Privacy Statement

Alzheimer.App B.V. — version 12 October 2026

Alzheimer.App helps people with dementia, family carers, loved ones and care professionals. To do so, you sometimes share sensitive information with us, also about someone else. This statement explains which data we use, why, with whom we share it, how long we keep it and what rights you have.

1. Who we are

Alzheimer.App B.V. is responsible for processing your personal data.

Baarschotsestraat 2, 5087 KW Diessen, the Netherlands
Chamber of Commerce (KvK) 96667400
Email: info@alzheimer.app

2. Who this is about

Users with an account, and visitors who ask Nova a question without an account.
The person a profile is about. Often this is someone with dementia who does not fill in the profile themselves.
Contributors and readers who get access to a profile.
Participants in Connect with others (circles and messages).

3. Which data, why and on what legal basis

Account (name, email address, encrypted password, language): to log in and provide the service. Legal basis: contract (Art. 6(1)(b) GDPR).
Profile (life story, habits, what causes distress and what helps, any health information, photo, What works card): so that Nova gives advice that fits this person. Legal basis: explicit consent via the consent screen (Art. 6(1)(a) and Art. 9(2)(a)). Without valid consent, Nova does not use the profile. See section 4 for who may give that consent.
Conversations with Nova when you are logged in, and short summaries of them: to answer and build on earlier conversations. Legal basis: explicit consent.
Conversations without an account (text of question and answer, language, country derived from the IP address; we do not store the IP address itself here): only to answer your question, not to improve Nova. Legal basis: explicit consent. Before your first question you tick a separate box; we record which version of the text you saw and when, under a random code per browser.
Connect with others (alias, role, circles, messages, contact requests): to make peer contact possible and safe. Legal basis: consent; you switch this feature on yourself.
Access (who is a contributor or reader of which profile): to work together on one profile. Legal basis: contract.
Family subscription (customer and subscription number at Stripe, status, term; no card or bank details): to arrange access to personal advice. Legal basis: contract.
Proof of consent (which consent, for which version of this statement, date and time, a limited reference to your account, any withdrawal; no profile or conversation content): to be able to show that consent was validly given or withdrawn. Legal basis: legal obligation (Art. 7(1) and Art. 6(1)(c)).
Sent email (date, type of email, recipient, subject; not the content): to check who received which email. Legal basis: legitimate interest (Art. 6(1)(f)).
Reminders and tips by email: to help you complete the profile; you can always stop them. Legal basis: legitimate interest.
Notifications on your phone (device code, language, country; notifications contain no content or names). Legal basis: consent via your phone.
Usage statistics (which pages and features are used, with a random code per browser, not your name or account; no message content): to analyse how the app is used and find faults. Legal basis: consent via the cookie notice; without "accept" we collect nothing.
Security log (IP address, requested address, time): to detect misuse and attacks. Legal basis: legitimate interest.

We never use your data for advertising and never sell it.

4. A profile about someone else

Are you filling in a profile about someone else, for example your mother or partner with dementia? Being a family member or carer does not automatically give you the right to consent on someone's behalf. This is how we handle it:

If the person can still understand what it is about, the person decides. So ask them first.
If the person cannot, an authorised representative gives consent, such as a guardian, mentor or holder of a written power of attorney.
On the consent screen you answer the question "May you create this profile on behalf of this person?" with: Yes, this person has given me permission; Yes, I am authorised to represent this person; or No, or I do not know. With the last choice you cannot enter information about this person yet. You can always ask Nova general questions.

Only share what is needed for good advice. The person the profile is about, or their representative, can always ask us to view, correct or delete the data, even without their own account. If it turns out there is no valid consent, we stop using the profile and delete the data.

5. Nova and artificial intelligence

Nova is an AI assistant, not a person and not a doctor. Nova makes no decisions about you; you decide what to do with any advice.
Your question is processed by Microsoft's Azure OpenAI, in data centres within the European Union (EU Data Zone).
For personal advice we include relevant parts of the profile, such as your loved one's first name and what helps. We do not include your email address or account details.
Microsoft does not use your data to train AI models.
Microsoft may keep questions and answers for up to 30 days to detect misuse of the service.
Messages in Connect with others are translated and checked by the same service for contact details, requests for money, hurtful content, advertising and signs of distress.

6. Who we share data with

We have agreements with our processors on security and confidentiality.

Hetzner Online GmbH: the app's servers and database, in Germany (Nuremberg); encrypted backup in Finland (Helsinki).
Microsoft Ireland Operations Ltd.: AI processing (Azure OpenAI) and sending email (Microsoft 365), in the EU.
Stripe: sale and payment of the Family subscription. Stripe acts as reseller and is itself responsible for payment and invoice data; Stripe's privacy statement applies to that. EU (Ireland); transfer to the US possible.
Expo (650 Industries), Apple and Google: notifications on your phone (device code only, no content), US.
WhatsApp (Meta): only if you press a share or contact button yourself.

The fonts of the website and app are on our own server; your browser does not connect to Google for them. We only give data to others where the law requires it.

7. Data outside Europe

Your profile and conversations are stored and processed in data centres within the European Union. With Stripe, the notification services and WhatsApp, data may go to the United States. A provider such as Microsoft may, in exceptional cases of technical support, have access from outside the EU. This only happens with the safeguards the GDPR requires: the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.

8. How long we keep data

Account, profile, photo, What works card, conversations as a logged-in user, Connect with others: until you delete your account or withdraw your consent. After a deletion request you have 7 days to change your mind; then we delete everything permanently.
What you contributed to someone else's profile: stays with that profile, without your name.
Conversations without an account: 30 days, then deleted automatically.
Your earlier conversation when you create a profile: if you create a profile after a conversation without an account, we ask whether Nova may use that conversation once to prepare the profile questions. Only if you say yes does Nova take suggestions from it, which you yourself keep or leave out. The conversation is not linked to your account and is deleted after 30 days.
Usage statistics: after 30 days we remove the details (full address, referring page, exact browser type). After 13 months the individual records are deleted; only anonymous daily totals are kept.
Sent-email register: 90 days.
Security log: about 2 weeks.
Subscription data with us: until you delete your account. Stripe keeps the financial records as seller itself, for 7 years (tax obligation).
Proof of consent: as long as your account exists. After processing ends we keep only this proof, under a code instead of your name or email address, for 5 more years (general limitation period); then it is deleted unless ongoing legal proceedings require longer. For guests we keep only the browser code, text version and time, also for 5 years.
Profiles from before the consent screen, without consent: we ask for consent three times by email. If it does not come, we delete the profile 6 months after the first request. The account remains.
Backups: 30 days, then deleted automatically.

9. Your rights

You have the right to access, rectification, erasure, restriction of processing, objection and data portability.

Withdrawing consent

You can always withdraw your consent, as easily as you gave it: in the app via Profile → Withdraw consent, or by email to info@alzheimer.app. Nova then no longer uses the profile and we delete the profile, the What works card, the photo and the conversations with Nova. Your account remains; you can still ask general questions. What we did before the withdrawal remains lawful.

Other requests

You delete your account and all data yourself via Profile → Delete account.
For all other requests: email info@alzheimer.app. We respond within one month.
Not happy with how we handle your data? You can file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or the authority in your own EU country.

10. Security

We take appropriate measures to protect your data, including encrypted connections, encrypted backups at a second location, strict access control, a second lock on admin pages and an automatic security check that runs every hour. If something does go wrong, we follow the legal rules for data breaches.

11. Age

You must be at least 16 to create an account yourself.

12. Changes

We update this statement when the app or the law changes. We announce important changes in advance and, where needed, ask for your consent again. See also our terms and conditions.