We understand that your data is important to you, so protecting it is our top priority. This policy outlines how we manage any personal information you provide on our website curitt.health. We, Curitt, with address at Bilderdijkstraat 77, Amsterdam, Netherlands, are the controller of your personal data. We encourage you to read this policy thoroughly to gain a comprehensive understanding of our privacy practices.
01
Legal basis for processing
We process your personal data on the following legal bases: execution of a contract with you (to schedule appointments, execute checkups, and provide results); your explicit consent (for tracking website usage and browsing behavior to serve relevant ads, and for emailing you when we open a clinic in a city you asked about); our legitimate business interests (such as fraud prevention, balanced against your privacy rights); and compliance with applicable laws that require processing of personal data. Our legal basis for processing specific categories of data depends on our processing purposes and the categories of data processed.
02
What we collect
We process the following categories of personal data: name, email address, phone number, weight and height, gender, blood parameters (depending on the scope of the chosen checkup package), ECG, spirometry, IP address, device and browser information, browsing behavior, and, only with your consent, the advertising cookie IDs set by Google and Meta. We use each of these data categories for one or more specific processing purposes at a time.
03
Why we process it
We process personal data to provide you with our services, to analyze users’ behavior on our website, to improve the user experience, to serve you with relevant ads, and to communicate with you and provide customer support. If you ask us to through the “Add your city” form, we use your email address and the city you entered only to tell you when we open a clinic there. We do not process payment information directly, your payment details are managed by Stripe, a third-party service adhering to rigorous global standards for payment processing.
04
How we collect it
We collect data in two ways: personal data you give us directly and voluntarily, and personal data we collect with the help of third-party tools. When you use our services or reach out for customer support, you share information with us directly. We also use tools from other companies to help run our website and understand how it is used. Analytics and advertising tools only run after you agree in our cookie banner, and only for the categories you choose: analytics and marketing are separate choices, and you can reject both. Our analytics and advertising tags send their data through our own tagging server at a curitt.health address, run for us by Stape in the EU, rather than straight from your browser to Google and Meta, so we can remove details before anything is passed on. If you arrive through a campaign link, we note the campaign (such as UTM tags or an ad click ID) for that visit; only if you agree to analytics cookies do we keep it for 30 days in our own cookie, curitt_campaign. When you book, we pass a short reference to your analytics ID and campaign into the booking form, so we can see which visit led to the booking. Once a booking is confirmed, our booking service tells Google Analytics that a booking was made, with its price and a booking reference. It never sends your name, contact details or health information, and it only links the booking to your visit if you agreed to analytics cookies; otherwise the booking is counted anonymously. If you agree to marketing cookies, we also tell Meta when a booking is made, so we can see which ads work: when you open the booking page, our booking service keeps Meta’s own cookie IDs and your browser type for up to three hours, and when the booking is confirmed it sends Meta only that a booking was made, with a booking reference. Meta never receives your name, contact details, health information, which service you booked, its price, or the pages you read.
05
Data processors and third parties
Curitt Health works with several trusted partners who process personal data on our behalf. All processors are bound by data processing agreements compliant with the GDPR and, where applicable, HIPAA. Our processors include: Reinier Haga Medisch Diagnostisch Centrum B.V. (laboratory diagnostics); our contracted physicians (medical data analysis); Tresorit (encrypted cloud storage); Jane App (electronic health records); Medicus (health results interpretation); Acuity Scheduling, part of Squarespace (online booking and gift certificates); Stripe (payments); Pipedrive (CRM); Microsoft (business communication); Framer (website building and hosting, and emailing us what you send through the forms on our website); Cloudflare (our appointment-availability service, and the connection that records confirmed bookings in Google Analytics and, with your consent, reports them to Meta); Stape (our tagging server, hosted in the EU, which passes analytics and advertising data on to Google and Meta); Google (website analytics and advertising, through Google Tag Manager and Google Analytics); and Meta (advertising on Facebook and Instagram, and measuring which ads lead to bookings). Our clinic map loads map images from OpenFreeMap and the map software from jsDelivr and esm.sh. These services receive your IP address in order to deliver the files, but set no cookies.
06
Data retention
The data retention period depends on the purpose of processing. Data processed for providing our services, including your name, email, phone number, and health data, is stored for 10 years. Website analytics data is stored for 1 year. Browsing behavior data and other data used for advertising are stored for 1 year. City requests (your email address and city) are kept until we have let you know about a clinic opening in that city, until you unsubscribe, or for at most 2 years, whichever comes first. Our campaign cookie, curitt_campaign, expires after 30 days. The browser type and Meta cookie IDs our booking service keeps for reporting a booking to Meta are deleted after three hours at most.
07
Your rights
You have the following data subject rights: the right to access, update or correct, object to the use of, restrict the use of, transfer, and erase your data, as well as the right to withdraw consent and to file a complaint with the relevant data protection authority. You can exercise your rights by submitting a request at info@curitt.health. We may ask you to confirm your identity before responding. You can also raise concerns with a Data Protection Authority about how we handle your data.
08
Location and security
We process personal data within the European Union or in countries with adequate levels of data protection. Health data is processed in the Netherlands. Our website is built and hosted by Framer and delivered through a global network. Our tagging server (Stape) is hosted in the EU. Our booking system (Acuity Scheduling), our appointment-availability service (Cloudflare) and some marketing tools are run by US companies certified under the EU-US Data Privacy Framework. We implement technical and organizational measures to ensure your personal information is secure, including encrypted storage and password-protected email delivery of health data.
09
Children and unsolicited data
Curitt is not intended for persons below the age of 18. We do not collect children’s data knowingly. If you become aware that we have collected your child’s data, please contact us and we will delete it as soon as possible. We also ask you not to send personal health or medical information via our general contact form or email. If we require such information, we will provide a secure channel. Any unsolicited medical information will not be used for decision-making and will not be stored in any structured medical record.
10
Changes and contact
Occasionally, we might make changes to this privacy policy. When we do, we’ll refresh the “last updated” date at the beginning of the policy. If there are significant changes, we’ll let you know through our website, a blog post, an email, or any other appropriate channel. For any privacy inquiries, contact us at info@curitt.health.