Privacy policy

Privacy Policy – Your Healthy Mind

(Version June 2026)

Who we are

Your Healthy Mind (hereinafter: “we”, “us”) is responsible for the processing of personal data when using our services, the Healthy Mind app and the website www.yourhealthymind.nl. In this privacy policy, we explain how we handle personal data and how we protect your privacy. In doing so, we act in accordance with the General Data Protection Regulation (GDPR) and other applicable legislation.

For questions about privacy, you can contact us via info@yourhealthymind.nl. Your Healthy Mind has not appointed a Data Protection Officer.

Applicability

This privacy policy applies to everyone who uses our app, website or services, including participants in programmes, sessions and events such as the YHM Weekend. Our services are not aimed at persons under the age of 16. If you are under the age of 16, consent from a parent or legal representative is required.

Which personal data we process

When using our services, we process personal data that are necessary for the functioning of the app, website and service provision. This includes, among other things, identification data such as name, email address, telephone number and address details, as well as data required for account management and access, such as login details and device identification. In addition, we process data generated when using our systems, such as IP addresses, log data and usage information, in order to safeguard the operation and security of our services.

Within our service provision, we also process substantive data that you provide yourself, for example when completing exercises, reflections, questionnaires or during sessions. These data may relate to personal circumstances, behaviour, mental health and progress within programmes. Insofar as these data are regarded as special categories of personal data, they are processed only with your explicit consent or insofar as this is necessary for the performance of the agreement.

When you use social login via Google, Apple or Microsoft, we receive your name, email address and a unique user identifier from these parties. We do not receive passwords and have no access to the authentication data managed by these parties.

To enable automatic login via biometrics, such as Face ID, Touch ID or fingerprint, the app may store your login details in encrypted form in the secure storage of your device. Biometric login is optional. Your Healthy Mind does not receive, process or store facial data, fingerprints or other biometric data. The biometric verification takes place via the operating system of your device. The locally stored login details do not leave your device and are not shared with us or with third parties.

Purposes of processing

We process personal data exclusively for legitimate and clearly defined purposes. This includes enabling access to our app and website, performing agreements, providing coaching, guidance and other forms of service provision, and monitoring progress within programmes. In addition, we use data for communication, administration, invoicing and the improvement of our services.

Furthermore, we process data to secure our systems, prevent misuse and comply with legal obligations, including fiscal retention obligations. Data are not used for purposes that are incompatible with the original processing.

Legal bases

The processing of personal data takes place on the basis of the following legal bases: performance of an agreement, your consent, a legal obligation or a legitimate interest. The legitimate interest relates in particular to improving our services, ensuring the security of our systems and preventing misuse.

For the processing of health data and other special categories of personal data, we request explicit consent, unless processing is necessary for the performance of the agreement.

Sharing of personal data and processors

We do not sell personal data to third parties. Data are shared only when this is necessary for the performance of our services or to comply with a legal obligation.

For the technical and operational execution of our services, we make use of external parties. Our website and web application are hosted via TransIP. A separate data processing agreement has been concluded with TransIP, in which arrangements have been laid down regarding the processing and security of personal data.

For our app and database, we use Google Firebase, and for email and communication we use Google Workspace. The standard data processing terms of Google apply to these services, including the Google Cloud Data Processing Terms, which automatically form part of the agreement with Google.

For payments, we use Mollie. In this context, Mollie acts as an independent controller, as it has its own legal obligations, such as financial and fiscal obligations, and independently determines how it processes personal data. Mollie’s privacy policy applies to this processing.

In addition, we use login and platform services from Apple, Google and Microsoft. These parties also act as independent controllers for the data they process within their own services, such as account data and authentication. Their own privacy terms apply to this processing.

International transfer

In some cases, personal data may be processed outside the European Economic Area, for example by parties such as Google, Apple or Microsoft. In such cases, we ensure appropriate safeguards, such as the use of standard contractual clauses approved by the European Commission or participation in relevant international arrangements.

Health applications

If you choose to connect our app to external health applications, such as Apple HealthKit or Google Health Connect, data will only be shared at your request. The further processing of these data falls under the privacy policy of the relevant party.

Cookies and similar technologies

When using our website and web application, functional and necessary cookies may be used to support the functioning of the website and improve the user experience. Insofar as additional cookies are used, this is done in accordance with applicable regulations and you can manage these through your browser settings.

Retention periods

We do not retain personal data for longer than is necessary for the purpose for which they were collected, unless a longer retention period is legally required. Account data and data stored in the app remain stored for as long as the account is active and can be deleted by the user. File data are in principle retained for up to three years after the end of a programme or session, unless our services are used again within this period, in which case the period starts again.

Data relating to administration, invoicing and payments are retained for the statutory period of seven years. Technical log data are retained for a limited period for security and analysis purposes. Back-ups are stored only temporarily and are automatically overwritten.

Security

We take appropriate technical and organisational measures to protect personal data against loss, misuse and unauthorised access. This includes, among other things, the use of encrypted connections, access restrictions, secure storage and system monitoring. For locally stored login details, the app uses the secure storage options of the operating system, such as Keychain on iOS and secure storage on Android. We continuously evaluate and improve our security measures.

Exclusion and blocking list

In exceptional cases, Your Healthy Mind may decide to exclude users from further participation in services, programmes or events. This may be the case, for example, in the event of misuse, fraud, repeated improper use or situations in which continuation of the service provision is deemed irresponsible.

In order to enforce such exclusion, we may retain a limited set of personal data, such as email address, user identification, such as Firebase UID, and necessary technical data. These data are used exclusively to prevent renewed participation and are accessible only to authorised persons within Your Healthy Mind.

The processing of these data takes place on the basis of a legitimate interest, namely the protection of our services and other users. Data are not retained for longer than necessary and are evaluated periodically.

Your rights

You have the right to access your personal data, to have them corrected or to have them deleted. In addition, you may request restriction of processing, object to processing or exercise the right to data portability. You may also withdraw previously given consent.

Requests may be submitted via info@yourhealthymind.nl. In principle, we will respond within 30 days.

Complaints

If you are not satisfied with the way in which we handle your data, you may submit a complaint to the Dutch Data Protection Authority.

Automated decision-making

Your Healthy Mind does not use automated decision-making that has significant consequences for individuals.

Third-party websites

This privacy policy does not apply to third-party websites or applications to which reference is made. We recommend consulting the privacy policies of these parties.

Changes

We reserve the right to amend this privacy policy. The most current version is always available via our website.

Contact

For questions about this privacy policy, you can contact us via:

info@yourhealthymind.nl