1. General
This privacy and cookies statement (“Statement”) applies to all products, services and activities of CuraDose, located at Princetonlaan 6, 3584 CB Utrecht, the Netherlands, and registered with the Dutch Chamber of Commerce (KvK) under number 42049480. This Statement describes how CuraDose processes your personal data and for what purposes.
CuraDose acts in two capacities. For the personal data of website visitors, account holders and people who contact us, CuraDose is the controller, and this Statement explains how we handle that data. For patient data that healthcare professionals enter into the CuraDose application, CuraDose acts as a processor on behalf of the healthcare institution, which is the controller (see “Processing of patient data on behalf of healthcare institutions” below).
This Statement explains how CuraDose handles your personal data. It does not in itself constitute a request for your consent: where we rely on your consent for a specific processing activity, we ask for it separately and you can withdraw it at any time.
2. Processing of personal data
CuraDose processes personal data for the purposes set out below. For each purpose we describe what the processing involves, the categories of personal data, the legal basis, and the retention period.
Creating and managing an account
To use CuraDose’s products and services, we ask you to create an account and provide account information. We use this data to provide our services, administer your account and keep you informed about your account and orders. Legal basis: performance of the agreement with you (and, where applicable, our legitimate interest in administering our services). Retention: for the duration of the account; the account can be deleted on request.
| Category | Comments |
|---|---|
| Account data: Company name, VAT number, title, first name, last name, e-mail address, phone number, delivery address, invoice address. | For a business or institutional account, the company name and VAT number are required. Entering a telephone number is optional. Signing up for messages about order status and offers is optional. |
Handling contact requests
If you contact us (by e-mail, contact form or otherwise), we process the personal data you provide — such as your name, e-mail address, telephone number and the content of your message — in order to handle and respond to your request. Legal basis: our legitimate interest in responding to enquiries, or steps taken at your request prior to entering into an agreement. Retention: for as long as necessary to handle your request and a reasonable period thereafter.
Sending order updates and offers
If you opt in, we send you messages about your order status and occasional offers. For this we process your name and e-mail address. Legal basis: your consent, which you can withdraw at any time (for example via the unsubscribe link in each message). Retention: until you unsubscribe.
Processing of patient data on behalf of healthcare institutions
The CuraDose application is used by healthcare professionals, who enter patient data — including health data — in order to use its functionality. In respect of this patient data, CuraDose acts as a processor: the healthcare institution using CuraDose is the controller and determines the purposes and means of the processing. CuraDose processes this patient data only on the documented instructions of the healthcare institution and on the basis of a data processing agreement (DPA) concluded with that institution, which sets out arrangements on security, confidentiality and the rights of data subjects. Legal basis and information to patients: these are the responsibility of the healthcare institution as controller; patients with questions about the processing of their data should contact the healthcare institution concerned. Retention: only for as long as necessary to provide our services to the institution and in accordance with the DPA.
Automated decision-making
CuraDose does not take decisions that produce legal effects concerning you, or that similarly significantly affect you, based solely on automated processing of the personal data for which it is the controller. Any clinical decisions made in connection with the CuraDose application are taken by the healthcare professional and remain the responsibility of the healthcare institution.
3. Transfer to third parties (within the EEA)
Only persons authorised by CuraDose to protect or otherwise process personal data, or to perform IT maintenance, have access to your personal data.
CuraDose may engage third parties for the processing purposes described in this Statement. Where these third parties process your personal data on behalf of CuraDose, they do so as processors. CuraDose has concluded a data processing agreement with each such processor, governing among other things security, confidentiality and your rights. These processors process and store your personal data within the EEA. Insofar as a processor is affiliated with an entity outside the EEA, any such transfer is safeguarded as described below.
CuraDose engages processors in the following categories:
- Hosting and cloud infrastructure: Vercel (application hosting, EU region) and Supabase (database, authentication and file storage, hosted in Frankfurt, Germany).
- E-mail and communication tooling: Resend (transactional e-mail) and Twilio (SMS, for multi-factor authentication and notifications).
- Website analytics: Vercel Web Analytics (privacy-friendly and cookieless — no cross-site tracking and no personal profiles).
- Bot protection and website security: Cloudflare (Turnstile).
These processors deliver their services from, and store your personal data within, the European Economic Area. Some of these providers are affiliated with entities established outside the EEA. Where any processing or support activity involves a transfer of personal data outside the EEA, CuraDose ensures an appropriate transfer mechanism is in place, such as the European Commission’s Standard Contractual Clauses, together with supplementary measures where required.
Where third parties themselves determine the purposes and means of processing, they act as controllers and must comply with the GDPR in their own right. For more information, CuraDose refers you to the privacy statements of these third parties.
In all other cases, CuraDose will not provide your personal data to third parties, unless this is necessary for the performance of its services, required by law, or in an emergency where, in CuraDose’s reasonable opinion, this is in your interest.
4. International transfer (outside the EEA)
In principle, CuraDose processes your personal data only within the European Economic Area (EEA), which comprises the EU member states as well as Norway, Iceland and Liechtenstein. This means your personal data is protected under the GDPR or equivalent legal standards.
If CuraDose were to transfer your personal data to parties outside the EEA, it would do so only to countries offering an adequate level of protection, or subject to appropriate safeguards — for example standard contractual clauses approved by the European Commission, a code of conduct or certification.
5. Your rights
You have the following rights regarding the personal data that CuraDose processes as controller:
- Right to information about what happens to your data and why (set out in this Statement).
- Right of access to the personal data CuraDose holds about you and the purposes of processing.
- Right to rectification of inaccurate or incomplete data.
- Right to erasure (“right to be forgotten”), in the cases provided by law.
- Right to restriction of processing, in the cases provided by law.
- Right to data portability, in the cases provided by law.
- Right to object to the processing of your personal data.
You can exercise these rights by contacting CuraDose at info@curadose.io. If you have given consent for processing, you may withdraw it at any time; processing carried out before withdrawal remains lawful. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
Patient data: where CuraDose acts as a processor for patient data entered by healthcare professionals, please direct requests to exercise your rights to the healthcare institution concerned, which is the controller.
6. Retention period
CuraDose does not retain your personal data for longer than is necessary for the purposes described in this Statement, unless a longer retention period is required by law.
7. Security
CuraDose has implemented appropriate technical and organisational measures to protect your personal data against loss, misuse, unauthorised access, and unlawful processing. These measures include, among others:
- Encryption in transit and at rest. All data transmitted between your browser and our systems is protected with TLS. Data stored in our systems is encrypted at rest using AES-256.
- Pseudonymisation before processing. Medical imaging and clinical data are pseudonymised server-side before they reach the CuraDose planning team. Directly identifying information is removed or replaced with pseudonymous references, and the mapping required to reverse this is stored separately under additional encryption.
- Strict access controls and authentication. Access is granted on a need-to-know basis, enforced through role-based access control and row-level security in our database. Accounts are protected by multi-factor authentication (MFA).
- Segregated storage. Uploaded files are held in isolated storage zones. Raw, not-yet-pseudonymised uploads are quarantined and are never accessible to the CuraDose planning team; only pseudonymised data is made available for treatment planning.
- Logging and monitoring. Access to and processing of personal data is recorded in an append-only audit log, retained in line with applicable healthcare record-keeping standards (NEN 7513).
- Hosting within the EU/EEA. All personal data is hosted within the European Union (application hosting in the EU; database and storage in Frankfurt, Germany).
- Confidentiality and data processing agreements. Staff are bound by confidentiality obligations, and data processing agreements are concluded with our partner hospitals and sub-processors.
Our information security practices are designed in line with recognised standards, including ISO/IEC 27001 and the NEN 7510, 7512 and 7513 healthcare information-security norms.
Despite these measures, the transmission and processing of personal data over the internet carries inherent risks. CuraDose cannot guarantee absolute security, but continuously works to maintain and improve the protection of your personal data.
9. Withdrawing consent for cookies
You can withdraw your consent to CuraDose’s use of cookies at any time via the cookie settings in the cookie banner on our website, or by deleting cookies through your browser settings.
You can also set your browser to refuse cookies or to alert you when a cookie is being placed. If you refuse cookies, some parts of our website may not function properly.
10. Modifications
CuraDose reserves the right to amend this Statement. You are therefore advised to review this Statement on the CuraDose website regularly. Continued use of our products and services after amendment implies your acceptance of the amended Statement.
11. Contact
If you have any questions, suggestions or complaints about this Statement or other aspects of our services, please contact us at info@curadose.io.
CuraDose, July 2026