Privacy policy
How Bionezis handles personal data as an information and navigation platform for public preventive screening programs.
This page describes how Bionezis handles personal data in practice. It is not a substitute for legal advice. The formal company name (e.g. KVK registration) will be added when the Dutch operating entity is finalized.
Controller
Bionezis (bionezis.com) is the data controller for personal data collected through this website and optional accounts. Correspondence address: Patroclosstraat 2, 1076 NG Amsterdam, Netherlands. Privacy requests: privacy@bionezis.com. General contact: hello@bionezis.com.
Patroclosstraat 2 1076 NG Amsterdam Netherlands
Purposes
We process data to operate the website securely, provide optional accounts (preferences and saved programs), send transactional emails (verification and password reset), maintain reliability and security, and — only with consent — measure aggregated traffic.
Legal bases (GDPR)
Contract / steps prior to contract (Art. 6(1)(b)): creating and running your account, preferences, saved programs, and related transactional email. Legitimate interests (Art. 6(1)(f)): security, abuse prevention, and essential technical logs, balanced against your rights. Consent (Art. 6(1)(a)): optional analytics cookies and any non-essential marketing. You may withdraw consent anytime via Cookie settings without affecting essential service.
Data we process
Account data: email, optional display name, password hash, language/country preferences, saved program references, terms-acceptance timestamp. Technical data: session and CSRF cookies, security logs (IP and user agent retained only as needed). Optional analytics events after consent. We do not ask for health questionnaires. Anonymous assistant chat is not stored by default; do not enter unnecessary sensitive health details.
Processors and hosting
We use service providers under data-processing arrangements where required. Primary hosting is Hetzner Cloud in the EU (sovereign European cloud infrastructure for bionezis.com, including the database). Transactional email is sent via Proton SMTP. Optionally, Plausible or a similar privacy-oriented analytics provider may run after you consent. Error monitoring (for example Sentry) may process technical diagnostics if enabled. We do not sell personal data.
International transfers
Primary hosting and database are in the EU/EEA on Hetzner. If a provider processes data outside the EEA, we rely on an adequacy decision or appropriate safeguards such as Standard Contractual Clauses, as documented with that provider.
Retention
Account data is kept while the account is active and deleted when you delete the account (or sooner if we close inactive accounts after notice). Security logs are typically retained up to 90 days unless needed longer for an incident. Backups are rotated on a limited schedule and expire after the backup retention window. Cookie consent choices stay in your browser until you clear storage or change them.
Your rights
Under the GDPR you may request access, rectification, erasure, restriction, portability, or objection, and withdraw consent where processing is based on consent. Account export and deletion are available in Settings. You may also lodge a complaint with a supervisory authority.
Supervisory authority
You can contact the data protection authority in your EU/EEA country of residence or work. For the Netherlands: Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).
Contact
Privacy requests: privacy@bionezis.com. Do not send urgent medical questions by email — contact local healthcare or emergency services instead.