Skip to content
At your door in 3 daysFree shipping over €40
Google4,7
Account
Privacy statement

Your data, your control

1. Who are we (data controller)?

Gezondheidspas, trading as Healthcard24.com, is responsible for processing your personal data. We are based at Kerklaan 48, 2451 CG Leimuiden (the Netherlands), reachable at info@healthcard24.com and +31 6 33 04 02 13.

2. What data do we process?

  • Account and contact data: name, email address, phone number.
  • Order and delivery data: address, order history and payment status. Your payment details themselves are processed by our payment provider and not stored by us.
  • Medical emergency data (special category data): the details you enter yourself on your card and in your medical profile, such as conditions, allergies, medication, blood type, implants, GP/insurer and emergency contacts. You decide per item what you enter and what is publicly visible.
  • Technical data: IP address and browser data for the security check on forms (see section 4) and in server logs, kept briefly for security.

3. On what legal basis and why?

  • Performance of the contract (Art. 6(1)(b) GDPR): making, delivering and managing your card and profile, and payment handling.
  • Explicit consent (Art. 9(2)(a) GDPR): processing your medical emergency data. You give this consent by entering the data yourself and can withdraw it at any time (see section 7).
  • Legal obligation (Art. 6(1)(c) GDPR): including retaining invoices for the statutory tax period (7 years).
  • Legitimate interest (Art. 6(1)(f) GDPR): protection against abuse, fraud prevention and limited customer support.

4. Who do we share your data with (processors)?

Only with parties needed for our service, under data processing agreements and solely for the purposes above: - Mollie B.V. (Netherlands): payment handling. - PostNL (Netherlands): delivery; receives name and address. - Neon (database, stored in the EU, Frankfurt): all your data, medical data additionally encrypted. - Vercel Inc. (USA): hosting and delivery of the website; transfers based on the EU standard contractual clauses and the EU-US Data Privacy Framework. - SendLayer (USA): sending transactional emails (confirmations, sign-in codes); receives name, email address and the content of that email. - Cloudflare Inc. (Turnstile, USA/EU): checks that a form is filled in by a human at sign-in, contact and return requests; processes IP address and browser characteristics for that purpose. - Anthropic (USA): the language model behind our chat assistant. The assistant only processes what you type into the chat yourself; no medical profile data is sent to the AI and, if you are logged in, the assistant only knows your first name. Transfers based on the EU standard contractual clauses; Anthropic does not use the conversations to train models. We keep the text of chat conversations for at most 90 days (with email addresses, postal addresses and numbers automatically masked) for quality review; a contact address for follow-up for at most 14 days; after that only anonymised statistics, for at most 12 months. To display reviews we fetch public ratings from Google, without sharing customer data. We never sell your data to third parties and do not use it for automated decision-making or profiling.

5. How do we protect your data?

Secure, encrypted connections, storage of your data in a database within the EU and access limited to authorised persons. Your medical emergency data is additionally stored encrypted. Your medical emergency profile is not indexed by search engines and, for an NFC card, only opens by holding the physical card against a phone; a shared or saved link does not work.

6. How long do we keep your data?

No longer than needed: order and account data for the duration of the customer relationship, invoices for 7 years (tax retention obligation), and your medical profile data until you have the profile or account deleted. After that we delete it securely.

7. Your rights

You have the right to access, rectification, erasure, restriction, objection, data portability and to withdraw your consent. You can update and disable your medical profile online yourself. For access, a copy/export or permanent deletion of your data, send a request to info@healthcard24.com; we handle it within the statutory period (no later than one month). You can also lodge a complaint with the Dutch Data Protection Authority (autoriteitpersoonsgegevens.nl) or with the supervisory authority of the country where you live.

8. Cookies and statistics

We only use functional cookies needed to run the site, such as your login session and cart. For visit statistics we use a cookieless, privacy-friendly method (Vercel Analytics) without tracking or profiling.

9. Contact

Questions about your privacy or want to submit a request? - Healthcard24.com, trading name of Gezondheidspas - Kerklaan 48, 2451 CG Leimuiden - info@healthcard24.com - +31 6 33 04 02 13