Liberdat Privacy Notice

Last modified on: October 26th, 2026

This is the Privacy Notice of Liberdat B.V. (“Liberdat”, “we”, “us” or “our”). In this Privacy Notice we explain which personal data of which categories of individuals we process, for what purposes and on what legal basis we do so, and which rights these individuals have. We recommend that you read this Privacy Notice carefully. If you have any questions after reading it, please contact us via privacy@liberdat.io.

Scope of this Privacy Notice

This Privacy Notice covers the processing of personal data in connection with:

• a. the App, which Patients use under the End User License Agreement (EULA);
• b. the Platform, which Healthcare Professionals and Verified Researchers use under the Terms of Use, and which Partners use under the Collaboration Agreement and the Patient Data Transfer and Use Agreement;
• c. our website and social media pages; and
• d. our dealings with suppliers.

Categories of data subjects and structure of this Privacy Notice

We process personal data of the following categories of individuals (“data subjects”):

• Patients: individuals who use the App.
• Healthcare Professionals: individuals who provide care to Patients, who work for or on behalf of a Partner and who use the Platform.
• Verified Researchers: individuals who work for or on behalf of a Partner, who conduct research using the Platform and whose identity and eligibility have been verified by Liberdat. A Healthcare Professional may also be a Verified Researcher; in that case the information for both categories applies.
• Partner Contact Persons: individuals who work for or on behalf of a Partner and who are our contact persons for the collaboration with that Partner, for example for contracting, administration or invoicing.
• Supplier Contact Persons: individuals who work for or on behalf of a supplier from which Liberdat obtains goods or services.
• Website Visitors: individuals who visit our website or our social media pages.

Sections 1, 2, 3, 5, 8, 9 and 10 set out the information per category of data subjects. The numbering of the sub-sections is the same in each of these sections: sub-section .1 always concerns Patients, .2 Healthcare Professionals, .3 Verified Researchers, .4 Partner Contact Persons, .5 Supplier Contact Persons and .6 Website Visitors. For example, section 2.1 sets out which personal data we process about Patients and section 8.1 how long we keep it. The other sections apply to all categories of data subjects alike.

Definitions

In this Privacy Notice, the terms set out above and the following terms have the meaning given to them below:

• App: Liberdat’s mobile application for Patients.
• Collaboration Agreement: the collaboration agreement between Liberdat and a Partner.
• EEA: the European Economic Area.
• EULA: the End User License Agreement for the App, which applies between Liberdat and Patients.
• Exploratory Access: access by a Verified Researcher via the Platform, without an RDR, to visualisations of fitness insights and to Patient Data, and the use of Liberdat's algorithm on Patient Data within the Platform, in each case in pseudonymised form and without the possibility to download Patient Data, solely to formulate research questions and hypotheses and to assess the feasibility of Research.
• GDPR: the General Data Protection Regulation (Regulation (EU) 2016/679).
• Health Platform: Apple Health (HealthKit) on iOS devices or Health Connect on Android devices.
• Lead Investigator: the Verified Researcher, or the person working for or on behalf of Liberdat, who bears ultimate responsibility for an RDR.
• Partner: an organisation, such as a hospital or other healthcare provider or a research institution, that has entered into a Collaboration Agreement and a Patient Data Transfer and Use Agreement with Liberdat.
• Patient Data: personal data of a Patient, including demographic and digital measurement data used to generate fitness insights, clinical data, and data regarding the Healthcare Professional(s) treating the Patient and the Partner(s) with which they are affiliated.
• Patient Data Transfer: the uploading of Patient Data to, or the downloading of Patient Data from, the Platform by a Partner, Healthcare Professional or Verified Researcher.
• Patient Data Transfer and Use Agreement: the agreement between Liberdat and a Partner on the transfer and use of Patient Data, which forms part of the Collaboration Agreement.
• Platform: Liberdat’s web-based research platform.
• RDR (Research Data Request): a request submitted through the Platform by a Lead Investigator for access to and use of Patient Data for a single, specified research project that qualifies as Research, led by that Lead Investigator, alone or together with other Verified Researchers, which has been approved by Liberdat.
• Research: research that contributes to existing scientific knowledge or applies existing knowledge in novel ways, including research supporting innovation such as technological development and demonstration, which is carried out with the aim of contributing to society’s general knowledge and wellbeing and in accordance with the ethical standards in the relevant research area.
• Terms of Use: the Terms of Use of the Platform and Patient Data, which apply between Liberdat and Healthcare Professionals and Verified Researchers.
• Your Healthcare Professional: for a Patient, the Healthcare Professional who treats that Patient.

Modifications

We may update this Privacy Notice from time to time to reflect changes in our data processing practices or legal obligations. The most current version of this Privacy Notice can always be found on Liberdat’s website and in the App and on the Platform. We encourage you to review this Privacy Notice regularly so that you are aware of these modifications. We will inform Patients, Healthcare Professionals and Verified Researchers of material changes via the App or the Platform.

1. Who is the controller?

Liberdat B.V., having its registered office at Soerapatistraat 59, 1018 PN Amsterdam, the Netherlands, is the controller for the processing of personal data described in this Privacy Notice, unless stated otherwise below. Other parties may also process personal data of the categories of data subjects described in this Privacy Notice. They are then responsible for their own processing.

1.1 Patients

Liberdat is the controller for the processing of Patient Data in the App and on the Platform. This includes collecting Patient Data via the App, storing it, pseudonymising and anonymising it, and making it available via the Platform to Your Healthcare Professional and to Verified Researchers (for RDRs and through Exploratory Access).

The Partner with which Your Healthcare Professional or a Verified Researcher is affiliated (for example a hospital or research institution) is a separate, independent controller for (i) Patient Data Transfers and (ii) any processing of Patient Data outside the Platform, including in the context of an RDR and in your medical file. Healthcare Professionals and Verified Researchers act under the authority of that Partner. For these activities the Partner’s own privacy notice applies and you can exercise your rights with that Partner. If you contact us about processing for which a Partner is responsible, we will tell you which Partner to contact and assist that Partner where we can.

1.2 Healthcare Professionals

Liberdat is the controller for the processing of your personal data in connection with your account and your use of the Platform. The Partner with which you are affiliated is a separate controller for its own processing of your personal data, for example as your employer, and for the Patient Data Transfers you carry out on its behalf.

1.3 Verified Researchers

Liberdat is the controller for the processing of your personal data in connection with your account, your use of the Platform and the RDRs in which you participate, including your use of Exploratory Access. The Partner with which you are affiliated is a separate controller for its own processing of your personal data, for example as your employer, and for the processing of Patient Data in the context of an RDR outside the Platform.

1.4 Partner Contact Persons

Liberdat is the controller for the processing of your personal data in connection with the collaboration between Liberdat and the Partner for which you work.

1.5 Supplier Contact Persons

Liberdat is the controller for the processing of your personal data in connection with the goods or services Liberdat obtains from the supplier for which you work.

1.6 Website Visitors

Liberdat is the controller for the processing of your personal data in connection with our website and our social media pages. For the page statistics of our social media pages, Liberdat and the operator of the social media platform concerned (e.g. LinkedIn) are joint controllers. The essence of the arrangement between us is that the operator is primarily responsible for informing you and for handling requests to exercise your rights. You can find the arrangement between Liberdat and LinkedIn here.

2. Which personal data do we process, for which purposes and on which legal basis?

For each category of data subjects, this section sets out the categories of personal data we process, the purposes for which we process it and the legal basis under the GDPR on which we rely. The letters in the column “Personal data” refer to the categories of personal data listed for that category of data subjects. We rely on the following legal bases:

• Consent (Art. 6(1)(a) GDPR) and, for health data, explicit consent (Art. 9(2)(a) GDPR). You may withdraw your consent at any time. This does not affect the lawfulness of processing based on consent before its withdrawal. How you can withdraw your consent is explained per category of data subjects below.
• Performance of a contract (Art. 6(1)(b) GDPR): the processing is necessary to perform a contract with you, such as the EULA or the Terms of Use.
• Legal obligation (Art. 6(1)(c) GDPR): the processing is necessary to comply with a legal obligation to which Liberdat is subject.
• Legitimate interests (Art. 6(1)(f) GDPR): the processing is necessary for the purposes of Liberdat’s legitimate interests. Our specific legitimate interests are set out per category of data subjects below. We have balanced these interests against your interests and fundamental rights and freedoms. You can obtain more information about this balancing by contacting us. You have the right to object to processing based on our legitimate interests (see section 10).

2.1 Patients

Personal data

• a. Account and contact details, including email address (and its verification status) and the identifier of the account you use to sign in, such as your Apple or Google account (OAuth ID).
• b. Personal details, including name, birth month, birth year, smoking history and gender.
• c. Clinical data, depending on your primary diagnosis: (i) for Multiple Sclerosis (MS): diagnosis (start/end dates), other conditions, treatments (start/end dates), events such as relapses (start/end dates), pregnancies (start/end dates), and progression independent of relapse activity (PIRA) events (start/end dates); (ii) for Pulmonary Hypertension (PH): diagnosis (start/end dates), subdiagnosis (start/end dates), other conditions, risk scores (start/end dates), treatments (start/end dates), and hospitalisations (start/end dates); and (iii) for Lung Cancer: diagnosis (start/end dates), histological subtype, subdiagnosis (start/end dates), other conditions, treatments (start/end dates), side effects (start/end dates), and disease progression (start/end dates). This data may be entered by you in the App or added via the Platform by Your Healthcare Professional.
• d. Connected device (health) metrics, including for Apple Health (iOS): Active energy, Exercise minutes, Flights climbed, Resting energy, Sleep and Steps; and for Health Connect (Android): Active calories burned, Activity intensity, Distance, Exercise, Sleep, Speed, Steps and Total calories burned. On Android, the App reads this data exclusively from Health Connect, into which apps such as Samsung Health, Google Fit, Google Health and Health Connect’s Native on-device tracking sensors write their data.
• e. System metadata, including IP addresses, device identifiers such as your push notification token, the authentication token stored on your device to keep you signed in, records of your use of the App (such as the screens and settings you open and the buttons you tap), product analytics data, crash reports (from which identifiers are removed), feedback you submit and deletion records.
• f. Fitness insights derived from your data, such as your daily activity and how it compares with that of other Patients.
• g. Consent and sharing preferences, including the consents you have given or withdrawn and the Healthcare Professional(s) with whom you share your data.
• h. Research identifiers, i.e. the pseudonymous codes that replace your name and contact details when your Patient Data is made available for Research or through Exploratory Access.

The data in categories b (insofar as it concerns your smoking history), c, d and f, and any health details you include in feedback (category e), concerns your health and is a special category of personal data under Article 9 GDPR. Unless stated otherwise below, we process this data only with your explicit consent (Article 9(2)(a) GDPR).

Feedback is entered in an open text field. Please do not include health information or other sensitive information in your feedback. If you do, we only use it to handle your feedback.

Purposes and legal basis

Our legitimate interests

Our legitimate interests are to keep the App and the Platform secure and functioning, to prevent and investigate misuse and fraud, to analyse and improve the use of the App, and to establish, exercise or defend legal claims.

Information provided before asking for your consent

Before you consent to the use of your Patient Data for Research, we inform you in the App of the nature, purpose and duration of the research, the procedures, risks and benefits for you, how your data is kept confidential and with whom it is shared, whom you can contact with questions and how you can withdraw your consent.

Withdrawing your consent

You can withdraw your consent in the App via Settings -> Delete Account, via https://www.liberdat.io/legal/delete-account for Android users or by sending an email to privacy@liberdat.io.

You can withdraw your consent to the use of your Patient Data for an RDR in the App via Settings > Research > Research Data Requests. You can withdraw your consent to Exploratory Access in the App via Settings > Research > Exploratory Access.

If you withdraw your consent to the use of your Patient Data for Research, we will stop making your Patient Data available for new RDRs and will notify the Partners and Verified Researchers who received your Patient Data. They must then stop using it and delete it, unless the law or, to the extent permitted by applicable law, rules on scientific integrity require them to keep it, in which case it is kept in pseudonymised form for no longer than required. To the extent permitted by law, anonymised data, aggregated results, publications and trained models created before your withdrawal are not affected. If you withdraw your consent to Exploratory Access, your Patient Data will no longer be shown to Verified Researchers through Exploratory Access.

If you withdraw your consent to sharing your Patient Data with Your Healthcare Professional, they will no longer be able to view your Patient Data via the Platform. Patient Data that the Partner has already included in your medical file is governed by that Partner’s own rules.

2.2 Healthcare Professionals

Personal data

• a. Contact details, including institutional email address.
• b. Identity details, including name and function.
• c. Professional details, including the Partner with which you are affiliated, your primary specialisation or disease field and your country.
• d. Verification data, i.e. the information you provide to verify your identity and eligibility.
• e. Account and system data, including login data, the identifier of the account you use to sign in (OAuth ID), IP addresses and device details (such as browser and operating system), cookies, usage data, product analytics data, error reports and log files.
• f. Platform activity data, including the Patients who share their Patient Data with you, Patient Data Transfers you carry out, the Patient records you verify or delete, confirmations you give via the Platform and records of your access to Patient Data.

On the Platform we use a session cookie that keeps you securely signed in, and functional cookies that remember your preferred language and region (for one year) and whether you left the navigation menu expanded or collapsed. We do not use advertising, marketing or cross-site tracking cookies on the Platform.

Purposes and legal basis

Our legitimate interests

Our legitimate interests are to ensure that only verified and eligible individuals gain access to Patient Data, to enable Research collaboration on the Platform, to keep the Platform secure, to monitor compliance with the Terms of Use and our agreements with Partners, to inform and cooperate with Partners, to improve the Platform, and to establish, exercise or defend legal claims.

2.3 Verified Researchers

Personal data

• a. Contact details, including business email address and phone number.
• b. Identity details, including name and function.
• c. Professional details, including the Partner with which you are affiliated, your primary specialisation or disease field and your country.
• d. Verification data, i.e. the information you provide to verify your identity and eligibility.
• e. Account and system data, including login data, the identifier of the account you use to sign in (OAuth ID), IP addresses and device details (such as browser and operating system), cookies, usage data, product analytics data, error reports and log files.
• f. Platform activity data, including Patient Data Transfers you carry out, confirmations you give via the Platform and records of your access to Patient Data, including through Exploratory Access.
• g. Your role in an RDR (Lead Investigator or involved Verified Researcher) and any personal data included in the RDR, ethics committee approvals and proposed publications you submit to Liberdat, such as your name and professional details.

On the Platform we use a session cookie that keeps you securely signed in, and functional cookies that remember your preferred language and region (for one year) and whether you left the navigation menu expanded or collapsed. We do not use advertising, marketing or cross-site tracking cookies on the Platform.

Purposes and legal basis

Our legitimate interests

Our legitimate interests are to ensure that only verified and eligible individuals gain access to Patient Data, to enable Research collaboration on the Platform, to keep the Platform secure, to monitor compliance with the Terms of Use and our agreements with Partners, to protect our confidential information and intellectual property, to inform and cooperate with Partners, to improve the Platform, and to establish, exercise or defend legal claims.

2.4 Partner Contact Persons

Personal data

• a. Contact details, including business email address and phone number.
• b. Identity details, including name and function.
• c. Personal data included in documents and records relating to the collaboration with Liberdat, such as your name, function and role as stated in correspondence, contracts and invoices.

Purposes and legal basis

Our legitimate interests

The Collaboration Agreement is concluded with the Partner, not with you personally. Our legitimate interests are to enter into and perform the Collaboration Agreement, to maintain our relationship with the Partner, to keep proper financial records and to establish, exercise or defend legal claims.

2.5 Supplier Contact Persons

Personal data

• a. Contact details, including business email address and phone number.
• b. Identity details, including name and function.
• c. Personal data included in documents and records relating to the goods or services the supplier provides, such as your name, function and role as stated in correspondence, contracts and invoices.

Purposes and legal basis

Our legitimate interests

The agreement is concluded with the supplier, not with you personally. Our legitimate interests are to enter into and perform that agreement, to keep proper financial records and to establish, exercise or defend legal claims.

2.6 Website Visitors

Personal data

• a. Technical data, including IP address, browser type, device information, pages visited and time of visit.
• b. Cookie data. Only essential cookies.
• c. Contact details and the content of your message if you contact us via the website or sign up for our newsletter.
• d. Interactions with our social media pages, such as reactions, comments and messages.

Purposes and legal basis

Our legitimate interests

Our legitimate interests are to operate and secure our website, to respond to questions and to communicate via our social media pages.

Withdrawing your consent

You can withdraw your consent and unsubscribe from our newsletter via the link in each newsletter.

3. How do we obtain your personal data and are you required to provide it?

We obtain personal data in different ways: data you provide yourself, data collected automatically, data we receive from third parties and data we derive ourselves. Where we receive personal data from third parties, we state the source and the categories of personal data below.

3.1 Patients

• Provided by you: when you create an account, complete your profile, select your diagnosis, enter data in the App or contact us (categories a, b, c and g).
• Collected automatically: when you use the App (category e).
• From third parties: from Apple Health (iOS) or Health Connect (Android), if you connect them to the App (category d); from Your Healthcare Professional and the Partner with which they are affiliated (clinical data, category c, and confirmations of your consent for Research); and from the sign-in service you use, such as Apple or Google (your OAuth ID, category a).
• Derived by us: fitness insights, comparisons with other Patients and research identifiers (categories f and h), and pseudonymised, aggregated or anonymised data.

Liberdat may request access to certain features of your device, in particular your health data in Apple Health or Health Connect. You can change these permissions at any time in your device’s settings. If you do not grant certain permissions, some functions of the App may not be available to you. Liberdat will inform you about this in the respective request.

Providing your account details (category a) is necessary to conclude and perform the EULA; without them we cannot create an account for you. Providing health data and consenting to its use is entirely voluntary. If you choose not to provide certain data, you may not be able to use some functionalities of the App. You are not under any statutory obligation to provide personal data to us.

3.2 Healthcare Professionals

• Provided by you: when you register for and use the Platform and when you verify your identity and eligibility (categories a, b, c and d).
• Collected automatically: when you use the Platform (categories e and f).
• From third parties: from the Partner with which you are affiliated (name, contact details, function and affiliation, categories a, b and c).

Providing the data in categories a to d is necessary to conclude and perform the Terms of Use; without it we cannot give you access to the Platform. You are not under any statutory obligation to provide personal data to us.

3.3 Verified Researchers

• Provided by you: when you register for and use the Platform, when you verify your identity and eligibility, and when you submit or participate in an RDR (categories a, b, c, d and g).
• Collected automatically: when you use the Platform (categories e and f).
• From third parties: from the Partner with which you are affiliated (name, contact details, function and affiliation, categories a, b and c); and from other Verified Researchers involved in the same RDR (RDR documentation, category g).

Providing the data in categories a to d, and the RDR data in category g, is necessary to conclude and perform the Terms of Use and to participate in an RDR; without it we cannot give you access to the Platform or approve an RDR. You are not under any statutory obligation to provide personal data to us.

3.4 Partner Contact Persons

• Provided by you: when you communicate with us (categories a, b and c).
• From third parties: from the Partner for which you work (name, contact details and function, categories a and b).

You are not under any statutory or contractual obligation to provide personal data to us. Without your contact details we cannot communicate with you about the collaboration.

3.5 Supplier Contact Persons

• Provided by you: when you communicate with us (categories a, b and c).
• From third parties: from the supplier for which you work (name, contact details and function, categories a and b).

You are not under any statutory or contractual obligation to provide personal data to us. Without your contact details we cannot communicate with you about the goods or services.

3.6 Website Visitors

• Provided by you: when you contact us by mail or interact with our social media pages (category d).
• Collected automatically: when you visit our website, including via cookies (categories a and b).
• From third parties: from the operators of social media platforms (page statistics, category d).

Providing personal data is voluntary. We only place non-essential cookies with your consent.

4. Who within Liberdat has access to your personal data?

This section applies to all categories of data subjects. Within Liberdat, only employees and contractors who need access to perform their duties have access to your personal data, and only to the extent necessary. They are bound by confidentiality obligations.

5. With whom do we share your personal data?

For each category of data subjects, we set out below the recipients or categories of recipients of the personal data. In addition, we may share the personal data of all categories of data subjects with:

• service providers that process personal data on our behalf as processors and under a data processing agreement, which requires them to protect your personal data to at least the same level as described in this Privacy Notice.
• competent authorities and courts, where we are required to do so by law;
• our professional advisers, such as lawyers, accountants and auditors, who are bound by confidentiality; and
• a buyer of or successor to (part of) our business in the event of a merger, acquisition or reorganisation.

5.1 Patients

We may also share your personal data with:

• Your Healthcare Professional and the Partner with which they are affiliated, if you have consented to sharing your Patient Data with them. The Partner is an independent controller of Patient Data it downloads from the Platform, for example to include it in your medical file;
• Verified Researchers participating in an RDR and the Partners with which they are affiliated, in pseudonymised form, if you have consented to the use of your Patient Data for Research. Only if the Lead Investigator is Your Healthcare Professional and you have given explicit consent for the RDR concerned may they receive your Patient Data in directly identifiable form. These recipients are independent controllers. They are contractually prohibited from attempting to re-identify you, from sharing your Patient Data with third parties other than their own processors, and from publishing your Patient Data other than in aggregated or anonymised form, and they must delete your Patient Data when the RDR ends, unless Liberdat has approved a new or amended RDR covering the further use of your Patient Data and that further use is covered by your consent;
• Verified Researchers to whom we grant Exploratory Access, in pseudonymised form and only within the Platform, if you have consented to Exploratory Access. They cannot download your Patient Data, are contractually prohibited from attempting to re-identify you and may only use what they see to formulate research questions and hypotheses and to prepare an RDR;
• Apple and Google, as providers of sign-in services, Apple Health and Health Connect, under their own privacy notices; and
• notified bodies and other conformity assessment bodies, where necessary for the conformity assessment of our products.

When you download the App on your device, some data will automatically be transferred to the app store you selected, e.g. your username, account number, the time of the download and your device ID. This processing is carried out by the provider of the app store, under its own responsibility. Liberdat has no influence on this processing.

5.2 Healthcare Professionals

We may also share your personal data with:

• the Partner with which you are affiliated;
• Verified Researchers, insofar as needed to conduct Research; and
• Patients who share their Patient Data with you or whose records you verify (your name and affiliation).

5.3 Verified Researchers

We may also share your personal data with:

• the Partner with which you are affiliated; and
• other Verified Researchers involved in the same RDR and the Partners with which they are affiliated.

5.4 Partner Contact Persons

We may also share your personal data with Healthcare Professionals and Verified Researchers affiliated with the Partner for which you work, where relevant for the collaboration.

5.5 Supplier Contact Persons

We do not share your personal data with recipients other than those listed at the beginning of this section.

5.6 Website Visitors

We may also share your personal data with the operators of the social media platforms on which we have a page, as described in section 1.6.

6. Do we transfer your personal data to countries outside the EEA?

Liberdat hosts the App and the Platform and stores Patient Data within the EEA. Some of our processors and recipients of personal data may, however, be established in a country outside the EEA in which applicable laws do not provide the same level of data protection as the GDPR. This may also be the case for Verified Researchers outside the EEA who access pseudonymised Patient Data via the Platform, including through Exploratory Access. In such cases, and unless permitted otherwise by applicable law, Liberdat only transfers personal data if appropriate safeguards for the protection of personal data are in place, in particular if the recipient (data importer):

• is established in a country that has been recognised by the European Commission as providing an adequate level of data protection;
• complies with a relevant framework recognised by the European Commission, e.g. the EU-US Data Privacy Framework;
• has introduced approved Binding Corporate Rules in its organisation; or
• has entered into the EU Standard Contractual Clauses with us.

If none of these transfer mechanisms are available, we may ask for your explicit consent to the transfer in accordance with Art. 49(1)(a) GDPR. Please be aware that in such countries there is a risk that your personal data will be accessed by public authorities for control and monitoring purposes, possibly without effective means of redress. Further information on the safeguards in place, including a copy of them, is available by contacting Liberdat via privacy@liberdat.io.

7. How do we secure your personal data?

This section applies to all categories of data subjects. Liberdat takes appropriate technical and organisational measures to protect personal data and to maintain at all times a level of security which, given the state of the art and the costs of implementation, is appropriate, among other things, to prevent unauthorised access, alteration, disclosure, loss or any other form of unlawful processing of personal data. These measures include:

• data encryption (both in transit and at rest);
• encryption of health data before it is stored with our hosting provider, so that the hosting provider cannot read it;
• masking of IP addresses in consent records, and removal of identifiers from crash reports and from the content of push notifications;
• secure access controls and authentication procedures;
• monitoring and logging of access;
• regular security audits and vulnerability assessments;
• training and awareness programmes on data protection; and
• pseudonymisation of Patient Data and fitness insights before it is made available for Research, with any re-identification key stored separately. Patient Data made available through Exploratory Access is shown only within the Platform, cannot be downloaded and is presented in a form that minimises the risk of identification, for example as trends rather than exact values, with relative rather than calendar dates and without showing results relating to small numbers of Patients.

The employees and contractors involved are bound by appropriate confidentiality obligations and must comply with our instructions aimed at the adequate protection of personal data.

8. For how long do we keep your personal data?

We do not keep personal data longer than necessary for the purposes for which we process it. Anonymised data, which no longer qualifies as personal data, may be kept without a time limit. In addition, the following retention periods apply.

8.1 Patients

• Account and App data: for as long as you have an account. If you delete your account (in the App via Settings > Delete Account, or via https://www.liberdat.io/legal/delete-account for Android users, we delete your personal data without undue delay, and from back-ups within 14 days, unless we are required by law to keep it longer.
• Patient Data made available for Research: Verified Researchers may use it only for the duration of the RDR and must delete it within 30 days after the RDR ends, unless Liberdat has approved, before the RDR ends, a new or amended RDR covering the further use of that Patient Data and that further use is covered by your consent, in which case it may be used for the duration of the new or amended RDR. Where the law or, to the extent permitted by applicable law, rules on scientific integrity require research data to be retained, it is kept in pseudonymised form for no longer than required.
• Records of consents, withdrawals, deletion requests and deletions of Patient Data: 5 years after the consent was withdrawn or the request was handled, so that we can demonstrate compliance.

8.2 Healthcare Professionals

Your account is deleted when you are no longer affiliated with a Partner or when the Collaboration Agreement with your Partner ends. Your personal data is deleted as soon as the account is deleted Records of your access to Patient Data are kept for 1 year. Functional cookies on the Platform expire after one year.

8.3 Verified Researchers

Your account is deleted when you are no longer affiliated with a Partner or when the Collaboration Agreement with your Partner ends. Your personal data is deleted as soon as the account is deleted. Records of your access to Patient Data (including through Exploratory Access) and records relating to RDRs in which you participated are kept for 5 years after the end of the RDR concerned, so that we can demonstrate how an RDR was carried out and establish, exercise or defend legal claims. Functional cookies on the Platform expire after one year.

8.4 Partner Contact Persons

For the duration of the Collaboration Agreement. Financial records are kept for seven years in accordance with Dutch tax law.

8.5 Supplier Contact Persons

For the duration of the agreement with the supplier. Financial records are kept for seven years in accordance with Dutch tax law.

8.6 Website Visitors

Functional cookies on the Platform expire after one year. Enquiries are deleted within 365 days after they have been handled.

9. Do we use automated decision-making or profiling?

Liberdat does not make decisions based solely on automated processing, including profiling, that produce legal effects concerning any data subject or similarly significantly affect them (Article 22 GDPR).

9.1 Patients

To generate personal fitness insights and predictions, the App automatically analyses your step data together with your birth month, birth year, smoking history and gender, and predicts actual and expected trends. This is a form of profiling (Article 4(4) GDPR). The insights are for your information only, do not constitute medical advice and do not result in any decision about you. If you have consented to Exploratory Access, Verified Researchers may also configure and train Liberdat's algorithm on your pseudonymised Patient Data within the Platform. This is used only to formulate research questions and hypotheses and does not result in any decision about you.

9.2 Healthcare Professionals

The verification of your identity and eligibility involves human review. We do not use automated decision-making or profiling.

9.3 Verified Researchers

The verification of your identity and eligibility and the approval of RDRs involve human review. We do not use automated decision-making or profiling.

9.4 Partner Contact Persons

We do not use automated decision-making or profiling.

9.5 Supplier Contact Persons

We do not use automated decision-making or profiling.

9.6 Website Visitors

We do not use automated decision-making.

10. What are your rights?

Under the GDPR, all data subjects have the following rights:

• the right of access to your personal data;
• the right to have inaccurate or incomplete personal data rectified;
• the right to have your personal data erased;
• the right to restriction of processing;
• the right to data portability, where we process your personal data on the basis of consent or a contract and by automated means;
• the right to object to processing based on our legitimate interests;
• the right to withdraw your consent at any time, where we process your personal data on the basis of consent; and
• the right to lodge a complaint with a supervisory authority (see section 15).

You can exercise your rights by sending an email to privacy@liberdat.io. We will respond without undue delay and within one month. Depending on the complexity and number of requests, we may extend this period by two further months, in which case we will inform you. We may ask you to verify your identity. These rights are not absolute; in some cases they may be limited to the extent permitted by the GDPR and the Dutch GDPR Implementation Act (UAVG).

10.1 Patients

You can withdraw your consent in the App as described in section 2.1. In addition, you can rectify or delete your personal data via the settings in the App. The right to data portability applies to the data you have provided to us (categories a to d and g). Where a Partner is the controller (see section 1.1), please address your request to that Partner. Partners, Healthcare Professionals and Verified Researchers are legally and contractually required to assist in handling your request.

10.2 Healthcare Professionals

You can update your account details on the Platform. For processing by the Partner with which you are affiliated (see section 1.2), please address your request to that Partner.

10.3 Verified Researchers

You can update your account details on the Platform. For processing by the Partner with which you are affiliated (see section 1.3), please address your request to that Partner.

10.4 Partner Contact Persons

As we process your personal data mainly on the basis of our legitimate interests, you may in particular object to that processing. The right to data portability does not apply to processing based on legitimate interests.

10.5 Supplier Contact Persons

As we process your personal data mainly on the basis of our legitimate interests, you may in particular object to that processing. The right to data portability does not apply to processing based on legitimate interests.

10.6 Website Visitors

For page statistics of our social media pages, you can exercise your rights with the operator of the social media platform concerned (see section 1.6).

11. Children

The App is not intended for individuals under the age of 18 and they may not register for or use it. The Platform and our website are not directed at children. If we become aware that we have collected personal data of an individual under the age of 18 via the App, we will delete that data and the account concerned. If you believe this has happened, please contact us.

12. Third-party websites

The App, the Platform and our website may contain links to third-party websites and services, such as app stores, Apple Health, Health Connect and social media platforms. This Privacy Notice does not apply to them and Liberdat is not responsible for the way they process personal data. Please read their privacy notices.

13. Contact details

Liberdat B.V.

Soerapatistraat 59

1018 PN Amsterdam

the Netherlands

If you have any questions or comments about our handling of your personal data, or if you would like to exercise any of your rights, you can contact Liberdat at privacy@liberdat.io. Liberdat will always use its best efforts to address and settle any requests or complaints brought to its attention.

14. Data Protection Officer

Liberdat has appointed a data protection officer (DPO), who monitors Liberdat's compliance with the GDPR and this Privacy Notice. If you have questions about the processing of your personal data, you can contact our DPO via dpo@liberdat.io. Requests to exercise your rights can be sent to privacy@liberdat.io. (see section 10).

15. Requests and complaints

If you have any requests or complaints, please get in touch with us first. You may also contact a supervisory authority with requests or complaints. The lead supervisory authority for Liberdat is the Autoriteit Persoonsgegevens (Dutch Data Protection Authority). You may also lodge a complaint with the supervisory authority of the EU member state in which you live or work or in which the alleged infringement took place.