Privacy Policy

Gemoedje respects the privacy of visitors, care seekers and care providers. This Privacy Policy explains which personal data we process, why we process it, with whom data may be shared, how long data is retained and what rights you have.

Gemoedje.nl is operated by:

Kiab Management is generally the controller for personal-data processing within the Gemoedje Platform.

Gemoedje is an online platform that helps people seeking care, guidance or support find care providers and make contact with them. Gemoedje does not itself provide care and does not maintain a medical record.

Care providers are independently responsible for personal data they receive and subsequently process for their own professional care or services.

When you create a care-seeker account, we may process the following information:

• Full name.
• E-mail address.
• Telephone number.
• Login and account information.
• Technical data required for account security and operation.

A care-seeker profile is not public. Gemoedje does not store personal search history or selected filters as part of the account. Filters are used to generate search results at that moment.

When you contact a care provider through Gemoedje, this happens via a booking request or a message attached to that request. We then process data necessary to handle that request, such as your name, contact details, the selected provider, the content of your message or note, and the date and time of the request.

This information is stored so that you and the care provider can view and follow up on the request in the Platform. Gemoedje does not routinely read these messages.

Limited technical access may occur where necessary for technical support, security, investigation of fraud or misuse, investigation of Platform-related complaints or compliance with a legal obligation.

A message to a care provider may contain information about health, mental-health concerns, religion or other personal circumstances. Health data and certain information about religion or origin may be special-category personal data under the GDPR and receive additional protection.

Gemoedje therefore asks care seekers not to share more sensitive information in a booking message or note than is necessary to make contact.

• Preferably do not send a complete medical record.
• Do not send a Dutch citizen service number (BSN) or a copy of an identity document.

Do not send an extensive medical history or test results unless this is genuinely necessary and you specifically wish to share it with the provider.

If you deliberately choose to include special-category personal data in a message, that information is processed to enable the contact you initiated with the selected provider. Gemoedje does not use the content of these messages to build a commercial health profile or for advertising profiling.

When a booking request is made through Gemoedje, we may process information such as the selected provider, requested date and time, request status and technical data needed to display the appointment in the Platform.

The provider manages their own calendar. Gemoedje uses booking information to operate the Platform and for necessary communications concerning the booking.

For care providers, we may process information including:

• Full name, profile photo, business name and business address.
• E-mail address, telephone number and other supplied contact details.
• Fees and availability.
• Provider type, specialisms, expertise and treatment methods or ways of working.
• Languages, cultural background, country of origin and religion or belief.
• Consultation formats, target groups and age groups.

Dutch Chamber of Commerce, BIG, SKJ or other professional registration information.

• Subscription status and payment or transaction information for Premium.

A care-provider profile is intended to make the provider findable by care seekers. Information entered on the public profile may therefore be publicly visible.

Public profile information may be visible without logging in and may be indexed by search engines such as Google. Care providers should therefore not place information on their public profile that should not be public.

Cultural background, religion and belief may be special-category or otherwise highly sensitive personal data. These profile fields allow care providers voluntarily to make themselves more findable to care seekers who consider these aspects important to a personal match.

Care providers are not required to provide this information. Where a provider deliberately enters and publishes it, the information becomes part of the public profile and may be used as a search filter.

Where explicit consent is required for this processing, Gemoedje relies on the provider’s explicit and voluntary choice to make the information public. The provider may later change or remove this information.

Gemoedje may consult public sources in an attempt to verify certain profile information, including Dutch Chamber of Commerce registration, BIG registration, SKJ registration and other public professional registrations.

Gemoedje does not verify diplomas. Results of checks may be recorded administratively to help prevent fraud and deception.

Care providers may purchase a Premium subscription. Payments are processed by Stripe. Stripe may process payment details, billing information, technical data and transaction data.

Gemoedje receives information needed to manage the subscription, such as subscription status, payment status, amounts paid and transaction references. Gemoedje does not need to receive or store all complete payment-card details itself.

• Creating and managing accounts.
• Publishing and making care-provider profiles findable.
• Providing search and filtering functionality.
• Facilitating contact through booking requests between care seekers and care providers.
• Processing booking requests and calendar functionality.
• Sending service e-mails and notifications.
• Managing Premium subscriptions and payments.
• Investigating fraud, identity misuse and other abuse.
• Protecting the security and technical operation of the Platform.
• Providing support and complying with legal obligations.
• Maintaining and improving the Platform technically.

• Depending on the processing activity, Gemoedje relies on one or more legal bases under the GDPR.

Performance of a contract: for example, account management, provision of Premium and delivery of Platform functionality.

Legitimate interests: for example, security, fraud prevention, technical logging, support and Platform management, while taking users’ privacy interests into account.

Legal obligation: for example, where financial records must be retained or data must be disclosed under applicable law.

Consent: for example, optional cookies, marketing where consent is required, and where necessary for voluntarily published special-category profile information.

Where processing is based on consent, consent may be withdrawn. Withdrawal does not retroactively make earlier lawful processing unlawful.

Gemoedje may send service messages necessary for operation of the Platform, such as account confirmations, password messages, booking notifications, important account changes and security notices.

The technical mailing environment may be used for such service communications. Creating an account does not automatically constitute valid consent to commercial marketing where separate consent is required by law.

Gemoedje complies with the applicable rules for commercial newsletters and marketing messages. Where marketing is based on consent, unsubscribing must be easy.

Care providers: when a care seeker submits a booking request or shares contact details through Gemoedje, the selected provider receives the data required to respond. The provider then becomes independently responsible for data used for their own services.

Supabase: for parts of the technical infrastructure, authentication, database and Platform functions such as profiles, search, bookings and calendar.

Stripe: for processing Premium payments.

Mapbox: for location and distance functionality, such as searching within a region or radius.

Hostnet: for domain and e-mail infrastructure, including sending service e-mails via SMTP.

Cloudflare Turnstile: to protect forms and the Platform against spam, bots and misuse.

Google Analytics: Gemoedje does not currently use Google Analytics. If analytics tools that require consent are added in the future, they will only be activated after consent is provided and this Policy will be updated.

Own systems: bookings, calendar, notifications and other components are operated through Gemoedje’s own software and connected infrastructure.

Some external suppliers may process personal data outside the European Economic Area. Where required, Gemoedje uses appropriate legal safeguards such as an adequacy decision, standard contractual clauses or other mechanisms permitted by law.

Gemoedje does not retain personal data longer than necessary for the purpose for which it was collected, unless a legal retention duty or justified need requires a longer period.

Active accounts: account and profile data are generally retained while the account remains active.

After account deletion: following a valid deletion request, Gemoedje aims to delete or anonymise the relevant account and profile data within 30 days, unless specific data must be retained longer for a legal obligation, fraud investigation, security, an ongoing dispute or legal rights.

Back-ups: after deletion, data may temporarily remain in technical back-ups. Back-ups are generally retained for a maximum of 90 days before data is overwritten or removed, unless exceptional technical or legal reasons require otherwise.

Financial records: data forming part of legally required financial administration are retained for the applicable tax retention period.

Searches: Gemoedje does not retain a care seeker’s personal search history as part of the user profile.

Gemoedje takes appropriate technical and organisational measures to protect personal data. These may include encrypted connections, authentication, access restrictions, secure infrastructure and measures against spam and automated misuse.

No digital system is entirely risk-free. Gemoedje therefore cannot guarantee that a cyberattack or security incident will never occur.

If a personal-data breach or security incident occurs, Gemoedje assesses the incident and acts in accordance with applicable legal obligations, including where necessary recording and notifying the Dutch Data Protection Authority and/or affected users.

Persons aged 16 and over may use an account independently. For a person under 16, a parent or legal representative must use the Platform on behalf of the child.

If Gemoedje becomes aware that an account for a child under 16 has been created without valid involvement of a parent or legal representative, Gemoedje may request additional verification or remove the account.

Depending on the circumstances, you may have rights under the GDPR including access, rectification, erasure, restriction, objection, data portability where applicable, and withdrawal of consent where processing is based on consent.

If you have a complaint about the way Gemoedje handles personal data, we encourage you to contact us first so that we can investigate. You also have the right to submit a complaint to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Gemoedje may amend this Privacy Policy when services, technology or legislation change. The most recent version will be published on Gemoedje.nl. Registered users may also be informed of material changes.

For privacy questions or requests, you may also use the contact form on Gemoedje.nl.