Privacy policy

Last updated: {{POLICY_DATE}}

1. Controller identity

{{LEGAL_ENTITY_NAME}} (KvK {{KVK_NUMBER}}, VAT {{VAT_NUMBER}}), {{REGISTERED_ADDRESS}}, {{CONTACT_EMAIL}}, is the controller for the processing of personal data through the FitInsured platform.

2. Categories of data

Account data

When you create an account, we collect your name, email address, and authentication credentials.

Health data (special category)

With your explicit consent (Article 9(2)(a) GDPR), we collect activity data from connected wearable devices and health platforms: step counts, active minutes, workout types, heart rate, sleep duration and quality, and derived metrics such as health scores and FitPoints balances.

Usage data

We collect page views, feature interactions, and API call metadata for service improvement and security monitoring.

Communication data

If you contact us, we retain correspondence and any data you choose to share.

3. Purposes and lawful bases

• Service provision (Art. 6(1)(b)): create and maintain your account, connect wearables, calculate health scores and FitPoints.
• Health-data processing (Art. 9(2)(a)): collecting, storing, and analysing special-category data from wearables based on your explicit consent, revocable at any time.
• Aggregated reporting (Art. 9(2)(j)): producing de-identified, aggregated risk cohorts for partner insurers. Individual records are never shared without separate explicit consent.
• Legal compliance (Art. 6(1)(c)): retaining records as required by applicable law.
• Service improvement (Art. 6(1)(f)): analysing anonymised usage patterns to improve the platform.

4. Recipients and subprocessors

Data is processed by FitInsured personnel and the following subprocessors:

• Microsoft Azure (EU region) — cloud hosting, storage, and computation.
• {{PLACEHOLDER_SUBPROCESSOR_1}} — {{PLACEHOLDER_SUBPROCESSOR_1_PURPOSE}}.
• {{PLACEHOLDER_SUBPROCESSOR_2}} — {{PLACEHOLDER_SUBPROCESSOR_2_PURPOSE}}.

Each subprocessor is bound by a data processing agreement consistent with GDPR Article 28. The list is updated before any change takes effect.

5. International transfers

All data is processed within the European Union. No personal data is transferred to third countries unless a valid adequacy decision or appropriate safeguard (Standard Contractual Clauses) is in place. {{PLACEHOLDER_INTERNATIONAL_TRANSFERS}}

6. Retention periods

Data is retained for {{PLACEHOLDER_RETENTION_ACCOUNT}} after account inactivity, {{PLACEHOLDER_RETENTION_HEALTH}} for health data after consent withdrawal, and {{PLACEHOLDER_RETENTION_COMMUNICATION}} for communication records. Aggregated anonymised data may be retained indefinitely.

7. Data subject rights

Under the GDPR you have the right to:

• Access your personal data (Art. 15)
• Rectify inaccurate data (Art. 16)
• Erasure / right to be forgotten (Art. 17)
• Restrict processing (Art. 18)
• Data portability (Art. 20)
• Object to processing (Art. 21)
• Not be subject to automated individual decision-making (Art. 22)

To exercise any right, visit your account settings or contact {{CONTACT_EMAIL}}. Requests are fulfilled within 30 days.

8. Automated decision-making and profiling

Health scores and FitPoints are calculated through automated processing of activity data. Every score is explainable per factor. Automated scoring is reviewable by a human on request. A Data Protection Impact Assessment (DPIA) has been conducted for this processing.

9. Complaints

You have the right to lodge a complaint with the Dutch data protection authority: Autoriteit Persoonsgegevens, {{PLACEHOLDER_AP_ADDRESS}}.

10. Contact

Controller: {{LEGAL_ENTITY_NAME}}, {{REGISTERED_ADDRESS}}, {{CONTACT_EMAIL}}.
Data Protection Officer: {{DPO_EMAIL}}.