Version 21 August 2026
1. Who we are
LiveLong B.V. (Chamber of Commerce number 95606572, VAT number NL867201794B01), located at Prinses Marijkestraat 21, 1077XB Amsterdam, provides intermediary services in the field of blood testing, health consultations and personalised health advice. LiveLong acts as data controller for personal data to the extent that LiveLong itself determines the purpose and means of the processing. For medical records maintained under the responsibility of independent healthcare providers, the relevant healthcare provider acts as data controller, and LiveLong processes data on behalf of that healthcare provider to the extent that LiveLong acts as processor in that context.
2. What data we process
We may collect and process the following categories of personal data:
- Identification data (name, date of birth, contact details)
- Payment and billing information
- Health data obtained through blood tests, consultations or questionnaires
- Platform usage data (login details, communication, technical logs)
3. Purposes and legal bases
We process your personal data for the following purposes:
- Providing our intermediary services (performance of a contract, Article 6(1)(b) GDPR)
- Facilitating blood tests and consultations with healthcare providers (performance of a contract)
- Complying with legal obligations (Article 6(1)(c) GDPR)
- With your explicit consent, processing health data and providing personalised health insights (Article 9(2)(a) GDPR)
4. Medical records and responsibilities
- Independent healthcare providers (BIG and AGB registered) remain the legal custodians of medical records and are subject to statutory retention periods, including the minimum retention period of 20 years under Dutch law.
- LiveLong may provide technical hosting and secure storage of these records on behalf of healthcare providers. This delegation does not affect the healthcare provider's legal responsibility for maintaining and protecting the medical record.
- In this context, LiveLong acts as processor for medical records, whereby health data is processed solely on the explicit instructions of the healthcare provider.
- For account data, billing and platform usage data, LiveLong acts as data controller. For health data, LiveLong's role depends on the specific processing concerned and on which party determines its purpose and means.
5. Sharing of data
We may share your personal data, to the extent necessary, with:
- Laboratories and independent healthcare providers, to the extent necessary to provide services
- IT, hosting, security and communication providers that support our platform
- Authentication providers
- Location, address and mapping services
- Payment service providers
- Government authorities where legally required
Appropriate data processing agreements are concluded with parties that process personal data on behalf of LiveLong. Other recipients may be independent data controllers for their own processing. This applies, among others, to the external payment service provider that processes payments; the privacy policy of that payment service provider applies to that processing. An overview of the categories of service providers and other recipients involved, including their role in the processing, is available on the Data Processing page.
6. International transfers
Your personal data is stored within the European Economic Area (EEA) wherever possible. To the extent data is processed outside the EEA, we ensure an appropriate level of protection, for example through EU Standard Contractual Clauses or certification under a framework recognised by the European Commission, such as the EU-U.S. Data Privacy Framework. More information about international transfers and the safeguards applied is available on the Data Processing page.
7. Data retention
We do not retain personal data for longer than necessary for the purpose for which it was collected, in accordance with Article 5(1)(e) GDPR. The specific retention periods per category are set out on the Data Processing page.
Medical records maintained under the responsibility of healthcare providers are subject to the statutory and professional retention obligations that apply to those healthcare providers. To the extent LiveLong processes these records as a processor, the obligations that the GDPR imposes on LiveLong as processor also apply.
8. Your rights
You have the right to:
- Request access to your data
- Request correction or deletion
- Restrict processing or object to it
- Withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal
- Receive a copy of your data in a portable format (data portability)
Requests can be sent to: support@livelong.nl
9. Security
We implement appropriate technical and organisational measures to protect your data against unauthorised access, loss or misuse. This includes logging access to electronic health records (EHRs) and strictly limiting access to clients and independent healthcare providers.
10. Complaints
If you believe your data is being processed unlawfully, you can contact us via support@livelong.nl or lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl).
11. Updates
We may amend this Privacy Statement from time to time. The most recent version is always available on our website.
Last updated: 21 August 2026