Privacy Statement
Patient App B.V. (Caro Health) · Version 3.0, September 2026 · replaces version 2.0 (June 2026)
Caro Health makes digital healthcare easier for patients and healthcare providers. Do you use our website caro.health, contact us or apply for a job with us? Then we process some of your personal data. Below we explain in plain language which data that is, why we use it, how long we keep it and what rights you have.
This statement covers our website, our business contacts, contact and demo requests, and job applications. Do you use the Caro app as a patient, or the healthcare provider portal as a healthcare provider? Separate privacy statements apply to those.
Who are we?
We are Patient App B.V., better known as Caro Health. We determine which of your data is processed and why. Under the General Data Protection Regulation (GDPR) we are the “data controller”. You can reach us via:
Patient App B.V. · H.J.E. Wenckebachweg 123, 1096 AM Amsterdam · KvK (Chamber of Commerce) 71943765 · info@caro.health · +31 (0)20 244 0361
Caro Health is part of the HOPCo group, based in the United States. This does not affect the storage of or access to your data. We do not share it with our parent companies in the United Kingdom or the United States, and they do not have access to it.
Our Data Protection Officer (DPO) monitors on our behalf that we comply with privacy law. The DPO has a statutory duty of confidentiality (Article 38(5) GDPR). Whatever you share with the DPO — for example in a complaint or a question about your data — remains confidential. Do you have a question about your data or do you want to exercise a right? Send an email to privacy@caro.health.
Who does this statement apply to?
For:
website visitors of caro.health;
business contacts at (potential) clients and partners;
people who contact us or request a demo;
job applicants.
Patients who use the Caro app and healthcare providers who use the portal can find information about the processing of their personal data in separate privacy statements.
What data do we use, and why?
Below you will find, for each processing activity, which data we use and on what legal basis.
What for | Answering your question or arranging a demo (Cal) |
Which data | Name*, email*, company*, your message |
Ground | Performance of a contract (to carry out your request or prepare a quotation with a view to entering into a contract); or our legitimate interest in responding to a question or request |
What for | Maintaining contact with (potential) clients (Pipedrive) |
Which data | Name*, email*, phone number, company, job title, conversation history* |
Ground | Performance of the contract with your organisation; or our legitimate interest in customer management |
What for | Sending you our newsletter or product updates (Intercom) |
Which data | Name*, email* |
Ground | Your consent; for existing clients our legitimate interest in informing them about relevant updates (you can unsubscribe at any time) |
What for | Making our website work, securing and improving it (Framer) |
Which data | IP address*, anonymised usage statistics* |
Ground | Our legitimate interest in a secure, well-functioning website |
What for | Analysing and improving website visits (Google Analytics 4) |
Which data | Cookie and device IDs*, usage data (page views, clicks), anonymised location data |
Ground | Your consent via the cookie banner for cookies and tracking; limited legitimate interest in performance and website analysis |
What for | Helping you via the chat (Intercom) |
Which data | Name, email, chat content*, technical data |
Ground | Our legitimate interest in good support |
What for | Processing your job application (Homerun) |
Which data | Name*, email*, CV*, cover letter, interview notes |
Ground | Your consent to process your application data; our legitimate interest in managing the recruitment procedure |
What for | Invoicing (WeFact) |
Which data | Name*, company name*, address*, Chamber of Commerce number*, VAT number*, type of subscription* and amount* |
Ground | Legal obligation (including tax legislation) |
What for | Signing contracts (PandaDoc) |
Which data | Name*, email* |
Ground | Performance of the contract (signing contracts); or our legitimate interest in managing contractual documents |
*This is mandatory information: without this data we cannot process your request, application or job application.
Do we rely on a “legitimate interest”? Then we always weigh that interest against the privacy of the person concerned, and we only use data that is necessary. We do not process special category data (such as health data) through this website.
Who processes your data — us or someone else?
We are responsible for all processing described in this privacy statement. We do engage suppliers who process data on our behalf (for example for our CRM, hosting and statistics). We have a data processing agreement with each of them.
The patient platform is different. If we deliver the patient platform to a healthcare institution, that institution is the data controller and we are their processor. More information about the processing of patient data can therefore be found in the privacy statement of the healthcare provider concerned.
Who do we share your data with?
Only where necessary, with:
our suppliers: Pipedrive (CRM), Intercom (chat/email), Google (Google Workspace — email, documents, calendar; Google Analytics — website statistics), Framer (website hosting), Homerun (recruitment), Cal (demo requests), WeFact (billing), PandaDoc (signing contracts), Leadfeeder (marketing and lead generation) and Cookiebot (cookie consent banner);
advisers, independent auditors and authorities, if required or legally permitted.
We do not sell your data and we do not use it for advertisements.
Does your data stay in Europe?
Your data is processed as much as possible within the European Economic Area (EEA). Homerun (recruitment) stores your data within the EU.
A number of suppliers are based in the United States: Google (Workspace, Analytics), Intercom (chat), Framer (hosting), PandaDoc (signing) and Pipedrive (CRM). For any transfer to the US we use the EU-US Data Privacy Framework if the supplier is certified for it, or the standard contractual clauses (SCCs) of the European Commission with additional safeguards where needed. We take into account possible access by US government authorities, for example under the CLOUD Act. Want to know more? Send an email to privacy@caro.health.
How does Caro protect your data?
We take various technical and organisational measures to properly secure your personal data. Caro is ISO 27001 and NEN 7510 certified — recognised standards for information security in healthcare. Our platform runs entirely in the cloud at Amazon Web Services (AWS); we do not manage physical servers ourselves. Access to our systems is limited to employees who need it for their work and always requires two-factor authentication.
More information about the protection of your data can be found here.
How long do we keep your data?
No longer than necessary. Specifically:
(Business) contact and CRM data: as long as we are in contact, and up to 180 days after a question or lead is closed. After that, we delete or anonymise the data.
Contracts and invoices: 7 years. This is required by tax law (Art. 52 AWR).
Application data: with your consent, we keep your data for up to 12 months after the application (for example for a later vacancy). Without consent, we keep your data for up to 1 month. After that, we ask for consent again or we delete your data.
Website statistics (Google Analytics 4): we keep event data for 2 months from the moment of the event. Data linked to a cookie or user ID is kept for 14 months from your last activity on the website; a new visit restarts this period. Aggregated, non-identifiable statistics remain available afterwards.
Newsletter: until you unsubscribe. After that, we only remember that you no longer want emails.
Do we use cookies?
We use cookies to make our website work properly and securely, to remember your preferences, to measure website use and for marketing purposes. Our cookie banner (Cookiebot/Usercentrics) divides cookies into four categories:
Necessary cookies — required for the website to work properly and securely, for example the cookie in which we store your cookie preferences. No consent is required for these (Art. 11.7a(3) Telecommunications Act).
Preference cookies — remember your choices and support the chat function, for example the cookies Intercom places once you open a chat with us.
Statistics cookies — measure how our website is used. For this we use Google Analytics 4, which collects for example device IDs and approximate location data (country, region, city).
Marketing cookies — placed by Leadfeeder (Dealfront) to recognise which organisations visit our website and which pages they view.
For preference, statistics and marketing cookies we ask for your prior consent via our cookie banner.
Viewing, withdrawing or changing cookie consent
You can view, withdraw or change your consent at any time via the black round button at the bottom left of the website. More information can be found in our cookie statement.
Do we make automated decisions about you?
No. We do not make decisions about you that are made solely by a computer and affect you significantly. Your job application is always assessed by people, not by an algorithm.
What rights do you have?
You have various rights with regard to your personal data. You can always ask us to:
see what data we have of yours (access);
correct errors or delete data;
restrict processing or object to it;
receive your data in a usable file (portability);
withdraw your consent.
Send an email to privacy@caro.health and we will respond within one month. If your question is complex, we may take an extra two months; we will let you know within the first month.
Not satisfied with how we handle your data?
Please let us know first via privacy@caro.health: we will gladly resolve it. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) (autoriteitpersoonsgegevens.nl).
Data of children
Caro.health is not intended for children aged 16 or under. If we do receive data from a child, we will delete it as soon as we know.
Changes
We may adjust this privacy statement. We will announce important changes in good time. The latest version is always on caro.health.
Want to know more about how Caro can work for you?
Effective care requires innovative solutions. Discover what we can achieve together.
