What BASE does with your data.

Who is responsible

Movement Based Therapy, a partnership (maatschap), is the data controller for BASE. I am Jurre Kok, physiotherapist and owner of the practice, and I am also your point of contact for privacy questions. You reach me at info@getbase.coach.

If you use BASE through a practice or coach other than Movement Based Therapy, that practice or coach is responsible for what happens with your file. We then provide the platform and work on behalf of that practice.

Who this applies to

• Patients of the practice who use BASE during their treatment.
• Athletes who use BASE for training without treatment, with or without a coach.
• Therapists, coaches and administrators with an account.
• Visitors of getbase.coach who do not sign in. For them only the section on cookies matters.

What data we process

Your account

Name, email address and year of birth: the practice fills these in when it invites you. We only ask for the year, not your full date of birth. If you fill them in: phone number and a profile photo. We store no citizen service number (BSN) and no insurance details. Those live only in the practice's medical record system, not in BASE.

Your treatment or training

Your injury or goal, your programs and the sessions you log: exercises, weights, repetitions, how heavy it felt, pain scores and how you feel. Also the notes you add and the complaints you log, with a session in BASE or on their own. In addition wellness checks, mobility tests, rehabilitation criteria, clinical tests such as the strength ratio between left and right, test reports, running analyses, the messages with your practitioner, the habits you keep track of and the load curve we calculate from all of this.

From connections you switch on yourself

Sleep and sleep stages, heart rate and heart rate variability, respiratory rate, workouts with a heart rate and pace curve, steps, energy expenditure and VO2max. See the section on connections.

Measurements by your therapist

Strength tests and jumps the practice measures with KINVENT equipment in the treatment room. See the section on KINVENT.

Technical data

The time, IP address and device you sign in with, a log of who opens or changes your file (mandatory in healthcare, standard NEN 7513), and if you enable notifications a device token for push messages.

Why, and on what basis

• Treatment (patients): The treatment agreement. For health data: provision of care under professional secrecy (GDPR art. 9(2)(h)). The record-keeping duty under the Dutch Medical Treatment Contracts Act (WGBO).
• Training (athletes): The agreement for using BASE, which is the terms of use. For health data: your explicit consent, which you give separately at your first sign-in.
• Connections with watches and services: Your explicit consent per source, on your device or in that service's sign-in screen. You withdraw it by disconnecting.
• Signals for your practitioner: Part of the treatment. BASE applies fixed rules to your data, such as three consecutive sessions with high pain, and shows that to your practitioner. It is not a diagnosis and the app never changes your program by itself.
• Anonymised cohort insights: Only if you take part. The option is off by default and you switch it off again in the app without any effect on your treatment.
• Email and push notifications: Needed to make BASE work (invitation, sign-in code, reminders). You choose yourself what you do and do not want to receive.
• Security and access log: Legal obligation (WGBO, Wabvpz) and our legitimate interest in detecting misuse.

When you first sign in, you accept the terms of use (in Dutch) and read this privacy statement. If you train as an athlete without a treatment relationship, you also give separate, explicit consent for processing your health data. You can withdraw it at any time under Agreement and consent; without that consent you cannot use BASE.

Who sees your data

As a patient: your treating therapist and their colleagues within the same practice, so a colleague can take over when your therapist is away. That is the same arrangement as for your regular medical file.

As an athlete: only the therapist or coach you have accepted yourself. A coach then sees your training, check-ins, pain reports and the measurements from your watch, and nothing from a treatment. You see who you accepted under Settings, Access, and you withdraw that access there as well.

You: the app has an access log where you see who opened your file and when.

The administrator of the platform sees data only for technical maintenance and for checking the log. Nobody else sees your data. If you are in a training group, its staff see your name and whether you accepted a request. We sell nothing on, show no advertising and share no data with insurers or employers. We hand over data only when the law obliges us to, for instance on a police order.

Connections you switch on yourself

You can connect your Apple Watch (through Apple Health), your Polar watch or your Strava account. BASE then retrieves sleep, heart rate, heart rate variability, respiratory rate, workouts, steps and energy expenditure for as long as the connection exists. Connecting is never a condition for treatment or training. At the moment connections are open to athletes, coaches and therapists; not yet to patient accounts.

• Apple Health: you give permission per data type on your own iPhone. The data goes directly from your device to BASE; Apple does not see that transfer.
• Strava: you sign in at Strava and give permission there to read your activities. We keep duration, distance, heart rate and pace, no route and no photos. When you disconnect or delete your account, we withdraw our access at Strava and delete our keys. You can also remove BASE yourself in your Strava settings at any time. Strava Inc. is based in the United States; the only thing we send to Strava is the key you created there.
• Polar: same principle through Polar's sign-in screen. Polar Electro Oy is based in Finland, inside the EEA. When you disconnect we delete the keys and withdraw our registration at Polar.

We store the access keys of these services encrypted. The data itself falls under the same security and retention period as the rest of your file.

Measurements from KINVENT

The practice measures strength and jumps with equipment from KINVENT (Montpellier, France). Those measurements live in the KINVENT software under the practice's account. Your therapist can link your BASE file to your KINVENT profile and import measurements, so your report and your rehabilitation criteria rest on the same measurement.

BASE stores a reference code to the KINVENT profile and the imported measurements, including the body mass the force plate measures during a jump. Name, date of birth, email address and photo from that profile are not copied. No file information goes to KINVENT. The imported measurements are stored in BASE in London, like the rest of your file.

No AI on your data

BASE does not send your data to an AI service. Previously your practitioner could have a draft text written by Anthropic (Claude) for test reports and running analyses, using only your measured values and without your name or year of birth. That feature was removed in September 2026.

Email and push notifications

Email we send through Resend: your invitation, sign-in codes and sign-in links, reminders, a message when you are added to a training group, and a message when a therapist or coach asks for access to your data. Such an email contains your email address, your first name, the name of your program, the name of the person asking and possibly an instruction from your practitioner. A sign-in link is valid for seven days, stops working once it has been used and goes only to your own mailbox. When your practitioner is alerted to a critical signal, for example a high pain score, that email contains no name and no measurement, only a link to BASE.

Push notifications go through Expo to Apple or Google, who deliver the message on your device. A device token and a short text go along. That text contains no names of others, no message content and no measurements: for a message you only read that there is a new message, and the content loads in the app after you unlock your device. A few notifications do give a short hint about your own training, for example that your recovery is a bit lower, that your load is rising sharply this week or that you have moved a step further in your recovery. If you do not want that on your lock screen, switch off the Progress and recovery notifications in the app under Settings. You switch all notifications off in the app or in your phone's settings.

App updates also come through Expo. When you open the app, it asks Expo whether a newer version is ready. Your IP address, the type of phone (iOS or Android), the app version and a random code for this installation go along with that request. No account details and no health data are sent.

Companies that work for us

We have a data processing agreement with every company below. They may use your data only to deliver their service to us.

• Supabase: Database, sign-in and storage of all data in BASE. London, United Kingdom (EU adequacy decision).
• Vercel: Hosting of getbase.coach and the server code. US, with standard contractual clauses and the EU-US Data Privacy Framework.
• Resend: Sending email. US, with standard contractual clauses.
• Expo: Passing push notifications on to Apple and Google, and delivering app updates. US, with standard contractual clauses and the EU-US Data Privacy Framework.
• Apple and Google: Delivering push notifications on your device and distributing the app through the App Store and Google Play. US, under their developer terms with standard contractual clauses.
• Mollie: Payments, only if you buy something in the shop. No health data. Netherlands.

Apple Health, Strava, Polar and KINVENT are not processors of ours but sources we read from; see the sections above. Exercise videos are shown through YouTube (in "nocookie" mode) or Vimeo. Only when you tap play does the video load and can that provider see your IP address. No file information goes along.

Outside the EEA

Your data is stored in London. For hosting, email and push notifications we work with companies from the United States. For those transfers we use the standard contractual clauses of the European Commission and, where the company is certified, the EU-US Data Privacy Framework.

How long we keep data

• Patients: your data in BASE is part of your treatment. The practice keeps the medical file for 20 years after the last change in the file, as the WGBO prescribes (article 7:454 of the Dutch Civil Code). You can have your BASE account deleted earlier; see the section on your rights.
• Athletes: as long as your account exists. If you request deletion, we erase everything 30 days later.
• Messages in the app (between you and your practitioner): 30 days after sending, then we erase them automatically. They are meant for brief contact about a session or exercise. Anything important for your treatment your practitioner puts in your file, which falls under the period above.
• Access log: 5 years.
• Connection keys of watches and services: removed immediately on disconnecting. Push tokens: until you sign out.
• Sent emails: Resend keeps a delivery log for about 30 days.

Security

• Sign-in without a password, with a code or link in your mailbox. Therapists, coaches and administrators must also sign in with a second factor; a new account has seven days to set it up.
• Access is enforced on the server per role and per treatment relationship, down to the database (row level security on every table).
• Encrypted connections, encrypted storage, and the keys of your connections encrypted separately.
• A log of every access and change, which we review monthly.
• Daily backups, with a tested restore procedure.
• Every staff member signs a confidentiality statement in the app. We have the security tested regularly and have a data breach procedure. If you find a vulnerability yourself, email me; we take that seriously.

Your rights

Most of it you arrange yourself in the app, under Settings.

• Access and download: under My data you download your data as a file, including the access log. A few things are deliberately left out, such as drafts and working notes of your practitioner, login keys and other people's data. The file lists exactly what is not in it.
• Correction: you edit your profile details yourself. If something in your file is wrong, tell your practitioner or email me.
• Deletion: under Settings you request deletion of your account. You then have 30 days in which you can withdraw the request. After that we erase your account and all data in BASE, including connected watch data and push notifications. Your medical file at the practice is not included; we keep that for as long as the law prescribes. Do you use BASE as a therapist, coach or administrator? Then you don't delete your account yourself: what you recorded belongs to the files of your patients and athletes. Email me when you stop and we remove your access to other people's data.
• Portability: the download is a readable file you can hand to another healthcare provider.
• Withdrawing consent: you switch connections off yourself, as well as your participation in cohort insights. As an athlete you withdraw your consent for health data under Agreement and consent.
• Objection or restriction: email me. I respond within a month and may ask you to identify yourself.
• Complaint: if we cannot resolve it together, you can turn to the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens.

Under 16

BASE is intended for users aged 16 and over. For a younger patient we create an account only with written consent from a parent or guardian.

Cookies on getbase.coach

Getbase.coach sets only functional cookies: the cookie that keeps you signed in and a note in your browser that you have seen the cookie notice. There are no analytics, no tracking and no advertising cookies. We host fonts ourselves. An exercise video loads only after you tap play.

Changes

If anything changes in how BASE handles data, we update this page and the date at the top. For a substantial change, such as a new type of data or a new company that processes it, we let you know in the app or by email.

Contact