This is a translation for your convenience; the Dutch version is legally binding.
BioBlue processes personal data in accordance with the General Data Protection Regulation (GDPR), the Dutch GDPR Implementation Act (Uitvoeringswet AVG, UAVG) and other applicable Dutch laws and regulations. In this privacy policy, we explain which personal data we collect, for which purposes we process it, how we protect it and what rights you have.
1. Who are we?
BioBlue B.V. is located at Nieuwendijk 19c, 1012 LZ Amsterdam, and is responsible for the processing of your personal data. You can contact us at privacy@bioblue.nl.
2. What personal data do we collect?
We only collect personal data that you provide to us yourself or that is necessary to perform our services. This concerns:
- first name and surname;
- email address and other contact details;
- health-related information that you share voluntarily through questionnaires or analyses;
- details of your order, such as the partner through which you ordered (for example your gym or personal trainer) and whether you have consented to your data being shared with that partner;
- usage data from our website and digital tools.
We do not collect medical records or information that falls within the exclusive domain of healthcare professionals.
3. For what purposes do we process your data?
We process your personal data exclusively for the following purposes:
- providing personalised health advice (not medical advice);
- improving our services, customer communication and user experience;
- the administration and settlement of orders received through a partner;
- sharing your BlueTest results and your chosen blood test and supplement programme with your coach or personal trainer, only if you give your explicit consent (see section 6);
- complying with legal obligations (such as the statutory obligation to retain records for tax purposes);
- security purposes, such as preventing fraud or misuse.
4. Legal basis for processing
We process your data exclusively on the basis of one or more of the following legal grounds:
- your explicit consent (Article 6(1)(a) GDPR and, for health data, Article 9(2)(a) GDPR);
- the performance of a contract (Article 6(1)(b) GDPR);
- a legal obligation (Article 6(1)(c) GDPR);
- a legitimate interest, such as improving our services (Article 6(1)(f) GDPR).
5. How do we protect your personal data?
BioBlue takes appropriate technical and organisational measures to protect your personal data against loss or unlawful processing. Our security measures comply with recognised standards, including:
- NEN-ISO/IEC 27001 (information security);
- NEN-ISO/IEC 27701 (privacy information management).
These include encryption, access control, secure storage and regular audits.
6. Sharing data with third parties
We do not provide your data to third parties unless:
- this is necessary for the performance of our contract (for example hosting partners);
- we are legally obliged to do so;
- you have given us your explicit consent to do so.
We conclude a data processing agreement with external parties, setting out strict arrangements on the security and confidentiality of your data.
Sharing with your coach or personal trainer (partner programme)
If you order via a partner's page, such as your gym or personal trainer, we record with your order which partner you came through. For settlement with the partner, we only use totals, such as the number of orders. We do not share any health data with the partner without your consent.
At checkout, you can use a separate tick box to give explicit consent to share your BlueTest results and your chosen blood test and supplement programme with your coach or personal trainer at that partner. This box is unticked by default and is not required in order to place an order. If you give your consent, we share only this data, only with the partner you have chosen, and only so that your coach can tailor your training and guidance accordingly. The partner may not use this data for any other purpose.
We never share your medical intake, any medical treatments or the doctor's assessment with a partner, even if you tick the box.
We record when you gave your consent and with what wording. You can withdraw your consent at any time via privacy@bioblue.nl or info@bioblue.nl. From that moment on, we will not share any new data with the partner. Withdrawing your consent has no consequences for your order or subscription.
7. Retention periods
We do not keep your personal data for longer than is necessary for the purpose for which it was collected. In some cases, we comply with statutory retention periods (such as 7 years for invoice data). We keep your consent to sharing with a partner, and the time at which you gave or withdrew it, for as long as is necessary to demonstrate that we have handled your data with due care.
8. Your rights
Under the GDPR, you have the following rights:
- the right of access to your personal data;
- the right to rectification or erasure;
- the right to restriction of processing;
- the right to object;
- the right to data portability;
- the right to withdraw your consent at any time.
To exercise these rights, please contact us at privacy@bioblue.nl. We will respond within 30 days.
9. Cookies and tracking
BioBlue uses functional and analytical cookies. For tracking cookies, we ask for your explicit consent through our cookie banner. Read more in our cookie policy.
10. Complaints
Do you have a complaint about how we process your data? You can lodge a complaint with the supervisory authority, the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
11. Changes
We reserve the right to amend this privacy policy. We advise you to consult this policy regularly. In the event of substantial changes, we will inform you actively.