Privacy policy

1. Introduction

Lean Clinic B.V. ("Lean Clinic", "we") provides digital lifestyle support for weight loss, with medical assessment by BIG-registered doctors where medication may be appropriate. In this privacy policy we explain which data we process, why, how we keep it secure, how long we retain it and what rights you have under the GDPR and, where applicable, the WGBO.

2. Data controller

Name: Lean Clinic B.V.
Address: Bargelaan 200, 2333 CW Leiden, the Netherlands
Chamber of Commerce: 97542695
Email: contact@leanclinic.nl

Lean Clinic is the data controller for data processed within our platform and services. BIG-registered doctors and the pharmacy are generally independent data controllers for their own records (electronic patient records and pharmacy records). Data is only shared with the doctor or pharmacy where this is necessary and lawful, for example with your consent or on the basis of the treatment relationship.

3. Who this policy applies to

Clients participating in our programme
Users of our digital services (app, portal and AI coach)
Visitors to our website
Applicants and suppliers (limited; see also our contractual arrangements)

4. What data we process

4.1 Clients

Identification & contact: name, address, city, email, phone number, date of birth and (optionally) gender.
Administration: client number, treatment programme, linked coach and doctor, appointment details, payment references (via payment provider).
Health data: reason for seeking help, medical history, medication use (including GLP-1), relevant measurements (such as BMI, weight and height), contraindications and side effects.
Lifestyle data: eating habits, physical activity, sleep and stress assessments, progress measurements, and answers to questionnaires and assignments.
BSN (citizen service number): only if and to the extent required by law (for example in the context of medication dispensed by the pharmacy), and kept to the minimum necessary.
Identity verification: a photo of your identity document (passport or driving licence) and a selfie for verification purposes. This data is processed by our verification partner Stripe Identity and is not stored by Lean Clinic. See section 7 for details.

4.2 Users of digital services

Account details: name, email and (optionally) phone number.
Usage & technical data: login logs, role (doctor, coach or client), app activity, device and browser information, IP address.
Provided by you: notes, answers, uploads (such as photos) and preferences.
AI coach interactions: the questions and answers you enter. These are used to support you and personalise your programme. No decisions with legal consequences are made based solely on automated processing.

4.3 Website visitors

Forms: name, email, phone (if provided) and your message.
Technical: IP address, device/browser data, cookie IDs (depending on your cookie preferences).

4.4 Apple Health (iPhone app only)

Linking Apple Health is your choice. You switch it on yourself in the app, and in Apple Health you decide per measurement what you share. Without a link we read nothing from Apple Health.

What we read: weight, body fat percentage, waist circumference, blood pressure, glucose, resting heart rate, sleep, steps, activity and workouts, to the extent you allow it.
What for: to pre-fill your weekly check-in and to show your progress in the app. The values you send with a check-in are visible to your care team in your record.
What we write: only the weight you enter yourself in your check-in, so all your weigh-ins are in Apple Health.
Retention: we keep the daily values for as long as the link is on, for the charts in the app. If you remove the link, we delete them. Values you sent with a check-in are part of your record and follow the retention periods in section 9.
Not shared: we do not use Apple Health data for advertising or marketing, do not sell it, and share it with no one outside your care team, except the hosting providers in section 7 that store it for us. The AI coach (Milo) and the AI provider do not receive it.
Withdrawing: in the app via More, Settings, Apple Health, then Remove link. You can also turn off access in Apple Health itself.

5. Purposes and legal bases

Care and support agreement (performance of contract / WGBO): intake, coaching, progress monitoring, medical consultation and (where indicated) physician review for (repeat) prescriptions.
Legal obligations: fiscal retention requirement (7 years), WGBO retention (20 years for medical records), Wkkgz requirements (incidents/complaints).
Legitimate interest: security and logging, quality improvement, prevention of fraud/misuse, service communications.
Consent: where required (e.g. sharing health data with a physician, use of non-essential cookies, marketing emails). You can withdraw your consent at any time.
Scientific and statistical research: anonymising and aggregating data to measure the quality and effectiveness of our programme (Article 9(2)(j) GDPR). See section 10.

6. Sources of data

Directly from you (registration, intake, app/portal, email, (video) consultation).
From your physician (if you give consent for this or on the basis of a treatment relationship).
Automatically via our platform (logs, security events).
From Apple Health, if you switch on the link in the iPhone app (see 4.4).

7. Recipients and categories

Physicians (BIG): independent data controllers for their own EHR; they receive only the data necessary for assessment/consultation.
Pharmacy: independent data controller; medication dispensing and invoicing are handled directly through the pharmacy.
Hosting & infrastructure: database/auth via Supabase (hosted on AWS EU, Frankfurt) and frontend hosting via Vercel. We have data processing agreements in place with these parties.
Payment provider: Stripe (or equivalent) for payments/subscriptions.
Identity verification (Stripe Identity): to confirm your identity, Stripe Identity processes your identity document and selfie. Stripe acts as an independent processor for this purpose and retains this data in accordance with their own privacy policy and applicable law. Lean Clinic receives only the verification result (confirmed/not confirmed) and does not store copies of your identity document. This verification is required under the BIG Act and regulations governing remote prescribing of medication.
Video consultations (Daily.co): video consultations between you and the physician take place via Daily.co, integrated into our platform. The connection is encrypted. No video or audio recordings are made or stored, neither by Lean Clinic nor by Daily.co.
Communication & support: email service and helpdesk tools where needed.
Analytics (PostHog): with your consent, we use PostHog for website analytics and session recordings. Data is stored in the EU (via reverse proxy). PostHog has a DPA with us in accordance with GDPR requirements. See section 13 for details.
Other processors only where necessary and contractually guaranteed (DPA/SCCs).

8. International transfers

We prefer to process data within the EEA. Where transfer outside the EEA takes place (e.g. by a sub-processor), we safeguard this with appropriate measures under the GDPR, such as the EU standard contractual clauses (SCCs) and additional measures where necessary.

9. Retention periods

Medical (EHR) data: in principle 20 years (WGBO), unless a different statutory period applies.
Coaching/lifestyle data: for as long as necessary for the programme and quality purposes; after that we delete or anonymise this data, unless a legal obligation requires longer retention. What we do with anonymised data is set out in section 10.
Financial records: 7 years (fiscal retention requirement).
Log files: retained in accordance with our information security policy and proportionality (security/forensic needs).

10. Anonymised and aggregated data

The combined data of all our clients teaches us what works: how weight develops on average, which guidance has an effect and how medication is experienced. For insights like these we process data such as check-ins, weight development and medication use so that it can no longer be traced back to a person. We remove identifying details and only report on groups large enough that nobody can be recognised.

We use the outcomes to improve and substantiate our programme, for scientific and statistical research, and for publications about our results. We may also share them with third parties, for example healthcare providers and researchers. We never share or sell data from which you can be identified for this purpose.

Legal basis: anonymising is itself a processing of your data. We base it on scientific and statistical research (Article 9(2)(j) GDPR in conjunction with Article 89 GDPR and Article 24 of the Dutch GDPR Implementation Act) and, for data from your medical record, on Article 7:458 of the Dutch Civil Code. Once data is genuinely anonymous it is no longer personal data and the GDPR no longer applies to it. Lean Clinic holds the rights to the anonymised and aggregated outcomes.

Objecting: if you do not want your data used for this, let us know at contact@leanclinic.nl. We will then exclude you, without any consequences for your treatment. Outcomes that have already been anonymised or published cannot be withdrawn.

11. Security

Encryption in transit (TLS/HTTPS) and encrypted storage where appropriate.
Separate roles and permissions (doctor/coach/administrator), row-level security and policy checks.
Strict need-to-know principle; coaches have no access to medical records held by doctors.
Authentication and access control; periodic review of authorisations.
Automatic logging of (medical) changes; daily encrypted backups.
Incident and data breach procedure (notification to the AP within 72 hours where required; informing those affected in the event of high risk).

12. Your privacy rights

Access: a copy of your personal data.
Rectification: correcting inaccurate data.
Erasure: where possible and not in conflict with legal retention obligations (e.g. WGBO).
Restriction: temporarily limiting the processing of your data.
Data portability: in a transferable format, to the extent required by law.
Objection: to processing based on legitimate interest or marketing.
Withdraw consent: withdrawal cannot be applied retroactively, but it does apply to any future processing.

You can exercise your rights by contacting us at contact@leanclinic.nl. We aim to respond within 30 days. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens). We kindly ask you to reach out to us first so we can resolve things quickly.

13. Cookies and tracking

13.1 Types of cookies

Functional cookies: necessary for authentication, security and core functionality.
Analytical cookies: for website analysis and user insights. We only place these with your consent via the cookie banner.

13.2 PostHog (Analytics)

With your consent, we use PostHog for website analysis and user experience research. PostHog collects:

Page visits, click behaviour and scroll depth
Device and browser information (type, operating system, screen size)
Anonymised IP address (last octets removed)

Purpose: improving the user experience, identifying technical issues and optimising our service.

Data location: PostHog data is stored in the EU (via our own server with a reverse proxy to PostHog Cloud EU). PostHog has signed a DPA (Data Processing Agreement) with us in accordance with GDPR requirements.

Retention period: analytical data is kept for a maximum of 12 months, after which it is automatically deleted or anonymised.

13.3 Your choices and control

On your first visit, a cookie banner will appear where you can choose to accept or decline analytical cookies.
You can withdraw your consent at any time by clearing your browser cookies and refreshing the page. The cookie banner will then appear again.
If you decline, we will not place any PostHog cookies and no analytical data will be collected.
To withdraw your consent, you can also contact us at contact@leanclinic.nl.

13.4 Advertising attribution (first-party)

If you arrive on our website via an advertisement, we record the campaign parameters from the link (utm_source, utm_medium, utm_campaign, utm_content and utm_term) and the Meta click identifier (fbclid) in our own (first-party) cookie. If you create an account, we store this data with your own registration in a separate table. Purpose: measuring which advertisements lead to sign-ups and subscriptions, so that we can assess the effectiveness of our advertising ourselves without depending on Meta to track the conversion. Legal basis: legitimate interest (efficient use of our advertising budget). This data is kept separate from your medical record and is not used to track or infer health characteristics or conditions.

14. AI, profiling and automated decision-making

Our AI coach helps you with personalised guidance based on information you provide. The AI does not make solely automated decisions with legal consequences or similarly significant impact. Medical indication/prescription is always assessed by a doctor.

14.1 Automated eligibility check

When you sign up, you complete a medical questionnaire. Our platform automatically checks whether, based on the information you provide, you meet the eligibility criteria for the treatment programme. These criteria are established in advance by the doctors at Lean Clinic.

If your answers suggest you may not be eligible (for example, due to certain contraindications), you will be informed of this. This is not a medical decision: the doctor always makes the final decision about admission to the treatment programme, following your consultation.

You have the right to request a personal reassessment if the automated check indicates you may not be eligible. You can do so by contacting us at contact@leanclinic.nl.

14.2 AI coach (Milo) and data sent to the AI provider

Our AI coach helps with lifestyle (nutrition, movement, sleep, stress and habits), explains common side effects based on our own medically reviewed information, and answers questions about your subscription and orders. The AI coach does not give medical advice and does not make diagnoses. It refers questions about medication or dosage to your care team, and in urgent situations it refers you to your GP or 112.

For the AI coach, we use an external AI provider (Anthropic). To protect your privacy, we do not send directly identifying data (such as your name) to the AI provider; where necessary, your age is used instead of your date of birth. The data processed for guidance purposes is processed exclusively under a data processing agreement and is not used to train the provider's AI models. Your care team may view AI conversations for quality control and guidance purposes.

When you send a message to your care team, the AI provider may read that message and the earlier conversation to prepare a draft reply for the team. Your prescription and your age are included, but not your name, date of birth or contact details. A member of the care team reads every draft, edits it where needed and sends it themselves: no reply is ever sent to you automatically. The care team also uses the same AI provider to translate or improve a message, without your name. The data processing agreement and the commitment that your data is not used to train AI models apply here too.

15. Minors

Our services are aimed at adults (18+). We do not process data from minors for this programme. If we have inadvertently received data relating to a minor, we will delete it upon notification.

16. Changes to this privacy policy

We review this policy at least once a year. For significant changes, we'll let you know by email or in the app. The most recent version is always available on our website.

17. Contact

Questions or requests? Email us at contact@leanclinic.nl.