Version 2.0 · 22 October 2026
Privacy statement.
How PCD CareHub handles your personal data in accordance with the GDPR.
This is a translation of the Dutch privacy statement. If the two differ, the Dutch text prevails.
This statement explains which personal data PCD processes, why, on what legal basis, for how long, with whom we share it and what rights you have. In section 3, find the situation that applies to you: website visitor, investor, business contact, board member, data room guest or user of our platform.
1. Who we are
PCD Investment Partners B.V., trading as PCD CareHub ("PCD", "we"), is the controller.
- Address: Lijndonk 4, 4825 BG Breda
- Chamber of Commerce (KvK): 97139572
- Telephone: +31 6 53 85 27 53
- Email for privacy questions and requests: niels.roest@pcdinvestmentpartners.com
The privacy contact person is Niels Roest. We have not appointed a data protection officer. Based on our own assessment, we are not required to do so (Art. 37 GDPR).
2. What this statement covers
- the websites pcdcarehub.com and pcdinvestmentpartners.com, including the protected architecture pages;
- the investor portal (investors.pcdinvestmentpartners.com and investors.pcdcarehub.com);
- our platform pcdOS (os.pcdcarehub.com, platform.pcdinvestmentpartners.com, vault.pcdcarehub.com), including data rooms for external parties;
- the pcdOS demo environment;
- email and other communication with PCD.
3. Which data we process, why and for how long
3.1 You visit our website
| Data | IP address and browser data (user agent) in our hosting provider's logs; page visits and click events (contact form submitted, click on a button, click through to another site) in our visitor statistics |
|---|---|
| Purpose | Providing and securing the website; seeing which pages work, so that we can improve the site |
| Legal basis | Legitimate interest (Art. 6(1)(f) GDPR) |
| Retention period | Hosting logs 1 day (Vercel's fixed period); statistics according to the fixed period of Vercel Web Analytics |
Our visitor statistics (Vercel Web Analytics) do not use cookies and do not track you across other websites. See section 7.
3.2 You fill in the contact form
| Data | Name, email address, organisation, target group, sector, size, product category, number of clients and your message |
|---|---|
| Purpose | Answering your question and following up on business contact |
| Legal basis | Legitimate interest (Art. 6(1)(f)); if you ask for a quotation or collaboration: steps prior to entering into a contract (Art. 6(1)(b)) |
| Retention period | 12 months after the last contact, unless it leads to a client relationship. Your message arrives as an email; after that, it is covered by section 3.6 |
Please do not include health data or other sensitive data in the free text field; we do not need it.
3.3 You open the protected architecture pages
| Data | Email address, name of the investor, whether you are shown anonymously; a one-time login code (as a hash only) and the number of attempts; a session cookie |
|---|---|
| Purpose | Showing confidential documentation only to invited investors |
| Legal basis | Legitimate interest: confidentiality (Art. 6(1)(f)) |
| Retention period | Access list: for as long as the investor relationship continues. Login code cookie 10 minutes, session cookie 30 days. We keep the access list in our source code; after removal, an old version remains in the version history |
| Source | We draw up the access list; you enter your email address yourself |
3.4 You are a (prospective) investor and use the investor portal
Account, login and communication
| Data | Name, email address, telephone number, two-step verification, IP address of the last login, IP address and browser data in the audit log, your consents (privacy, processing, marketing, AI) with date, IP address and version, invitation, emails we send you |
|---|---|
| Purpose | Giving you access, letting you log in securely and informing you about your participation |
| Legal basis | Performance of the contract (Art. 6(1)(b)); marketing only with your consent (Art. 6(1)(a)) |
| Retention period | Account until 12 months after the end of the investor relationship; audit log with IP address 2 years; integration log with our platform 90 days |
| Source | You, and PCD when sending the invitation; your portfolio comes from pcdOS |
Customer due diligence (KYC), suitability and risk profile
| Data | Full name, date of birth, nationality, address, telephone number, citizen service number (BSN, stored encrypted), copy of your identity document and its expiry date, proof of address, whether you are a politically exposed person, source of funds, investment amount, your answers to the suitability test (income, free assets, reserves, capacity to bear losses) with scores, your risk profile, our assessment notes |
|---|---|
| Purpose | Establishing your identity and the source of your funds, and assessing whether the investment is suitable for you |
| Legal basis | Legal obligation (Art. 6(1)(c)) to the extent that we are subject to the Wwft (Dutch Anti-Money Laundering and Anti-Terrorist Financing Act) or the AFM regime; otherwise performance of the contract (Art. 6(1)(b)). We only process your BSN where a law requires it (Article 46 of the Dutch GDPR Implementation Act (UAVG)). |
| Retention period | 5 years after the end of the business relationship (Article 33 Wwft) if the Wwft applies; rejected or withdrawn applications 1 year; suitability test for as long as the relationship continues, after that together with the file |
Your suitability score and risk category are calculated from your answers. A member of staff decides on your application; that decision is not taken automatically.
Documents, signing, complaints and reporting
| Data | Signed documents (file name, checksum, storage location), assessment notes, who opened a document (with IP address and browser data), complaints and our response, your privacy requests, reports to the supervisory authority |
|---|---|
| Purpose | Providing prospectuses, receiving and assessing signed documents, handling complaints, reporting to the AFM |
| Legal basis | Performance of the contract (Art. 6(1)(b)); legal obligation for the complaints procedure and reporting, where prescribed (Art. 6(1)(c)) |
| Retention period | Signed documents 7 years after the end of the participation; complaints 5 years after they are handled; document access 2 years |
Investor Support Agent and personal summary. See section 4.
Retention periods in the portal are not yet applied automatically. Until that function is available, we delete data manually.
3.5 You are a business contact: healthcare provider, entrepreneur, financier or partner
We search for and approach healthcare organisations, entrepreneurs, financiers and partners. We often do not receive your data from you. That is why we inform you at the latest at the first contact, or within one month after we obtained your data (Art. 14 GDPR).
| Data | Name, email address, telephone number, job title, LinkedIn URL, notes, an AI-generated summary and relevance score, whether and when you opened our emails or clicked a link; for a deal or capital round, also purchase price, reinvestment and commitments |
|---|---|
| Source | Public sources (Chamber of Commerce (KvK), Zorgkaart Nederland, professional registers, news, internet), email correspondence with us, and you |
| Purpose | Finding, assessing and approaching acquisition candidates, financiers and partners; managing deals and capital rounds |
| Legal basis | Legitimate interest: business development and business operations (Art. 6(1)(f)) |
| Retention period | Contacts and financiers for as long as the relationship is active, with an annual review; leads that come to nothing 1 year after they were found; deal data for the duration of the process plus 7 years |
You can always object. We will then no longer approach you and will anonymise your data.
3.6 You email us
| Data | Sender, recipients (including cc and bcc), subject, content, attachments, calendar invitations; an AI-generated summary, category, priority and phishing score; whether you opened our email or clicked a link, with IP address and browser data |
|---|---|
| Purpose | Receiving, sending, organising and answering business email |
| Legal basis | Legitimate interest: business operations (Art. 6(1)(f)) |
| Retention period | 2 years, unless linked to an ongoing deal; email with tax relevance 7 years in our accounting records |
A filter rejects health-related and criminal-law content before an email is sent to an AI service.
3.7 You are a board member, shareholder or invitee at a meeting
| Data | Attendance and reason for absence, votes with explanation, declarations of conflicts of interest, mandates, minutes and resolutions, summaries, whether you opened a board briefing or clicked a link |
|---|---|
| Purpose | Preparing meetings, taking minutes, recording resolutions and mandates |
| Legal basis | Legal obligation: duty to keep records and minutes (Art. 6(1)(c), Book 2 of the Dutch Civil Code) and legitimate interest (Art. 6(1)(f)) |
| Retention period | Minutes and resolutions 7 years; data about the opening of briefings 1 year |
Please do not give health details when stating a reason for absence; we do not need them.
3.8 You are given access to a data room
| Data | Name, email address, organisation, your acceptance of the confidentiality statement (with IP address and signature), one-time code (as a hash only), characteristics of your device, which documents you viewed or downloaded (with IP address and browser data), your questions and our answers, an invisible watermark in PDFs |
|---|---|
| Purpose | Sharing confidential documents under confidentiality and preventing misuse |
| Legal basis | Performance of the confidentiality agreement (Art. 6(1)(b)) and legitimate interest: protection of confidential information (Art. 6(1)(f)) |
| Retention period | Invitations and sessions until the data room closes plus 1 year; access log 2 years after closure |
We receive an alert if you log in from a new IP address or download an unusually large amount.
3.9 You take part in a conversation that we record
| Data | Your voice, the transcript of the conversation with speaker names, a summary, the confirmation that the participants agreed to the recording |
|---|---|
| Purpose | Transcribing and summarising board, deal, financier and partner conversations |
| Legal basis | Legitimate interest (Art. 6(1)(f)); we only record if the participants agree |
| Retention period | Audio recording: deleted after transcription, at the latest after 30 days. Transcript: for as long as the minutes or the file exist |
We do not use your voice to recognise you.
3.10 You use pcdOS
| Data | Name, email address, role, profile photo, presence status, login sessions with IP address and browser data, push notifications, tasks and comments, audit log, short-term IP logging to prevent abuse; your conversations with our AI assistant and what it remembers |
|---|---|
| Purpose | Giving staff, board members and external users access, and working together |
| Legal basis | Performance of the employment or service relationship (Art. 6(1)(b)) and legitimate interest: security and efficient business operations (Art. 6(1)(f)) |
| Retention period | Account until 3 months after the end of the relationship; audit log 3 to 10 years depending on the type of action; IP logging to prevent abuse 24 hours; conversations with the AI assistant 1 year |
3.11 You try our demo environment
We keep your email address and login sessions until 3 months after your last login (legitimate interest, Art. 6(1)(f)). The demo contains fictitious people and companies.
3.12 Always: records, security and privacy requests
- Records. We keep invoices, contracts and contact details of clients, suppliers and investors for 7 years (statutory tax retention obligation, Art. 6(1)(c)).
- Security. We use logs, audit logs, backups and incident files to secure our systems and to detect and handle data breaches (Art. 6(1)(c) and (f)). Platform logs according to the hosting provider's fixed period (1 to 7 days), database backups 7 days, data breach files 5 years.
- Privacy requests. We keep your request and our decision for 2 years after it has been handled (Art. 6(1)(c)).
4. AI and automated decisions
We use AI services in these places:
| Where | What the AI does | Service |
|---|---|---|
| Investor Support Agent (portal) | Answers your questions about your participation. To do so, it uses your name and status, your investments and portfolio, your document list, the status of your customer due diligence and suitability assessment, your risk category, your consents and the subjects of your complaints | Anthropic (Claude) |
| Personal summary (portal) | Creates a short summary at the top of your dashboard: first name, customer due diligence status and ID expiry date, risk category, portfolio companies, total committed amount | Anthropic (Claude) |
| Relationships and business development (pcdOS) | Searches for and summarises public information, determines a relevance score, builds a search index | Anthropic, Voyage AI |
| Email (pcdOS) | Summarises, categorises, determines priority and phishing risk, suggests replies | Anthropic, Voyage AI, TypeSafe (test runs on filtered data) |
| Meetings and conversations (pcdOS) | Transcribes, creates draft minutes and preparatory material | AssemblyAI (in the EU), Anthropic, Voyage AI |
| Internal assistant (pcdOS) | Answers staff questions about relationships, deals and documents | Anthropic, TypeSafe, Voyage AI |
Consent for the Investor Support Agent. The first time you use the Investor Support Agent, we ask for your consent (Art. 6(1)(a)). You can withdraw it at any time by emailing the address in section 1. We will then delete your conversations. Withdrawal does not change anything we lawfully did before that.
We keep your conversations with the Investor Support Agent until 12 months after your last message. Anthropic keeps the messages for a maximum of 30 days and does not use them to train models.
No decisions without a human. Scores and classifications made by AI (relevance, priority, phishing risk) are tools. We do not take any decision about you that is based solely on automated processing and that produces legal effects concerning you or similarly significantly affects you (Art. 22 GDPR).
5. With whom we share data
We do not sell data. We share it with service providers that process it on our behalf under a data processing agreement, and with others only where the law requires it (for example the AFM or the Dutch Tax and Customs Administration (Belastingdienst)).
| Service provider | For what | Where | Transfer outside the EEA and safeguard |
|---|---|---|---|
| Vercel Inc. | Hosting of websites, portal and pcdOS; visitor statistics | Portal: Dublin; pcdOS: Frankfurt; website forms and login codes: Washington D.C. (US); platform logs: US | Yes; EU-US Data Privacy Framework and standard contractual clauses |
| Supabase | Database, login, file storage (portal, pcdOS, demo) | Portal: Ireland; pcdOS and demo: Frankfurt | Only account, support and telemetry data; standard contractual clauses |
| Resend (Plus Five Five, Inc.) | Sending and receiving email, including measuring whether emails are opened and links are clicked | Sending from Ireland; storage in the US | Yes; EU-US Data Privacy Framework and standard contractual clauses |
| Anthropic | AI (section 4) | US and other countries | Yes; standard contractual clauses. No training on our data; retention for a maximum of 30 days |
| Voyage AI (MongoDB) | Search index (embeddings) | US | Yes; standard contractual clauses |
| TypeSafe AI | Test runs of AI features on filtered data, without storage | US | Yes; standard contractual clauses and a separate transfer impact assessment |
| AssemblyAI | Speech to text | EU (Frankfurt, Stockholm or Ireland); account and support data possibly US | Yes, limited; EU-US Data Privacy Framework and standard contractual clauses |
| mijn.host | Mailboxes | Netherlands/EU | No (for support, mijn.host engages Anthropic, with standard contractual clauses) |
| Cloudflare | Encrypted backup of pcdOS | EU | No |
| GitHub | Source code, including the access list for the architecture pages | US | Yes; EU-US Data Privacy Framework and standard contractual clauses |
| Email and documents (office applications) | US and other countries | Yes; EU-US Data Privacy Framework | |
| Gamma | Presentations | US | Yes; standard contractual clauses |
6. Your rights
You can ask us for:
- access to the data we hold about you;
- rectification of inaccurate or incomplete data;
- erasure of your data;
- restriction of processing;
- portability of data you provided to us, in a commonly used, machine-readable format;
- objection to processing based on our legitimate interest, and always to direct marketing;
- withdrawal of your consent where we asked for consent (marketing, Investor Support Agent).
Email your request to niels.roest@pcdinvestmentpartners.com. We will respond within one month. For a complex request, we may extend that period by two months. If so, we will tell you within the first month. We may ask you who you are, but we do not keep a copy of your identity document.
Sometimes we have to keep data, for example under the Wwft or the statutory tax retention obligation. In that case, we will explain why we cannot carry out a request for erasure (in full).
You can lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) (autoriteitpersoonsgegevens.nl).
7. Cookies and similar technologies
We do not use advertising or tracking cookies, and we do not use Google Analytics, Meta or LinkedIn services to track you. Measured on 22 October 2026.
| Where | Name | What | Retention period |
|---|---|---|---|
| Websites | NEXT_LOCALE | Remembers your language | Until you close your browser |
| Websites | cookie_consent (in your browser's storage, not a cookie) | Remembers that you closed the cookie notice | Until you clear that storage |
| Architecture pages | arch_otp | Verifies the login code | 10 minutes |
| Architecture pages | arch_session | Keeps you logged in | 30 days |
| Portal and pcdOS | Supabase session cookies | Logging in and staying securely logged in | For as long as you are logged in |
| Data room | dataroom-pending-token | Remembers your invitation while you log in | 10 minutes |
| pcdOS and portal | display preferences (sidebar, mailbox layout) | Remembers your display settings | Until you clear them |
These cookies are necessary to provide the service you request. No consent is required for them (Article 11.7a(3) of the Dutch Telecommunications Act).
Visitor statistics and speed measurement. On the websites we use Vercel Web Analytics; in the portal and pcdOS we use Vercel Speed Insights. Both work without cookies, store nothing in your browser and do not track you across other websites.
Email. In emails from PCD, our email service measures whether the email is opened and whether links are clicked, with IP address and browser data. This is done with an invisible image and redirecting links. You can prevent this by turning off images by default in your email program.
Data room. To prevent misuse, we record characteristics of your device. We consider this strictly necessary for the security of confidential documents.
8. Security
We protect your data with appropriate technical and organisational measures, including encrypted connections (TLS 1.2 or higher), encrypted storage of sensitive fields such as your BSN, two-step verification, role-based access, logging and daily backups. We have data processing agreements with our service providers. If you find a vulnerability, please report it via the address in /.well-known/security.txt.
9. Changes
We update this statement when our processing activities change. The version and date are always shown at the top. This version 2.0 replaces the version of March 2026.