This Privacy Policy explains how Lyvup Health handles personal data collected through our website lyvup.com, including our contact and sign-up forms. Our app and our research programmes have their own privacy notices (see section 9).
1. Who we are
Lyvup Health is the trade name of Lyvup B.V., Herengracht 59, 1015 BC Amsterdam, the Netherlands, Chamber of Commerce (KvK) number 80366708. Lyvup B.V. is the controller for the processing described in this policy.
For any question about privacy, contact us at privacy@lyvup.com.
2. What we process, why, and for how long
| Purpose | Personal data | Legal basis (GDPR) | Retention |
|---|---|---|---|
| Answering your message (contact form or email) | Name, organisation, email address, topic, your message | Legitimate interest in responding to enquiries (Art. 6(1)(f)) | 2 years after our last contact |
| Signing up for a pilot programme | See section 3 | Your explicit consent (Art. 6(1)(a) and 9(2)(a)) | See section 3 |
| Job applications | Contact details, CV, cover letter, interview notes | Steps taken at your request before a contract (Art. 6(1)(b)) | 4 weeks after the procedure ends; 1 year if you agree to be kept on file |
| Website analytics | Cookie identifiers, pages visited, referring site, device and browser type, approximate location | Your consent (Art. 6(1)(a)) | See our Cookie Policy; analytics reports 14 months |
| Protecting our forms against spam | A hidden check field and Google reCAPTCHA signals such as interaction data and IP address | Legitimate interest in preventing abuse (Art. 6(1)(f)) | Not stored by us; Google: see section 5 |
| Website security and operation | IP address, browser type, pages requested, date and time | Legitimate interest in a secure website (Art. 6(1)(f)) | 90 days |
We do not use your data for automated decision-making that has legal or similarly significant effects for you.
3. Signing up for a pilot programme
On our pages for participants (such as lyvup.com/nl/meedoen) you can sign up for a pilot programme. These programmes are for people with a heart or vascular condition, high blood pressure or high cholesterol. The fact that you sign up, and any answer about your health or about who referred you, therefore counts as health data: a special category of personal data under Article 9 GDPR. We distinguish three phases, each with its own rules.
Phase 1 – Registering your interest (on this website)
- What we collect: first name, last name, email address, phone number, who pointed you to the programme (GP, practice nurse, specialist or other), and whether you think you meet the participation criteria.
- Why: only to contact you, explain the programme and plan a first conversation. We do not use this data for marketing, and we do not share it with your doctor unless you ask us to.
- Legal basis: your explicit consent (Art. 6(1)(a) and 9(2)(a)), which you give by ticking the box on the form. You can withdraw it at any time by contacting us. We then stop using your sign-up for this purpose and delete it, unless the law requires or permits us to keep certain information.
- Where it is stored: in HubSpot, accessible only to the Lyvup Health team members who handle sign-ups.
- How long: if you do not continue, we delete your sign-up 6 months after our last contact. If you are on a waiting list, we ask you after 6 months whether you want to stay on it.
- Please do not include medical details in free-text fields. We do not need them at this stage.
Phases 2 and 3 – Screening and taking part
If you continue, a screening conversation and possibly a first appointment follow, and then actual participation. For these phases you receive the programme's own privacy information and, when you take part, its information letter and consent form. Those documents state who is responsible for your data in that programme, what is collected, on what legal basis and for how long.
The legal basis for processing personal data in a research programme is determined separately from the consent required to take part in it. Depending on the research and applicable law, the processing may rely on consent or another lawful basis under Article 6 GDPR, together with an applicable condition under Article 9 GDPR. The programme's privacy information explains the arrangements that apply.
The pilot programmes are for adults (18 and over).
4. Analytics and cookies
We only use analytics cookies after you have given consent in our cookie banner. We use HubSpot Analytics and Google Analytics 4, loaded through Google Tag Manager.
These tools recognise your browser through a cookie identifier, not through your name. This applies to all our pages, including our pages for participants. If you have accepted analytics cookies and later submit our contact form, HubSpot links your earlier visits to your contact details. We use analytics to understand which pages are useful. We do not use it for advertising. In Google Analytics we have switched off Google signals and advertising features.
You can change your choice at any time via Cookie Settings at the bottom of every page. Our Cookie Policy lists every cookie by name.
5. Who receives your data
We do not sell personal data. We use the following service providers, each under a data processing agreement:
- HubSpot (HubSpot Ireland Ltd. and HubSpot, Inc.): hosting of this website, our contact form, our contact database for business enquiries, email and HubSpot Analytics. Your data is stored in HubSpot's EU data centre. HubSpot's content delivery network is provided by Cloudflare.
- HubSpot: storage of pilot sign-ups (section 3), in the EU.
- Google (Google Ireland Ltd. and Google LLC): Google Tag Manager, Google Analytics 4 and reCAPTCHA.
We also share personal data with authorities when the law requires it, and with our professional advisers (such as our accountant or lawyer) when necessary, under a duty of confidentiality.
6. Transfers outside the European Economic Area
We store website data in the EEA. Some of our providers are US companies or use sub-processors outside the EEA, for example for support or security. We allow this only where your data is adequately protected: through the EU–US Data Privacy Framework for certified companies, or through the European Commission's Standard Contractual Clauses with additional safeguards. You can ask us for a copy of these safeguards.
7. Security
We protect personal data with appropriate technical and organisational measures. These include encrypted connections, access limited to staff who need it, two-factor authentication on our business accounts and data processing agreements with every provider.
8. Your rights
Under the GDPR, and as far as the conditions it sets are met, you have the right to:
- see the personal data we hold about you;
- have incorrect data corrected;
- have your data deleted;
- have processing restricted;
- receive your data in a structured, machine-readable format;
- object to processing based on our legitimate interest;
- withdraw your consent at any time, without affecting processing that took place before.
Email privacy@lyvup.com to use these rights. We reply within one month; for complex requests this can be extended by two months, and we will tell you if so. We may ask you to confirm your identity first.
If you are not satisfied with how we handle your data, you can file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl). We would appreciate it if you contacted us first.
9. Our app and research programmes
This policy covers the website and phase 1 of signing up for a pilot (section 3). The Lyvup Health app has its own privacy notice. If you take part in a research programme, such as RECOVERYou (part of the Eurostars programme of Eureka), the information letter and consent form of that programme apply. They explain who is responsible for your data (Lyvup B.V. alone, or together with research partners such as Amsterdam UMC), what is collected, on what legal basis, and for how long.
10. Children
This website is not aimed at children under 16. Our pilot programmes are for adults only.
11. Changes to this policy
We may update this policy. The date at the top shows the latest version. If we make important changes, we will announce them on the website.
12. Contact
Lyvup B.V. (Lyvup Health) · Herengracht 59, 1015 BC Amsterdam · KvK 80366708 · privacy@lyvup.com