Privacy Notice
Version 1.0 · Effective 23 August 2026
This Privacy Notice explains how PatientHub collects, uses, stores, and protects your personal information. We have written it in plain language so it is easy to understand. If you have any questions, please contact us at privacy@patienthub.be.
1. Who We Are (Data Controller)
The company responsible for your personal data ("the data controller") is:
We operate PatientHub — an online health monitoring platform that lets patients share health information with their care providers.
2. What Personal Data We Collect
2.1 Account data
When you register, we collect your name, email address, date of birth, country of residence, and preferred language.
2.2 Health data (special category data)
When you use the platform, you may provide vitals (e.g. blood pressure, heart rate, weight), symptoms, medications, and any other health information entered via forms your care provider has set up.
2.3 Usage data
We collect the date and time of your actions (e.g. when you submitted a form, when a provider viewed your data), your IP address at the time of consent, and audit log records of who accessed your data and when. We do not collect data for advertising, analytics, or profiling purposes.
3. Why We Process Your Data and the Legal Basis
| Purpose | What it means | Legal basis |
|---|---|---|
| Health monitoring | Storing your health data and making it available to your linked care providers | GDPR Art. 9(2)(a) — explicit consent |
| Automated monitoring alerts | Checking submitted data against alert thresholds and sending notifications when crossed | GDPR Art. 9(2)(a) — explicit consent |
| Care provider access | Allowing linked doctors or nurses to view your health submissions and upload documents | GDPR Art. 9(2)(a) — explicit consent |
| Account management | Creating and maintaining your account, authenticating you, and managing your profile | GDPR Art. 6(1)(b) — contract performance |
| Platform communications | Sending account notifications, security alerts, and service updates | GDPR Art. 6(1)(b) — contract performance |
| Compliance and security | Keeping audit logs, handling rights requests, and demonstrating legal compliance | GDPR Art. 6(1)(c) — legal obligation |
You may withdraw your consent to health data processing at any time (see Section 9). Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
4. Who Has Access to Your Data
4.1 Your care providers
Doctors, nurses, or other healthcare professionals you have been linked to on the platform can view your health submissions and upload medical documents to your record. You can always see which providers are linked to you in your account settings.
4.2 Our technology suppliers (data processors)
| Supplier | Role | Location | DPA |
|---|---|---|---|
| Supabase | Database, authentication, and file storage | European Union | ✅ Yes |
| Brevo | Transactional email (notifications, alerts) | France (EU) | ✅ Yes |
| Vercel | Platform hosting and serving the application | European Union | ✅ Yes |
We do not sell your data. We do not share it with insurers, employers, advertisers, or any organisation not listed above without your explicit consent.
4.3 Legal obligations
In exceptional circumstances, we may be required to disclose information to competent authorities (e.g. a court order). We will inform you where we are legally permitted to do so.
5. International Data Transfers
Your data is stored and processed within the European Union only. Supabase stores all data in EU-based data centres. Brevo is headquartered in France. Vercel serves the application from EU infrastructure. We do not transfer your personal data outside the EEA. If this ever changes, we will update this notice and comply with all applicable GDPR safeguards before any transfer takes place.
6. How Long We Keep Your Data
| Data type | Retention period | Reason |
|---|---|---|
| Health data and submissions | Minimum 10 years from collection, or as required by applicable EU medical records law | Legal obligation |
| Account data (name, email, profile) | Deleted within 30 days of a confirmed erasure request, unless legal retention applies | No longer needed |
| Consent records | Same period as health data | Legal evidence that processing was lawful |
| Audit logs | 10 years | Security, accountability, and legal compliance |
| Uploaded medical documents | Until deleted by patient or provider, subject to 10-year minimum | Medical records obligation |
When you request erasure, we will clearly explain what can and cannot be deleted due to legal retention obligations.
7. Your Rights Under the GDPR
Right of access (Art. 15)
You can ask us to confirm whether we hold data about you and receive a copy. Download your data directly from Profile → My Data → Export.
Right to rectification (Art. 16)
If any data is inaccurate or incomplete, you can update it in your profile or ask us to correct it.
Right to erasure (Art. 17)
You can ask us to delete your personal data. We will do so unless legally required to retain it (e.g. medical records). We will always tell you which data we can and cannot delete.
Right to restriction (Art. 18)
In certain circumstances, you can ask us to stop using your data while keeping it stored — for example, if you have contested its accuracy.
Right to data portability (Art. 20)
Download your data as a ZIP file (JSON + CSV) from Profile → My Data → Export. You can also ask us to transfer it to another service provider where technically feasible.
Right to withdraw consent
Withdraw your consent at any time from Profile → Privacy settings. Withdrawal takes effect immediately.
8. Automated Monitoring and Alerts
PatientHub can send you and your care provider alerts when your submitted health data crosses a threshold. These alerts are generated automatically, but they do not constitute a medical diagnosis, do not produce legal effects, and are intended to support — not replace — clinical judgment.
9. How to Exercise Your Rights
You can exercise most rights directly within PatientHub:
- Download your data: Profile → My Data → Export
- Update your profile: Profile → Edit profile
- Withdraw consent: Profile → Privacy settings
- View activity log: Profile → Activity
For all other requests — erasure, restriction, portability to a third party, or objection — contact us at privacy@patienthub.be. We will respond within 30 days.
11. Your Right to Complain to a Supervisory Authority
If you are unhappy with how we have handled your data, you have the right to lodge a complaint with your national data protection authority. We encourage you to contact us first at privacy@patienthub.be so we have the opportunity to resolve the issue directly.
| Country | Authority | Website |
|---|---|---|
| Belgium | Autorité de protection des données (APD/GBA) | apd-gba.be |
| France | CNIL | cnil.fr |
| Netherlands | Autoriteit Persoonsgegevens | autoriteitpersoonsgegevens.nl |
| Germany | BfDI | bfdi.bund.de |
12. Changes to This Privacy Notice
When we update this notice, we will update the version number and effective date, email you a notification, and show a notice when you next log in. For significant changes — such as a new purpose for processing your health data — we will seek your fresh consent before the change takes effect.