Privacy Policy

1. Data Controller

Get Body Data B.V.
Jacob Van Lennepkade 43, 1054ZG Amsterdam, The Netherlands
Email: info@getbodydata.com
Phone: +31 61 8210404

2. What Data We Collect

Contact information: your name, email address, phone number, and mailing address.

Health-related data: blood test results, genetic test results, lifestyle questionnaire responses, and supplement recommendations developed for you. This data is classified as special category data under GDPR Article 9.

Payment data: payment is processed through Stripe. We do not store your credit card details. Stripe handles all payment data in accordance with PCI DSS standards.

Website usage data: we use Google Analytics (GA4) to collect anonymized data about how you use our website, including pages visited, time on site, and device type. This data is collected through cookies with your consent.

3. Why We Collect Your Data

To provide our services to you (contract performance, GDPR Article 6(1)(b)).

To process health-related data for the purpose of developing your supplement recommendation (explicit consent, GDPR Article 9(2)(a)). You provide this consent when you purchase a service and agree to these terms.

To send your samples to our laboratory partner for analysis (contract performance and explicit consent).

To process payments through Stripe (contract performance).

To analyze website usage through Google Analytics (legitimate interest, GDPR Article 6(1)(f), or consent where required).

To comply with legal obligations such as tax and accounting requirements (legal obligation, GDPR Article 6(1)(c)).

4. Who We Share Your Data With

Medische Laboratoria Dr. Stein & Collegae (Limbach Group): your blood samples and genetic samples are processed by this laboratory. Lab reports are signed by a licensed physician at this laboratory.

PMO: blood draw appointments are facilitated through PMO's network of 70 certified lab locations across the Netherlands.

Our medical advisor (Dr. Aletta de Wit): your test results and supplement recommendation are reviewed by our medical advisor as part of our quality assurance process.

Stripe: payment processing.

Google: anonymized website analytics through Google Analytics (GA4).

Our supplement manufacturer: your supplement recommendation (ingredient list and amounts only, no personal health data) is shared with our manufacturer for production.

We do not sell your personal data. We do not share your data with advertisers. We do not use your data for research without your explicit consent.

5. Where Your Data Is Stored

Your personal data, including test results and supplement recommendations, is stored on Google Drive (Google Workspace) within the European Economic Area. Google Workspace complies with GDPR requirements.

Lab data is stored by Medische Laboratoria Dr. Stein & Collegae at their facilities in the Netherlands and Germany, in accordance with applicable medical data protection laws.

Payment data is stored by Stripe in accordance with PCI DSS standards.

6. How Long We Keep Your Data

Contact information: retained for the duration of your client relationship and for 7 years after for tax and accounting purposes.

Health-related data (test results, supplement recommendations): retained for the duration of your client relationship. Deleted within 30 days of your request for deletion, unless required by law.

Payment records: retained for 7 years in accordance with Dutch tax law.

Website analytics data: anonymized and retained by Google Analytics for 14 months.

7. Your Rights

Under GDPR, you have the following rights:

Right of access: you can request a copy of all personal data we hold about you.

Right to rectification: you can request correction of inaccurate data.

Right to erasure: you can request deletion of your personal data. We will comply within 30 days unless we are legally required to retain the data.

Right to restrict processing: you can request that we stop processing your data while a complaint is being resolved.

Right to data portability: you can request your data in a structured, machine-readable format.

Right to withdraw consent: you can withdraw consent for processing your health-related data at any time. This does not affect the lawfulness of processing before withdrawal.

Right to lodge a complaint: you can file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl.

To exercise any of these rights, email us at info@getbodydata.com.

8. Data Security

We take appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These include access controls on Google Drive, encrypted data transmission (HTTPS), and restricted access to client data on a need-to-know basis within our team.

9. Children

Our services are not intended for individuals under 18 years of age. We do not knowingly collect personal data from anyone under 18.

10. Changes to This Policy

We may update this Privacy Policy from time to time. The most current version will always be available on this page with the date of the last update.

11. Contact

Get Body Data B.V.
Jacob Van Lennepkade 43, 1054ZG Amsterdam, The Netherlands
Email: info@getbodydata.com
Phone: +31 61 8210404