Last updated: September 2026
Vitahealth handles the data of its participants and website visitors with care. We treat (medical) personal data confidentially and secure it appropriately. We comply with the applicable laws and regulations on privacy and data protection, including the General Data Protection Regulation (GDPR). Where necessary, we ask for your (explicit) consent. In this statement you can read which data we process, why, with whom we share it, how long we keep it, how we secure it and what rights you have.
1. Who are we?
This privacy statement applies to the services of Vitahealth. The data controller is Vitahealth BV, located at Oudhuizerstraat 31, 7382 BS Klarenbeek, the Netherlands, registered with the Dutch Chamber of Commerce under number 42133916.
The contact person for privacy is Pieter-Frank van Boven. For questions about privacy or to exercise your rights, you can contact us at support@vitahealth.nl.
Our services are intended for persons aged 18 and over.
2. Which data do we process?
Depending on your use of our services, we process the following categories of data:
- Contact and identity data: name, email address, telephone number, address, date of birth and gender.
- Order and payment data: your order, invoice details (name and address), payment status and any discount code. We do not receive or store any bank account numbers or payment card details: payment is made directly via the payment service provider Mollie (see section 4).
- Intake and questionnaire data: your answers about lifestyle, motivation and health, including the declaration of suitability for the test.
- Health data (special categories of personal data): biomarker values from your blood sample, the profiles and scores derived from them, the medical assessment and the lifestyle advice.
- Consent records: the content, time and version of the consent you have given.
- Logistics data: test kit codes, shipping and return data and the date of sample collection.
- Data you share with us additionally yourself: for example data from a wearable (steps, sleep, heart rate), only if you share it with us yourself.
- Technical data: limited data needed for the operation and security of our website and systems, such as log files and session data.
We do not process more data than is necessary for the purpose concerned.
3. Purposes and legal bases
We process your data for the following purposes:
- processing your order, payment and invoice;
- assessing your suitability for the test by a (lifestyle) doctor;
- carrying out the biomarker test and providing a personal health profile and advice;
- preparing a draft lifestyle advice to support the doctor (see section 5);
- communication about your request, test kit and results and answering questions and complaints;
- improving and securing our systems and evaluating the quality and safety of our process;
- complying with legal obligations, such as the tax retention obligation for invoices.
The legal bases for this are:
- Performance of the contract (Art. 6(1)(b) GDPR): for your order, payment and carrying out the test process.
- Your explicit consent (Art. 9(2)(a) GDPR): for processing your health data, and where applicable preventive medicine (Art. 9(2)(h)) for the assessment by the medical expert.
- Legal obligation (Art. 6(1)(c) GDPR): for administration, quality, safety and the tax retention obligation.
- Legitimate interest (Art. 6(1)(f) GDPR): for securing and improving our systems and services.
You can withdraw your consent at any time; this has no retroactive effect on processing that has already lawfully taken place.
4. With whom do we share data?
We share data only when this is necessary for our services, when a legal obligation requires us to do so, or with your (explicit) consent. Categories of recipients:
- The analysis laboratory (Nightingale Health, Finland, within the EEA) that analyzes your blood sample. The lab receives only a pseudonymous code with your date of birth and gender, never your name or contact details.
- Payment service provider Mollie, through which you pay for your order directly. Mollie is itself the data controller for the payment processing; we do not share any name or email address with Mollie.
- PostNL, for shipping and returning the test kit (name and address details only); PostNL is itself the data controller for the delivery.
- Email service providers: you receive your results via a secure, NTA 7516-certified email service; other service emails are sent via a transactional email service.
- IT/hosting and AI service providers that support our systems: hosting in the Netherlands, database within the EU, and an AI service within the EU (see section 5).
- Leiden University Medical Center (LUMC), in the context of the scientifically substantiated method and only if you have given separate consent for scientific research during the intake.
- Spam protection on the web forms (Cloudflare Turnstile): checks whether a submission comes from a human based on technical characteristics of your browser; it does not receive your name, email address or the content of your message. Cloudflare processes this data in the EU and the US under the EU standard contractual clauses.
- Competent authorities, only if we are legally obliged to do so.
With all parties that process personal data on our behalf, we conclude data processing agreements with appropriate safeguards, and we keep an internal register of these processors and their sub-processors. We never sell your data and do not use it for third-party advertising.
Transfers outside the EEA
Our data processing takes place within the European Economic Area as much as possible. Insofar as a service provider (such as the transactional email service) processes data outside the EEA, this is done on the basis of the European standard contractual clauses (SCCs) and additional safeguards.
5. AI-supported draft advice
When preparing your personal feedback, Vitahealth may use an AI tool that generates a draft advice. The following applies:
- the AI tool receives only pseudonymous data (age, gender, questionnaire answers and biomarker values), never your name or contact details;
- the processing takes place within the EU, on the basis of a data processing agreement; the AI service provider does not retain your data after processing and does not use it to train AI models;
- a medical expert always reviews the draft advice and determines the final feedback. You never receive a purely automated advice, and no legal effects are attached to purely automated decisions (Art. 22 GDPR).
6. Retention periods
We do not keep your data longer than necessary for the purpose for which it was collected. The following periods apply:
- Contact details: 24 months after your participation ends.
- Health and test data: 24 months after your participation ends, unless a statutory (medical) retention obligation requires a longer period. In that case we follow that period.
- Logistics process data: 24 months after your participation ends.
- Consent records: 5 years (accountability for GDPR compliance).
- Invoices and payment records: 7 years (tax retention obligation), even if you have your other data deleted.
- Technical data (logs): 12 months.
- Complaints and incidents: the statutory retention period (at least 5 years).
After the retention period expires, data is deleted or irreversibly anonymized, unless retention is still necessary for, for example, an ongoing dispute or a legal obligation. You can always request earlier deletion (see section 8).
7. How do we secure your data?
We take appropriate technical and organizational measures to protect your data. Specifically, we have taken the following measures, among others:
- Separate and encrypted storage: your identity data (name, address, contact details, date of birth) is stored encrypted per field (AES-256), separately from your medical data. Internally, medical data is linked only via a pseudonym.
- Pseudonymization towards third parties: the laboratory, the AI service provider and our logging systems never receive your name, only pseudonymous codes with the minimum of data they need.
- European storage: hosting in the Netherlands, database within the EU, encrypted connections (TLS) and encrypted storage.
- Strict access control: role-based access (medical data is visible only to the medical team), two-factor authentication for all staff and administration environments, and personal accounts.
- Full audit logging: relevant actions involving your data are recorded in an audit log, with a secure external copy (without medical content) so that the log remains intact even in the event of an incident.
- Secure results: we send your test results exclusively via an NTA 7516-certified secure email service.
- Secure infrastructure: firewalls with strict access rules, key-based administrative access only, automatic security updates and protection against intrusion attempts.
- Contractual safeguards: data processing agreements with all our processors, an internal register of processors and sub-processors, and an annual supplier review.
- Fixed security rhythm: monthly server maintenance, quarterly checks of keys, access rights and logging, half-yearly backup restore tests and an annual security review including rotation of encryption keys.
- Incident process: an established incident response and data breach process. In the event of a data breach posing a risk to your rights and freedoms, we notify the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) and, in the case of high risk, you as well, in accordance with the GDPR.
- Data minimization within the organization: logistics staff do not see medical data; medical data is reserved for the medical team.
Despite these measures, no system can guarantee absolute security; we do everything we can to keep privacy risks as small as possible. We ask security researchers who find a vulnerability to report it responsibly via support@vitahealth.nl.
8. Your rights
Under the GDPR you have the right to:
- access your data and receive a copy (Art. 15);
- have inaccurate or incomplete data corrected or completed (Art. 16);
- have your data deleted, insofar as statutory retention obligations allow (Art. 17);
- restrict the processing (Art. 18) or object to it (Art. 21);
- have your data transferred in a structured format (data portability, Art. 20);
- request human review of a result generated on the basis of your profile (Art. 22);
- withdraw consent you have given at any time.
You can submit a request via support@vitahealth.nl. We respond within one month; for complex or extensive requests, this period may be extended by two months. We will inform you of this in good time. To make sure a request comes from you, we may ask for additional information to verify your identity.
Do you disagree with how we handle your data? Please contact us first. We are happy to find a solution together. In addition, you always have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
9. Third-party websites
Our website may contain links to websites or services of third parties. The privacy statement of the party concerned applies on those websites; we are not responsible for how they handle your data. We recommend that you read their statements before using those services.
10. Marketing
We only send you messages that are necessary for your order, test kit and results (service communication). We send newsletters or other marketing communication only if you have signed up for them; you can then unsubscribe at any time via the unsubscribe link or by emailing us. We never use your health data for marketing purposes.
11. Cookies
Our website uses the following cookies and similar technologies:
- Functional and strictly necessary cookies: needed for the basic operation and security of the website.
- Analytical cookies, Google Analytics (gtag.js, measurement ID G-8GWRZRH9M2): with these we analyze anonymously how the website is used, so that we can improve it. In doing so, cookies are placed and (pseudonymized) data is processed by Google as a processor. Data may also be processed outside the EU in this process.
For display purposes we also load a font via Google Fonts; this may establish a connection with Google's servers.
Legal basis and refusal. We place analytical cookies only after you have given consent via our cookie notice. You can always refuse or delete cookies via your browser settings, and you can opt out of Google Analytics via the Google opt-out. See also Google's privacy policy.
12. Changes
We may amend this privacy statement, for example because our services or laws and regulations change. The most current version can always be found on this page; in the event of material changes, we actively inform participants.
13. Contact
Questions or comments about this privacy statement or about the processing of your personal data?
- Vitahealth BV, Oudhuizerstraat 31, 7382 BS Klarenbeek, the Netherlands
- Chamber of Commerce (KVK) number: 42133916
- Email: support@vitahealth.nl
