Privacy Policy

Viduet Health B.V.

Version V3

Last updated: June 2, 2026

Introduction

Viduet Health B.V. (hereinafter: “Viduet”, “we”, “us” or “our”) offers the Viduet app and the Viduet care management system, a service that supports you (hereinafter: “User”, “you” or “your”) with telemonitoring, consultation optimisation, self-management and transmural collaboration between healthcare organisations, patients and informal caregivers for (chronic) conditions (including Type 2 Diabetes, COPD, Heart Failure, High Blood Pressure and Atrial Fibrillation).

Through the service, you may, among other things, register, view, analyse and share health-related data, such as measurement values and questionnaire responses. You may also receive relevant information and notifications, support care processes and make use of algorithms that identify abnormal patterns or measurement values. Depending on your role, you may additionally use functionalities for communication, collaboration, monitoring and guidance within the care process.

Reading guide

Depending on your role and status within the Viduet telehealth platform, certain parts of this privacy policy may or may not be relevant to you. Therefore, the table below shows which sections apply to you. The explanation of patient status (passive, active, activated) can be found in section 3.

Article 1 – About this privacy policy

When you use the service, we process "personal data." When we use this term, we mean information that relates to you, as defined in Article 4 (1) of the General Data Protection Regulation (GDPR). This includes, for example, your name, email address, and date of birth. This privacy policy describes how we collect, store, process, share, and use this data for the purposes of providing our services. We strive to inform you clearly and transparently about how, why, and on what legal basis this is done. We also inform you about how long we retain your personal data and which parties may be involved. Finally, this privacy policy informs you about the use of cookies.

Why is this privacy policy important to you?

Viduet is a telehealth platform specifically developed for the remote monitoring and self-management of chronic conditions, such as heart failure and diabetes. The mere fact that you have a Viduet account reveals something about your health. Therefore, your data is considered special personal data under Article 9 of the GDPR. We require your explicit consent to process this data. We attach great importance to the protection of your personal data and ensure that it is processed in accordance with the GDPR.

Article 2 – Contact details

Viduet Health BV
Europalaan 93
3526 KP Utrecht
The Netherlands
E-mail: support@viduet.eu
Tel. +31 (0)85 130 7020
KvK: 63124939

For specific privacy questions, you can contact our Data Protection Officer at:
functionarisgegevensbescherming@viduet.eu

Article 3 – Controller

This privacy policy applies solely to the processing of personal data by us as the data controller. It's important to understand when this is and isn't the case. Viduet uses the following categorisation for this purpose:

1. Passive patient

You are a passive patient if:

• Your healthcare provider uses Viduet for planning purposes (for example, to keep track of when you are due for a check-up);
• You are not aware that a healthcare institution, such as your GP practice, uses Viduet;
• You do not receive emails from Viduet;
• You do not log in to a Viduet account yourself.

The healthcare institution acts as the controller, and Viduet as the (sub)processor. Therefore, this privacy policy does not apply, but that of your healthcare provider. For questions about your data, please contact your healthcare provider, not Viduet.

2. Active patient (without self-measurements)

You are an active patient without self-measurements if:

• You receive invitation emails from Viduet for appointments at your healthcare institution;
• You sometimes complete questionnaire(s) via a link in the email;
• You have clicked on a questionnaire/appointment link in an email, but have not yet activated your account;
• You do not log in independently to take measurements.

In this situation, your healthcare provider is also responsible for your data. For questions about your data, please contact your healthcare provider, not Viduet.

3. Active activated patient (self-measurer)

You are an active activated patient if:

• You have received an activation email from Viduet;
• You have set a password;
• You log in independently to the Viduet platform or the Viduet app;
• You can take measurements at home yourself (blood pressure, glucose, etc.);
• You have accepted the Viduet terms of use.

As an active, activated patient, you have a direct agreement with Viduet. Viduet is responsible for your data. For questions about your data, please contact Viduet, not your healthcare provider.
Please note: even as an active activated patient, your healthcare providers will continue to have access to your data for the chronic care program. Viduet acts as a processor for this purpose on behalf of your healthcare provider.

If you have any doubts about your status, please contact support@viduet.eu or your healthcare provider.

Article 4 – Change of patient status

In the event of a status change, we will always inform you about the data controller, the applicable privacy policy, and the rights you can exercise. A status change has the following substantive consequences:

1. You change from a passive to an active patient:

• You have been invited by your healthcare provider to complete one or more Viduet questionnaires; or
• You have been invited by your healthcare provider to schedule one or more appointments through a link sent to you by Viduet.

2. You change from a passive to an active activated patient:

• You have received an activation email from Viduet;
• You have accepted the Terms of Use and this Privacy Policy;
• You have given explicit consent for the processing by Viduet as controller;

3. You change from an active to an active activated patient:

• You have received an activation email;
• You have activated your account for home measurements.

Article 5 – Processing of Personal Data

Below you will find a non-exhaustive overview of the personal data we process, arranged by situation.

5.1   Passive patient

On behalf of your healthcare provider for the chronic care program, we process your:

• First and last name;
• Your patient number from your healthcare institution;
• Date of birth;
• Postal code and city;
• Any patient labels created by your healthcare provider;
• Email address and/or mobile phone number (if known to your healthcare provider).

This data is used solely by your healthcare provider for planning and oversight of the chronic care programme.

5.2   Active patient

If you complete the questionnaires or make appointments, we process your:

• First and last name;
• Date of birth;
• Email address;
• Mobile phone number;
• Postal code and city;
• Answers to questionnaires;
• Your confirmation that you have made an appointment with your healthcare provider.
• Any patient labels added to your record by your healthcare provider.

Questionnaire responses and patient labels may contain health data.

5.3   Active activated patient

If you have a Viduet account, we process your:

• First and last name;
• Date of birth;
• Email address;
• Postal code and city;
• Phone number;
• Answers to questionnaires.
• Any patient labels added to your record by your healthcare provider.

If you use the app and take measurements, we process your:

• Measurements (blood pressure, oxygen saturation, glucose, heart rate, etc.);
• Values ​​and frequencies of measurements;
• Program and settings in the app, including Community settings (which healthcare providers have access to your data);
• Communication data (the messages you send through the app);
• Usage logging (date and time of login/logout);
• IP address;
• Authentication tokens;
• Device type (iOS/Android) and version number;
• App version;
• Information for push notifications.

Data entered by you or your healthcare provider through messages or patient labels may contain health data, such as information about conditions, diagnoses or medication use.

5.4   All users

If you contact us for support, we process:

• Your name and email address;
• The content of your question or complaint;
• The correspondence between you and our customer service.

If you participate in surveys or provide feedback, we process:

• Your answers to survey questions;
• Your feedback messages;
• The date of your participation.

If you visit our website, we process your:

• IP address;
• Browser information (type and version);
• Visitor data (page views, traffic sources, user flows);
• Date and time of visit.

If you request a demo through our website, we process:

• Your name;
• Organisation name;
• Email address;
• Telephone number (if provided);
• Type of healthcare organisation;
• Any additional comments or remarks.

If you subscribe to our newsletter through our website, we process:

• Your name;
• Email address;
• Any topics you have indicated an interest in;
• Your job title or role (if provided).

Article 6 – Purposes of processing

Viduet processes your data to achieve the following goals.

6.1   Website analysis (see article 5.4)

We use your data from website visits and app usage to evaluate the performance of our website and app and to improve the user experience.

6.2   App functionality and security (see article 5.3)

We use this information to:

• To gain insight into the overall performance of the app;
• To improve stability and functionality;
• To ensure the proper functioning and security of our services (including API calls and provision of feature flags);
• To monitor performance and detect and resolve errors;
• To prevent abuse or automated abuse;
• To detect, investigate and resolve technical issues;
• To record acceptance of Terms of Use;
• To register consent for the processing of special personal data.

6.3   Telemonitoring and health insights (see article 5.3)

We use this information so that you can:

• Gain insight into your measurements and their history;
• Easily share this information with your healthcare provider(s);
• Receive notifications, together with your healthcare provider(s), when certain target values are exceeded.

6.4   Scientific research (optional)

We may use your anonymized health data for scientific research. This only happens if:

• You have given explicit consent for this (you can refuse this without consequences for your use of the service);
• The data has been anonymized in such a way that you are no longer identifiable;
• The research meets strict ethical and scientific standards;
• We have a separate research agreement with the research institution.

6.5   Account management (see article 5.3)

We use this information to provide registered users with an account that allows them to log in, keep track of personal details, and communicate with their healthcare provider.

6.6   Customer service (see article 5.4)

We use this information to respond to your questions, provide technical support and resolve problems.

6.7   Quality improvement (see article 5.4)

We use this data to improve the quality of our services.

6.8   Personnel management

We process personal data for our own employees for employee administration, payroll tax, and tax compliance. This data is scanned and stored on the encrypted computer. Physical documents are destroyed after scanning.
We retain application data for a maximum of one year (with permission); copies of identity documents and payroll tax statements for five years; and tax data for seven years after termination of employment.

Article 7 – Legal basis for processing

We require a legal basis for processing your personal data. Viduet uses the following legal bases:

7.1   For all users

When you seek support and complete our surveys, your data is processed based on Article 6, paragraph 1, subparagraph a GDPR. For these actions, you will be asked to consent to the processing of your data, which you must provide before you can use the action.

7.2   For passive patients

There is a medical treatment agreement between you and your healthcare provider. The basis for processing your data is Article 6, paragraph 1, subparagraph b of the GDPR. In addition, this data is considered special personal data. Your healthcare provider can process this data based on Article 9, paragraph 2, subparagraph h of the GDPR because it is necessary for the provision of healthcare.

Viduet processes your data on behalf of your healthcare provider. You do not have a direct contract with Viduet and therefore do not need to give Viduet permission.

7.3   For active patients

There is a comprehensive medical treatment agreement between you and your healthcare provider. The basis for processing your data is Article 6, paragraph 1(b) of the GDPR. In addition, this data is considered special personal data. Your healthcare provider can process this data based on Article 9, paragraph 2(h) of the GDPR because it is necessary for the provision of healthcare.

When completing questionnaires, you accept the Terms of Use, but Viduet still processes your data on behalf of your healthcare provider.

7.4   For active activated patients

There is a comprehensive medical treatment agreement between you and Viduet. The basis for processing your data is Article 6, paragraph 1(b) of the GDPR. In addition, this data is considered special personal data. Under Article 9, paragraph 2(a) of the GDPR, you must give Viduet explicit consent to process this data. Since Viduet processes special personal data about you, we require your explicit consent.

I. Explicit consent

1. Why do we need your explicit consent?
   Viduet is a telehealth platform for chronic conditions. Having a Viduet account reveals information about your health. This data therefore falls under the "special categories of personal data" referred to in Article 9, paragraph 1, of the GDPR (also known as health data).
2. How do we obtain your explicit consent?
   Explicit consent is required for the processing of special personal data. This means that you must actively give consent through a clear action. When creating your Viduet account, you will therefore be asked to give explicit consent for the processing of your health data. This is done by:

• Clear information in advance : you will receive a clear explanation of which data we process and why;
• Separate consent box: You must explicitly check a box that states:
  "I explicitly consent to Viduet Health processing my medical and health data for: the use of the Viduet platform for self-management, and the sharing of such data with healthcare providers that I can select and manage myself, as described in the Privacy Policy.";
• No pre-checked boxes: The consent box is not pre-checked;
• Free choice: you are not forced, but it is your free choice to use the Viduet platform.

3. Your right to withdraw consent
   You have the right to withdraw your consent at any time in accordance with Article 7, paragraph 3, GDPR. You can do this by:

• Contacting us via support@viduet.eu; or
• Via your account settings on the Viduet platform ("Withdraw consent" button).

4. Please note: withdrawing your consent does not affect the lawfulness of the processing carried out before its withdrawal. However, after you withdraw your consent, we will no longer be able to provide you with the service, as processing this data is necessary for its operation.

II. Performance of agreement

Certain processing operations do not require separate consent because they are necessary for the performance of the agreement you have with us (e.g., account management, billing, and customer service). These processing operations are based on Article 6, paragraph 1, subparagraph b, of the GDPR.

Article 8 – With whom do we share your personal data?

8.1   No sale of data

Viduet does not sell your data to third parties.

8.2   (Sub-)Processors (service providers)

Viduet engages third parties to process certain personal data under our responsibility (for example, to host the app). We have data processing agreements in place with these third parties in accordance with Article 28 of the GDPR to ensure that your personal data is handled with care.
Your data is stored on OVHcloud servers in European data centers. OVHcloud is ISO 27001 certified.

8.3   Scientific research (optional and only with separate permission)

Only if you have given separate, explicit consent may we make your anonymized health data available to healthcare providers, hospitals, academic institutions, or other researchers for scientific research in the public interest or for statistical purposes. The following conditions apply:

• The processing is based on Article 9 paragraph 2 under j GDPR (scientific research)
• Your data has been anonymized (can no longer be traced back to you), or if that is not technically possible, at least pseudonymized (indirectly identifiable via a code)
• We provide safeguards as required by Article 89 paragraph 1 GDPR:

• Sound research agreement with the research party;
• Data minimization (only necessary data);
• Strict security measures at the receiving party.

You can withdraw your consent for scientific research at any time without this affecting your use of the Viduet app.

8.4   Overview of service providers

An up-to-date overview of the specific service providers we use is available to Viduet users upon request via support@viduet.eu .

8.5   Relationship with affiliated healthcare providers

For passive patients and active patients who have not activated a Viduet account, Viduet processes personal data on behalf of the affiliated healthcare provider. The healthcare provider acts as the controller and Viduet as the (sub-)processor. This processing is governed by a data processing agreement between the healthcare provider and Viduet.

This means that the healthcare provider determines which personal data is processed and for which purposes. Requests for access, rectification, erasure or other privacy rights should therefore be directed to your healthcare provider and not to Viduet. Viduet processes this personal data solely on behalf of and for the benefit of your healthcare provider.

If you have activated a Viduet account and have provided consent for the processing of your personal data by Viduet as controller, the provisions of this Privacy Policy apply to that processing. Requests relating to that processing may be directed to Viduet.

8.6 Data of affiliated healthcare professionals

For affiliated healthcare professionals, Viduet processes personal data for account management, authentication, logging and the use of the Service.

As a rule, this personal data is not shared with third parties. An exception applies where integrations with external systems are used for authentication, authorisation or user verification, such as healthcare information systems, GP information systems (HIS) or Single Sign-On (SSO) solutions. In such cases, personal data may be processed to verify that the Viduet account corresponds to the account within the connected system.

8.7   Links to third party websites

The Viduet website may contain links to third-party websites. We are not responsible for the privacy practices of these websites. We encourage you to read the privacy policies of these websites.

Article 9 – International data transfers

Some of the third parties mentioned in Article 8 may be located outside the European Economic Area (EEA). When personal data is processed or stored outside the EEA, we ensure that appropriate safeguards are in place, such as:

• Standard Contractual Clauses (SCCs) approved by the European Commission;
• Binding Corporate Rules (BCRs);
• An adequacy decision by the European Commission for the country concerned.

We only engage third parties that offer sufficient guarantees for the protection of your personal data.

Article 10 – Retention period

Viduet is legally obligated to retain your data. Below, we indicate how long Viduet retains your data for each category.

10.1   Personal data

We do not retain personal data for longer than is necessary for the purposes for which they were collected or processed, taking into account the specific periods mentioned below.

10.2   Consent data

We retain consent data (proof that you have given consent) for as long as your account is active, and for a further 3 years thereafter to demonstrate that we have fulfilled our legal obligations.

10.3   Categories of data described under Article 5

We store these categories of data, for which no retention period follows from the law, as follows:

Article 11 – Your rights

In the context of our processing of your personal data, you have, among other things, the following rights:

11.1   The general list of rights

1. Right of access (Article 15 GDPR)
   You have the right to access the personal data we process about you. You can access much of this information yourself via your profile page in the app. For a complete overview, please contact us.
2. Right to rectification (Article 16 GDPR)
   You have the right to have inaccurate or incomplete data corrected. You can edit many of your data yourself via your account page.
3. Right to erasure - Right to be forgotten (Article 17 GDPR)
   You have the right to have your personal data erased. This is possible under certain conditions, for example, when the data is no longer necessary for the purpose for which it was collected. Please note: we may refuse erasure if we are legally obligated to retain the data (for example, financial data for the tax authorities).
4. Right to restriction of processing (Article 18 GDPR)
   You can request us to temporarily restrict the processing of your personal data, for example while we investigate the accuracy of the data.
5. Right to data portability (Article 20 GDPR)
   You have the right to receive the personal data you have provided to us in a structured, commonly used, and machine-readable format (e.g., a CSV or JSON file). You can transmit this data to another service provider.
6. Right to object (Article 21 GDPR)
   You have the right to object to the processing of your personal data. For processing based on your consent (such as the processing of health data), you can withdraw this consent at any time (see Article 7.1).
7. Withdrawal of consent (Article 7, paragraph 3, GDPR)
   You have the right to withdraw your consent to the processing of special categories of personal data at any time. You can do this by:

1. Send an email to support@viduet.eu, or;
2. By clicking the "Withdraw consent" button in your account settings.
   Withdrawing consent does not affect the lawfulness of processing before its withdrawal. However, after withdrawal, we will no longer be able to provide the service to you.

11.2   Exercising your rights per patient status
Exercising your rights depends on your patient status. Below, we'll explain how to exercise your rights, category by category.

1. Passive and active patients:
   For questions about your data, requests for access, correction, or deletion, please contact your healthcare provider. Your healthcare provider is the data controller and is the only party that can decide on the deletion of your data. Your healthcare provider's privacy policy applies.
   
2. Activated active patients
   To exercise your rights, you can contact us directly via:

1. Email: support@viduet.eu
2. Post: Viduet Health BV, Europalaan 93, 3526 KP Utrecht
3. Telephone: +31(0)85 130 70 20

In your request, please describe as clearly as possible which personal data you are referring to. We may ask you to attach a copy of your ID to the request to verify that the request is made by you. You may redact your photo and citizen service number (BSN). We will respond within one month of receiving your request, in accordance with Article 12, paragraph 3, of the GDPR. In complex cases, we may extend this period by up to two months, in which case we will inform you accordingly.

For data relating to your healthcare provider's chronic care programme, please contact your healthcare provider.

Article 12 – Safety

Viduet handles your personal data with care by taking appropriate technical and organizational measures to prevent loss or unlawful processing of personal data, in accordance with the GDPR.

12.1   Personal data

Our security measures meet the following standards:

• ISO 27001:2022 – International Standard for Information Security
• NEN 7510 – Dutch standard for information security in healthcare
• NEN 7512 and 7513 – Additional care standards

12.2   Security measures

We continuously take measures to improve data security and ensure that only necessary individuals have access to your personal data, that access to personal data is secure, and that our security measures are regularly reviewed and evaluated. This means, among other things, that we:

1. Clearly define the purposes for processing personal data and store only the personal data that are necessary for the specific purposes;
2. Only process personal data if there is a valid basis for doing so;
3. We implement appropriate security measures to protect personal data. We also impose these obligations on parties that process personal data for us;
4. Respect your rights, such as the right to access, correct, transfer or delete your Personal Data.

Viduet takes the following security measures, among others:

1. Encrypting the databases containing personal data;
2. Run database and backups twice;
3. Maintaining a policy document that explicitly describes the measures taken to secure data processing and ensure privacy;
4. Requiring employees involved in the processing of personal data to keep this information confidential;
5. Physically securing IT facilities and equipment against unauthorized access and against damage and malfunctions;
6. Maintaining procedures to grant authorized access to the information systems and services they need to perform their duties and to prevent unauthorized access to information systems;
7. The use of strong, unique passwords and password vaults;
8. Maintaining procedures for obtaining, developing, maintaining and destroying data and information systems;
9. Recording activities performed by users (with personal data) in log files. The same applies to other relevant events, such as unauthorized access attempts to access personal data and disruptions that could lead to alteration or loss of personal data;
10. Incorporating security measures into all application systems, including adequate access control;
11. Providing a procedure to address potential data breaches;
12. Providing the IT infrastructure with security updates in a timely manner; and
13. Monitoring compliance with the policy (random sampling).

If personal data is processed by third parties, they must be able to ensure proper security. Agreements necessary for the processing of personal data are made with these (potential) parties. If these parties are located outside the EEA, appropriate safeguards are in place to enable the transfer.

12.3   Data breach reporting obligation

In the event of a security breach, we will notify the affected parties immediately, but no later than within 24 hours. For active activated patients, we will inform you directly. For passive patients and active patients who have not activated a Viduet account, we will inform your healthcare provider, who will notify you in accordance with legal requirements. We will take immediate action to resolve the breach and mitigate further consequences. A full report will be prepared and shared with the affected parties.

Article 13 – Use by minors

Our service is intended for all individuals who wish to use it. We process the personal data of minors under the age of 16 if they have obtained explicit consent from their parent, guardian, or legal representative. This consent is required under Article 8, paragraph 1, of the GDPR, which stipulates that children under the age of 16 require the consent of their parent or guardian for the processing of personal data.
Viduet reserves the right to deny access to the Service or request additional verification if there are doubts about age or consent.

Article 14 – Business relations

When you, as a business owner, supply goods or services to Viduet, we collect and use your business contact information solely for the purpose of our collaboration. The basis for processing your personal data is necessary for the performance of the agreement, in accordance with Article 6(1)(b) of the GDPR. We retain this data for as long as necessary for the performance of the agreement, and thereafter for a maximum of 7 years due to tax retention obligations.

Article 15 – Cookies

Viduet uses minimal cookies on the website and in the app. We only use functional cookies that are strictly necessary for the platform to function, such as:

• Authentication (to keep you logged in);
• Session management (to remember your settings);
• Security cookies (to prevent abuse).

These cookies do not process personal data and do not require consent under Article 11.7a of the Telecommunications Act. Viduet does not use third-party tracking, marketing, or analytical cookies.

Article 16 – Complaints and supervisor

If you have any questions or complaints about how we process your personal data, you can contact us using the contact details in Article 3. You also have the option to lodge your complaint with the supervisory authority:

Dutch Data Protection Authority
PO Box 93374
2509 AJ The Hague
Telephone: 088 – 1805 250
Website: www.autoriteitpersoonsgegevens.nl

Article 17 – Automated decision-making

We do not make decisions about you based solely on automated processing of personal data (such as profiling) that produce legal effects or significantly affect you in a similar manner. Any analyses or recommendations generated by our Service are for support purposes only and are not performed automatically or implemented without human intervention. A healthcare provider or authorized employee will always review this information before making a decision that may affect you.

Article 18 – Changes to the privacy policy

Viduet reserves the right to amend its privacy policy at any time. Viduet will notify you of any changes to the privacy policy and its content by email or via a notification in the app. We recommend that you regularly review the privacy policy to stay informed of any changes. For substantial changes relating to the processing of special personal data, we will again ask for your explicit consent before the changes take effect.
If you do not agree to significant changes, you have the right to terminate the agreement.
Please note: if you are a passive or active patient (you do not have an activated Viduet account), changes to this privacy policy will not apply to you. The privacy policy of your healthcare provider applies to you. If you have any questions, please contact your healthcare provider.