Privacy Policy

1. Introduction

Praxium attaches great importance to the protection of your personal data. In this privacy policy, we explain what data we collect when you visit our website, how we use this data, with whom we share it and what rights you have. This privacy policy applies to all websites and services operated by Digital Front, the company behind the Praxium platform.

2. Data Controller

The data controller for the processing of data on this website is:

3. What Data We Collect

We only collect data that is necessary for the functioning of our website and for processing your requests.

4. Legal Basis for Processing

We process your personal data on the following legal grounds under the General Data Protection Regulation (GDPR), Article 6:

• Legitimate interest (Article 6(1)(f) GDPR): For the operation and security of our website, maintaining server logs, protecting our forms against bots and abuse, and analyzing website usage to improve our services.
• Performance of a contract, or steps you ask us to take before entering into one (Article 6(1)(b) GDPR): For creating your trial workspace, confirming your email address and delivering our services to the organizations that use Praxium.
• Legitimate interest (Article 6(1)(f) GDPR): For answering the messages you send us through our contact form, for holding the calls you book with us and for confirming that we received them.

5. How We Use Your Data

We use the collected data exclusively for the following purposes:

• Operating and maintaining our website
• Creating your trial workspace and sending the email that confirms your address
• Answering the messages you send us through our contact form, holding the calls you book with us and confirming that we received them
• Improving the user experience on our website
• Ensuring the security of our website and protecting our forms against bots
• Complying with legal obligations
• Generating anonymous, aggregated statistics about website usage, including which websites and search engines bring visitors to us

6. Who We Share Your Data With

We only share your personal data with carefully selected service providers that are necessary for the operation of our platform. We have entered into data processing agreements with all of these parties.

Our service providers

Some of these providers are based outside the European Economic Area, or process data there. Vercel, Resend, Upstash, Cloudflare and Google are certified under the EU-U.S. Data Privacy Framework. Supabase and Ahrefs contract with us through companies in Singapore, and for them we rely on the standard contractual clauses approved by the European Commission. You can ask us for a copy of these safeguards at info@praxium.nl.

Two providers also use data for purposes of their own. Cloudflare uses the signals from the security check to improve its bot detection, and is responsible for that use as an independent controller. Ahrefs uses your IP address only to derive your country and city and does not store it; it may use anonymized, aggregated analytics data to improve its own products.

One recipient is not a service provider working on our instructions. When you enter a Dutch postcode and house number, our server asks the public address register (BAG), kept by Kadaster, for the matching street and town. Kadaster answers under its own legal task and decides its own purposes, so it acts as an independent controller and no data processing agreement applies. Only the postcode and house number are sent, never your name, your IP address or any health data.

Two more recipients receive data only when you choose them yourself. In the client portal you can add an appointment or a session to Google Calendar or to Microsoft Outlook (Outlook.com or Microsoft 365). Your browser then opens that service with the date and time, the name and address of the practice, and a link to the appointment in the portal. Google and Microsoft decide their own purposes under the terms you agreed with them, so each acts as an independent controller and no data processing agreement applies. We never send them the service you booked, the name of the person you see, notes or other health details.

We do not sell your personal data to third parties and will never do so.

7. Data Retention

We do not retain your personal data for longer than necessary for the purposes for which it was collected. For platform users (the organizations that use Praxium), specific retention periods apply in accordance with healthcare legislation:

• Trial signup requests you do not confirm: deleted automatically within 3 days
• Trial signup details you confirm: kept for as long as your workspace exists, and deleted together with it
• Contact form messages and booked calls: kept in our mailbox and calendar for as long as we need them to answer and follow up on your message or call, and deleted at the latest 2 years after our last contact
• Server logs: 90 days, automatically deleted thereafter
• Counters that limit repeated attempts on our forms (IP address): deleted automatically after at most 1 hour
• Cookie preferences: until you revoke them or clear your browser data
• Website analytics (Vercel Analytics and Ahrefs Web Analytics): cookie-free, aggregated usage data for understanding website traffic and improving the site
• Security check (Cloudflare Turnstile): Cloudflare keeps the signals only for as long as it needs them for the check and to improve its bot detection
• Admin session data: duration of the session plus 30 days after logout
• Admin audit logs: 7 years. Dutch law requires at least 5 years for logs of access to health data (NEN 7513).
• Patient and client health records: 20 years, in accordance with the Dutch Medical Treatment Contracts Act (Wgbo, Article 7:454 of the Dutch Civil Code)
• Staff employment data: duration of employment plus 2 years after end of employment

8. Your Rights

Under the GDPR (Articles 15 to 21), you have the following rights regarding your personal data:

• Right of access (Article 15): You have the right to know what personal data we process about you and to request a copy thereof.
• Right to rectification (Article 16): You have the right to have inaccurate or incomplete personal data corrected.
• Right to erasure (Article 17): You have the right to request that we delete your personal data, unless there is a legal ground for retaining it.
• Right to restriction of processing (Article 18): You have the right to restrict the processing of your data under certain circumstances.
• Right to data portability (Article 20): You have the right to receive your personal data in a structured, commonly used and machine-readable format.
• Right to object (Article 21): You have the right to object to the processing of your personal data based on our legitimate interest.
• Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing prior to withdrawal.

To exercise any of these rights, please contact us at info@praxium.nl. We will respond to your request within 30 days, in accordance with the GDPR.

9. Security

We take the protection of your personal data very seriously and implement appropriate technical and organizational measures to protect your data against unauthorized access, alteration, disclosure or destruction:

• HTTPS/TLS encryption for all data transmission
• Two-layer encryption at rest: all data is encrypted by our hosting infrastructure through transparent disk encryption, and sensitive personal data is additionally encrypted at the application level with AES-256-GCM before storage in the database
• Role-based access control (only authorized personnel have access)
• Regular security audits and updates
• Incident response plan for data breaches in compliance with the GDPR notification requirement

Security monitoring and audit logging

To protect the security and integrity of our platform, we log IP addresses and browser information for security monitoring purposes. The legal basis for this processing is our legitimate interest in ensuring the security of our platform and the prevention of fraud and abuse (Article 6(1)(f) GDPR). Security audit logs are retained for 7 years in accordance with healthcare compliance requirements.

10. Cookies

Our website only uses strictly necessary cookies and similar browser storage that are essential for the functioning of the website. We do not place tracking, marketing, or analytics cookies. For aggregated website statistics we use Vercel Analytics and Ahrefs Web Analytics, which both work without cookies.

Cookies we use

• Language preference: Remembers the language you selected
• Cookie preferences: Stores your cookie choice in your browser’s local storage, so the banner is not shown on every visit
• Security check on our forms: Cloudflare Turnstile can store strictly necessary data in your browser to tell people apart from bots

For transparency: we use Vercel Analytics and Ahrefs Web Analytics to measure aggregated website usage, such as visits, page views, referring websites, search engines, and device and browser trends. Neither tool sets cookies.

You can adjust your cookie preferences at any time via the cookie settings in the website footer.

11. Third-Party Services

Below you will find an overview of all external services we use, the purpose of processing and what data is processed:

12. Changes to This Privacy Policy

We may update this privacy policy from time to time to reflect changes in our practices, new technologies or legal requirements. In the case of substantial changes, we will inform you via a notice on our website. We recommend that you review this privacy policy regularly. The date of the last modification is indicated at the top of this document.

13. Contact and Complaints

Do you have questions about this privacy policy or about how we process your personal data? Please contact us:

If you believe that your personal data is not being processed correctly, you have the right to file a complaint with the Autoriteit Persoonsgegevens (AP), the Dutch supervisory authority for data protection: