our products.
- Legal basis: steps taken at your request before entering into a contract (GDPR Art. 6(1)(b)) and our legitimate interest in responding to business enquiries (Art. 6(1)(f)).
- The form is delivered to us by email. It is not stored in a database on the Website.
2.2 Brochure downloads
To download a brochure you give us your first name, last name and email address.
- Purpose: to send you the brochure and, where relevant, follow up about the products it covers.
- Legal basis: your request (Art. 6(1)(b)) and our legitimate interest in following up on product interest (Art. 6(1)(f)).
- We do not use these details to send newsletters or marketing emails.
2.3 Emails you send us
If you email us directly (for example info@ehsghealth.com), we process your email address and whatever you include in the message, to reply to you (Art. 6(1)(b) or (f)).
2.4 Website analytics (only with your consent)
With your consent, we use Google Analytics 4 to understand how visitors use the Website — for example which pages are visited and whether forms are submitted. Google Analytics uses cookies and collects data such as pages viewed, approximate location, device and browser type, and how you arrived at the Website. Google Analytics 4 does not log or store full IP addresses.
- Legal basis: your consent (Art. 6(1)(a)), given through the cookie banner.
- Analytics cookies are not set until you accept them. You can change or withdraw your choice at any time through the “Manage consent” link at the bottom of every page.
- Details of each cookie are in our Cookie Policy.
2.5 Technical data
Our hosting provider automatically records standard server logs (IP address, date and time, page requested, browser type) to keep the Website secure and working.
- Legal basis: legitimate interest in operating a secure website (Art. 6(1)(f)).
- Server logs are kept for up to 6 months.
We do not use advertising or social media tracking pixels, and we do not sell personal data.
3. Who we share data with
We use trusted service providers who process data on our behalf under data processing terms:
- GlobalHost d.o.o. — website hosting and server logs. Location: Bosnia and Herzegovina.
- Microsoft (Microsoft 365) — business email, including delivery of form submissions. Location: EU/EEA and USA.
- Google (Google Analytics 4) — website analytics, only with your consent. Location: USA and other countries.
We may also disclose data where the law requires it.
4. International data transfers
Certain service providers we use, including cloud, communication and information technology providers such as Microsoft and Google, may process personal data outside Bosnia and Herzegovina or the European Economic Area, including the United States.
Where personal data is transferred to another country or international organisation, such transfers are carried out only where an appropriate legal basis exists and suitable safeguards are implemented in accordance with applicable data protection legislation.
Such safeguards may include:
- adequacy decisions issued by competent authorities;
- standard contractual clauses or other contractual transfer mechanisms;
- binding corporate rules;
- approved codes of conduct;
- approved certification mechanisms;
- other lawful safeguards or derogations provided by applicable legislation.
Where European Union legislation applies to a particular processing activity, we may also rely on international transfer mechanisms recognised or approved by competent European Union institutions, including adequacy decisions and other appropriate transfer safeguards.
Additional information regarding the safeguards applied to international transfers of personal data is available upon request.
5. How long we keep data
- Demo and contact requests: up to 24 months after our last contact, unless a business relationship follows.
- Brochure requests: up to 24 months.
- Google Analytics data: up to 14 months.
- Consent choices: stored in a cookie on your device for up to 365 days.
6. Your rights
Subject to applicable data protection laws, including the Law on Personal Data Protection of Bosnia and Herzegovina and, where applicable, the laws of the European Union, you have the right, to the extent provided by applicable legislation, to:
- access your personal data and information relating to its processing;
- request correction of inaccurate personal data and completion of incomplete personal data;
- request erasure of your personal data where legal requirements for erasure are met;
- request restriction of the processing of your personal data;
- object to processing based on legitimate interests or public interests, including related profiling;
- receive the personal data you have provided to us in a structured, commonly used and machine-readable format and transmit that data to another controller where legally applicable;
- withdraw your consent at any time where processing is based on consent. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal;
- lodge a complaint with a competent data protection authority.
To exercise any of these rights, please contact us at:
szlp@ehsghealth.com
We will respond to your request without undue delay and within the period prescribed by applicable law. For individuals subject to the laws of Bosnia and Herzegovina, this period is generally 30 days from receipt of the request, subject to any lawful extension where justified by the complexity or number of requests.
If you believe that your personal data is being processed in violation of applicable legislation, you have the right to lodge a complaint with the competent supervisory authority.
In Bosnia and Herzegovina, the competent authority is the Personal Data Protection Agency of Bosnia and Herzegovina.
Special categories of personal data, including health-related data, are processed only where an appropriate legal basis exists and where suitable technical and organisational safeguards have been implemented in accordance with applicable legislation.
7. Cookies
Cookie details — names, purposes and how long they last — are in our Cookie Policy.
8. Security
We use appropriate technical and organisational measures to protect personal data, including encrypted (HTTPS) connections to the Website.
9. Children
The Website is aimed at healthcare organisations and professionals. It is not directed at children, and we do not knowingly collect children’s data.
10. Changes to this policy
We may update this policy from time to time. The “Last updated” date at the top shows when it last changed.