Privacy policy

Healthy7 Benelux BV is the controller of the personal data processed through this website and the Healthy7 app. You will find us at Frankrijklei 5 bus 0401, 2000 Antwerpen, Belgium, registered under company number 1039.091.615.

If you have a question about your data, reach us at privacy@healthy7.com. We answer within thirty days, and sooner where we can.

We collect no more than we need to fulfil your order and run the site. Specifically:

• Order data: your name, email address, delivery address, billing address, the products you chose, your subscription type and the history of your orders.
• Payment data: the payment method and the status of the payment. Your full card number never reaches us - it goes straight to our payment provider.
• Account data: your email address, your password in encrypted form, and your preferences for the Healthy7 Club.
• Address data from the map: when you allow us to use your location at checkout, we turn those coordinates into an address to save you the typing. We do not keep the coordinates separately from your order.
• Communication: the emails, forms and messages you send us, and our replies.
• Usage data: which pages you visit, from what kind of device, and whether an email from us was opened. See our cookie policy for the detail.
• Pharmacy code: when you order through a pharmacy's QR code or promotional code, we record which pharmacy that was, so that it is credited correctly.

We do not ask about your health and we process no medical data. What you buy can of course say something about your interests, which is why we treat order data as carefully as we would sensitive data and never share it with advertisers.

The GDPR requires a legal basis for every processing operation. These are ours:

• Fulfilling, delivering, invoicing and following up your order - necessary for the performance of our contract with you.
• Running your subscription: scheduling the next delivery, taking payment, pausing or stopping when you ask - performance of the contract.
• Running your account and the Club, including sign-in and comments - performance of the contract.
• Customer service, questions about a delivery, returns and the money-back guarantee - performance of the contract and our legitimate interest in serving you well.
• Accounting, VAT and statutory record-keeping - a legal obligation.
• Our newsletter and offers by email - your consent, which you can withdraw with one click in every email.
• Improving the site, finding faults and preventing abuse - our legitimate interest in a shop that works and is safe. Analytics cookies are only set once you accept them.
• Paying the pharmacy that referred you - our legitimate interest and theirs in a correct settlement.

We do not sell your data. We pass it to the parties needed to get your order to you, and only what they need for that:

• Our webshop and payment platforms, which process your order and your payment.
• The carrier delivering your parcel: your name, address, email address and phone number for the delivery notice.
• Our email software, for order confirmations and - if you signed up - the newsletter.
• Map and address services, to complete your address when you ask them to.
• Our accountant, and the tax authorities where the law requires it.
• The pharmacy that referred you, only as an aggregated settlement - never your name or your address.

We have a data processing agreement with each of them that forbids using your data for anything else.

Our service providers are in the European Economic Area wherever possible. Where processing does happen outside the EEA - certain email and map services have servers in the United States - it rests on an adequacy decision of the European Commission or on the standard contractual clauses, with technical measures such as encryption on top.

• Orders and invoices: seven years, the statutory retention period for accounts.
• Your account: as long as it exists. Ask us to delete it and we do so within thirty days, invoices excepted.
• Newsletter sign-up: until you unsubscribe, and for at most one year after that, to be able to show that you had consented.
• Customer service conversations: two years after the last contact.
• Cookie data: the period per cookie is in our cookie policy.

The GDPR gives you a set of rights you can exercise at any time, free of charge:

• Access to the data we hold about you.
• Rectification of data that is wrong.
• Erasure, where we no longer need it or you withdraw your consent.
• Restriction of processing, while a dispute is running.
• Portability: your data in a readable file, or sent directly to another party.
• Objection to processing based on our legitimate interest, and always to direct marketing.
• Withdrawal of your consent, without that changing anything about what happened before.

Send your request to privacy@healthy7.com. We may ask for proof of identity when we are not certain who is asking - that protects you, not us.

If you are unhappy with how we handle it, you can complain to the Belgian Data Protection Authority (Drukpersstraat 35, 1000 Brussels, gegevensbeschermingsautoriteit.be) or, if you live in the Netherlands, to the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), or in Luxembourg, to the Commission nationale pour la protection des données (cnpd.public.lu).

Traffic to this site runs over an encrypted connection, passwords are stored hashed, and access to order data is limited to the staff who need it. Payment details do not pass through our servers. Should there be a data breach despite all this, with a risk to you, we notify you and the supervisory authority within the statutory deadline.

Healthy7 is meant for adults. We do not target children and do not knowingly sell to minors. If you notice that a child has given us data anyway, tell us and we will delete it.

If something material changes - a new processing operation, a new partner - we update this policy and note the date at the top. For significant changes we tell you by email.