This privacy statement has been prepared by Vaccinatieboekje B.V., trading under the name Vaxy (hereinafter: "Vaxy" or "we"). Vaxy attaches great importance to the protection of personal data and acts in accordance with the General Data Protection Regulation (GDPR) and other applicable laws and regulations.
This statement applies to the Vaxy mobile app and the websites vaxy.app and vaccinatieboekje.com (together: "the app"). By using the app, you agree to this privacy statement.
1. Controller and scope
Vaccinatieboekje B.V., with its statutory seat in Amsterdam, is the controller for the processing of personal data through the app. This statement describes how Vaxy collects, uses, stores and protects personal data, as well as users' rights. No rights can be derived from this statement.
2. Data processing and purposes
Vaxy only processes personal data that is necessary for the operation of the app, including:
- Identification data: name, date of birth, gender, email address and profile photo.
- Health data: vaccination information that you add yourself (such as disease, date, brand, batch number and validity period).
- Technical data: device information and usage statistics required for functionality and security.
These data are processed for:
- Creating and managing your account.
- Showing, storing and updating your vaccination overview.
- Sending necessary service messages.
- Inviting you to voluntary surveys about the app.
- Improving the stability, security and reliability of the app.
Processing takes place on the basis of:
- Consent (Article 6(1)(a) GDPR).
- Performance of the contract (Article 6(1)(b) GDPR).
- Legitimate interest in improving the service (Article 6(1)(f) GDPR).
To the extent health data are processed, this is done only with explicit consent as referred to in Article 9(2)(a) GDPR. You can withdraw this consent at any time through your account settings.
3. Use of photos and camera
The app may request access to your photos or camera to add or photograph vaccination records. This access is optional and is granted only after your explicit consent. The photos remain within your account and are not shared with third parties unless you choose to do so yourself.
4. Automatic recognition with artificial intelligence (AI)
To make entering vaccinations easier, Vaxy uses artificial intelligence (AI) to automatically recognize vaccination records. The AI only processes text visible on the vaccination record, does not use facial recognition or other personal information, does not train models with your data and does not share anything with third parties. This processing takes place within our secure infrastructure and is intended only to help you record your vaccinations faster and more accurately.
5. Service messages and newsletters
When creating an account, you agree to receive necessary messages that are essential for the operation of the app, such as security notices and updates. This communication is part of the performance of the contract and cannot be disabled while the account is active.
We may email you invitations to voluntary surveys about the app, so we can improve the service. Participation is voluntary. These messages are based on our legitimate interest (Article 6(1)(f) GDPR) and are not promotional messages. You can unsubscribe at any time via the unsubscribe link in the email. Responses are not linked to health data in your account, unless you enter that data yourself.
You may also voluntarily subscribe to our newsletter. It contains news and updates about our services. You can unsubscribe at any time via the unsubscribe link or in the app under notification settings. Promotional messages are sent only with your prior consent.
6. Anonymized research and data use
Vaxy may use anonymized or aggregated data for statistical or scientific research, for example to gain insight into vaccination behavior or trends in preventive care. These data cannot be traced back to individual persons. Results are presented only in aggregated or fully anonymous form. Processing is based on Vaxy's legitimate interest in improving its services and contributing to general research without infringing privacy.
7. Processors and subprocessors
Vaxy uses carefully selected processors and subprocessors (such as hosting, email and analytics tools). A processing agreement that complies with Article 28 GDPR has been concluded with each party. These parties process data only on behalf of Vaxy and under its supervision. An up-to-date list of processors is available on request via [email protected].
8. Location of data storage
Personal data are generally processed within the European Economic Area (EEA). If processing takes place outside the EEA, this is done only with appropriate safeguards, such as EU Standard Contractual Clauses (SCCs) or an adequacy decision by the European Commission.
9. External platforms (App Stores)
The app is distributed through the app stores of Apple and Google. Vaxy has no influence over data processing by these parties. Please also read their own privacy statements. Vaxy accepts no liability for damage arising from or related to the use of these external services.
10. Cookies
The app and website use cookies to improve functionality and keep statistics. Consent is requested for non-essential cookies on first use. You can disable cookies through your browser settings, but some functions may then not work correctly.
11. Analytics and measurement services
11.1 Google Analytics
Vaxy uses Google Analytics to collect anonymized information about app use. A processing agreement has been concluded with Google. IP addresses are anonymized and data are not used for other Google services.
11.2 Mixpanel Analytics
Vaxy uses Mixpanel to understand use of the app. Device IDs and usage statistics are processed for this purpose. Mixpanel anonymizes IP addresses and may not use the data for its own purposes. More information: mixpanel.com/legal/privacy-policy.
12. Data security
Vaxy takes appropriate technical and organizational measures to protect personal data, including:
- Encrypted data storage;
- Secure connections (TLS/SSL);
- Internal access restrictions and logging;
- Regular security checks.
Despite these measures, Vaxy cannot guarantee absolute security. Use of the app is at your own risk. Vaxy is not liable for damage resulting from unauthorized access to or loss of data, unless caused by intent or gross negligence on its part.
13. Retention periods
Personal data are not kept longer than necessary for the purpose for which they were collected, unless a legal obligation requires a longer retention period. Anonymized data may be retained longer for statistical purposes.
14. Changes
Vaxy reserves the right to amend this privacy statement. The most recent version is always available in the app and on the website. You will be informed of significant changes.
15. Your rights
You have the right to:
- access your personal data;
- have inaccuracies corrected;
- have your data deleted;
- object to processing or direct marketing;
- have your data transferred to a third party;
- temporarily restrict processing.
Requests can be submitted via [email protected]. Vaxy may ask for identification (with BSN and passport photo shielded). We respond within 30 days, unless the complexity of the request requires an extension.
16. Medical disclaimer
The information in the Vaxy app is intended solely to support personal health administration and does not constitute medical advice. Vaxy is not a healthcare provider. Always consult a doctor or qualified healthcare professional for medical questions. Vaxy accepts no liability for damage arising from the use of the information provided.
17. DPIA and responsibilities
Vaxy has carried out a Data Protection Impact Assessment (DPIA) for the app's core functionalities. Vaccinatieboekje B.V. acts as controller for the data processed through the app. External partners or healthcare providers that receive or provide data through integrations are independently responsible for GDPR compliance for their own processing.
18. Complaints
If you believe that Vaxy is not acting in accordance with privacy legislation, you may lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
19. Liability and applicable law
Vaxy endeavors to provide accurate and up-to-date information, but does not guarantee that the app will function error-free or without interruption at all times. Use of the app is at your own risk. Vaxy cannot be held liable for direct or indirect damage arising from use of the app or the information displayed, except in cases of intent or gross negligence.
This privacy statement is governed exclusively by Dutch law. Disputes will be submitted to the competent court in Amsterdam.
20. Contact
Vaccinatieboekje B.V.
Trading under the name Vaxy
[email protected]
vaxy.app | vaccinatieboekje.com