Privacy statement.

This is a placeholder, deliberately not a draft privacy statement. Writing plausible-sounding privacy text for a service that processes health data would be worse than writing nothing: it reads as a legal commitment nobody reviewed, and under the GDPR the intake answers are special-category data (art. 9).

The real statement has to cover at least the following, and it needs a legal review before this page goes live:

• Which data is collected: contact details, date of birth, and the questionnaire answers — including the contra-indication questions, which are health data.
• The legal basis. For the health answers that is explicit consent (art. 9(2)(a)); the consent moment and the version of this statement are recorded on every request.
• Who sees it: the reviewing physician. The answers are not included in notification e-mails.
• Retention. Contact details and billing data are kept longer than the questionnaire answers. The answers are deleted 90 days after the physician's decision, or 30 days if the scan turns out not to fit your situation — there is no scan, so the answers have no purpose once the decision has been given. Those two periods follow from the licence and are held as a setting, not written into this text.
• Processors: hosting, database, e-mail delivery, and — only with marketing consent — advertising measurement.
• Cookies and measurement, and how consent is withdrawn.
• Your rights: access, correction, erasure, portability, objection, and the route to the Autoriteit Persoonsgegevens.
• Contact details of the controller, and a data protection officer if one is appointed.

Until the statement is written and reviewed, the consent copy in the questionnaire references this version identifier so it stays traceable which text a person agreed to.