Privacy statement

    1. Who are we?

    SYOD B.V. is the data controller within the meaning of Article 4(7) AVG for the processing of personal data via the ombrio platform.

    ombrio is a European health data transaction platform that facilitates secure data exchange between users and authorised healthcare professionals, with the aim of capturing and sharing home measurements of vital signs.

    2. What personal data do we process?

    We process the following categories of personal data:

    • Identification data: name, address, e-mail address, phone number, date of birth

    • Account details: username and password (stored encrypted)

    • Health data: vital values such as blood pressure, heart rate, weight and oxygen saturation (SpO₂) obtained through linked certified devices from various brands

    • Technical data: IP address, device data, log data and usage data

    IP addresses are considered personal data.

    3. What do we use personal data for?

    We use personal data for the following purposes:

    • Providing and running the ombrio platform

    • Storing and displaying health measurements

    • Sharing measurement data with selected healthcare providers (only with your consent)

    • Subscription and billing management

    • Security and fraud prevention

    • Meeting legal obligations

    • Customer service

    • Improving and maintaining the ombrio platform

    4. Legal bases

    We process personal data on the basis of:

    • Performance of an agreement (Art. 6(1)(b) AVG)

    • Legal obligation (Art. 6(1)(c) AVG)

    • Consent (Art. 6(1)(a) AVG)

    For health data, explicit consent applies (Art. 9(2)(a) AVG).

    Data sharing takes place only on the basis of explicit, informed and revocable consent from the user at any time.

    5. Health data

    Health data is only processed on the basis of your explicit consent and only for the purposes described in this privacy statement.

    SYOD B.V. processes health data to enable secure collection, storage, synchronisation and sharing of health measurements between users and authorised healthcare providers.

    Health data is never sold to third parties and is never used for advertising purposes.

    SYOD B.V. does not perform medical analyses or diagnoses. Healthcare providers remain solely responsible for any medical interpretation, diagnosis, treatment or further handling as part of their healthcare relationship with the user.

    See also: Apple Healthkit & iOS Privacy Notice

    6. Data sharing

    We share personal data exclusively:

    • With authorised healthcare professionals within the European Union, and only after your explicit consent, exclusively for the purpose of medical monitoring and healthcare provision

    • With processors (such as):

      • Cloud and hosting providers

      • IT and infrastructure providers

    • If we are legally obliged to do so

    Personal and health data is never sold and not used for advertising purposes.

    We conclude processing agreements with processors.

    7. International transmission and storage

    All personal and health data is stored and processed exclusively within the European Union.

    In exceptional cases where data is processed outside the European Economic Area (EEA), this is done solely on the basis of:

    • An adequacy decision by the European Commission, or

    • Standard Contract Clauses (SCCs)

    8. Retention periods

    We store personal data:

    • As long as the subscription is active

    • Up to a maximum of 2 years after termination (administrative purposes)

    • Billing data: 7 years (legal obligation)

    Afterwards, data is deleted or anonymised.

    9. Security

    We take appropriate technical and organisational measures, including:

    • Encrypted storage

    • Secure connections (TLS/SSL)

    • Access control

    • Logging and monitoring

    • Regular security tests

    10. Data breach

    In case of a data breach:

    • Do we report this to the Personal Data Authority if required

    • Inform stakeholders without unnecessary delay if there is a high risk

    11. Your rights

    You are entitled to:

    • Access

    • Correction

    • Removal

    • Limiting processing

    • Data portability

    • Objection

    • Withdrawal of consent

    Requests can be submitted via: privacy@syod.nl

    We respond within one month.

    12. Tracking and analytics

    The ombrio platform can use limited analytical or technical data to improve performance and stability.

    • We do not use tracking for advertising purposes

    • We do not track users across third-party apps or websites

    If required, we seek prior consent.

    13. Changes

    We may amend this privacy statement.

    In case of important changes, we inform users through appropriate channels.

    14. Complaints

    You have the right to lodge a complaint with the Personal Data Authority:
    https://www.autoriteitpersoonsgegevens.nl

    15. Contact

    For questions about this privacy statement or data processing:

    E-mail: privacy@syod.nl
    Data protection officer: fg@syod.nl