PRIVACY STATEMENT

Last update: July 13th, 2026

This privacy statement of Liberdat B.V. (operating under the name Liberdat) (“we”, “us” or “our”) describes how and why we, as the data controller, collect, store, use, and share (“process”) your personal data when you use our services (“Services”) via:

Website • https://liberdat.io

Mobile application – Liberdat • Apple App Store: https://apps.apple.com/in/app/liberdat/id6463052903 • Google Play Store: https://play.google.com/store/apps/details?id=com.liberdat.liberdatbeta&hl=en_IN&pli=1

Liberdat is a privacy-focused data platform, built in accordance with the General Data Protection Regulation (GDPR) and secured in accordance with international standards, that enables users to securely collect personal data and share it with their healthcare provider for research purposes. In addition, users can share their data, in a form that cannot be directly traced back to them, with verified researchers for other research purposes. Users retain control over what they share and can exercise their rights at any time.

Do you have questions? Reading this privacy statement helps you understand your privacy rights and choices. We are responsible for making decisions about how your personal data is processed. For questions, please contact us at info@liberdat.io.

WHAT DATA DO WE COLLECT?
WHY DO WE PROCESS YOUR DATA?
ON WHAT LEGAL BASIS DO WE RELY TO PROCESS YOUR PERSONAL DATA?
WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL DATA?
DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?
DO WE OFFER ARTIFICIAL INTELLIGENCE-BASED PRODUCTS?
IS YOUR DATA TRANSFERRED INTERNATIONALLY?
HOW LONG DO WE RETAIN YOUR DATA?
HOW DO WE KEEP YOUR DATA SAFE?
DO WE COLLECT DATA FROM MINORS?
WHAT ARE YOUR PRIVACY RIGHTS?
CONTROLS FOR DO-NOT-TRACK FEATURES
DO WE PROVIDE UPDATES TO THIS STATEMENT?
HOW CAN YOU CONTACT US ABOUT THIS STATEMENT?

1. WHAT DATA DO WE COLLECT?

Personal data provided by you The personal data we collect includes, among others, the data you share with us such as: • Names • Email addresses • Passwords • Contact or authentication data • Health data from mobile apps • Health data provided by you

Data collected via smartphone When you use the platform via a smartphone, we may collect certain data. We do this carefully and with the aim of protecting your privacy and the security of your data. Some data, such as IP addresses, help us, for example, to detect and prevent unauthorized access, so that your account and personal information remain well protected.

• Log and usage data: These data show how you use the Liberdat app. This includes, for example, the measurement data you view and the functions within the app that you use. Based on this information, we can improve the functioning of the app and provide you with better tailored, personal health insights. • Device data: We automatically collect certain device data, such as the type and model of your device, the manufacturer, the operating system and its version, and general system settings. In addition, we may record information such as device and application identification numbers, browser type and version, hardware model, internet or mobile provider and the IP address (or a proxy server). When you use our application, we may also collect data about the mobile network your device is connected to, the operating system or platform used, the type of device and a unique device ID. Furthermore, we may keep track of which functions within the application you use. We use these data to improve the functioning, security and user-friendliness of the application. • Fitness apps: With your consent, we may request access to certain data, including health and fitness information. This may include, for example, step counter data and other health measurements shared via Apple HealthKit or Health Connect. These data help us to provide you with insight into your activities, track your progress and improve your experience within the app. You always retain control: if you wish to adjust or withdraw your consent, you can easily do so via your device settings.

Google Application Programming Interface Our use of data that we receive from Google Application Programming Interfaces (APIs) will comply with the Google API Services User Data Policy, including the Limited Use requirements.

Data collected via web portal If you access our services via the website, we may collect the following data so that the software functions properly and securely:

• Log and usage data: When you use our Services, our servers automatically collect certain log and usage data. These are technical and usage-related data that are stored in log files. Depending on your usage, this may include your IP address, device data, and browser type and settings. We may collect information about your activities within the Services, such as when you use the app, which pages or files you view, which searches you perform and which functions you use. In addition, technical data may be recorded, such as system activity, error reports (also referred to as “crash dumps”) and hardware settings. We use these data to ensure our Services function properly, to resolve malfunctions and to improve the user experience. • Device data: We collect data about the device you use to access our Services, such as a computer, phone or tablet. Depending on the type of device, this may include your IP address (or proxy server), device and application identification numbers, (approximate) location data, browser type, hardware model, internet or mobile provider, operating system and system settings. These data help us to ensure that the Services function properly and to improve them where possible.

2. WHY DO WE PROCESS YOUR DATA?

After your consent, we process your personal data for the following purposes: • Research: For research purposes, your data is shared with the healthcare provider you select during the registration process, with the aim of improving the predictive models in the application. • Data sharing: To improve the predictive models in the application, your data may be shared in a non-directly identifiable form within the research collaboration with verified healthcare providers and researchers.

To support the above purposes, your personal data are further processed for the following purposes: • To facilitate account creation and authentication and otherwise manage user accounts. • To respond to user inquiries/provide support to users. We may process your data to respond to your questions and solve any issues you may have with the requested service. • To send you administrative information. We may process your data to send you details about our products and services, changes to our terms and policies, and other similar information. • To enable user-to-user communications. We may process your data if you choose to use any of our offerings that allow communication with another user. • To request feedback. We may process your data when necessary to request feedback and to contact you about your use of our Services. • To protect our Services. We may process your data as part of our efforts to keep our Services safe and secure, including fraud monitoring and prevention. • To identify usage trends. We may process information about how you use our Services to better understand how they are used so that we can improve them. • To protect or save an individual’s vital interest. We may process your data when necessary to protect an individual’s vital interests, for example to prevent harm.

3. ON WHAT LEGAL BASIS DO WE RELY TO PROCESS YOUR PERSONAL DATA?

The General Data Protection Regulation (GDPR) requires us to explain the valid legal basis on which we rely to process your personal data. We may rely on the following legal bases to process your personal data: • Consent: We may process your data if you have given us permission to use your personal data for a specific purpose. You can withdraw your consent at any time. • Legal obligations: We may process your data where we believe it is necessary to comply with our legal obligations, such as to cooperate with a law enforcement body or regulatory agency, to exercise or defend our legal rights, or to disclose your data as evidence in litigation in which we are involved.

4. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL DATA?

We may only share your personal data with your explicit consent in specific situations described below: • Research: For research purposes, your data is shared with the healthcare provider you select during the registration process, with the aim of improving the predictive models in the application. • Data sharing: To improve the predictive models in the application, your data may be shared in a non-directly identifiable form within the research collaboration with verified healthcare providers and researchers.

Furthermore, your data may be shared with the following processors in order to provide you with the Services of Liberdat: a) Amazon Web Services - https://aws.amazon.com/service-terms/ b) PostHog - https://posthog.com/terms c) Apple Store - https://www.apple.com/legal/internet-services/itunes/ d) Google Play Store - https://play.google.com/about/play-terms/index.html e) Firebase - https://firebase.google.com/terms f) Apple Push Notifications - https://www.apple.com/legal/internet-services/itunes/ g) Resend - https://resend.com/legal/terms-of-service

5. DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?

We may use cookies and similar technologies (such as web beacons and pixels) to collect data when you interact with our Services. Some of these technologies help us maintain the security of our Services and your account, prevent crashes, fix bugs, save your preferences and support basic site functionalities. We also allow third parties and service providers to use technologies on our Services for analytics and advertising.

6. DO WE OFFER ARTIFICIAL INTELLIGENCE-BASED PRODUCTS?

No, since we currently operate in a scientific context, we do not currently offer artificial intelligence-based products. The tools we develop do use Machine Learning (ML) technologies to make health predictions.

7. IS YOUR DATA TRANSFERRED INTERNATIONALLY?

Regardless of where you are located, your data may be processed by us or by contracted processors in facilities in the European Union, the United Kingdom, the United States, Canada and other countries.

When personal data of Liberdat users are transferred to external processors in the United States, this is done on the basis of the adequacy decision of the European Commission for the EU-US Data Privacy Framework, as laid down in Commission Implementing Decision (EU) 2023/1795 of 10 July 2023. This decision recognizes that participating U.S. organizations provide an adequate level of protection for personal data transferred from the European Union. Liberdat ensures that its U.S. processors, where required, are certified under the EU-US Data Privacy Framework.

If you are a resident of the European Economic Area (EEA), the United Kingdom (UK) or Switzerland, these countries may not have the same data protection laws or other similar laws that are as comprehensive as those in your country. We will, however, take all necessary measures to protect your personal data in accordance with this Privacy Statement and applicable law.

Transfers of personal data outside the EEA will only take place on the basis of Standard Contractual Clauses approved by the European Commission or other legally permitted mechanisms. These clauses can be found here: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en

8. HOW LONG DO WE RETAIN YOUR PERSONAL DATA?

We retain your personal data until you decide to delete your account. A longer retention period may be justified in the event of legal requirements.

When we have no ongoing legitimate business need to process your personal data, we will either delete or anonymize such data, or, if this is not possible (for example because your personal data is stored in backup archives), then we will securely store your personal data and isolate it from any further processing until deletion is possible.

9. HOW DO WE KEEP YOUR DATA SAFE?

We have implemented appropriate technical and organizational security measures to protect the security of all personal data we process, such as the encryption of data. Although we do our best to protect your personal data, the transmission of personal data to and from our Services is at your own risk. You should only access the Services within a secure environment.

When we share data that is not directly traceable, this means that direct identification of you as a person is not possible. For example, we do not share dates of birth, names or email addresses. In addition, we modify data to further complicate identification, such as applying a transformation to raw data (for example changing the exact number of steps you take per day). This makes it more difficult to determine your identity, but it is not a full guarantee.

10. DO WE COLLECT DATA FROM MINORS?

We do not knowingly collect data from, request data from, or market to children under 18 years of age, nor do we sell such personal data. By using the Services, you represent that you are at least 18 years old or that you are the parent or guardian of such a minor and consent to such minor’s use of the Services.

If we learn that personal data from users under the age of 18 has been collected, we will deactivate the account and take reasonable measures to promptly delete such data from our records. If you become aware of any data we may have collected from children under age 18, please contact us at info@liberdat.io.

11. WHAT ARE YOUR PRIVACY RIGHTS?

In some regions (such as the EEA, the UK and Switzerland), you have certain rights under applicable data protection laws. You also have the right to object to the processing of your personal data. You can submit such a request by contacting us via info@liberdat.io.

We will consider and act upon any request in accordance with applicable data protection laws.

If you are located in the EEA or the UK and you believe we are unlawfully processing your personal data, you also have the right to lodge a complaint with your Member State data protection authority or with the UK data protection authority. If you are located in Switzerland, you may contact the Federal Data Protection and Information Commissioner.

Withdrawal of your consent You can withdraw your consent at any time by deleting your account via Settings -> Delete Account.

Account information If you would at any time like to review or change the information in your account or terminate your account, you can: • Log in to your account settings and update your user account. • Contact us using the contact information provided.

Cookies and similar technologies Most web browsers are set to accept cookies by default. If you prefer, you can usually choose to set your browser to remove or reject cookies. If you choose to remove or reject cookies, this could affect certain features or services of our Services.

If you have questions or comments about your privacy rights, you may email us at info@Liberdat.io.

12. CONTROLS FOR DO-NOT-TRACK FEATURES

Most web browsers and some mobile operating systems and mobile applications include a Do-Not-Track (“DNT”) feature or setting that you can activate to signal your privacy preference not to have data about your online browsing activities monitored and collected. At this time, no uniform technology standard for recognizing and implementing DNT signals has been finalized. As such, we do not currently respond to DNT browser signals or any other mechanism that automatically communicates your choice not to be tracked online. If a standard for online tracking is adopted that we must follow in the future, we will inform you about that practice in a revised version of this privacy statement.

13. DO WE PROVIDE UPDATES TO THIS STATEMENT?

We will keep you informed of significant changes to this statement.

14. HOW CAN YOU CONTACT US ABOUT THIS STATEMENT?

If you have questions or comments about this statement, you can contact us by email at info@liberdat.io, or contact us by post at:

Liberdat B.V. Soerapatistraat 59 1018 PN, Amsterdam The Netherlands