Version 21 August 2026
1. Who we are
LiveLong B.V. (Chamber of Commerce number 95606572, VAT number NL867201794B01), located at Prinses Marijkestraat 21, 1077XB Amsterdam, provides intermediary services in the field of blood testing, health consultations and personalised health advice. LiveLong acts as data controller for personal data to the extent that LiveLong itself determines the purpose and means of the processing. For medical records maintained under the responsibility of independent healthcare providers, the relevant healthcare provider acts as data controller, and LiveLong processes data on behalf of that healthcare provider to the extent that LiveLong acts as processor in that context.
2. What data we process
We may collect and process the following categories of personal data:
- Identification data (name, date of birth, contact details)
- Payment and billing information
- Health data obtained through blood tests, consultations or questionnaires
- Platform usage data (login details, communication, technical logs)
- Website visit data: the page a visit arrives on, the source category, and the campaign and advertising parameters in the URL, including the click identifier Google attaches to an ad click (gclid, gbraid or wbraid). We do not record an IP address, device data or a visitor identifier for this purpose.
- If you create an account: the source category of the visit through which you first found us (for example "Google Ads", "search engine" or "direct") and the campaign names from the URL, recorded with your account. This is one category and a campaign name; we never record the click identifier of an advertisement with it.
3. Purposes and legal bases
We process your personal data for the following purposes:
- Providing our intermediary services (performance of a contract, Article 6(1)(b) GDPR)
- Facilitating blood tests and consultations with healthcare providers (performance of a contract)
- Complying with legal obligations (Article 6(1)(c) GDPR)
- With your explicit consent, processing health data and providing personalised health insights (Article 9(2)(a) GDPR)
- Measuring visits to our website and assessing the effectiveness of our advertising, including providing conversion data to Google (legitimate interest, Article 6(1)(f) GDPR). Our legitimate interest is understanding which channels and campaigns bring visitors, so that we can direct our services and our advertising spend. We retain this data for 90 days. This processing takes place regardless of whether you accepted the cookie notice, because it does not rely on consent. You may object to this processing at any time (Article 21 GDPR); see "Your rights" below.
- Recording with your account the channel that first brought you to us, at the moment you register (legitimate interest, Article 6(1)(f) GDPR). Our interest is being able to see which channels and campaigns actually produce customers, and not only visitors. This recording does not rely on your consent and therefore also takes place if you refuse the cookie notice: in that case the channel is not stored on your device, but derived during the same visit and sent with your registration. We keep this value for as long as your account exists. You may object to this processing at any time (Article 21 GDPR); see "Your rights" below.
4. Medical records and responsibilities
- Independent healthcare providers (BIG and AGB registered) remain the legal custodians of medical records and are subject to statutory retention periods, including the minimum retention period of 20 years under Dutch law.
- LiveLong may provide technical hosting and secure storage of these records on behalf of healthcare providers. This delegation does not affect the healthcare provider's legal responsibility for maintaining and protecting the medical record.
- In this context, LiveLong acts as processor for medical records, whereby health data is processed solely on the explicit instructions of the healthcare provider.
- For account data, billing and platform usage data, LiveLong acts as data controller. For health data, LiveLong's role depends on the specific processing concerned and on which party determines its purpose and means.
5. Sharing of data
We may share your personal data, to the extent necessary, with:
- Laboratories and independent healthcare providers, to the extent necessary to provide services
- IT, hosting, security and communication providers that support our platform
- Authentication providers
- Location, address and mapping services
- Payment service providers
- Google, for measuring the effectiveness of our advertising
- Government authorities where legally required
For advertising measurement we may provide Google with the click identifier it attaches to an ad click (gclid, gbraid or wbraid), together with the fact that a purchase took place. This disclosure rests on our legitimate interest (Article 6(1)(f) GDPR) and not on your consent, and therefore also takes place where you have not accepted the cookie notice. You may object to it. Google is an independent controller for its own processing of this data.
Appropriate data processing agreements are concluded with parties that process personal data on behalf of LiveLong. Other recipients may be independent data controllers for their own processing. This applies, among others, to the external payment service provider that processes payments; the privacy policy of that payment service provider applies to that processing. An overview of the categories of service providers and other recipients involved, including their role in the processing, is available on the Data Processing page.
6. International transfers
Your personal data is stored within the European Economic Area (EEA) wherever possible. To the extent data is processed outside the EEA, we ensure an appropriate level of protection, for example through EU Standard Contractual Clauses or certification under a framework recognised by the European Commission, such as the EU-U.S. Data Privacy Framework. More information about international transfers and the safeguards applied is available on the Data Processing page.
7. Data retention
We do not retain personal data for longer than necessary for the purpose for which it was collected, in accordance with Article 5(1)(e) GDPR. The specific retention periods per category are set out on the Data Processing page.
Medical records maintained under the responsibility of healthcare providers are subject to the statutory and professional retention obligations that apply to those healthcare providers. To the extent LiveLong processes these records as a processor, the obligations that the GDPR imposes on LiveLong as processor also apply.
8. Your rights
You have the right to:
- Request access to your data
- Request correction or deletion
- Restrict processing or object to it
- Withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal
- Receive a copy of your data in a portable format (data portability)
Requests can be sent to: support@livelong.nl
9. Security
We implement appropriate technical and organisational measures to protect your data against unauthorised access, loss or misuse. This includes logging access to electronic health records (EHRs) and strictly limiting access to clients and independent healthcare providers.
10. Complaints
If you believe your data is being processed unlawfully, you can contact us via support@livelong.nl or lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl).
11. Updates
We may amend this Privacy Statement from time to time. The most recent version is always available on our website.
Last updated: 21 August 2026