Last updated: 9 October 2026.
BioProfile is a business of 95 Bulls B.V., Kabelweg 57, 1014 BA Amsterdam, KvK 82254753. Superfoodies is a separate business. BioProfile recommends products from Superfoodies as an affiliate partner and may receive a fee for doing so. We are responsible for processing your personal data on bioprofile.com and app.bioprofile.com. Send any questions or requests about your data to support@bioprofile.com.
The health scan. Your answers, your result, your year of birth, your sex, your language and your email address. We use them to create and store your personal analysis, so that you can see your results now and later, and to email you the result. If you create an account, we also store a profile with your health goal, your sex and your language from your most recent scan. Basis: your consent, which you give at the email step, and the service you buy from us. Your answers are about your health and are therefore special category personal data.
The scan in your browser. While you are working through it, your browser keeps your answers on your own device, so that you can carry on after reloading the page. They only reach us at the email step. If you share a device, the next person using the same browser profile can see an unfinished scan; you can clear that storage yourself in your browser.
Emails. If you choose to receive them, we send personal advice that matches your result, or general emails. For this, your email address, your first name, your language, your three main points of attention with their scores, your wellbeing score and your total score, which scan you did, which page you came through and the status of your order are held in our email system (ActiveCampaign). Legal basis: your consent, which you can always withdraw through the link at the bottom of every email.
Which advert or page you came in through. With your scan we store which advert, advertorial or page you came in through, to measure which adverts work. A cookie on bioprofile.com (bp_ft) remembers that for 90 days, also when you go to the scan through our menu. Basis: our legitimate interest in measuring our adverts. You can object to this.
Orders. When you make a purchase we process your order and your payment in order to deliver it; the checkout runs through Plug and Pay (the Netherlands). We keep the order records for seven years, as the law requires. When you buy a plan we currently also send your name, your email address and the product to the server of our tracking partner, to measure the advert that led to the purchase. Basis: performance of the contract, our legal obligation and, for the measurement, our legitimate interest; you can object to that measurement.
Your personal plan and your expert. If you buy a plan, we create it from your answers and store it with your account. If you choose an expert, or one is linked to you, that expert sees your plan and your answers in order to guide you. The expert gives advice under their own responsibility. Basis: the contract; when you choose an expert we are also going to ask you for explicit consent.
Lab values. Lab values you enter yourself are stored with your account, so that you see them in your analysis. Basis: your consent.
Having a lab report read. If you upload a report from another laboratory, we have it read by an AI service, but only with your explicit consent. The service is Claude, from Anthropic. Our contract is with Anthropic Ireland Limited, and the reading takes place in the United States, outside the European Union. The service fills in your values so that you can check them. Anthropic keeps your report for no more than 30 days. It keeps it longer only if Anthropic’s safety review flags it as misuse (then for up to two years) or if the law requires it. Your data is never used to train a model. We delete the uploaded report as soon as you have checked the values. We keep only the values you confirm, as your results, in the European Union. You can delete a report you entered or confirmed yourself at any time on your lab results page. If you delete your whole account, all these results are deleted along with it in one go. Legal basis: your explicit consent.
Measurement on our pages. Our pages currently load measurement scripts from Google (Analytics and Ads), Meta (the pixel, also through our own server) and PostHog, and on bioprofile.com the visit measurement from ActiveCampaign. These measure page visits and events; the address of a page can contain the name of a scan or of a complaint. After you log in or sign up, PostHog can receive your email address. A cookie choice that lets you refuse this measurement is being built and is not there yet. Until it is, you can block measurement scripts with your browser settings or a blocking programme. You can read which cookies and storage these are in our cookie statement. No answer from the scan ever goes to these parties through these measurement scripts.
Our own figures. For our own reports we count how many people do the scan and which complaints come up often. Those overviews show numbers, not people. Basis: our legitimate interest.
Security. We record log-in times and the actions staff carry out on your data. Basis: our legitimate interest in a secure service.
An expert who works with BioProfile can connect a Google Calendar. BioProfile then reads only when the expert’s main calendar is busy (the busy times, never the titles, the guests or the locations of appointments), so a client is never offered a time the expert already has taken.
BioProfile also creates one separate calendar named “BioProfile” in the expert’s own Google account and puts the sessions booked through BioProfile into it. BioProfile never reads or changes any other calendar.
The busy times are used only at that moment and are not stored. BioProfile keeps the connection itself (the permission Google gave, encrypted) until the expert disconnects it in BioProfile or withdraws BioProfile’s access in the Google account. To show the connection, BioProfile also keeps the email address of the connected Google account for as long as the connection exists. Only the expert can see it.
Data from Google is used only to show available times and to book them in BioProfile. It is not sold, not shared with others, not used for advertising and not read by people. BioProfile’s use and transfer of information received through Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements.
We never sell your data. We work with processors that handle your data only on our instructions: the database, storage and server code (Supabase and Vercel, in the European Union, Paris), email (ActiveCampaign and Resend, United States), payments (Plug and Pay, the Netherlands), analytics (PostHog, European Union; Google Analytics, United States), reading lab reports you upload yourself, only with your consent (Anthropic, United States) and the hosting of bioprofile.com. For the Meta pixel, we share responsibility with Meta for collecting and passing on the data. If you choose an expert, that expert sees your plan and your answers.
ActiveCampaign, Resend, Meta and Google process data in the United States. These transfers rely on the EU-US Data Privacy Framework, under which these companies are certified, and on the European Commission’s standard contractual clauses. When you have a lab report read, Anthropic reads it in the United States. Anthropic is not on the Data Privacy Framework list. That transfer relies on the European Commission’s standard contractual clauses in Anthropic’s data processing agreement.
A scan without an account: our policy is 30 days after the last activity; the automatic deletion is not switched on yet, so until then we delete on request. A scan with an account, your profile, your plan and your lab values: as long as your account exists. The data in our email system: until you unsubscribe or ask for deletion. The advertising cookie: 90 days. The records of orders: seven years. Back-ups: twelve months at most.
You can see your data, have it corrected, have it deleted, get a copy, object and withdraw your consent. You can always object to use for direct marketing. Send your request to support@bioprofile.com; we answer within a month. If you ask for deletion, we delete your data with us and ask our email service to delete your contact. You also have the right to lodge a complaint with the Autoriteit Persoonsgegevens.
The scan is for people of 16 and older. Lab testing is for people of 18 and older.
BioProfile gives you an analysis and advice, never a medical diagnosis. If you have complaints that need attention, we refer you to a doctor.
These parts are still being built and are switched off. They only start once this statement describes them and, where that is needed, after you have said yes to them yourself.
You can read which cookies and storage we use in our cookie statement.
If we change this statement in a substantial way, we let you know on this page and, if you have an account, by email.
