Privacy Policy.

At Vitary, we believe you should understand what happens to your personal and health data. Health information is particularly personal, and we treat it with care and confidentiality.

This Privacy Policy explains what information we collect when you visit our website, book an appointment or use our services, why we collect it, how we protect it, who we may share it with and what rights you have.

1. Who is responsible for your data?

Vitary V.O.F. is responsible for the processing of personal data described in this Privacy Policy.

Vitary V.O.F.
Bos en Lommerplantsoen 3F, 1055 AA Amsterdam, the Netherlands
Chamber of Commerce (KvK): 42031729
Email: info@vitary.nl
Website: www.vitary.nl

If you have any questions about privacy or the use of your personal data, you can contact us using the email address above.

2. What information do we collect?

The information we process depends on the services you use.

Contact and administrative information

When you contact us or book an appointment, we may process information such as:

• your name;
• email address;
• telephone number;
• date of birth;
• appointment details;
• correspondence with Vitary; and
• billing and payment information.

We use this information to schedule appointments, communicate with you, process payments and provide our services.

Health and lifestyle information

When you use our health services, we may process information that you provide through our health questionnaire or during a consultation.

Our questionnaire has two parts: a short health questionnaire when you request a scan, and a more detailed lifestyle questionnaire after you have booked.

Depending on the service, this may include information about:

• age and sex;
• height, weight and waist circumference;
• relevant medical history;
• pregnancy or breastfeeding;
• circumstances that may affect the scan, such as an implant or being unable to lie still;
• blood values measured in the past, such as blood pressure, glucose or cholesterol;
• your life stage or circumstances, such as menopause or shift work;
• relevant medication and supplements;
• physical activity and exercise;
• mental health & performance;
• nutrition and digestion;
• sleep;
• stress;
• smoking, alcohol and caffeine consumption;
• any question you would like to ask the physician; and
• other lifestyle factors relevant to your assessment or advice.

We aim to collect only the information that is relevant to the service you receive.

3. DEXA measurements

If you have a DEXA scan at Vitary, our DEXA system measures aspects of your body composition.

Depending on the service you receive and, where applicable, the relevant medical indication, this may include information about:

• total body composition;
• fat mass and body fat percentage;
• fat distribution;
• visceral fat;
• lean mass and muscle mass;
• regional body composition; and
• bone mineral density

In addition to DEXA scans, we may measure grip strength and lower-body strength. We use these results to provide you with insight into relevant aspects of your health and body composition and, where applicable, to translate these insights into personalized lifestyle recommendations.

After your scan, we make your report available in your personal client account on our website. You receive an invitation by email to set up this account. Signing in requires your password and a second step, such as a code sent by email. Your report files are kept in private storage that is not publicly accessible and can only be opened through your account.

4. Medical screening

For the DEXA scans, a medical assessment is required beforehand.

Relevant answers from your short health questionnaire shall be reviewed by a physician affiliated with Vitary. The physician receives only the information necessary to determine whether the examination can be performed safely and appropriately.

If an answer is unclear or requires additional information, the physician may contact you.

This assessment is intended to determine whether the relevant examination can be performed responsibly. It is not intended to replace regular medical diagnosis or treatment.

5. Medical review of unexpected or abnormal findings

If a measurement gives reason for further assessment, Vitary may suggest that relevant results are reviewed by a physician.

In that case, we only share the information necessary for that assessment. Where your consent is required, we will ask for it before sharing your information.

Depending on the findings, we may recommend that you contact your general practitioner (GP) or another healthcare professional.

Vitary does not replace or offer regular medical care or advice. If you have symptoms, a medical condition, or questions about diagnosis or treatment, you should consult your GP or treating healthcare professional.

6. On what legal basis do we process your data?

We only process personal data where there is a valid legal basis for doing so under the General Data Protection Regulation (GDPR).

Depending on the circumstances, we may process personal data because:

• processing is necessary to perform our agreement with you, for example to arrange an appointment, provide our services or process a payment;
• processing is necessary to comply with a legal obligation;
• we have a legitimate interest in processing the information, for example to operate and protect our business or respond to enquiries; or
• you have given us your consent, for example to receive marketing communications.

Health data is classified as a special category of personal data under the GDPR and receives additional protection. We only process health data when an additional legal basis under Article 9 GDPR applies.

Where processing is based on your consent, you can withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing that took place before your consent was withdrawn.

7. Who do we share your data with?

We never sell your personal or health data.

We only share personal data when this is necessary to provide our services, another valid legal basis applies, or you have given us permission to do so.

Depending on the services you use, your information may be processed by or shared with:

• the physician performing medical screening or an additional medical review for Vitary;
• Wolck, which builds and maintains our website, booking system and client account;
• Microsoft 365, for business communication and data storage;
• Microsoft Teams, for the online information session;
• Calendly, for appointment scheduling (we pass on your first name and email address);
• Mollie, for online payment processing;
• Mailchimp, if you have subscribed to our newsletter or other marketing communications;
• Hologic and associated software or systems, where necessary to perform and process DEXA measurements;
• Supabase, for our database and file storage, hosted in the European Union (Ireland);
• Vercel, for hosting our website, with the server functions that process your data running in the European Union (Dublin, Ireland);
• Resend, for sending emails;
• Cloudflare, for the domain name system of our website and for streaming the videos on our website;
• Railway, for hosting the system that manages our website content, which does not contain your health information; and
• other IT, hosting or professional service providers where necessary for our operations.

We aim to prevent service providers from having access to health information where such access is not necessary for the service they provide.

Where another organisation processes personal data on our behalf, we put appropriate privacy, confidentiality and security arrangements in place and enter into a data processing agreement where required.

8. How do we protect your information?

Health information requires a high level of protection.

Vitary takes appropriate technical and organisational measures to protect personal data against loss, unauthorised access, accidental disclosure, alteration and other unlawful processing.

Access to health information is limited to people who need it to perform their work.

Signing in to your client account, and to the environment used by our physician and staff, requires a second step in addition to your password, such as a code sent by email or a code from an authenticator app. After several failed attempts, signing in is temporarily blocked. Each person can only see and do what their role allows.

Security keys are stored in encrypted form. Where we keep IP addresses for security purposes, we store them hashed or shortened, so they do not show your full address. Viewing and changing client records and reports is recorded in a log that cannot be altered afterwards.

Where possible, we keep systems containing health and measurement data separate from publicly accessible systems and limit the transfer of health information to what is necessary.

9. How long do we keep your information?

We do not keep personal data for longer than necessary for the purpose for which it was collected, unless a longer retention period is required or permitted by law.

Administrative and financial information is retained in accordance with applicable statutory retention requirements.

The retention period for health information depends on the nature and purpose of the processing.

Where personal data forms part of a medical record under a medical treatment agreement, the statutory retention period under the Dutch Medical Treatment Contracts Act (WGBO) is generally 20 years, unless a different statutory retention period applies or longer retention is necessary.

Health information that is not subject to such a statutory retention requirement is retained only for as long as necessary for the purpose for which it was collected.

10. Research and improving our services

Vitary aims to contribute to a better understanding of the relationship between body composition, lifestyle, health and longevity.

Fully anonymised information that can no longer be linked to an individual may be used for statistical analysis, research and improvement of our services.

When you book, we also ask separately whether you would like to allow Vitary to use your pseudonymised health and measurement data for research and for the further development and improvement of our services.

This is entirely voluntary. Giving consent is not a condition for using Vitary's services and your decision will not affect the assessment or services you receive from us.

Where your consent is required:

• we ask for it separately and explicitly;
• the option is not pre-selected;
• we explain what we intend to use the information for;
• we limit use to the purposes for which you have given consent; and
• you can withdraw your consent at any time in your client overview on our website, or by emailing us.

Withdrawal of consent does not affect processing or research that lawfully took place before your consent was withdrawn.

11. Marketing and communications

We use your contact information to send communications that are necessary in connection with your appointment or the services you receive.

We only send newsletters, offers or other marketing communications where this is permitted by law. Where marketing is based on your consent, you can withdraw that consent at any time.

Marketing emails include an option to unsubscribe.

We do not use your health information for personalised marketing.

12. Website and cookies

When you visit our website, certain technical information may be processed, such as:

• your IP address;
• browser and device type;
• pages visited;
• date and time of your visit; and
• cookie information.

We only use functional cookies that are necessary for the website to work, for example to keep you signed in, to complete the second sign-in step and to let our editors preview new content.

When you fill in the request form, your browser saves a draft of your answers, first name and email address on your own device, so you can continue later. This draft is removed once you submit the form and is no longer used after seven days. You can remove it at any time by clearing your browser data.

We currently do not use analytical or marketing cookies. If we start doing so, we will first ask for your consent where required by law. More information can be found in our Cookie Policy.

13. International transfers of personal data

Some of the service providers we use may process personal data outside the European Economic Area (EEA).

Where personal data is transferred outside the EEA, we ensure that an appropriate legal mechanism and safeguards are in place, such as an adequacy decision by the European Commission or approved Standard Contractual Clauses.

14. Your rights

Under the GDPR, you have several rights in relation to your personal data.

Depending on the circumstances, you may ask us to:

• provide access to the personal data we hold about you;
• correct inaccurate information;
• complete incomplete information;
• delete information where there is no longer a valid reason to retain it;
• restrict certain processing;
• provide eligible information in a portable format; or
• stop certain processing to which you have a right to object.

Where processing is based on consent, you can withdraw your consent at any time.

These rights are not absolute. For example, where we are legally required to retain certain information, we may not be able to delete it immediately.

You can exercise your rights by contacting us at info@vitary.nl

To protect your privacy, we may need to verify your identity before fulfilling a request.

15. Automated decision-making

Vitary does not make decisions that have significant legal or similar effects on you solely on the basis of automated processing of your personal data.

Digital systems may be used to process information, perform calculations or present results. Where professional or medical judgement is required, this is not based solely on an automated decision.

When you request a scan, the form automatically ends the request if you are under 18, if you are or may be pregnant or are breastfeeding, or if you weigh more than our scanning table can safely support (237 kg). In that case the request is not assessed by a person and you are not charged. All other requests are reviewed by a physician before the scan takes place.

16. Data breaches

Despite appropriate security measures, it is not possible to eliminate every risk of a security incident.

If a personal data breach occurs, we assess its potential impact and notify the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) where required by law.

Where a breach is likely to result in a high risk to your rights and freedoms, we will also inform you in accordance with the GDPR.

17. Questions or complaints

If you have questions or concerns about how we use your personal data, please contact us at info@vitary.nl. We will do our best to address your question or concern.

You also have the right to submit a complaint to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

18. Changes to this Privacy Policy

Our services may evolve over time. We may therefore update this Privacy Policy from time to time.

The most recent version will always be available on our website. If we make significant changes that affect how we use your health information, we will inform you separately where appropriate.

Last updated: 30 September 2026