Legal
Privacy policy
PRIVACY POLICY (including cookie policy)
Amelio Health BV (“Wellis”, “we” or “us”) respects the privacy of individuals. We are a “controller” within the meaning of the General Data Protection Regulation (EU) 2016/679 (“GDPR”), the Wet Gegevensbescherming 2018 and the Privacy and Electronic Communications Regulations (EU) 2003/2426 (together, the “Data Protection Laws”).
This privacy policy contains important information about the following:
The type of information we collect about you
How that information is used
Who has access to that information
How long we retain your personal data
Our security measures to protect that information
How our processing of your personal data is lawful, and
Your rights under data protection legislation
The term “personal data” means any information by which a living person can be identified, such as name, contact details and photographs.
“Special categories of personal data” relate to more sensitive types of personal data, including (among other things) racial or ethnic origin, physical or mental health or condition, and sex life. These concepts are defined in the Wet Bescherming Persoonsgegevens.
Categories of information collected
We will collect and retain these categories of personal data about you:
General questions or complaints: If you ask a general question or submit a complaint, we need your:
name
contact details (address, telephone number, email address), and
the details of your question or complaint.
Account data: We collect the following data in order to create and maintain your account and to enable the medical services provided to you:
your first and last name
your email address, username and password
your date of birth
your telephone number
your marketing preferences.
Medical information: In order to assess whether the product you have requested can be prescribed to you, you must complete our medical questionnaire in which medical information about you is collected. This is a special category of personal data and may include photographs you submit in connection with your medical consultation.
Purchase of prescribed products: We collect the following information in order to administer your purchases from us:
your contact and delivery details (telephone number, email address and postal address)
your purchase details (product, date, amount)
the prescription issued by a general practitioner. The general practitioner who reviews your medical data decides whether the product you want can be prescribed to you safely.
Payment information: We do not store your payment card details in your account because all payments are handled directly by Stripe Payments Europe, Ltd. Stripe lets us know whether a transaction was successful or not.
Surveys: We may from time to time ask you to give feedback on the quality of our service. For this we need your:
name
contact details (address, telephone number, email address), and
information about how you came to us, how you found us and how you think we can improve our services.
Automatically collected information: When you visit our site or use our services, we automatically collect certain information from the hardware and software you are using at that time, which together with the other information we collect may constitute “personal data” within the meaning of the Wet Bescherming Persoonsgegevens.
If you are an unregistered user, we still collect the following data (which on their own are unlikely to constitute “personal data” within the meaning of the Wet Bescherming Persoonsgegevens, but about which we want to be transparent in any event):
your browsing history on our websites
the information provided by your device and browser, including referral and tracking data, and
your IP address.
Use of collected information
Wellis uses your personal data for the following purposes described below. We may do this on certain legal bases (see the section “Legal basis for the processing of your personal data” for more information):
General questions or complaints (legitimate interests): To answer your general questions and handle your complaints.
Account data (contract): To manage your account, verify your age and identity since some of our products are only available to persons aged 18 to 65 (inclusive), and to provide you with information about Wellis and our company, products and services.
Purchase of prescription products and payment information (contract): To process your payments for products and administer your purchase of products.
Medical information (consent): To share with doctors who assess whether you can safely use the medical products you ordered, based on the answers you give to the questionnaire, and to issue a prescription.
Surveys (legitimate interests): To improve our website, app and/or their respective content, features and/or services; Wellis's products, services, marketing and/or promotional efforts; and to create new products, services, marketing and/or promotions for Wellis.
Retention and sharing of collected information
Wellis shares your personal data with Wellis service providers who process your data as part of the services they provide to us. We take steps to ensure that our service providers handle your data in accordance with the law, use it only in accordance with our contract with them, and store it securely.
Like any business, we use many other suppliers to help us operate and who process your personal data as part of providing their services to us. These providers fall into the following categories:
AWS (eu-west-2) — for data storage and hosting
Google Cloud — for web hosting
Braze — for customer engagement services, including email and SMS storage
Google Analytics and Tag Manager — to analyse and develop our web services
Amplitude — to analyse and develop our product strategy
Facebook — for advertising and marketing
Google AdWords — for advertising and marketing
Looker — for our own business intelligence
In addition, we share your personal data with the following organisations that act as separate controllers. You should read their privacy policy to find out how they process your personal data. If you have questions or complaints about the way they process your personal data, please contact them separately using the contact details on their website.
Huisartsenpraktijk Keijzer and the affiliated doctors who review your medical information in order to prescribe the products
Wellis Pharmacy and other affiliated pharmacies — sell and deliver the prescribed products to you
Stripe Payments Europe, Ltd. — takes payment for the products
Chargebee Inc. — manages the subscriptions
We also share data where necessary to enforce our legal rights, defend legal claims, and where we are legally required to disclose it to courts, police, law enforcement authorities or regulators.
Retention of data
The list below sets out details of how long we process your data.
General questions or complaints:
For general questions, the information is retained until the question has been completed and no further responses have been received for a reasonable period.
If you are an existing customer, the question may be added to other information we hold about you as a customer.
For complaints, the information is retained for up to 6 years after the complaint has been handled.
If you are an existing customer, the complaint and its resolution may be added to other information we hold about you as a customer.
Account data: For the duration of your account and up to 6 years after you have closed your account with us.
Purchase of prescription products: Up to 6 years after purchase.
Payment data: We do not store payment data. Payment data are processed by our service provider Stripe Payments Europe, Ltd.
Medical information: 7 years after purchase.
Prescriptions: 6 years after purchase.
Surveys: For the duration of your account and up to 1 year after you have closed your account with us.
Security
Wellis implements security measures to help protect the personal data we retain. We do this by implementing and using appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, accidental loss or alteration, unauthorised disclosure or access, and other unlawful forms of processing.
We also strive to ensure that the level of security and the measures taken to protect your personal data are appropriate to the risks entailed by the nature and use of your personal data. We do this by following recognised industry practices for protecting our IT environment and physical facilities: for example, we encrypt the transmission of information via the website and app by using SSL (Secure Socket Layer) technology and use AWS and Aptible to provide ISO 27001 and SOC2 compliance for the personal data we store on your behalf.
To safeguard the security of your personal data, we ask you to notify us immediately of any unauthorised visit to, access to or use of the website, or of the loss or unauthorised use of your username or password, via the contact details shown below.
Legal basis for the processing of your personal data
Wellis may process your personal data and special categories of personal data on the following legal bases:
Account data, purchase of prescribed products, payment information, medical information
Contract: Processing your personal data is necessary for the performance of our contract with you. These obligations include facilitating the process of obtaining a consultation with a doctor and purchasing prescribed products from our associated pharmacy. If you do not provide us with your personal data, we cannot fulfil our obligations under the terms of the contract.
Legal claims: We need to process your personal data to defend or bring a legal claim (for example claims relating to our services under the law of obligations).
Special data categories
Explicit consent: We process your special categories of personal data with your explicit consent in order to facilitate your access to a doctor to obtain a consultation and possibly a prescription and the purchase of the relevant prescription medicine from our affiliated pharmacy. Please note that you have the right to withdraw this consent at any time. However, if you withdraw your consent, this means we are unable to fulfil our obligations.
Legal claims: We need to process your personal data to defend or bring a legal claim (for example claims relating to our Membership service under the law of obligations).
General questions or complaints and investigation
Legitimate interests: We may process your personal data where this is based on our “legitimate interests”, i.e. we have good, sensible, practical reasons to process your personal data that are in our interest. To do this, we have considered the impact on your interests and rights and have put in place appropriate safeguards to ensure that the intrusion into your privacy is limited as much as possible. Our legitimate interest is to provide you with the information you have requested, to offer effective and helpful customer service, and to improve our products, services and marketing.
You may object to the processing we carry out on the basis of legitimate interests. See the section “Your privacy rights under data protection legislation” below for more information.
Our use of cookies
Our websites use cookies (small text files stored on your device) to distinguish you from other users. Some of these are set by us and others by our approved third parties.
We use the following types of cookies:
cookies that are strictly necessary for the operation of our site, including those that allow you to log in to the user area, use the shopping cart or make purchases
analytical and performance cookies that enable us to track use of our site before, during and after accessing it and that in turn enable us to improve the site
cookies that improve functionality and the user experience for you, including remembering your visit to the site and personalising the site based on your previous use and preferences, and
targeting cookies, which record your visit to our site, the pages visited and the links followed, and are used to provide you with relevant advertising and information where possible.
At present, the following approved third parties may also place cookies when you use our services:
to display personalised advertisements: Facebook, Google AdWords and Bing
to test our services: Visual Website Optimizer
for our own internal web analytics: Google Analytics and Amplitude
for customer engagement: Braze
for processing payments: Stripe
for subscription management: Chargebee Inc.
These cookies help us to provide you with a personal experience and to improve our services. You can block the use of cookies in the browser settings of your device, but this may mean you cannot access or use our site properly.
Data shared with advertising platforms
With your explicit consent, given via our cookie banner, we share limited data with advertising platforms in order to measure how many people make a purchase on our website after seeing an advertisement (conversion measurement).
What we share: solely a generic conversion event (without product information), a click identifier from the advertising platform, and limited hashed (encrypted) personal data (such as contact details) for attribution.
What we do not share: product names, product categories, page URLs, medical data or data from your medical questionnaire. All shared personal data are hashed in advance and conversion events are passed under neutral names that reveal nothing about the product.
Our partners for conversion measurement, including but not limited to:
Meta Platforms Ireland Limited processes received data as an independent controller in accordance with facebook.com/privacy/policy.
Google Ireland Limited processes received data as an independent controller in accordance with business.safety.google/privacy.
Consent and retention period: if you do not accept marketing cookies, no conversion measurement takes place and no data are shared. You can withdraw your consent at any time via the cookie menu at the bottom of each page. After withdrawal, no new data are shared and we request the platforms to delete previously received hashed data. For the platforms' retention periods we refer to their privacy policy.
Your privacy rights under the Wet Bescherming Persoonsgegevens
You have the following rights under the Wet Bescherming Persoonsgegevens. We will respond within one month of receipt of your request to all rights you exercise, unless the request is particularly complex, in which case we will respond within three months. Please note that there are exceptions relating to some of these rights which we will apply in accordance with the Wet Bescherming Persoonsgegevens.
Right of access to your personal data: You can ask to see what personal data we hold about you and you can obtain:
a copy
details of the purpose for which the data are or will be processed
details of the recipients or categories of recipients to whom the information is or may be disclosed, including if they are abroad and what protection is used for those transfers abroad
the period for which it is retained (or the criteria we use to determine how long it is retained)
any available information about the source of that data, and
whether we carry out automated decision-making or profiling, and if we do, information about the logic involved and the intended outcome or consequences of that decision or profiling.
To help us find the information easily, we ask you to give us as much information as possible about the type of information you want to see.
Right to rectification: You can ask us to correct any errors in your data that we hold, free of charge. If you want to do this, please tell us which information is incorrect and with which information it should be replaced.
Right to erasure (“the right to be forgotten”): You can ask us to erase your personal data when:
you do not believe we need your data in order to process it for the purposes set out in this privacy policy;
if you had given us consent to process your data, you withdraw that consent and we cannot process your data in another lawful way;
you object to our processing and we have no legitimate interests in processing your personal data; or
your personal data have been processed unlawfully or have not been erased when they should have been.
Right to withdraw consent: For the use of data as specified in this privacy policy, you have the right to withdraw the consent you have given us at any time. If you want to withdraw your consent, you can contact us using the details in the “Contact” section. Please note that any processing carried out before the date of withdrawal of your consent remains valid and that published personal data cannot be withdrawn.
Right to restriction of processing: You can ask us to temporarily stop processing your personal data if:
you think your data are not accurate. We will resume processing once we have checked whether the data are accurate or not;
the processing is unlawful, but you do not want us to erase your data; or
we no longer need the personal data for our processing, but you need the data to establish, exercise or defend legal claims.
Right to data portability: You can ask for an electronic copy of your personal data that you have provided to us, that we store electronically and that we process when we have entered into a contract with you. You can also ask us to provide this directly to another party.
Right to object to the processing of your personal data: You can object to the processing of your personal data where we rely on a legitimate interest as the legal basis for processing. If you object to the processing of your personal data, we must demonstrate compelling reasons to continue doing so. We believe we have demonstrated compelling reasons in the section “Legal basis for the processing of your personal data”.
Rights relating to automated decision-making: We do not take automated decisions about you, so this right does not apply.
If your rights under the Wet Bescherming Persoonsgegevens are infringed, you may be entitled to compensation for damage caused by the infringement of the Wet Bescherming Persoonsgegevens.
It is important that you make sure you have read this privacy policy — and if you find that we have not processed your data in accordance with this notice, you should let us know as soon as possible.
You can also lodge a complaint with the Autoriteit Persoonsgegevens (AP), the data protection supervisory authority in the Netherlands. Information on how to do this can be found on the website at www.autoriteitpersoonsgegevens.nl.
Changes to this privacy policy
Wellis may supplement, amend or otherwise adapt this privacy policy from time to time. We will alert you on the website and/or send you an email when changes are made.
Processing takes place on the basis of your prior consent. You may withdraw it at any time with effect for the future. To do so, simply open the cookie menu and untick the relevant consent. Please note that you must make this change to the cookie settings separately for each device.
Contact
Questions about this privacy policy, our websites or apps or our services in general can be addressed to any of the following:
By post: Amelio Health BV with subject line “Data protection”, Hoogstraat 42, 2861 Onze-Lieve-Vrouw-Waver, Belgium.
By email: support@getwellis.com, with subject line “Data protection”.