Caro App Privacy Statement

For patients · Patient App B.V. (Caro Health) · Version 3.0, October 2026 (replaces version 2.0, August 2026)

Caro is an app that supports you during your treatment or recovery. You use Caro because your hospital or clinic offers it to you. Below we explain in plain language what happens with your data and how we protect it.

Important: your healthcare provider decides which data is used in Caro and why. They are the “controller”. Caro only processes your data on your provider’s instructions. For the full picture, please also read your own healthcare provider’s privacy notice.

Who is responsible for your data?

Your healthcare provider (the hospital or clinic treating you) decides which data is used in Caro and why. Through your arrangements with your provider, they engage Caro to process your data. So Caro (Patient App B.V.) processes your data on your provider’s instructions, under a data processing agreement. A few things Caro decides itself; you can read about those further on.

You can reach us at: Patient App B.V. · H.J.E. Wenckebachweg 123, 1096 AM Amsterdam, The Netherlands · info@caro.health · +31 (0)20 244 0361.

Our Data Protection Officer (DPO) monitors on our behalf that we comply with privacy law. The DPO has a statutory duty of confidentiality (Article 38(5) GDPR). Whatever you share with the DPO — for example in a complaint or a question about your data — remains confidential. Do you have a question about your data? Please email privacy@caro.health.

What data does Caro process?

• Who you are: name, date of birth (optional), contact details.

• Your treatment: type and location of treatment, appointments, symptoms, pain scores, questionnaires and recovery progress.

• Messages between you and your care team.

• How you use the app: which parts you view and complete.

• Technical data needed to run the app and send you notifications.

Some of this is health data. It is extra sensitive, so we handle it with extra care.

What does Caro use your data for, and on what legal basis?

For your care, Caro processes your data on your provider’s instructions. Your provider has a legal basis for this, which is usually the provision of care (Art. 9(2)(h) GDPR).

Caro is a processor for the following activities:

• keeping the app secure and preventing fraud and misuse (legitimate interest);

• anonymising technical data for analytical purposes (legitimate interest).

Does Caro use artificial intelligence (AI)?

Yes. Caro uses AI to give you practical information about your treatment and to support your care team, for example in preparing information or texts.

For this we work with Orq, a supplier that provides the AI services for us. Your data is not used to train AI models.

A human is always involved in everything AI prepares. Caro makes no automated decisions about your treatment or care: those decisions are always made by your healthcare professionals.

Who might Caro share your data with?

With your care team, through your healthcare provider, and with suppliers Caro engages to run the app. We have concluded a data processing agreement with each of them. We engage suppliers for the following purposes:

• storage and hosting: AWS and MongoDB Atlas;

• push notifications on your phone: Google Firebase;

• text messages: Spryng;

• AI features: Orq (with sub-processors Azure and Bedrock).

Caro never sells your data and does not use it for advertising. Your data is not used to train AI models.

Does your data stay in Europe?

Your health data is processed and stored within the European Economic Area (EEA). For this we use AWS and MongoDB Atlas, American companies with data centres in the EEA. For any transfer to the US we rely on the EU-US Data Privacy Framework (DPF). In doing so, we take into account possible access by US government authorities, for example under the CLOUD Act.

For push notifications we use Google Firebase; limited technical information may go to the United States, with appropriate safeguards (DPF and SCCs). For AI features that involve your data, we use European (Azure) models. Want to know more? Please email privacy@caro.health.

How does Caro protect your data?

We take various technical and organisational measures to keep your personal data properly secure. Caro is ISO 27001 and NEN 7510 certified; these are recognised standards for information security in healthcare. Our platform runs entirely in the cloud at Amazon Web Services (AWS); we do not manage any physical servers ourselves. In addition, access to our systems is limited to employees who need it for their work, and always requires two-factor authentication. We run automated vulnerability scans every week and keep a log of activity involving sensitive data, so that we can always trace who did what.

How long is your data kept?

Your healthcare provider decides how long your health data is kept. They follow the statutory retention periods for medical records. Caro keeps your data for as long as needed to provide the app and for as long as your provider asks us to keep it. At your provider’s request we delete or anonymise your data.

Cookies and statistics in the app

We use cookies to make our app work properly and securely and to measure how our app is used. Some of these cookies are strictly necessary, for example for security purposes. No consent is required for those (Article 11.7a(3) of the Dutch Telecommunications Act).

To measure how our app is used, we use Google Analytics 4. This tool places cookies and collects, for example, device IDs and anonymised location data. We do not place cookies for commercial purposes and do not track you across different websites.

Children’s data

Is the patient under 16, or under legal guardianship or mentorship? Then a parent or legal representative acts on the patient’s behalf. Your healthcare provider arranges the necessary consent.

What rights do you have?

You have various rights regarding your personal data. You may always ask your healthcare provider to:

• show you which data we hold about you (access);

• correct errors or delete data;

• restrict the processing or object to it;

• provide your data to you in a usable file (portability);

• withdraw your consent.

Because your healthcare provider is responsible for your personal data, you exercise these rights through your provider. If you send your request to Caro anyway, we will forward it to your provider. We cooperate with this and give your provider the information and support they need to handle your request.

A question or complaint?

For questions about your health data, contact your healthcare provider. For questions about the Caro app, email privacy@caro.health. You also always have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl).

Changes

We may update this privacy statement. The latest version is available in the app.