Cookie Policy

Patient App B.V. (Caro Health) Cookie Policy

Last updated: 20-08-2026

1. Introduction

This is the Cookie Policy (the "Policy") of Patient App B.V., also registered as Caro Health, with registered office at H.J.E. Wenckebachweg 123 in Amsterdam, registered with the Chamber of Commerce under number 71943765 ("we", "us" or "Caro Health"), accessible via https://www.caro.health. To ensure this site functions properly, we and third parties engaged by us sometimes place small data files, called cookies, on your device. These cookies improve your browsing experience and serve other purposes as described below. Caro Health is the data controller (Article 4, sub 7, GDPR) for the processing of personal data via cookies on this website.

2. What are cookies?

Cookies are small text files that are stored on your device. They remember, for example, login details, preferences or language settings. There are two types of cookies:

• Session cookies: expire as soon as you close your browser.

• Persistent cookies: remain active until they expire or are deleted.

In addition to cookies, we also use similar techniques, such as tracking pixels and local (HTML/browser) storage. Where "cookies" are mentioned in this Policy, this also refers to these types of similar techniques.

3. How we use cookies

We use cookies to:

• Allow essential functions to work (Necessary cookies; in the cookie banner: “Necessary”)

• Remember your preferences (Preference cookies; in the cookie banner: “Preferences”)

• Analyse visitor behaviour (Statistics cookies; in the cookie banner: “Statistics”)

Cookies are managed by us and, in some cases, by trusted third parties. The category names above correspond to the categories you see in the cookie banner on our website. The banner currently displays these in English (Necessary, Preferences, Statistics); when the banner language in Cookiebot is set to Dutch, we show the Dutch names here (Noodzakelijk, Voorkeuren, Statistieken).

4. Legal basis for the use of cookies

The following legal bases apply to the placement of cookies and similar techniques:

• Necessary cookies: exempt from the consent requirement under Article 11.7a paragraph 3 of the Telecommunications Act, as they are strictly necessary for the functioning of the website or for a service explicitly requested by you (such as remembering your cookie preferences).

• Preference and statistics cookies: we request your prior consent for these based on Article 6 paragraph 1 sub a GDPR, in combination with Article 11.7a paragraph 1 of the Telecommunications Act. Our principle is that we do not place these cookies before you have given consent via the cookie banner, and that you can withdraw your consent at any time (see chapter 5). For Google Analytics cookies, this is not yet fully configured in this way (see chapter 6); this is being resolved.

5. Your choice and cookie management

You can manage or delete cookies through your browser settings. In addition, we use a cookie banner (powered by Cookiebot/Usercentrics) that allows you to make a choice upon your first visit via the buttons “Allow all”, “Allow selection” or “Deny”. Please bear in mind the following:

• Necessary cookies cannot be disabled.

• You can give consent or change settings via the cookie banner during your first visit.

• You can withdraw or change your consent at any time via the black round button at the bottom left of the website. Our starting point is that after consent is withdrawn, previously placed cookies and similar identifiers (including local storage) of the relevant category are also deleted.

6. Types of cookies we use

The overview below shows the cookies and similar techniques actually placed or executed on caro.health. The “Retention period” column indicates the lifespan of the cookie itself on your device; this is not necessarily identical to the period for which the underlying data is kept by the provider — for this, please see the privacy policy of the respective provider (chapter 7). This overview is updated periodically; the most recent version can always be found on this page.

Necessary cookies (1)

Preference cookies (4 cookies, combined into 2 lines)

Statistics cookies (5 cookies, partly combined into 2 lines)

Even if you decline, Google can still receive a limited, cookie-less signal (without a cookie or client ID) via “Consent Mode” for the purpose of aggregated measurements. This is a technical signal and not an independent basis for consent; our principle remains that the _ga cookies themselves are not placed without consent.

Marketing cookies (0)

At this moment, we do not place any marketing cookies on our website. If we start using marketing cookies again in the future, this paragraph will be updated.

Similar techniques without cookie (1)

7. Third-party cookies

We use cookies and similar techniques from the following third parties, amongst others, for chat and analysis. Google Analytics also processes the data collected through its cookies for its own purposes; to that extent, Google is not a processor of ours, but an independent data controller for its own processing operations.

• Google Analytics (statistics) – Google cookie policy

• Cookiebot / Usercentrics (cookie banner and consent registration) – Cookiebot privacy policy

• Intercom (chat feature) – Intercom cookie policy (visible and active as soon as you accept cookies for the Preferences/Statistics category; upon refusal or before a choice is made, the chat feature does not load)

• Framer, Inc. (website hosting and website analysis via events.framer.com) – Framer privacy policy (see framer.com)

8. Transfer of personal data outside the EEA

Some of the providers mentioned above are (partly) located outside the European Economic Area (EEA). When personal data is transferred to the United States via cookies, we ensure that this is done on the basis of a valid transfer mechanism under the GDPR, such as the recipient's participation in the EU-US Data Privacy Framework (DPF) or the use of Standard Contractual Clauses, supplemented if necessary by additional technical and organisational measures.

We verify the certifications below periodically (at least annually) against the official DPF list (dataprivacyframework.gov). Last checked on: 20 August 2026, by: the Data Protection Officer. At that moment, the following applied:

• Google and Intercom: certified under the EU-US Data Privacy Framework.

• Framer: established in the United States. Certified under the EU-US Data Privacy Framework.

9. Changes to this policy

We may change this policy in the event of legal or technical changes. You can find the latest version on this page, with the date of the last update at the top.

10. Acceptance of this policy

Necessary cookies are always placed, as the website cannot function without them. For all other (non-necessary) cookies, we request your active prior consent via the cookie banner. By clicking “Allow all” or “Allow selection”, you consent to the placement of the cookie categories you have selected, as described in this Policy. If you click “Deny” or close the cookie banner without making a choice, our principle is that we do not place non-necessary cookies. You can also use the website if you refuse non-necessary cookies; however, this may affect certain features, such as the chat function.

11. Your rights

For more information on how we handle your personal data, including your rights as a data subject (such as the right to access, rectification, erasure and objection), please refer to our privacy statement. This contains comprehensive information about the way we process personal data, the legal bases we rely on and how you can contact us for privacy-related questions.

You can view the privacy statement here: https://www.caro.health/en/veiligheid/privacy-statement

Specifically in relation to cookies, you have at least the following rights:

• You can withdraw your consent for non-necessary cookies at any time, in the same simple way you gave it. Withdrawing your consent does not affect the lawfulness of the processing prior to withdrawal.

• You have the right to lodge a complaint with the Dutch supervisory authority, the Dutch Data Protection Authority (autoriteitpersoonsgegevens.nl), if you believe that the processing of your personal data via cookies violates the GDPR.

• In addition, you have the rights described in our privacy statement, including the right of access, rectification, erasure, restriction, portability and objection.

12. Contact

For questions, please contact our Data Protection Officer at privacy@caro.health.