Privacy policy

01Who we are

Veyra Health B.V. ("Veyra", "we", "us") provides digital healthcare services, including online doctor consultations, mental health support and at-home diagnostics. Our registered office is at Keizersgracht 120, 1015 CW Amsterdam, the Netherlands.

This policy explains how we handle personal data when you use our website, apps and services. Where our services are provided by an affiliated entity or a partner clinic in your country, that entity may also act as a controller of your data, and we will tell you when this is the case.

02Data we collect

We only collect the information we need to provide safe, high-quality care and to run our services. This may include:

• Identity and contact details, such as your name, date of birth, email address, phone number and postal address.
• Account information, such as your login details, preferences and communication settings.
• Health information you share with us or that is created during your care (see Health data below).
• Payment and insurance details, processed by our regulated payment providers.
• Technical data, such as device type, app version, IP address and diagnostic logs.
• Usage data about how you use our website and apps, collected with your consent where required.

03How we use your data

We use your personal data to:

• Provide consultations, prescriptions, referrals, lab tests and follow-up care.
• Create and maintain your health record so your care team has the right context.
• Manage your account, memberships, payments and insurance claims.
• Communicate with you about appointments, results and service updates.
• Keep our services safe, secure and compliant, including preventing fraud.
• Improve our services using aggregated or de-identified data wherever possible.

We rely on different legal bases depending on the purpose, including performance of a contract, our legal obligations, your explicit consent, the provision of healthcare, and our legitimate interests where these are not overridden by your rights.

04Health data

Health data is a special category of personal data and receives the highest level of protection. It includes your symptoms, medical history, consultation notes, prescriptions, test results and any images or files you share with a clinician.

Your health data is only accessible to the clinicians and care staff involved in your care, and to a small number of authorised staff where strictly necessary, for example to provide technical support or meet a legal obligation. We never sell health data and never use it for advertising.

05Sharing your data

We share personal data only when necessary and with appropriate safeguards, for example with:

• Pharmacies you choose, to fulfil prescriptions.
• Laboratories and partner clinics that carry out tests or in-person care.
• Your insurer or employer benefits provider, limited to what is needed to process your cover.
• Other healthcare providers, such as your own doctor, when you ask us to or when it is needed for your safety.
• Service providers that host or support our platform, under strict data processing agreements.
• Authorities, where we are required to by law.

Where data is transferred outside your region, we use recognised safeguards such as adequacy decisions or standard contractual clauses.

06Your rights (GDPR & HIPAA)

Depending on where you live, you have rights over your personal data. Under the EU and UK GDPR these include the right to access, correct, delete or port your data, to restrict or object to certain processing, and to withdraw consent at any time.

If you are in the United States, the HIPAA Privacy Rule gives you the right to access and obtain a copy of your health records, request corrections, receive an accounting of certain disclosures and request restrictions on how your information is used. You can also ask us to communicate with you confidentially.

You can exercise most rights directly in the app, or by contacting our Data Protection Officer. You also have the right to lodge a complaint with your local data protection authority, such as the Dutch Autoriteit Persoonsgegevens, or with the U.S. Department of Health and Human Services.

07Retention

We keep personal data only for as long as we need it. Medical records are kept for the period required by healthcare law in the country where you received care, which is often between 10 and 20 years. Account and billing data is kept for as long as your account is open and afterwards as required for tax and accounting purposes.

08Security

Your data is encrypted in transit and at rest and stored in regional data centres. We use role-based access controls, multi-factor authentication for staff, continuous monitoring and regular independent security testing. No system is completely secure, so if we ever become aware of a breach affecting you we will notify you and the relevant authorities as required by law.

09Cookies

We use essential cookies to make our website work, and optional analytics cookies only with your consent. You can change your cookie choices at any time from the cookie settings link in the footer.

10Contact

Questions about this policy or your data? Contact our Data Protection Officer at privacy@veyrahealth.com, or write to Data Protection Officer, Veyra Health, Keizersgracht 120, 1015 CW Amsterdam, the Netherlands.

We may update this policy from time to time. When we make significant changes, we will let you know in the app or by email before they take effect.