Privacy policy

1. Introduction

Phase2 Software B.V. ("Phase 2", "we", "us" or "our") attaches great importance to the protection of your personal data. This privacy policy explains which data we collect through this website, why we do so, how long we retain it and what rights you have under the General Data Protection Regulation (GDPR).

This privacy policy applies to your use of the website www.phase2system.com and the services offered there. Use of the Phase 2 EHR platform by healthcare providers is governed by an additional data processing agreement.

2. Data controller

The controller responsible for processing your personal data is:

Phase2 Software B.V. 's Gravelandseweg 51 1217 EH Hilversum The Netherlands

Email: hello@phase2system.com Phone: +31 85 250 22 37

3. Data Protection Officer (DPO)

For questions about how we process your personal data or to exercise your rights, please contact our Data Protection Officer at info@phase2system.com.

4. Personal data we process

We only process personal data that you actively provide to us or that is strictly necessary to make the website work. Specifically:

• Contact form: first and last name, email address, phone number, reason for contact and the content of your message.
• Chat widget: the messages you share with us through our built-in chat, together with technical data (timestamp, page) needed to facilitate the conversation.
• Technical data: IP address (anonymised), browser type, operating system and pages visited. Security logs process this data to keep the website secure; Google Analytics processes similar data only in aggregated, anonymised form for statistical analysis.

5. Purposes and legal bases

We process your data only for the following purposes, each based on a legal ground in Article 6 GDPR:

• Answering questions submitted via the contact form or chat — basis: performance of a (pre-)contractual relationship or your consent.
• Scheduling demos and following up on interest — basis: legitimate interest and/or consent.
• Securing, maintaining and improving our website — basis: legitimate interest.
• Complying with legal obligations such as tax and accounting retention requirements — basis: legal obligation.

6. Cookies and similar technologies

On this website, Phase 2 System uses functional storage (such as localStorage) that is necessary for the site to work — for example to remember your language choice or your cookie preference.

In addition, we use Google Analytics 4 to collect anonymous statistics about how visitors use our website, such as pages visited and where visitors come from. We use this measurement data solely to improve the website. IP addresses are anonymised.

If you accept in the cookie banner, we also use Google Ads measurement to see whether our ads on Google lead to an enquiry through the introduction form. Without your consent this advertising measurement does not take place. Read more about how Google handles data at https://business.safety.google/privacy/.

If you do not want us to measure your website visit, you can decline via our cookie banner, configure your browser to block cookies, or install Google Analytics' official opt-out browser extension.

7. How long we retain data

We do not retain your personal data longer than necessary for the purpose for which it was collected:

• Contact requests: a maximum of 24 months after the last contact, unless an active customer relationship is established.
• Chat messages: a maximum of 12 months after the last message.
• Security logs: a maximum of 6 months.
• Analytics data (Google Analytics): a maximum of 14 months.
• Data we are legally required to keep (e.g. for tax purposes): for as long as the law prescribes, typically 7 years.

8. Sharing with third parties

We never sell your data. We only share it with third parties when this is necessary to provide our services or to fulfil a legal obligation:

• Hosting and cloud providers within the European Union with whom we have a data processing agreement in place.
• Google (Google Analytics) as a processor for anonymous usage statistics, based on a data processing agreement and the Standard Contractual Clauses.
• Competent authorities, where we are legally required to do so.

9. Transfers outside the EEA

We aim to process all your data within the European Economic Area (EEA). Should a transfer outside the EEA nevertheless be necessary, we only do so on the basis of appropriate safeguards such as the European Commission's Standard Contractual Clauses.

10. Security

We take appropriate technical and organisational measures to protect your personal data against loss, misuse or unauthorised access. These include TLS encryption in transit, AES-256 encryption at rest, two-factor authentication for staff and periodic security audits. Our infrastructure complies with the requirements of NEN 7510 and ISO 27001.

11. Your rights

Under the GDPR you have a number of rights regarding your personal data:

• Right of access to the data we process about you.
• Right to rectification of inaccurate or incomplete data.
• Right to erasure ("right to be forgotten").
• Right to restriction of processing.
• Right to data portability.
• Right to object to processing based on legitimate interest.
• Right to withdraw any consent given, at any time.

12. Submitting a request or filing a complaint

Would you like to exercise any of the above rights? Send an email to info@phase2system.com. We will respond to your request within four weeks. To prevent abuse, we may ask you to verify your identity.

Are you not satisfied with how we handle your personal data? You always have the right to lodge a complaint with your national data protection authority — in the Netherlands this is the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).

13. Changes

We may update this privacy policy from time to time, for example when laws or our services change. The most recent version is always available on this page. In the event of significant changes we will inform you actively.