Ancora Privacy Policy

Privacy Policy – 05 June 2026

Introduction

This Privacy Policy is to inform you what Personal Data is processed by using this App/Site, how it is collected, to whom it is or may be disclosed, and how it is used. This Privacy Policy is incorporated into, and is subject to, the Terms of Use.

By “Personal Data” we mean any information relating to an identified or identifiable natural person, as further defined in the General Data Protection Regulation (EU) 2016/679.

By “Data Controller” we mean the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data, as further defined in the General Data Protection Regulation (EU) 2016/679.

This privacy policy was last updated on 05 June 2026. 

Controller details

We are the controller with respect to the processing of the personal data that you provide to us. In certain circumstances, we are the processor with respect to the processing of your personal data that are provided by your healthcare provider. Our contact details:  

  • Ancora Health B.V. Lübeckweg 2 9723 HE Groningen  

 

Which Personal Data are processed

A variety of Personal Data are processed when you use the services of Ancora Health. These Personal Data may be provided directly by you, or may be information resulting from your use of our services through your healthcare provider. Depending on the service you use, Ancora may collect the following Personal Data:  

  • Your identity (name, date of birth and healthcare identification number (if applicable))  
  • Your contact details (residential address, telephone number and email address)  
  • Your health data (medical history, medication use, vital signs and notes from your healthcare provider)  
  • Your use of our services (usage data from Ancora Health services (including location data), records of contact moments and feedback that you share with us) 

 

Purposes of data processing

Ancora Health processes your Personal Data only for specific purposes. The Personal Data collected by us are used for the following purposes:  

  • Creating your account in order to register you as a user of Ancora Health and give you access to our services. Legal basis: performance of a contract. 
  • Logging in to your account, in order to provide you with secure access to your personal environment within the app and/or website. Legal basis: performance of a contract. 
  • Maintaining your medical record in order to keep an up-to-date and complete overview of your health data for the purpose of providing your care. Legal basis: performance of a contract and, for health data, provision of healthcare. 
  • Providing health reports and lifestyle advice in order to offer you personalized insights and recommendations based on your health data. Legal basis: performance of a contract and, for health data, provision of healthcare. 
  • Scheduling appointments in order to plan and manage appointments with your healthcare provider or care team. Legal basis: performance of a contract. 
  • Recording your preferences in order to store your personal settings and preferences so that we can tailor our services to you. Legal basis: legitimate interest, namely improving the user experience. 
  • Improving our services in order to continuously optimize our services, functionalities and user experience. Legal basis: legitimate interest, namely the further development and improvement of our services.  
  • Performing services requested by you in order to comply with specific requests that you have submitted to us in the context of our services. Legal basis: performance of a contract. 
  • Handling correspondence in order to respond to your questions, requests and reports by telephone, email or live chat correctly and in a timely manner. Legal basis: legitimate interest, namely providing adequate customer service. 
  • Sending newsletters in order to keep you informed about developments, news and offers from Ancora Health. Legal basis: consent. You may withdraw your consent at any time via the unsubscribe link in the newsletter. 
  • Maintaining results from previous examinations and/or treatments in order to keep a complete and continuous picture of your health history, in support of your ongoing care. Legal basis: performance of a contract and, for health data, provision of healthcare. 

 

Sharing with third parties

Your personal data are confidential and we handle them with care. We share your data with third parties only when this is strictly necessary for the provision of your care, for the performance of our services, or when we are legally required to do so. In this context, your data may be shared with the following categories of recipients:  

  • Your healthcare provider and care team: to keep your treating healthcare professionals informed of your health situation and to ensure good continuity of care. 
  • Technology partners: parties that manage and support our platform and technical infrastructure, and that have access to your data only insofar as this is necessary for the performance of their work.  
  • Business partners: parties with whom we cooperate in the context of contractual or operational obligations, insofar as sharing your data is necessary for that purpose. 
  • Competent authorities and supervisory bodies: government agencies, supervisory bodies or other competent authorities, if and insofar as we are required by law or regulation to provide your data to them. 

We never sell your personal data to third parties and never share them for commercial purposes without your explicit consent.  

In principle, your personal data are processed and stored only within the European Economic Area (EEA). We aim to keep your data within the EEA at all times, because a uniform and high level of data protection applies in this area under the GDPR. When we transfer your Personal Data outside the EEA, we do so in accordance with applicable data protection law and will ensure that your information is kept secure and that the recipient has an appropriate level of security. This may include:  

  • An adequacy decision by the European Commission, showing that the country concerned offers an appropriate level of protection  
  • The use of standard contractual clauses approved by the European Commission (Standard Contractual Clauses) 

 

Your rights and choices

In accordance with the General Data Protection Regulation, you have the following rights:  

  • Right of access: You may contact us to confirm whether or not we process Personal Data about you. Where this is the case, we will inform you about the categories of Personal Data that we process, the purposes of processing, the categories of recipients to whom Personal Data have been or will be disclosed, and the intended retention period or the criteria used to determine that period.  
  • Right to rectification: You have the right to have inaccurate Personal Data that we store about you corrected or supplemented.  
  • Right to object: If our processing is based on our legitimate interest, you have the right to object to this processing at any time. We will then no longer process your Personal Data unless we demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or for the establishment, exercise or defense of legal claims.  
  • Right to restriction of processing: You have the right to obtain from us restriction of the processing of your Personal Data in specific situations provided for by applicable data protection law (e.g. when the accuracy of your Personal Data is contested by you, for a period enabling us to verify the accuracy of your Personal Data).  
  • Right to erasure: You have the right to ask us to delete your Personal Data from our systems if your Personal Data are no longer necessary in relation to the purposes for which they were collected or otherwise processed. In addition, you have the right to erasure if you exercise your right to object as referred to above, unless we have an overriding legitimate reason not to erase the relevant data. We may not be able to immediately delete all remaining copies from our servers and backup systems after the active data have been erased. Such copies will be erased as soon as reasonably possible.  
  • Right to data portability: You have the right to receive your Personal Data in a structured, commonly used and machine-readable format and/or to request that we send those data to a third party where technically feasible. Please note that this right applies only to Personal Data that you have provided to us.  

 

Automated Decision-Making

We do not make decisions based solely on automated data processing, including profiling.  

 

Data retention

Your Personal Data will not be kept in identifiable form for longer than necessary. We determine the retention period for your Personal Data based on the following criteria: (a) the purpose for which we use your Personal Data: we retain the data for as long as necessary for that purpose; and (b) legal obligations: various laws and regulations impose minimum retention periods with which we must comply.  

In certain cases, we may process your data in anonymized and/or aggregated form. This means that all information that can be traced directly or indirectly to you is removed or combined with data from others, so that you as an individual are no longer identifiable. We use such data exclusively for the following purposes:  

  • Improving the quality of our services and the experience of our users;  
  • Supporting the development of new healthcare tools, functionalities and applications;  
  • Analyzing trends and patterns in health outcomes at population level; and  
  • Contributing to scientific research that benefits the quality of healthcare. 

 

We emphasize that these data are used only in a form in which they are not personally linked to you. Based on these data, it is not possible to identify you as an individual. The processing of anonymized and/or aggregated data therefore falls outside the scope of the GDPR.  

 

Security

We take the protection of your Personal Data against unauthorized access, use and loss seriously. We have implemented appropriate administrative, technical and physical measures to protect your Personal Data. To protect your Personal Data, we have taken appropriate security measures, as evidenced by our ISO27001 and NEN7510 certificates.  

 

Third-party sites and services

The website or services of Ancora Health may contain links to websites, other apps and other online services operated by third parties that are not under our control. We are not responsible for the collection, use and disclosure of your Personal Data on those websites and other online services by those third parties. We recommend that you review the privacy policy of every website and other online service you visit.  

 

Updates to this data protection policy

We reserve the right to amend this privacy policy from time to time. These changes will be announced on our website. We therefore recommend that you regularly consult this privacy policy so that you are aware of any changes.  

Contact and questions

To exercise the above rights, or if you have questions about our privacy safeguards or our use or disclosure of your Personal Data while using the Site and/or App, you can contact us at privacy@ancora.health.

Home