Plants for Health
Privacy Notice
Version 1.0 — effective 28 July 2026
This notice explains what personal data we collect, why, who we share it with, how long we keep it, and what you can ask us to do. It applies wherever you live.
1 Who we are
Plants for Health B.V., Stadhouderslaan 77, 3583 JE Utrecht, the Netherlands. Registered with the Dutch Chamber of Commerce under number 93914369. VAT identification number NL866571711B01.
We are the controller of the personal data described in this notice.
Contact for anything to do with your data: [email protected]. We monitor this address and confirm receipt of every request.
2 What this notice covers
This notice covers our website, our webshop, our learning platform, our Community, our group sessions, and our email correspondence with you.
If you are a resident of Washington or Nevada, our Consumer Health Data Privacy Policy also applies to you. It is a separate document with its own link on our homepage, and it deals specifically with health information. Where the two differ in respect of health data, that policy applies.
If you buy the printed edition of Past the Pain from Amazon or a bookseller, your contract is with that retailer and they handle your data, not us.
3 What we collect
From you, when you buy something or sign up:
- your name and email address;
- your country of residence, which determines your tax treatment and which regional annex of our Terms applies to you;
- the fact that you gave the three declarations described in clause 4.2 of our Terms, with the date and the version you accepted;
- the fact that you accepted our Terms, the applicable Annex and our Health Disclaimer, with date, time and version.
When you pay:
- payment data, which is processed by Stripe. We see the amount, the currency, the date and the last four digits of your card. We never see or store your full card number.
While you take part:
- which lessons you opened and completed, and whether you opened our programme emails. This happens in the learning platform, Kajabi;
- what you post in the Community, including anything you choose to share about your health;
- what you tell us in emails or support messages.
Automatically:
- your IP address and basic technical data, logged by our providers for security and to deliver the service.
We do not ask you for a diagnosis, your medication, your weight, your BMI or any test result. There is no intake questionnaire and no medical file.
4 Why we use it, and our legal basis
| What for | Legal basis | Notes |
|---|---|---|
| Giving you access to what you bought, and running the programme and the Community | Performance of our contract with you | |
| Taking payment and keeping the records the tax authorities require | Performance of our contract, and a legal obligation | Dutch tax law requires us to keep invoices for 7 years |
| The three declarations you give before you enrol | Your explicit consent, given by a separate tick box | This is health data. See clause 5 |
| What you choose to share about your health in the Community or by email | Your explicit consent | You are never required to share it |
| Sending you emails about the programme you are taking | Performance of our contract | Every email has an opt-out link |
| Sending you our newsletter or offers | Your consent | You can unsubscribe at any time |
| Answering questions, handling complaints, and defending or bringing legal claims | Our legitimate interest, and a legal obligation where one applies | |
| Keeping our systems secure and preventing fraud | Our legitimate interest |
No automated decisions. We do not make decisions about you by automated means that have legal or similarly significant effects, and no decision about your suitability for a programme is ever made by a system. We do not profile you.
5 Health information
We ask you about your health in only one place: the three declarations before you enrol. They concern eating disorders, unintended weight loss and upcoming medical procedures, and they exist for your safety.
For each of them, you confirm that you have discussed taking part with your own doctor or practitioner, and that they support it. You do not tell us what your condition is, and we do not ask. We record only that you gave the declarations, on which date, and against which version of our Terms.
Under the GDPR, health data is a special category of personal data. We process it on the basis of your explicit consent, which you give by a separate tick box at checkout. That box is never pre-ticked, and it is not bundled with your acceptance of our Terms.
You may withdraw that consent at any time. If you do, we may no longer be able to provide part of what you bought, and the refund provisions in clause 10 of our Terms will apply.
Anything else we hold about your health is what you chose to tell us, either in the Community or in an email. You can take part in the Community under a name of your choosing, and we recommend you do if you intend to write about your health. Other participants then see only that name. This does not make your posts anonymous to us.
We are not a covered entity or a business associate under the United States Health Insurance Portability and Accountability Act, and we do not provide services that it governs.
6 Who we share it with
We share your data only with providers who process it on our behalf, under a written data processing agreement. We do not sell your data, we do not rent it, and we do not share it for anyone else’s advertising.
| Provider | What they process | Role |
|---|---|---|
| Kajabi | Account, enrolment, declarations, lesson progress, Community posts, video viewing, programme emails | Learning platform, community and programme email |
| Microsoft | Email correspondence, and our internal documents | Email and document storage |
| Brevo | Your email address, and whether you opened our emails | Sending our newsletter |
| Stripe | Payment data and the name of the product you bought | Payment processing |
We may also disclose data to our accountant or to a professional adviser where we need advice, to a public authority where the law requires it, or to protect someone from serious harm.
If our business is ever transferred to another party, your data may transfer with it. We would tell you in advance, and clause 20 of our Terms sets out your right to end the agreement in that case.
7 Sending data outside Europe
Kajabi and Microsoft are established in, or have parent companies in, the United States. Where your data is transferred out of the European Economic Area, that transfer is safeguarded by the European Commission’s Standard Contractual Clauses, or by another mechanism recognised under the GDPR such as the EU–US Data Privacy Framework.
Brevo is established in France, so data held by it stays within the European Economic Area. For payments we contract with Stripe’s European entity.
You may ask us for details of the safeguards that apply to a particular provider.
8 Cookies and tracking
We do not use advertising pixels, and we do not use website analytics. We do not follow you across other websites, we do not build advertising profiles, and we do not share anything about you with advertising platforms.
The cookies we and our providers set are the ones needed to make the site and the platform work: to keep you logged in, to remember what is in your basket, and to let Stripe detect fraudulent payments.
Our Cookie Policy lists every cookie in use, what it does and how long it lasts. It is kept up to date and you can reach it from the footer of every page. Where a cookie is not strictly necessary, we ask for your consent before we set it, and you can change or withdraw that consent at any time using the link in our cookie notice.
If we ever introduce advertising pixels or analytics, we will ask for your consent first, we will say so in our Cookie Policy, and you will be able to refuse without losing access to anything you have paid for.
9 How long we keep it
| What | How long | Why |
|---|---|---|
| Invoices and payment records | 7 years | Dutch tax law |
| That you gave the three declarations, and that you accepted our Terms | 7 years after your access ends. Kept as a separate record, so it survives deletion of your account | To show what you agreed to, for as long as a claim could be brought |
| Account, lesson progress and email engagement | Duration of your access, then 12 months | So you can return, and so we can answer questions |
| Community posts | Indefinitely, unless you ask us to remove them | So later participants can read earlier discussions. You can ask for removal at any time, including after your access ends |
| Email correspondence | 2 years after our last contact | To handle follow-up questions and complaints |
| Newsletter subscription | Until you unsubscribe, then 12 months | To show that you consented, and that you withdrew it |
10 How we protect it
We limit access to the people who need it for their work, we grant access individually, and we review it periodically. Data is encrypted in transit and at rest by our providers, and we require comparable measures from each of them. Where health information reaches us by email, it stays in our email system and we do not copy it into other systems or documents.
If a data breach occurs that is likely to result in a risk to you, we will notify the Dutch Data Protection Authority within 72 hours and, where the law requires it, tell you as well.
11 Your rights
Wherever you live, you can ask us to:
- tell you what data we hold about you, and give you a copy;
- correct anything that is wrong;
- delete your data;
- restrict what we do with it, or object to a particular use;
- give you your data in a portable form, or send it to someone else;
- withdraw a consent you gave us.
Email [email protected]. We may ask you to confirm your identity, and we will ask only for what we need to do that. We never charge for a request.
We respond within one month. If your request is complex, we may take up to two further months, and we will tell you within the first month if that is the case. If you are a resident of the United States, we respond within 45 days, with one possible extension of 45 days.
If we refuse a request, we will explain why and tell you how to challenge it.
On deleting Community posts: we will remove them on request, at any time, including after your access has ended. Ask us and we will confirm when it is done.
12 If you live in a particular country
European Union and EEA. Your rights are those set out in clause 11, under the GDPR. You may complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl), which is our lead supervisory authority, or to the data protection authority in your own country.
United Kingdom. The same rights apply under the UK GDPR. You may complain to the Information Commissioner’s Office (ico.org.uk).
United States. Because the GDPR applies to everything we do, you have the rights in clause 11 even where the law of your state does not require them. We do not sell personal information, and we do not share it for cross-context behavioural advertising. If you are a resident of Washington or Nevada, see also our Consumer Health Data Privacy Policy. If you are a resident of California, you may exercise the rights in clause 11 and we will not discriminate against you for doing so.
Canada. The same rights apply. You may complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca), or to the privacy commissioner of your province.
Australia. The same rights apply. You may complain to the Office of the Australian Information Commissioner (oaic.gov.au).
13 Children
Our products and services are for adults. You must be 18 or older to buy from us. We do not knowingly collect personal data from anyone under 18. If you believe we hold data about a child, tell us and we will delete it.
14 Changes to this notice
If we change this notice, we will publish the new version with a new version number and a new effective date, and we will keep previous versions available. Where a change materially affects your rights, we will tell you by email at least 30 days in advance. We will not start using data we already hold for a materially different purpose without asking you first.
15 Complaints
If you are unhappy with how we handle your data, please tell us first at [email protected]. We would rather put it right ourselves. You can go to a supervisory authority at any time — clause 12 says which one — and you do not have to come to us first.
16 Contact
Plants for Health B.V., Stadhouderslaan 77, 3583 JE Utrecht, the Netherlands