Privacy Policy

This Policy applies to visitors to and customers of the Website who are located in the EU/EEA or the United Kingdom. For individuals in the EU/EEA, Bluevere Health B.V. is the data controller under the GDPR. For individuals in the United Kingdom, Bluevere Health B.V. is the data controller under the UK GDPR. This Policy does not apply to the websites or services of our suppliers or partners, which have their own privacy notices.

Your test results, including any DNA-based results, are what the GDPR calls "special category data": a class of information the law treats with extra care because of how sensitive it is. This section explains how we handle it.

• Legal basis: we process your health and genetic data on the basis of your explicit consent (Article 9(2)(a) GDPR), which we ask for separately and clearly before you take a test.
• Withdrawing consent: you can withdraw this consent at any time by contacting us. This does not affect the lawfulness of anything we did with your data before you withdrew, but it may mean we are no longer able to provide you with a test result or report you have ordered.
• No use for insurance, employment, or credit decisions: we do not use your health or genetic data to make, or to inform, decisions about insurance, employment, or creditworthiness, whether yours or anyone else's, and we do not sell this data to anyone.
• Limited access: access to your health and genetic data is limited to the staff and service providers who need it to deliver your results and to support you, all of whom are bound by confidentiality and data-processing obligations (see Section 8).
• Genetic counselling: where a result concerns your predisposition to a serious, generally untreatable hereditary condition, we signpost independent genetic counselling resources, as described in Article 13 of our Terms & Conditions.

Our "DEAR" analysis works by automatically processing your test results and questionnaire answers to generate personalised lifestyle insights and recommendations. Under the GDPR, this is a form of "profiling" (Article 4(4)).

• This automated analysis is designed to support general wellness and lifestyle decisions. It does not diagnose disease, and we do not use it to make any decision that would produce legal effects, or similarly significant effects, concerning you without a human being involved.
• Where our analysis flags something that may warrant medical attention, we present this as a prompt to consult a healthcare professional, not as an automated medical decision about you.
• Under Article 22 GDPR, you have the right not to be subject to a decision based solely on automated processing (including profiling) that produces legal or similarly significant effects concerning you. If you believe this applies to a decision we have made, you may ask us for human review, express your point of view, and contest the decision, by contacting us using the details in Section 16.

• The Website sets no cookies of its own. With your prior consent, we use analytics cookies, set by Google Analytics, to understand how the Website is used. We do not use functional or marketing cookies.
• Before you consent, our analytics provider receives a record that a page was viewed, without setting a cookie and without any identifier that would let it recognise you again. Your cookie choice is stored on your own device so that we can honour it.
• We ask for your consent to non-essential cookies through a cookie banner when you first visit the Website, in line with the ePrivacy rules implemented in the Netherlands through the Telecommunicatiewet and, for UK visitors, the Privacy and Electronic Communications Regulations (PECR).
• You can change or withdraw your cookie choices at any time through the cookie settings link in the Website footer, or through your browser settings.

We share personal data only where necessary, and only with:

• The laboratory and testing partners who analyse your sample and generate your results (see Section 9 regarding partners located outside the EEA/UK);
• Logistics and delivery providers, to ship your order to you;
• Payment service providers, to process your payment securely;
• Analytics providers, currently Google, where you have consented to analytics cookies, and to the limited extent described in Section 7 where you have not;
• IT hosting, cloud storage, and software providers, including those supporting our automated analysis features;
• Professional advisers, such as accountants and lawyers, where necessary;
• Regulators and public authorities, where we are required to share data by law.

We do not sell your personal data. Every third party that processes personal data on our behalf does so under a written data-processing agreement that meets the requirements of Article 28 GDPR and binds them to confidentiality and appropriate security measures.

• Some of our service providers are located outside the EEA and the UK. In particular, the laboratory partner that processes certain biomarker samples is located in the United States.
• Where we transfer personal data outside the EEA/UK, we put in place an appropriate safeguard before doing so, such as Standard Contractual Clauses approved by the European Commission (together with a transfer impact assessment), the UK's International Data Transfer Addendum, or reliance on the recipient's certification under the EU-U.S. Data Privacy Framework (and its UK extension), as applicable.
• Transfers of personal data between the EEA and the UK are additionally covered by the European Commission's UK adequacy decisions, renewed on 19 December 2025 and valid until 27 December 2031, which allow such transfers without any additional safeguard.
• You can ask us for more information about, or where legally required a copy of, the safeguard that applies to a particular transfer by contacting us using the details in Section 16.

Under the GDPR and UK GDPR, you have the right to:

• Access the personal data we hold about you;
• Have inaccurate data corrected;
• Ask us to erase your data ("right to be forgotten"), subject to certain exceptions;
• Ask us to restrict how we use your data;
• Receive certain data you have given us in a portable format;
• Object to processing based on our legitimate interests or carried out for direct marketing;
• Withdraw your consent at any time, without affecting the lawfulness of processing before withdrawal.

To exercise any of these rights, contact us using the details in Section 16. You also have the right to lodge a complaint with a supervisory authority. For most EU/EEA residents this will be the Dutch Autoriteit Persoonsgegevens (AP), and for UK residents the Information Commissioner's Office (ICO); see Section 16 for their contact details.

We use appropriate technical and organisational measures to protect your personal data, including encryption of health data in transit and at rest, access controls limiting who can see your data, confidentiality obligations for our staff and processors, and regular review of our security practices. No system is completely secure; if you believe your data has been compromised, please contact us immediately using the details in Section 16.

Our Products and the Website are intended for adults aged 18 and over. We do not knowingly collect personal data from children. If we become aware that we have collected data from someone under 18, we will delete it promptly.

We will only send you marketing communications if you have opted in to receive them. Every marketing email includes an unsubscribe link, and you may also update your preferences at any time by contacting us.

We may update this Policy from time to time to reflect changes in our practices or in the law. We will post the updated version on this page with a revised effective date, and where a change is material, we will take reasonable steps to notify you directly (for example, by email).