Participants trust your organisation with their health. On this page, you can read how BetterSteps protects their data, and what we agree with you.
All participant data is stored in a data centre in the Netherlands, within the EU. Nothing goes to countries outside the EU.
Hosted by a cloud partner in the West Europe region.
Encrypted and kept for [BEWAARTERMIJN] days.
We regularly test whether we can actually restore a backup.
No advertising or analytics tools from other parties in the app.
Each organisation has its own shielded environment. A bug in the software can never show data from another organisation.
The database itself refuses to show data from another organisation.
The most sensitive data is encrypted per organisation.
For organisations that want full physical separation.
A participant belongs to one organisation.
Access is set per role, down to the level of a single coach. What is not needed is not visible.
For example: a coach only sees their own participants.
Mandatory for administrators, and for participants on a new device.
Logging in on a new device ends the old session.
Only with a reason, temporarily, and always logged.
Participants decide for themselves who sees their health data. Without consent, it stays private.
Only if the participant gives consent.
Only anonymised, and only with separate consent.
Can be done in the app, and erases the data in line with the retention periods.
Participants can request their own data.
Every time someone views or changes sensitive data, it is recorded in an audit log that cannot be altered.
With time, role and reason, but without the sensitive content itself.
Attempts without permission are logged too.
Your data protection officer can request the log for your organisation.
Suspicious login attempts end sessions immediately.
Your organisation is responsible for the data; we process it. We put that properly in writing.
Standard with every contract.
A public list of the parties we use, with their role.
We report a data breach as quickly as possible, so that you can report it within 72 hours.
An independent security test, [FREQUENTIE].
Everything you need for your DPIA and your record of processing activities. Request them and we will send them within one working day.
security@[domein]