Patient Universe: Privacy Policy
Effective date / last updated: 15 October 2026
1. About this policy
This policy explains how personal data is processed on Patient Universe (patientuniverse.com and the groups hosted on it) and through the related contact, demo and pricing-sheet forms. It should be read together with our Terms of Use and Cookie Policy.
You use one member account (one e-mail address) to join one or more groups. Who is responsible for your data (the "controller") depends on what the data is and who runs the group:
| Situation | Controller | Role of Esperity |
|---|---|---|
| You visit patientuniverse.com, use the contact form, book a call, ask for a pricing sheet, or you are a business contact of Esperity | Esperity BV | Controller |
| Your platform account: e-mail address, sign-in, language, and the list of groups you belong to (one account across all groups) | Esperity BV | Controller |
| You take part in a group created by a patient organisation or another organisation (your profile in that group, posts, private groups, events, surveys, messages) | That organisation. In its own organisational admin portal, it decides which accounts are admitted or excluded, which roles they have, and what content is visible to whom | Processor: Esperity processes this data only on the organisation's documented instructions, under a data processing agreement (Art. 28 GDPR) |
| You take part in a group initiated by Esperity | Esperity BV | Controller |
Below, "the Organisation" means whoever runs the group concerned; for a group initiated by Esperity, that is Esperity. An organisation that runs a group may publish its own privacy notice for that group. If it does, that notice applies to your data in that group, alongside this policy for your platform account. Each group shows who runs it and links to its own notice where there is one.
2. Who we are
- Esperity BV, a Belgian private limited company (besloten vennootschap), Boulevard Brand Whitlock 108, 1200 Brussels, Belgium, enterprise/VAT number BE 0848.466.027.
- Contact for privacy questions and requests: info@esperity.com.
- Data protection officer (DPO): Esperity has appointed Chino.io as its external DPO. You can contact the DPO via info@esperity.com.
3. What data we process, why, and on what legal basis
3a. Where Esperity is controller
| Purpose | Data | Legal basis (GDPR) | Retention |
|---|---|---|---|
| Your platform account: creating it, sign-in by secure e-mail link, language, keeping track of the groups you belong to, security | E-mail address, sign-in data (time, device/browser, IP address), language, group memberships, age confirmation (18+) | Art. 6(1)(b): providing the service under the Terms of Use; Art. 6(1)(f): legitimate interest in security | While your account exists; deleted or anonymised within 30 days after you delete it |
| Running and securing the website (delivery, security, abuse prevention, error logs) | IP address, browser and device data, pages requested, date/time | Art. 6(1)(f): legitimate interest in a secure, working website | 30 days |
| Website statistics with Lovable's built-in statistics and Google Analytics (only after you click "Accept all" in the cookie banner; public website only, not inside groups) | Pages visited, referrer, browser/device type, language, approximate location, cookie identifiers | Art. 6(1)(a): consent | 14 months |
| Answering contact-form messages, booking a call or demo, sending a pricing sheet | Name, e-mail, organisation, role, topic chosen, message | Art. 6(1)(b): steps at your request before a contract; Art. 6(1)(f): legitimate interest in answering enquiries | 24 months after the last contact, unless a contract follows |
| Business relationships with organisations that run groups, pharma and life-science companies, partners and suppliers, including contracts and invoicing | Name, business contact details, role, organisation, correspondence, contract and billing data | Art. 6(1)(b): contract; Art. 6(1)(c): legal obligations (accounting, tax); Art. 6(1)(f): managing business relationships | Contract term + 10 years after the contract ends (in line with Belgian accounting and limitation rules) |
| E-mail to business contacts about Esperity's services | Business contact details | Art. 6(1)(f), or consent where the law requires it | Until you object or unsubscribe |
| Groups initiated by Esperity | As in section 3b | As in section 3b, with Esperity as controller | As in section 7 |
| Handling reports, moderation requests and review requests sent to info@esperity.com | Your message, the content concerned, our reply and decision | Art. 6(1)(c): obligations under the Digital Services Act; Art. 6(1)(f): a safe platform | 12 months after the report or review is closed |
| Establishing, exercising or defending legal claims | Data relevant to the claim | Art. 6(1)(f) | Until the claim is settled or time-barred |
No payments by members. Members never pay to use Patient Universe, so we do not process payment data of members. Organisations may pay Esperity to run a group; their billing data is business data, handled as described above.
We do not use your data for automated decision-making or profiling with legal or similarly significant effects.
3b. Group data
For a group created by an organisation, that organisation decides the purposes and legal bases, and Esperity processes the data on its behalf. For a group initiated by Esperity, Esperity decides them as controller. The typical processing in a group is:
| Purpose | Data | Legal basis (set by the group's controller) |
|---|---|---|
| Your membership of the group: admission, roles, notification settings, topics of interest | Display name or random ID, topics of interest, badges (e.g. patient, carer, volunteer), membership status, approval or check against the Organisation's membership list | Art. 6(1)(b): membership under the Terms of Use and the group's rules |
| Taking part in discussions, private groups, events, surveys and forms | Content you post, group memberships, event registrations (including e.g. accessibility needs), survey answers, messages | Art. 6(1)(b); Art. 6(1)(a) consent where the group asks for it |
| Health-related information you share or that can be inferred (e.g. membership of a group for a condition, posts, survey answers) | Special categories of data (Art. 9 GDPR). Because most groups focus on a specific condition or health area, membership and content in a group will often reveal health information. An Organisation may also add its own forms with extra data fields; the Organisation's group-specific terms and privacy notice then apply to those fields. | By default, your explicit consent (Art. 9(2)(a)), asked separately and recorded with date and version. Each Organisation sets its legal basis in its group privacy notice; it may rely on another basis allowed by Art. 9(2), such as Art. 9(2)(d) for not-for-profit bodies. |
| Moderation and safety: member flagging, moderation queue, automatic word filter, optional pre-approval of posts by new members, warnings, suspensions, statements of reasons | Flagged content, moderation actions, statements of reasons, audit log | Art. 6(1)(f): a safe and respectful group; Art. 6(1)(c) where the Digital Services Act applies |
| Group statistics for the Organisation | Aggregated, anonymous figures only, never below a minimum group size of 20 | Art. 6(1)(f); the output is anonymous |
| Newsletter opt-in (exported by the Organisation to its own newsletter tool) | E-mail address, opt-in record | Art. 6(1)(a): consent |
| Taking part in a partner project (see section 5) | Only data you choose to give after you agree to take part | Your consent, asked separately for each project (Art. 6(1)(a) and 9(2)(a)) |
You can withdraw consent at any time, for example in your settings or by contacting the Organisation or info@esperity.com. Withdrawal does not affect processing done before.
3c. Anonymous mode
You can take part under a random ID instead of your name. Anonymous mode hides your identity from other members, and other members never see your e-mail address. The Organisation and Esperity can still link your account to your e-mail address for sign-in, safety and moderation. Content you post can still identify you if it contains identifying details, so please keep that in mind.
4. Who receives your data
- The Organisation that runs a group you joined, and the people it authorises (admins, editors, moderators, group admins). The Organisation decides in its admin portal who has which role and what is visible to whom.
- Other members, for what you post in spaces they can see. Private-group content is visible only to members of that group and is not indexed by search engines.
- Esperity: only staff and contractors who need access and are bound by confidentiality, as processor for organisation groups or as controller for your account, Esperity-initiated groups and the data in section 3a.
- Service providers that host or support the platform (section 6).
- Sponsors, pharma and life-science companies and other partners do not get access to member data. Your content is not used for advertising, and it is not given to sponsors or companies unless you explicitly consent. An Organisation may share anonymous, aggregated insights (for example survey results) with partners, but never your identity or member lists.
- Authorities, where the law requires it.
We do not sell personal data.
5. Partner projects (advisory boards, surveys, co-creation)
An Organisation may tell you about projects run by researchers or by pharma and life-science companies, such as advisory boards or co-creation workshops.
- Taking part is always voluntary; you decide yourself whether to apply.
- Projects are non-promotional. They run under a separate written agreement and, where you are compensated, at fair market value.
- Before you take part, you receive clear information about who runs the project, what data is collected, and any publication of payments required by transparency rules. You are then asked for your consent.
- The company running a project is the controller for its own processing of your data for that project and gives you its own privacy information. It has no access to your community account or to other members' data.
6. Where data is stored and who helps us
- Hosting: the website is hosted on Lovable, set to EU servers. The platform's database, back end and sign-in run on Supabase, coupled to Lovable, on servers in Germany (EU).
- Service providers:
- Lovable: website hosting and built-in visitor statistics (EU servers). Lovable's data processing agreement is with Lovable Labs Incorporated (United States); for any access from outside the EU we rely on the European Commission's Standard Contractual Clauses.
- Supabase: database, back end, authentication and storage (Germany, EU). Supabase is a US company; for any remote access from outside the EU we rely on the EU–US Data Privacy Framework and/or Standard Contractual Clauses.
- Amazon Web Services (AWS): e-mail delivery for sign-in links and notifications, in an EU region in Germany. AWS is a US company; for any access from outside the EU we rely on the EU–US Data Privacy Framework and/or Standard Contractual Clauses.
- Cloudflare: content delivery, security and image storage. Cloudflare runs a global network; stored data is kept in the EU (Germany) where configured, while traffic may pass through Cloudflare servers outside the EU. For any processing outside the EU we rely on the EU–US Data Privacy Framework and/or Standard Contractual Clauses.
- Google Analytics, provided by Google Ireland Limited (Esperity's Google account is set to the EU): website statistics on the public website, only after you click "Accept all", never inside groups. Google may access data from the United States; for this we rely on the EU–US Data Privacy Framework, under which Google LLC is certified.
- Transfers outside the EU: only with an adequacy decision (such as the EU–US Data Privacy Framework for certified companies) or the European Commission's Standard Contractual Clauses, with extra safeguards where needed. You can ask for a copy at info@esperity.com.
7. How long we keep data
- Your account: while it exists. You can delete it at any time in your account settings, through the Organisation, or by writing to info@esperity.com. Before deleting, you can download your data. After deletion, your personal data is deleted or anonymised within 30 days, including in backups.
- Group data: while you are a member of the group. Data you posted is deleted or anonymised within 30 days after you delete your account. Copies that others have already quoted in replies, or that must be kept by law, may remain.
- When a group closes: members are informed in advance and can download their data first. The data is then returned to the Organisation or deleted, as agreed in its data processing agreement with Esperity.
- Other data Esperity controls: see the table in section 3a.
- Consent records: as long as needed to show that consent was given.
8. Security
We protect your data with measures including hosting in the EU (Supabase, Germany), encryption in transit and at rest, extra encryption of sensitive fields, sign-in by secure e-mail link without passwords, two-factor authentication for administrators, role-based access set by each Organisation, an audit log of admin actions, and separation of data per organisation. No system is fully secure. If a breach is likely to put you at high risk, we or the Organisation will inform you.
9. Your rights
You have the right to access your data, correct it, have it erased, restrict its use, receive it in a portable format, and object to processing based on legitimate interests (and at any time to direct marketing). Where we rely on your consent, you can withdraw it at any time.
- You can download or delete your own data at any time in your account settings.
- For data in a group run by an organisation, you can contact that organisation directly. If you write to us, we pass your request on and help the organisation answer it.
- For your platform account, Esperity-initiated groups, and website and contact data, write to info@esperity.com. You can also reach our DPO, Chino.io, via that address.
- We reply within one month. For complex requests this can be extended by two more months; we will tell you why. We may ask you to confirm your identity.
10. Complaints
If you are unhappy with how your data is handled, please contact us first at info@esperity.com. You can also complain to the data protection authority where you live, work or where the issue occurred. In Belgium this is the Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données), Rue de la Presse 35 / Drukpersstraat 35, 1000 Brussels, +32 (0)2 274 48 00, contact@apd-gba.be, www.autoriteprotectiondonnees.be / www.gegevensbeschermingsautoriteit.be. For Esperity, the Belgian authority is the lead authority. An organisation that runs a group and is established in another EU country may have its own lead authority for its group data.
11. Age requirement
Patient Universe is only for people aged 18 or older. Accounts for people under 18 are not permitted. When you create an account you confirm that you are 18 or older. We close accounts of people under 18 when we become aware of them, and delete the related data.
12. Changes to this policy
We may update this policy, for example when the service or the law changes. We inform members of significant changes at least 30 days in advance via the platform or by e-mail. Where a change needs new consent, we will ask for it. If you do not agree, you can delete your account before the change takes effect.
13. Language and contact
This policy is available in English, Dutch, French and Spanish. If the language versions differ, the English version prevails.
Esperity BV · Boulevard Brand Whitlock 108, 1200 Brussels, Belgium · BE 0848.466.027 · info@esperity.com · DPO: Chino.io, via info@esperity.com