Plants for Health
Privacy Notice
Version 1.1 — effective 31 August 2026
This notice explains what personal data we collect, why, who we share it with, how long we keep it, and what you can ask us to do. It applies wherever you live.
1 Who we are
Plants for Health B.V., Stadhouderslaan 77, 3583 JE Utrecht, the Netherlands. Registered with the Dutch Chamber of Commerce under number 93914369. VAT identification number NL866571711B01.
We are the controller of the personal data described in this notice.
Contact for anything to do with your data: [email protected]. We monitor this address and confirm receipt of every request.
2 What this notice covers
This notice covers our website, our learning platform, our Community, our group sessions, our webinars, and our email correspondence with you. We do not sell physical products through this website.
If you are a resident of Washington or Nevada, our Consumer Health Data Privacy Policy also applies to you. It is a separate document, available on our Legal page at plants-for-health.com/legal, and it deals specifically with health information. Where the two differ in respect of health data, that policy applies.
If you buy the printed edition of Past the Pain from Amazon or a bookseller, your contract is with that retailer and they handle your data, not us.
3 What we collect
From you, when you buy something or sign up:
- your name and email address;
- your country of residence, which determines your tax treatment and which regional annex of our Terms applies to you;
- the fact that you gave the three declarations described in clause 4.2 of our Terms, with the date and the version you accepted;
- the fact that you accepted our Terms, the applicable Annex and our Health Disclaimer, with date, time and version;
- whether or not you gave the optional consent to our processing of health information you choose to share, with the date and the version you accepted.
When you register for a webinar:
- your name and email address. We use them to give you access, to send you the recording afterwards, and to send you occasional emails about our work. Every one of those emails has an unsubscribe link, and when you unsubscribe we delete your registration details.
When you pay:
- payment data, which is processed by Stripe. We see the amount, the currency, the date and the last four digits of your card. We never see or store your full card number.
While you take part:
- which lessons you opened and completed, and whether you opened our program emails. This happens in the learning platform, Kajabi;
- what you post in the Community, including anything you choose to share about your health;
- what you tell us in emails or support messages.
Automatically:
- your IP address and basic technical data, logged by our providers for security and to deliver the service.
We do not ask you for a diagnosis, your medication, your weight, your BMI or any test result. There is no intake questionnaire and no medical file.
4 Why we use it, and our legal basis
| What for | Legal basis | Notes |
|---|---|---|
| Giving you access to what you bought, and running the program and the Community | Performance of our contract with you | |
| Taking payment and keeping the records the tax authorities require | Performance of our contract, and a legal obligation | Dutch tax law requires us to keep invoices for 7 years |
| The declarations you give before you enrol | Performance of our contract with you | They are framed so that they do not reveal a health condition. See clause 5 |
| What you choose to share about your health in the Community or by email | Your own decision to share it | You are never required to share it |
| Giving you access to a webinar you registered for | Performance of our contract with you | |
| Sending you the recording of a webinar, and occasional emails about our work afterwards | Your consent | Every one of those emails has an unsubscribe link |
| Sending you emails about the program you are taking | Performance of our contract | Every email has an opt-out link |
| Sending you our newsletter or offers | Your consent | You can unsubscribe at any time |
| Answering questions, handling complaints, and defending or bringing legal claims | Our legitimate interest, and a legal obligation where one applies | |
| Keeping our systems secure and preventing fraud | Our legitimate interest |
No automated decisions. We do not make decisions about you by automated means that have legal or similarly significant effects, and no decision about your suitability for a program is ever made by a system. We do not profile you.
5 Health information
We do not ask you about your health. Before you enrol, we ask you to give three declarations, described in clause 4.2 of our Terms: the safe fit declaration, the medication declaration, and the program understanding declaration.
The first two are worded so that they do not reveal anything about your health. Each situation they mention — pregnancy or breastfeeding, being underweight or losing weight without meaning to, a planned operation or procedure, an eating disorder or a disordered relationship with food, and the use of prescription medication or being monitored by a doctor — can be confirmed in either of two ways: because it does not apply to you, or because it does and you have discussed taking part with your doctor, who supports it. Either way you tick the same box, and nothing about your health follows from it. The third declaration is about how the program works and contains no health information at all.
We record only that you gave each declaration, on which date, and against which version of our Terms. We do not record why, and we do not ask. Because that record does not reveal a health condition, we process it on the basis of the performance of our agreement with you, and not on the basis of consent. We do not derive, infer or store any information about your health from it.
Sharing anything about your health is optional. Whatever you choose to tell us, or to post in the Community, may be data concerning health. We process that only with your explicit consent, which you give by an optional fifth tick box at checkout, or at the moment you share it. That box is never pre-ticked, it is not bundled with anything else, and you can take part in the whole program without ticking it. Not giving it has no effect on your access.
You may withdraw that consent at any time, and we will remove your contributions on request. Withdrawing it does not give rise to a refund, except where clause 10 of our Terms applies.
You can take part in the Community under a name of your choosing, and we recommend you do if you intend to write about your health. Other participants then see only that name. This does not make your posts anonymous to us.
Some laws, including the Washington My Health My Data Act, define health data more broadly than the GDPR does. Where they apply to you, we treat these declarations as consumer health data as well, and our Consumer Health Data Privacy Policy describes how.
We are not a covered entity or a business associate under the United States Health Insurance Portability and Accountability Act, and we do not provide services that it governs.
6 Who we share it with
We share your data only with providers who process it on our behalf, under a written data processing agreement. We do not sell your data, we do not rent it, and we do not share it for anyone else's advertising.
| Provider | What they process | Role |
|---|---|---|
| Kajabi | Account, enrolment, lesson progress, Community posts, video viewing, program emails | Learning platform, community and program email |
| Microsoft | Email correspondence, our internal documents, and the long-term record of your declarations, via SharePoint | Email and document storage |
| mijn.host | Hosts our website, including the declaration form. Entries are permanently deleted within 2 days | Website hosting. Established in the Netherlands |
| Zapier | The confirmation record of your declarations, briefly, while it is routed from our website to SharePoint | Automation between our systems. Established in the United States |
| Zoom | Webinar registrations, and the recordings of our webinars | Webinar hosting. Established in the United States |
| Cloudflare | Technical signals from your browser, including your IP address, when you submit a form on our website | Protecting our forms against automated abuse. Established in the United States |
| Brevo | Your email address, and whether you opened our emails | Sending our newsletter |
Payments. Payments are handled through Stripe's managed payments service, with Sold through Link, LLC as merchant of record. That company is not our processor: it decides for itself what it does with the payment data it needs in order to take your payment, issue your receipt and meet its own tax and anti-fraud obligations. We receive from it the amount, the currency, the date, the last four digits of your card and the name of the product you bought. We never see or store your full card number. For what that company does with your data, see its own privacy statement.
We may also disclose data to our accountant or to a professional adviser where we need advice, to a public authority where the law requires it, or to protect someone from serious harm.
If our business is ever transferred to another party, your data may transfer with it. We would tell you in advance, and clause 20 of our Terms sets out your right to end the agreement in that case.
7 Sending data outside Europe
Kajabi, Microsoft, Zapier, Zoom and Cloudflare are established in, or have parent companies in, the United States. Where your data is transferred out of the European Economic Area, that transfer is safeguarded by the European Commission's Standard Contractual Clauses, or by another mechanism recognised under the GDPR such as the EU–US Data Privacy Framework.
Sold through Link, LLC, the merchant of record described in clause 6, is also established in the United States. It is not our processor but decides for itself what it does with the payment data it needs, so the safeguards above do not describe that relationship. Its own privacy statement explains how it handles your data and where.
Brevo (France) and mijn.host (the Netherlands) process your data within the European Economic Area.
You may ask us for details of the safeguards that apply to a particular provider.
8 Cookies and tracking
We do not use advertising pixels, and we do not use website analytics. We do not follow you across other websites, we do not build advertising profiles, and we do not share anything about you with advertising platforms.
The cookies we and our providers set are the ones needed to make the site and the platform work: to keep you logged in, to remember what is in your basket, and to let Stripe detect fraudulent payments.
Our forms are protected against automated abuse by Cloudflare Turnstile. It checks whether a submission comes from a person rather than from a script, using technical signals from your browser, including your IP address. It does not follow you across websites, it is not an advertising platform, and it sets no advertising cookies.
Our Cookie Policy lists every cookie in use, what it does and how long it lasts. It is kept up to date, and you can reach it from our Legal page at plants-for-health.com/legal and from our cookie notice. Where a cookie is not strictly necessary, we ask for your consent before we set it, and you can change or withdraw that consent at any time using the link in our cookie notice.
If we ever introduce advertising pixels or analytics, we will ask for your consent first, we will say so in our Cookie Policy, and you will be able to refuse without losing access to anything you have paid for.
9 How long we keep it
| What | How long | Why |
|---|---|---|
| Invoices and payment records | 7 years | Dutch tax law |
| That you gave the three declarations, and that you accepted our Terms | 7 years after your access ends. Kept as a separate record, so it survives deletion of your account | To show what you agreed to, for as long as a claim could be brought |
| Account, lesson progress and email engagement | Duration of your access, then 12 months | So you can return, and so we can answer questions |
| Community posts | Indefinitely, unless you ask us to remove them | So later participants can read earlier discussions. You can ask for removal at any time, including after your access ends |
| Webinar registration details | Until you unsubscribe, then removed | To give you access and to send you the recording |
| Recordings of webinars that form part of the program | 1 year after the webinar | So that participants can watch it back. Participants are not visible or audible in our recordings: we record only the presentation |
| Recordings of our public webinars | Published on our YouTube channel and kept available there | They contain no personal data of participants: we record only the presentation. We do not embed them on our own website |
| Email correspondence | 2 years after our last contact | To handle follow-up questions and complaints |
| Newsletter subscription | Until you unsubscribe | We send it for as long as you want it. Every email has an unsubscribe link, and we remove your address when you use it |
10 How we protect it
We limit access to the people who need it for their work, we grant access individually, and we review it periodically. Data is encrypted in transit and at rest by our providers, and we require comparable measures from each of them. Where health information reaches us by email, it stays in our email system and we do not copy it into other systems or documents.
If a data breach occurs that is likely to result in a risk to you, we will notify the Dutch Data Protection Authority within 72 hours and, where the law requires it, tell you as well.
11 Your rights
Wherever you live, you can ask us to:
- tell you what data we hold about you, and give you a copy;
- correct anything that is wrong;
- delete your data;
- restrict what we do with it, or object to a particular use;
- give you your data in a portable form, or send it to someone else;
- withdraw a consent you gave us.
Email [email protected]. We may ask you to confirm your identity, and we will ask only for what we need to do that. We never charge for a request.
We respond within one month. If your request is complex, we may take up to two further months, and we will tell you within the first month if that is the case. If you are a resident of the United States, we respond within 45 days, with one possible extension of 45 days.
If we refuse a request, we will explain why and tell you how to challenge it.
On deleting Community posts: we will remove them on request, at any time, including after your access has ended. Ask us and we will confirm when it is done.
12 If you live in a particular country
European Union and EEA. Your rights are those set out in clause 11, under the GDPR. You may complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl), which is our lead supervisory authority, or to the data protection authority in your own country.
United Kingdom. The same rights apply under the UK GDPR. You may complain to the Information Commissioner's Office (ico.org.uk).
United States. Because the GDPR applies to everything we do, you have the rights in clause 11 even where the law of your state does not require them. We do not sell personal information, and we do not share it for cross-context behavioural advertising. If you are a resident of Washington or Nevada, see also our Consumer Health Data Privacy Policy. If you are a resident of California, you may exercise the rights in clause 11 and we will not discriminate against you for doing so.
Canada. The same rights apply. You may complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca), or to the privacy commissioner of your province.
Australia. The same rights apply. You may complain to the Office of the Australian Information Commissioner (oaic.gov.au).
13 Children
Our products and services are for adults. You must be 18 or older to buy from us. We do not knowingly collect personal data from anyone under 18. If you believe we hold data about a child, tell us and we will delete it.
14 Changes to this notice
If we change this notice, we will publish the new version with a new version number and a new effective date. We will not start using data we already hold for a materially different purpose without asking you first.
15 Complaints
If you are unhappy with how we handle your data, please tell us first at [email protected]. We would rather put it right ourselves. You can go to a supervisory authority at any time — clause 12 says which one — and you do not have to come to us first.
16 Contact
Plants for Health B.V., Stadhouderslaan 77, 3583 JE Utrecht, the Netherlands