Privacy Policy & Terms of Use
Privacy Policy
Date: 14 May 2025
Version: v2.1
Who we are
The digi.me service is owned by World Data Exchange B.V., Kvk No 88297772, Zuid-Hollandlaan 72596 AL Den Hagg (we, our, us).
We can be contacted in several ways:
By email to: support@wdxglobal.com
In writing to:
Privacy Manager
World Data Exchange B.V.
C/- Spaces Rode Olifant
Zuid Hollandlaan 7
2596 AL Den Haag
Netherlands
Or contact us at www.digi.me
What is the digi.me service? Overview, background, context and functions
The digi.me App, website and associated technology platforms (together referred to as the digi.me service) are designed to function within and support the MedMij appointment system. More information about this appointment system can be found at: https://afsprakenstelsel.medmij.nl/asverplicht/mmverplicht/
The digi.me service provides a solution for the secure exchange and storage of your health information by making it readily available using an encrypted cloud-based data vault.
MedMij is the standard for the secure exchange of health data between healthcare providers and healthcare users in the Netherlands. The digi.me service has been specially built to form a personal health environment (in Dutch: een Persoonlijke GezondheidsOmgeving or PGO) that works within the MedMij appointment system. In general, a PGO is an app or a website where you can retrieve a copy of your health records for free. Often, you can also add health data that you measure yourself. For consistency, this text will refer to the personal health environment, using the Dutch abbreviation PGO.
The MedMij appointment system consists of technical, regulatory and standards-based requirements and safeguards to achieve MedMij's goal of enabling individuals to exchange health data in a vault and reliable manner. Compliance with these, together with the advanced functionalities of the digi.me service, enables this data exchange. It also enables participating PGOs to use the MedMij label referred to later in this section.
As a PGO within the MedMij appointment system, the digi.me service enables you to securely and independently connect to, access and obtain your personal and health data from healthcare providers participating in the MedMij appointment system, and to download your personal and health data to your individual encrypted cloud-based data vault. You can also add your own health data to your data vault such as blood pressure, weight, etc. You can then share this health data yourself with your healthcare provider.
Another feature of the digi.me service is that your connected personal and health data from all your participating healthcare providers can be viewed and managed by you in one location, in real time or near real time, on your own computer or device.
All organisations accredited to offer technologies and services that meet MedMij's high standards are allowed to use the MedMij label, giving healthcare providers and users the assurance that the service is reliable, safe and secure. After achieving the relevant MedMij functional accreditation, ISO and NEN 7510 security certification requirements, the digi.me service is entitled to use the MedMij label. World Data Exchange B.V. is therefore certified to work according to the MedMij standards and thus offer the digi.me service.
The MedMij framework operates against a background of laws and regulations, including the General Data Protection Regulation (GDPR), which requires organisations to provide individuals with information about control, processing, collection, use, disclosure and other handling of their personal data. This Privacy Policy is designed to meet these requirements.
Our approach to data protection
Our approach to data protection is in line with the requirements of Article 25 of the AVG (in English: GDPR), which requires organisations that manage and process personal data to adopt a ‘data protection by design and by default’ approach. This includes technical and organisational measures that support this methodology.
These requirements are complemented by the specific rules and standards established by MedMij under the MedMij agreement system.
Legal Basis for Processing
The legal basis on which we process your personal data (including your health data) is:
Consent, where you have provided us with consent. You should note that you may withdraw your consent at any time by contacting us using the contact details set out at the beginning of this privacy policy. If you do so, this may affect our ability to provide some or all of our services to you.
Necessity, processing your personal and health data is necessary for the performance of our agreement. We process your personal data in order to provide our services.
Some specific examples are the need to collect your e-mail address which is necessary for a login name, and your mobile phone number, which is necessary to enable robust security measures for the 2-factor authentication required. If you are using the digi.me App with a mobile device this can also be done with face recognition or finger print.For administration, security and possibly mandatory adaptation to future services of the encrypted data vaults, we need this personal data. If you do not wish to provide this data, the consequence is that you will not be able to use the digi.me service.
Customer contact and communication
We use your data to communicate with you in connection with our services, but only with your explicit consent to do so.The processing is necessary to comply with a legal duty.This includes keeping records, complying with legitimate requests from competent authorities (e.g. police/judiciary) or to combat terrorist financing, money laundering and fraud.
The processing is necessary to pursue our legitimate interest. We consider processing of your data to be justified if it concerns our interests in relation to your application, the improvement of our services, the maintenance, development and incident management of our services and the performance of general business processes. We also process your data to ensure the security of our services. For example, to detect and prevent fraud, theft and other misuse of our services.
Execution of general business processes, internal management. This includes archiving, insurance and other administrative purposes. But we also process your data for some internal operational processes, for example when we migrate customer data to a new database.
What personal data do we collect?
The personal data collected by the digi.me service is the personal data we collect through or as part of the registration process and to enable us to access your health data in order to encrypt it
Creating an account and logging in
The first step in using the digi.me service is to create an account and log in to the service.
The digi.me service can be accessed through two different ways - through a web browser on your computer or through the digi.me App that you can download on your device, such as a smartphone or tablet.
When you visit the digi.me app (either directly or via the website using the ‘Launch app’ function), you will be asked to create an account or, if you already have an account, to log in.
The personal data required to create your account that we process are:
your e-mail address; and
a mobile or other telephone number capable of receiving a text message used to provide you with the one-time, time-limited verification code required to complete account creation and login.
It is optional to provide your name as part of the sign-up process.
After this, you can select a healthcare provider. Once selected, you will be automatically redirected to MedMij. MedMij will then ask you to authenticate with your DigiD. Once the authentication process is complete, MedMij refers you back to the healthcare provider you selected and you will be asked to grant permission for the digi.me service to access your personal and health data from that healthcare provider. The verification process is carried out and managed by MedMij and DigiD.
How the digi.me service collects personal and sensitive data
Personal and health data collected in the digi.me service are subject to:
the rules and functionalities established for the MedMij appointment system by the MedMij foundation; and
the functionalities of the digi.me service.
These rules and functionalities allow you to select the sources of your health data that you wish to access and to download them via the digi.me service to a unique and encrypted data vault for which you possess the master access key of 256-bit encryption linked to the login ID of your account.
The decision as to which personal and health data is collected by the digi.me service in the encrypted data vault is made by you. Personal and health data retrieved, downloaded and stored in your own encrypted data vault are processed at your direction and with your consent after verification of your account with DigID.
We merely facilitate the data exchange between your digital vault and your healthcare providers. We do not access or use any of your personal data in this process.
You yourself make a copy of the data you want to move and you put the copy in the digital vault yourself. We do not process this copy either as it is encrypted and we do not hold the decryption keys.
You yourself link the digital vault to your healthcare providers' information systems.
You cannot change or modify your health data using the digi.me service.
If necessary, your personal and health data are converted for you so that IT systems can communicate with each other as part of the automated process. Here, too, we do not process your personal data.
Although the digi.me service collects your personal and health data, as determined by you, we do not access this data. Your data is transmitted and stored in encrypted form.
Processing: use and disclosure of personal data
The digi.me service uses your login data to create, maintain and service your digi.me account.
The digi.me service does not and will not access the personal and health data you download to your encrypted data vault using the digi.me service.
If a competent, legally authorised body, such as an enforcement or regulatory authority, requires us to provide access to your digi.me service account, we will have to comply with this requirement as required by law. To the extent permitted, we will take reasonable steps to notify you of any such requirement so that you may contest or otherwise oppose such requirement.
The personal and health data vault is provided by a third-party cloud service provider, Microsoft Azure cloud services, under a service agreement with us. Your personal and health data is encrypted in transit from us to it, within it and when accessed by you using your individual encryption/decryption key.
How does the digi.me service store your personal and sensitive data in your digital vault?
As part of our privacy-by-design approach, we have adopted ‘security-by-design’ to ensure the security and integrity of your personal and health data. We and our service providers take all reasonable measures to protect your personal and health data from misuse, unauthorised access or disclosure. As required under MedMij, the digi.me service is certified to comply with the security standard NEN 7510-1:2017.
When you choose to download your health data, it is automatically encrypted in transit. The data you download or upload to the digi.me service is encrypted with Secure Socket Layer (SSL) technology and placed in your personal digital data vault. We therefore do not process any data from you about your personal and health data in these circumstances.
Other security measures we implement include access controls, regular security audits and ongoing security training for staff.
Additional Functionalities
We make available functionalities that are in addition to those required under the MedMij framework. These additional functionalities enable you to subscribe to additional services. These are provided to users of the digi.me App on a subscription basis undertaken through either the Apple App Store or the Google Play Store.
If you wish to subscribe to these additional functionalities you may do so by clicking on the relevant link. All personal data associated with the subscription transaction, including your credit card details and billing address is processed by the relevant app store and in accordance with their respective privacy policies and terms and conditions, available via this link for Apple and this link for Google. We do not collect or otherwise process such personal data. The only personal data we process is:
that which is necessary to enable the additional functionality. For example, if you subscribe to an additional functionality that involves converting personal data in your digital vault to another format, this processing takes place within our App; and
that which is necessary for us to enable and manage your subscription. This consists of a transaction receipt from the relevant App store that notifies us that you have undertaken the subscription, the service to which you have subscribed and the time of the subscription.
Localisation of data
The digi.me service locates all your personal and health data on servers, computer facilities and infrastructure within the European Union in accordance with the requirements of the Medmij foundation.
Age restrictions
According to the rules of the MedMij Foundation, you must be 16 or older to participate in the PGO framework. This means that you may only use the digi.me service if you are sixteen years of age or older.
Time we keep your personal data
We only keep your personal data for as long as it is needed for the purposes for which it was collected or used and/or as long as required by law.
If you no longer use the digi.me service, we will mark you as ‘inactive’ in our database. In this case, we will no longer actively use your personal data.
Cookies
We only use cookies that enable us to ensure the functionality of the digi.me service, including proper log-in.
We do not use or implement performance, functionality, targeting or advertising cookies.
What are your data protection rights?
Your rights to access data
You can ask us to grant you access to the personal data we hold about you. To do so, please contact us by email at support@wdxglobal.com.
Your right to rectification
You have the right to request us to rectify personal data that we hold about you.
To do so, please contact us by email at support@wdxglobal.com.
If you wish to rectify personal or health data that you download from healthcare providers that participate in and hold your personal or health data as part of MedMij, you must contact the healthcare provider to amend, correct, annotate or rectify the data in question in accordance with the relevant laws and regulatory processes of the Netherlands and all applicable clinical rules and standards.
Your right to erasure
The digi.me service includes a feature that allows you to delete your personal data by deleting your account.
You can delete your account by selecting ‘Delete my account’ from the digi.me main menu icon and following the instructions. Once you have deleted your account, all your data is immediately deleted. This means that copies will no longer be available.
Your right to restrict processing
We do not use, disclose or provide your personal data to third parties for remuneration or otherwise. We do not access your personal and health data for any purpose or reason, unless we are compelled to do so by a law enforcement agency, regulatory authority or otherwise by a person or organisation legally authorised to do so.
Your right to data portability
You may request that we provide you with an accessible copy of the personal data we hold about you in a readily available format.
Such a request can be made by sending an email to support@wdxglobal.com.
Changes
We review this Privacy Policy from time to time to ensure that it remains accurate and up-to-date. If we change this policy, we will notify you in advance via the digi.me/en website and explain the changes. This will not be done by email unless you have given your explicit consent.
Questions or complaints
If you have any questions about how we use your personal data, please contact us at support@wdxglobal.com.
Through this route, you can also ask for our Data Protection Officer.
In addition, you have the right to file a complaint with the supervisory authority, the Authority for Personal Data. You can submit your complaint via the website of the Personal Data Authority. (https://www.autoriteitpersoonsgegevens.nl/en/about-the-dutch-dpa)
Terms of Use
Overview
World Data Exchange B.V., Kvk No. 88297772, Zuid-Hollandlaan 72596 ALs-Gravenhage (WDX, we, our) owns and provides the digi.me service as a personal health environment (PGO) for use with the MedMij health framework (Services).
The website located at digi.me (Site) is also owned and operated by us. Please read these terms (Terms) and our Privacy Policy carefully as they govern your access to and use of the Services and the Site.
These Terms may be amended by us at any time, and by continuing to use the Services and the Site, you accept the Terms as they apply from time to time.
Your use of the Services and the Site
Personal use only
You may view the Site and use the Services using a web browser on a personal computer or mobile device solely for your personal, non-commercial use. Any other use, including the reproduction, modification, distribution, transmission, re-publication, display or performance of the Content on the Site and Service is prohibited.
You must not modify or copy the layout of the Site or any computer software and code contained in the Services.
Must not interfere with the Site
You must not:
interfere with or disrupt the Site or the Services, including by transmitting any viruses, spyware, malware or any other code of a destructive or disruptive nature;
restrict, or attempt to restrict, another user from using or enjoying the Site or the Services; or
encourage or facilitate violations of these Terms.
Cookies
A cookie is a small text file that a website places on a device as you are browsing. These are processed and stored by your web browser.
The Site and the Services only use cookies that are strictly necessary to the proper functioning of the Site and the Services. Neither the Site nor the Services use or deploy other forms of cookies. Your continued use of the Site and Services is taken to constitute your consent to the use of strictly necessary cookies.
Content
General
The Content that is available for you to access and download to your PGO and, through the digi.me Service, to your digital data vault is determined by MedMij’s arrangements with health service and related providers in the Netherlands (Content).
We do not own or control any of the Content.
To the extent necessary you grant us a perpetual, non-exclusive, royalty-free, irrevocable, worldwide and transferable licence to use that Content for the purposes of making available to you the functionality of the Site and the Services.
Security of content
We take all reasonable steps to implement, maintain and enforce security procedures and safeguards to protect the security, confidentiality and integrity of the Site, the Services and any Content from unauthorised access or use by a third party or misuse, damage or destruction by any person.
However, given the nature of the internet, we do not guarantee and cannot ensure the security of Content and we expressly exclude liability for any such loss, however caused.
We recommend you take proactive means to protect your computer system and devices from security risks by installing firewalls, anti-virus software and other security applications.
Blocking
We reserve the right to remove or block any Content that violates our Terms.
Third Party Links
The Site and the Services may contain links to other websites owned and operated by third parties, which are not under our control (Third Party Links).
Third Party Links are provided as a convenience to you and the existence of such links on the Site or in relation to the Services does not constitute an endorsement of them.
We are not responsible for the content or material contained on any Third Party Link.
Intellectual property rights
We or our licensors reserve all intellectual property rights in the Site and the Services.
The Site and the Services are protected by copyright and database rights. Reproduction of the Site and the Services, in whole or in part, including the copying of text, graphics or designs without our prior consent is prohibited.
Nothing in our Terms constitutes a transfer of any intellectual property rights.
All the trademarks, trade names, business names, images and logos (Marks) identified and utilised on the Site belong to their respective owners and are used by us as either owner or licensee. You must not use, reproduce, copy, republish, upload, transmit, post or modify these Marks in any way, unless otherwise authorised by the owner in writing.
Privacy
We will process, collect and handle any personal or sensitive information you provide to us when using the Site of the Services in accordance with our Privacy Policy.
For more information please view our Privacy Policy above.
Disclaimer
The Site, the Services and Third Party Links are provided to you on an 'as is' and 'as available' basis. We give no warranty, guarantee or representation about the accuracy, reliability or timeliness or otherwise of the Site, Materials or Third Party Links.
We do not endorse or support any Content and reliance on any such information is at your own risk.
You are responsible for considering the appropriateness of the Site and the Services for your intended application and use. We do not warrant, guarantee or represent that the Site or the Services are suitable for or meet your requirements.
Exclusions and limitation of liability
To the fullest extent permitted by law, we are not liable to you for any loss or damage you may suffer or incur in connection with your access and use of the Site or the Services.
To the fullest extent permitted by law, we exclude liability for special, indirect or consequential damages, including damages for loss of data, loss of or claim for, revenue, profits, actual or potential business opportunities or anticipated savings or profit.
Any limitations or exclusions do not apply to our liability for loss suffered or incurred by you for:
fraud or other unlawful acts;
gross negligence; or
liability that cannot be limited or excluded by law, including under the law of the Netherlands.
Indemnity
You agree to indemnify us for all losses, damages, liabilities, claims and expenses (including reasonable legal costs) incurred by us arising out of or in connection with your use of the Site or the Services in breach of these Terms or your breach of any rights of any third party.
We reserve the right to assume exclusive control of any matter for which you are required to indemnify us and you agree to provide assistance at your expense for the purposes of defending and managing all such claims as is reasonably requested by us.
Contact us
If you wish to contact us or make a complaint, please contact us via email at privacy@worlddataexchange.com or via the contact us function in the www.digi.me website.
Variation to the Terms
We may vary, amend or otherwise modify the Terms at any time.
We will publish the New Terms on the Site, at which time they will be effective.
Your continued use of the Site following posting of the New Terms constitutes your acceptance of the New Terms.
Severability
If any provision of our Terms is unenforceable or invalid, it will be ineffective to the extent it is unenforceable or invalid and will not affect the enforceability or validity of the remaining provisions.
Jurisdiction
The Terms are governed by the laws in force in the Netherlands.
You and we submit to the non-exclusive jurisdiction of the courts of the Netherlands.
