Privacy notice
Last updated 15 November 2026
This notice explains how Pinnacle Health Systems handles personal data, in line with the EU General Data Protection Regulation (GDPR). We keep it short and in plain words. If anything is unclear, email contact@pinnaclehealthsystems.com.
1. Who is responsible
Pinnacle Health Systems is a sole proprietorship registered with the Dutch Chamber of Commerce (KvK) under number 93106084, at Figarostraat 39, 7323 DB Apeldoorn, the Netherlands. We are the controller for the personal data described in this notice, except for the data in section 7.
Contact for anything about your data: contact@pinnaclehealthsystems.com. We have not appointed a data protection officer, because the GDPR does not require one for our work.
2. What we use, why, and on what legal basis
| When | What data | Why | Legal basis (GDPR) |
|---|---|---|---|
| You book a call | Name, email address, clinic name, clinic website, city and country, the programme you want more clients for, and your phone number if you give it | To hold the call and prepare for it | Article 6(1)(b): steps you ask for before a contract. Article 6(1)(f): our legitimate interest in answering business enquiries |
| We talk or email | What you tell us in calls and emails, and notes we make | To answer your questions and make a proposal | Article 6(1)(b) and 6(1)(f), as above |
| Your clinic becomes a client | Contact details of the people we work with, agreement, invoices and payment details | To deliver our services and send invoices | Article 6(1)(b): performing the agreement. Article 6(1)(c): keeping records that tax law requires |
| You visit this website | Technical data such as IP address, browser, device and the pages requested | To show the website and keep it secure | Article 6(1)(f): our legitimate interest in a working, secure website |
Please do not share health information about yourself or your patients when you book. We do not need it.
We do not use your data for advertising, we do not sell it, and we do not make decisions about you by automated means or profiling.
3. Do you have to give us your data?
No. But without a way to contact you, we cannot arrange a call.
4. Who receives it
The two co-founders, and the service providers we use, who process data only on our instructions under a contract:
- Calendly, which runs our booking page and stores your booking.
- Google, which hosts our email and calendar and runs the video call (Google Workspace and Google Meet).
- Lovable, which hosts this website, together with its own sub-processors, such as Cloudflare for website delivery.
- Our accounting software provider, for invoices.
We share data with authorities only when the law requires it.
5. Transfers outside the European Economic Area
Calendly and some other providers above process data outside the European Economic Area, including in the United States. We only use providers covered by an adequacy decision of the European Commission, such as the EU-US Data Privacy Framework, or by the European Commission's standard contractual clauses. You can ask us for a copy of these safeguards.
6. How long we keep it
- Bookings and emails that do not lead to an agreement: 12 months after our last contact, then deleted.
- Data of client clinics: for as long as the agreement runs, and invoices and financial records for as long as tax law requires.
- Technical data from website visits: only as long as our hosting provider needs it for delivery and security.
7. People who respond to a clinic's ads
When we run campaigns for a clinic, we handle the data of people who respond to its ads on that clinic's behalf. The clinic is the controller and we are its processor, under a data processing agreement (Article 28 GDPR) signed before we start. The clinic's own privacy notice applies to those people, and requests go to the clinic. If we receive one, we pass it on.
On a clinic's behalf, we only send follow-up messages to people who agreed to receive them on the clinic's page, and WhatsApp messages only to people who opted in to WhatsApp. Dashboards and reports show numbers only, never patient names or health information.
8. Cookies
This website does not use cookies or similar technologies for analytics, advertising or tracking, so we do not ask for cookie consent. Our hosting provider sets one strictly necessary security cookie (__cf_bm, from Cloudflare) that protects the site against bots and expires after 30 minutes. It is not used to track you. Our fonts are served from our own website, not from Google. When you click Book a call, our booking calendar from Calendly opens in a window on this page. Only then does Calendly load, and it sets its own cookies and has its own cookie settings. If we ever add analytics or advertising tools to this website, we will ask for your consent first and update this notice.
9. Your rights
You can ask us to:
- show you the data we hold about you, and give you a copy;
- correct it or complete it;
- delete it;
- limit how we use it;
- send it to you or to someone else in a common digital format.
You can also object at any time to our use of your data based on legitimate interest. Email contact@pinnaclehealthsystems.com. We answer within one month and may ask you to confirm who you are.
You can complain to a data protection authority, in the EU country where you live, work or where you think the problem happened. Our lead authority is the Dutch Data Protection Authority (Autoriteit Persoonsgegevens). We would appreciate the chance to fix it first.
10. Security
We protect data with appropriate technical and organisational measures and give access only to the people who need it.
11. Changes
We update this notice when the way we handle data changes. The date at the top shows the latest version.