Last changed: 30 September 2026.
BioProfile is a company of 95 Bulls B.V., Kabelweg 57, 1014 BA Amsterdam, KvK 82254753. We are responsible for the processing of your personal data on bioprofile.com and app.bioprofile.com. Send questions or a request about your data to support@bioprofile.com.
The health scan. Your answers, your result, your year of birth, your sex, your language and your email address. We use them to create and store your personal analysis, so that you can see your results now and later, and to email you the result. If you create an account, we also store a profile with your health goal, your sex and your language from your most recent scan. Basis: your consent, which you give at the email step, and the service you buy from us. Your answers are about your health and are therefore special category personal data.
The scan in your browser. While you are working through it, your browser keeps your answers on your own device, so that you can carry on after reloading the page. They only reach us at the email step. If you share a device, the next person using the same browser profile can see an unfinished scan; you can clear that storage yourself in your browser.
Emails. If you choose to receive them, we send personal advice that matches your result, or general emails. For that, your email address, your first name, your language, your three main points of attention with their scores, your wellbeing score and your total score, which scan you did, which page you came in through and the status of your order are held in our email system (ActiveCampaign). At the moment we share that system with Superfoodies; a separate BioProfile account is being prepared. Basis: your consent, which you can withdraw at any time through the link at the bottom of every email.
Which advert or page you came in through. With your scan we store which advert, advertorial or page you came in through, to measure which adverts work. A cookie on bioprofile.com (bp_ft) remembers that for 90 days, also when you go to the scan through our menu. Basis: our legitimate interest in measuring our adverts. You can object to this.
Orders. When you make a purchase we process your order and your payment in order to deliver it; the checkout runs through Plug and Pay (the Netherlands). We keep the order records for seven years, as the law requires. When you buy a plan we currently also send your name, your email address and the product to the server of our tracking partner, to measure the advert that led to the purchase. Basis: performance of the contract, our legal obligation and, for the measurement, our legitimate interest; you can object to that measurement.
Your personal plan and your expert. If you buy a plan, we create it from your answers and store it with your account. If you choose an expert, or one is linked to you, that expert sees your plan and your answers in order to guide you. The expert gives advice under their own responsibility. Basis: the contract; when you choose an expert we are also going to ask you for explicit consent.
Lab values. Lab values you enter yourself are stored with your account, so that you see them in your analysis. Basis: your consent.
Measurement on our pages. Our pages currently load measurement scripts from Google (Analytics and Ads), Meta (the pixel, also through our own server) and PostHog, and on bioprofile.com the visit measurement from ActiveCampaign. These measure page visits and events; the address of a page can contain the name of a scan or of a complaint. After you log in or sign up, PostHog can receive your email address. A cookie choice that lets you refuse this measurement is being built and is not there yet. Until it is, you can block measurement scripts with your browser settings or a blocking programme. You can read which cookies and storage these are in our cookie statement. No answer from the scan ever goes to these parties through these measurement scripts.
Our own figures. For our own reports we count how many people do the scan and which complaints come up often. Those overviews show numbers, not people. Basis: our legitimate interest.
Security. We record log-in times and the actions staff carry out on your data. Basis: our legitimate interest in a secure service.
An expert who works with BioProfile can connect a Google Calendar. BioProfile then reads only when the expert’s main calendar is busy (the busy times, never the titles, the guests or the locations of appointments), so a client is never offered a time the expert already has taken.
BioProfile also creates one separate calendar named “BioProfile” in the expert’s own Google account and puts the sessions booked through BioProfile into it. BioProfile never reads or changes any other calendar.
The busy times are used only at that moment and are not stored. The connection itself (the permission Google gave, encrypted) is kept by BioProfile until the expert disconnects it in BioProfile or withdraws BioProfile’s access in the Google account.
Data from Google is used only to show available times and to book them in BioProfile. It is not sold, not shared with others, not used for advertising and not read by people. BioProfile’s use and transfer of information received through Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements.
We never sell your data. We work with processors that process your data only on our instructions: the database and the storage (Supabase, in the European Union, Paris) and the server code (Vercel; it runs in the United States at the moment and is moving to the European Union), email (ActiveCampaign and Resend, United States), payments (Plug and Pay, Netherlands), statistics (PostHog, European Union; Google Analytics, United States) and the hosting of bioprofile.com. For the Meta pixel we are responsible together with Meta for the collecting and the passing on. If you choose an expert, that expert sees your plan and your answers.
ActiveCampaign, Resend, Meta and Google process data in the United States. Our server code (Vercel) also runs there at the moment; the database is in the European Union. Those transfers rest on the EU-US Data Privacy Framework, for which these companies are certified, and on the standard contractual clauses of the European Commission.
A scan without an account: our policy is 30 days after the last activity; the automatic deletion is not switched on yet, so until then we delete on request. A scan with an account, your profile, your plan and your lab values: as long as your account exists. The data in our email system: until you unsubscribe or ask for deletion. The advertising cookie: 90 days. The records of orders: seven years. Back-ups: twelve months at most.
You can see your data, have it corrected, have it deleted, get a copy, object and withdraw your consent. You can always object to use for direct marketing. Send your request to support@bioprofile.com; we answer within a month. If you ask for deletion, we delete your data with us and ask our email service to delete your contact. You also have the right to lodge a complaint with the Autoriteit Persoonsgegevens.
The scan is for people of 16 and older. Lab testing is for people of 18 and older.
BioProfile gives you an analysis and advice, never a medical diagnosis. If you have complaints that need attention, we refer you to a doctor.
These parts are still being built and are switched off. They only start once this statement describes them and, where that is needed, after you have said yes to them yourself.
You can read which cookies and storage we use in our cookie statement.
If we change this statement in a substantial way, we let you know on this page and, if you have an account, by email.
