Legal

Health Check Privacy Notice

Version 1.2

This notice explains how we handle your personal data when you reserve a place in the PMOS Health Check on josie.care and pay the refundable deposit, or leave your email to hear about a future offer. Before the Health Check itself starts (prescription, blood tests and the doctor's review), we will give you a separate notice for that processing.

The Josie app is covered by the Josie Privacy Policy, and the rest of the website by the Website Privacy and Cookie Notice. Josie Privacy Policy · Website Privacy and Cookie Notice

1. Who we are

The Health Check and josie.care are provided by Health Surfers BV, enterprise number BE 1039.918.687, registered office Blauwhuisstraat 31, 8531 Hulste (Harelbeke), Belgium. We are the controller of the personal data described here. For any privacy question, write to privacy@josie.care.

2. What we collect

When you reserve, we collect only what we need to manage your place:

  • your email address;
  • the option you chose (Health Check or Metabolic Programme) and whether you added the doctor call;
  • the language of the page you reserved from;
  • the date and time you gave your consent, and the version of the consent wording you agreed to;
  • the status of your deposit (paid, refunded, expired or failed), its amount, how you paid (card or Bancontact), and the payment references Stripe gives us.

We do not ask for your name, date of birth or any health details on the website, and we never receive your card or bank details: you pay on Stripe's secure page.

If you sign up to hear about a future offer ("Coming later" on the Health Check page), we collect your email address, the offer you chose, the language of the page, and the date, time and version of your consent. Nothing else.

3. Why this is health data

The Health Check is for women who have PMOS (formerly PCOS). A reservation therefore shows that you have PMOS, which is health data, a special category of personal data under Article 9 of the GDPR. We only process it with your explicit consent, which you give by ticking the box before you reserve. Nothing is stored if you do not tick it.

Signing up for a future offer also reveals health information: that you have symptoms without a clear answer yet, or that you are planning a pregnancy. We only keep that sign-up with your explicit consent, given by ticking the box next to it.

4. Why we use your data, and our legal bases

  • To manage your reservation, confirm your place and contact you about the start of the Health Check: performance of a contract with you (Art. 6(1)(b) GDPR) and your explicit consent (Art. 9(2)(a)).
  • To email you when a future offer you signed up for opens, and only about that offer: your explicit consent (Art. 9(2)(a) and Art. 6(1)(a)).
  • To take your deposit and refund it if you change your mind: performance of a contract (Art. 6(1)(b)).
  • To keep payment and accounting records: our legal obligations under Belgian accounting law (Art. 6(1)(c)).
  • To prevent abuse, for example by limiting the number of reservation attempts per email address: our legitimate interest in protecting the service (Art. 6(1)(f)).
  • To count how people use the Health Check page (for example which option is chosen most): our legitimate interest in improving the page (Art. 6(1)(f)). These counts are kept in our own database, without your email address, IP address or any other identifier, and are never sent to an analytics or advertising company.

We do not use your reservation for marketing, we do not sell your data, and we never use it for advertising. You will only receive our newsletter if you sign up for it separately.

5. Who we share it with

We share your data only with the providers that run the reservation for us, and only as far as each one needs:

  • Supabase, which hosts the database and the functions that record your reservation, in the EU (Ireland).
  • Stripe (Stripe Payments Europe, Limited, Ireland), which processes your deposit and any refund. For some purposes, such as fraud prevention and its own legal obligations, Stripe acts as an independent controller under its own privacy policy.
  • Resend, our email provider, when we email you about your reservation or about an offer you signed up for.

No doctor or laboratory receives your data at the reservation stage.

6. Transfers outside the EU

Your reservation is stored in the EU. Stripe and Resend are part of, or work with, companies in the United States. Where your data leaves the European Economic Area, the transfer is protected by the European Commission's Standard Contractual Clauses and, where the provider is certified, the EU-US Data Privacy Framework.

7. How long we keep it

  • Reservations that are never paid (abandoned, expired or failed payments): deleted 30 days after they were started.
  • Reservations that are refunded or cancelled: deleted 30 days after the refund.
  • Paid reservations: kept until 12 months after the end of the Health Check group you joined, then deleted.
  • Sign-ups for a future offer: deleted 12 months after you sign up, or earlier if you ask us. Signing up again for the same offer restarts the 12 months.
  • Payment and accounting records: kept for 10 years, as Belgian accounting law requires. Stripe also keeps its own records of the payment.
  • Email delivery logs: the address an email was sent to is removed after 90 days.

8. Withdrawing your consent

You can withdraw your consent at any time by writing to privacy@josie.care. We will then cancel your reservation, refund your deposit in full and delete your data, except the payment records we must keep by law. Withdrawing does not affect processing carried out before you withdrew.

If you signed up for a future offer, writing to privacy@josie.care removes your email from that list.

9. Your rights

You have the right to access, correct or delete your data, to restrict or object to its processing, to receive it in a portable format, and to withdraw your consent. You do not need a Josie account: write to privacy@josie.care from the email address you reserved with. We aim to reply within one month.

You can also lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données, www.dataprotectionauthority.be) or the authority in the country where you live or work.

10. Age

The Health Check is for adults. You must be 18 or older to reserve, and we do not knowingly accept reservations from anyone younger. If we learn that a reservation was made by someone under 18, we cancel it, refund the deposit and delete the data.

11. How we protect your data

Reservations are stored in a database that only our backend can reach: the website and the Josie app cannot read it. Data is encrypted in transit and at rest, and only the few team members who manage the Health Check have access.

12. Changes to this notice

We will update this notice when the Health Check changes, and in particular before any blood tests or doctor reviews take place. The version is shown at the top of this page. If a change affects what you agreed to, we will ask for your consent again.

Health Surfers BV · BE 1039.918.687 · privacy@josie.care · Version 1.2