What BASE does with your data.

Who is responsible

Movement Based Therapy, a partnership (maatschap), is the data controller for BASE. I am Jurre Kok, physiotherapist and owner of the practice, and I am also your point of contact for privacy questions. You reach me at info@getbase.coach.

If you use BASE through a practice or coach other than Movement Based Therapy, that practice or coach is responsible for what happens with your file. We then provide the platform and work on behalf of that practice.

Who this applies to

• Patients of the practice who use BASE during their treatment.
• Athletes who use BASE for training without treatment, with or without a coach.
• Therapists, coaches and administrators with an account.
• Visitors of getbase.coach who do not sign in. For them only the section on cookies matters.

What data we process

Your account

Name, email address and year of birth: the practice fills these in when it invites you. We only ask for the year, not your full date of birth. If you fill them in: phone number and a profile photo. We store no citizen service number (BSN) and no insurance details. Those live only in the practice's medical record system, not in BASE.

Your treatment or training

Your injury or goal, your programs and the sessions you log: exercises, weights, repetitions, how heavy it felt, pain scores and how you feel. Also the notes you add and the complaints you log, with a session in BASE or on their own. In addition wellness checks, mobility tests, rehabilitation criteria, clinical tests such as the strength ratio between left and right, test reports, running analyses, the habits you keep track of and the load curve we calculate from all of this.

From connections you switch on yourself

Sleep and sleep stages, heart rate and heart rate variability, respiratory rate, workouts with a heart rate and pace curve, steps, energy expenditure and VO2max. See the section on connections.

Measurements by your therapist

Strength tests and jumps the practice measures with KINVENT equipment in the treatment room. See the section on KINVENT.

Technical data

The time, IP address and device you sign in with, a log of who opens or changes your file (mandatory in healthcare, standard NEN 7513), and if you enable notifications a device token for push messages.

Why, and on what basis

• Treatment (patients): The treatment agreement. For health data: provision of care under professional secrecy (GDPR art. 9(2)(h)). The record-keeping duty under the Dutch Medical Treatment Contracts Act (WGBO).
• Training (athletes): The agreement for using BASE, which is the terms of use. For health data: your explicit consent, which you give separately at your first sign-in.
• Connections with watches and services: Your explicit consent per source, on your device or in that service's sign-in screen. You withdraw it by disconnecting.
• Anonymised cohort insights: Only if you take part. The option is off by default and you switch it off again in the app without any effect on your treatment.
• Email and push notifications: Needed to make BASE work (invitation, sign-in code, reminders). You choose yourself what you do and do not want to receive.
• Security and access log: Legal obligation (WGBO, Wabvpz) and our legitimate interest in detecting misuse.

When you first sign in, you accept the terms of use (in Dutch) and read this privacy statement. If you train as an athlete without a treatment relationship, you also give separate, explicit consent for processing your health data. You can withdraw it at any time under Agreement and consent; without that consent you cannot use BASE.

Who sees your data

As a patient: your treating therapist and their colleagues within the same practice, so a colleague can take over when your therapist is away. That is the same arrangement as for your regular medical file.

As an athlete: only the therapist or coach you have accepted yourself. When you accept, you choose separately whether you share your schedule and training, and whether you share your health data: sleep, heart rate, recovery and other measurements from your wearable. A coach sees nothing from a treatment. You see who you accepted and what you share under Settings, Access. There you turn sharing your health data on or off, and withdraw access.

You: the app has an access log where you see who opened your file and when.

The administrator of the platform sees data only for technical maintenance and for checking the log. Nobody else sees your data. If you are in a training group, its staff see your name and whether you accepted a request. We sell nothing on, show no advertising and share no data with insurers or employers. We hand over data only when the law obliges us to, for instance on a police order.

Connections you switch on yourself

You can connect your Apple Watch (through Apple Health), your Android phone and watch (through Health Connect), your Polar or Garmin watch or your Strava account. BASE then retrieves sleep, heart rate, heart rate variability, respiratory rate, workouts, steps and energy expenditure for as long as the connection exists. Connecting is never a condition for treatment or training. At the moment connections are open to athletes, coaches and therapists; not yet to patient accounts.

• Apple Health: you give permission per data type on your own iPhone. The data goes directly from your device to BASE; Apple does not see that transfer.
• Health Connect: you give permission per data type on your own Android phone. BASE only reads and writes nothing back. The data goes directly from your device to BASE; Google does not see that transfer. When you disconnect in the app, BASE also withdraws that permission in Android.
• Strava: you sign in at Strava and give permission there to read your activities. We keep duration, distance, heart rate and pace, no route and no photos. When you disconnect or delete your account, we withdraw our access at Strava and delete our keys. You can also remove BASE yourself in your Strava settings at any time. Strava Inc. is based in the United States; the only thing we send to Strava is the key you created there.
• Polar: same principle through Polar's sign-in screen. Polar Electro Oy is based in Finland, inside the EEA. When you disconnect we delete the keys and withdraw our registration at Polar.
• Garmin: you sign in at Garmin Connect and choose there what you share (activities, health). We keep duration, distance, heart rate, pace, sleep, heart rate variability, resting heart rate, steps, energy expenditure and VO2max, no route. When you disconnect or delete your account, we withdraw our access at Garmin and delete our keys. You can also remove BASE yourself in Garmin Connect at any time. For users in the EEA, Garmin Würzburg GmbH is responsible; it is based in Germany, inside the EEA.

We store the access keys of these services encrypted. The data itself falls under the same security and retention period as the rest of your file.

Data from Garmin

If you connect Garmin Connect, Garmin gives us the data you share there. You log in to Garmin Connect yourself and choose per type what you share: activities and daily health statistics. You can change that choice at any time in Garmin Connect.

What we receive and keep. From your activities the type, duration, distance, heart rate, pace, calories and the name of your Garmin device, no route or location. From your health your sleep with the time per stage, heart rate variability, resting heart rate, respiration rate during sleep, steps, energy expenditure and VO2max.

What for. You see them in your own BASE account, and BASE uses them to calculate your load and recovery. Your therapist or coach only sees them if you have given that access; see the heading on who sees your data.

Who processes them. Only the companies under "Companies that work for us": Scaleway for the database and hosting. We share Garmin data with no other party, do not sell it and do not use it for advertising. Garmin data does not go to an AI service; see the heading "No AI on your data". Garmin sends the data to an address of BASE itself. We send Garmin no name, email address or internal number, only the key you created yourself.

Where and how long. In BASE in Amsterdam, in the same place and with the same security as the rest of your data; see the heading on how long we keep data. If you disconnect, no new data comes in, we revoke our access at Garmin and we delete our keys. If you also want the Garmin data we already received erased, ask us via the Contact heading, or have your account deleted.

Measurements from KINVENT

The practice measures strength and jumps with equipment from KINVENT (Montpellier, France). Those measurements live in the KINVENT software under the practice's account. Your therapist can link your BASE file to your KINVENT profile and import measurements, so your report and your rehabilitation criteria rest on the same measurement.

BASE stores a reference code to the KINVENT profile and the imported measurements, including the body mass the force plate measures during a jump. Name, date of birth, email address and photo from that profile are not copied. No file information goes to KINVENT. The imported measurements are stored in BASE in Amsterdam, like the rest of your file.

No AI on your data

BASE does not send your data to an AI service. Previously your practitioner could have a draft text written by Anthropic (Claude) for test reports and running analyses, using only your measured values and without your name or year of birth. That feature was removed in September 2026.

Email and push notifications

Email we send through Scaleway: your invitation, sign-in codes and sign-in links, reminders, a message when you are added to a training group, and a message when a therapist or coach asks for access to your data. Such an email contains your email address, your first name, the name of your program, the name of the person asking and possibly an instruction from your practitioner. A sign-in link is valid for seven days, stops working once it has been used and goes only to your own mailbox.

Push notifications go through Expo to Apple or Google, who deliver the message on your device. A device token and a short text go along. That text contains no names of others and no measurements. A few notifications do give a short hint about your own training, for example that your recovery is a bit lower, that your load is rising sharply this week or that you have moved a step further in your recovery. If you do not want that on your lock screen, switch off the Progress and recovery notifications in the app under Settings. You switch all notifications off in the app or in your phone's settings.

App updates also come through Expo. When you open the app, it asks Expo whether a newer version is ready. Your IP address, the type of phone (iOS or Android), the app version and a random code for this installation go along with that request. No account details and no health data are sent.

Companies that work for us

We have a data processing agreement with every company below. They may use your data only to deliver their service to us.

• Scaleway: Hosting of getbase.coach and the server code, the database and storage of all data in BASE, the counters against misuse, and sending email. Amsterdam, the Netherlands; email through France. A French company, within the EU.
• Expo: Passing push notifications on to Apple and Google, and delivering app updates. US, with standard contractual clauses and the EU-US Data Privacy Framework.
• Apple and Google: Delivering push notifications on your device and distributing the app through the App Store and Google Play. US, under their developer terms with standard contractual clauses.

Apple Health, Health Connect, Strava, Polar, Garmin and KINVENT are not processors of ours but sources we read from; see the sections above. Exercise videos are shown through YouTube (in "nocookie" mode) or Vimeo. Only when you tap play does the video load and can that provider see your IP address. No file information goes along. If an exercise has no video, you can tap "Search on YouTube" in the app. That opens YouTube with the name of the exercise as the search; YouTube then sees that search and your IP address. No file information goes along there either.

Outside the EEA

Your data is stored in Amsterdam and your email is sent from France. For push notifications we work with companies from the United States. For those transfers we use the standard contractual clauses of the European Commission and, where the company is certified, the EU-US Data Privacy Framework.

How long we keep data

• Patients: your data in BASE is part of your treatment. The practice keeps the medical file for 20 years after the last change in the file, as the WGBO prescribes (article 7:454 of the Dutch Civil Code). You can have your BASE account deleted earlier; see the section on your rights.
• Athletes: as long as your account exists. If you request deletion, we erase everything 30 days later.
• Messages in the app: BASE has had no messages since 18 October 2026. Anything that was still there we erase no later than 30 days after sending.
• Access log: 5 years.
• Connection keys of watches and services: removed immediately on disconnecting. Push tokens: until you sign out.
• Sent emails: Scaleway keeps a delivery log for delivery purposes.

Security

• Sign-in without a password, with a code or link in your mailbox. Therapists, coaches and administrators must also sign in with a second factor; a new account has seven days to set it up.
• Access is enforced on the server per role and per treatment relationship, down to the database (row level security on every table).
• Encrypted connections, encrypted storage, and the keys of your connections encrypted separately.
• A log of every access and change, which we review monthly.
• Daily backups, with a tested restore procedure.
• Every staff member signs a confidentiality statement in the app. We have the security tested regularly and have a data breach procedure. If you find a vulnerability yourself, email me; we take that seriously.

Your rights

Most of it you arrange yourself in the app, under Settings.

• Access and download: under My data you download your data as a file, including the access log. A few things are deliberately left out, such as drafts and working notes of your practitioner, login keys and other people's data. The file lists exactly what is not in it.
• Correction: you edit your profile details yourself. If something in your file is wrong, tell your practitioner or email me.
• Deletion: under Settings you request deletion of your account. You then have 30 days in which you can withdraw the request. After that we erase your account and all data in BASE, including connected watch data and push notifications. Your medical file at the practice is not included; we keep that for as long as the law prescribes. If BASE holds anything from your treatment, your therapist first adds it as a report to your medical file at the practice. Until that has happened, the erasure waits, and we let you know. Do you use BASE as a therapist, coach or administrator? Then you don't delete your account yourself: what you recorded belongs to the files of your patients and athletes. Email me when you stop and we remove your access to other people's data.
• Portability: the download is a readable file you can hand to another healthcare provider.
• Withdrawing consent: as an athlete you withdraw your consent for health data under Agreement and consent. Your connections with Strava, Polar and Garmin are then disconnected, also at those services. You switch off your participation in cohort insights yourself.
• Objection or restriction: email me. I respond within a month and may ask you to identify yourself.
• Complaint: if we cannot resolve it together, you can turn to the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens.

Under 16

BASE is intended for users aged 16 and over. For a younger patient we create an account only with written consent from a parent or guardian.

Cookies on getbase.coach

Getbase.coach sets only functional cookies: the cookie that keeps you signed in and a note in your browser that you have seen the cookie notice. There are no analytics, no tracking and no advertising cookies. We host fonts ourselves. An exercise video loads only after you tap play.

Changes

If anything changes in how BASE handles data, we update this page and the date at the top. For a substantial change, such as a new type of data or a new company that processes it, we let you know in the app or by email.

Contact