Privacy Statement Memory Lane – Roxelane Care B.V.

1. Introduction

Your privacy is important to us. This Privacy Statement explains how we handle your personal data.

We will only use your personal data for the purposes stated in this Privacy Statement and not for other purposes, unless further processing of the personal data is compatible with the purposes for which these data were originally processed.

2. What personal data we collect

We collect personal data (personal data) that you or a caregiver provide to us via our website www.mymemorylane.com, via our Memory Lane App, via the Memory Lane or when you contact us in any other way. Personal data are data that can be used to identify you.

Data we collect from you are:

• • Name
• • Date of birth
• • Gender
• • Address
• • Email address
• • Login details
• • Telephone number(s)
• • Payment details (bank account number, card number)
• • IP address
• • GPS coordinates
• • Photos
• • Health data
• • Family relationships
• • Movement data
• • Input for AI functionalities – such as text messages, questions, commands or descriptions of content

3. Why we collect your personal data: purposes and legal bases

We may process your personal data for the following purposes with the legal bases mentioned below.

We will not use your personal data for other purposes, unless further processing of the personal data is compatible with the purposes for which these data were originally processed.

We will not use your personal data to make a decision based solely on automated processing, including profiling.

We use some data for our own legitimate interests, such as improving our services. You have the right to object to these processings. If you wish to object, you can contact us. In that case, we will stop processing your personal data, unless there are compelling legitimate reasons why our interest in the processing outweighs your interest in stopping the processing. It is possible that if you ask us to stop the processing, you will no longer be able to make optimal use of our services.

Use of AI functionalities

Within the Memory Lane App we offer AI functionalities (such as smart reminders, behaviour analysis, conversation support or personalised insights). For this we work together with one of the third-party AI service providers such as OpenAI, Google Gemini or xAI (Grok).

Only after you have enabled the AI in the app, and have seen a clear consent screen and have given explicit consent for the service provider of your choice, the following data will be sent to that party:

• The text you enter (for example questions, commands or descriptions)
• Any relevant context, such as parts of the conversation history or information about your agenda, living conditions or other information that you have shared with us. xAI processes these data exclusively to generate an AI answer or result and thereby acts as a processor on our behalf. Without your explicit consent, no personal data will be sent to the AI service. You can withdraw your consent at any time via the settings in the app settings.

For each service provider, the official processor terms (Data Processing Addendum) of that party apply. This ensures that the data is processed exclusively as a processor in accordance with the GDPR. For more information on how they process personal data, we refer to their privacy policies:

• OpenAI: https://openai.com/policies/privacy-policy
• Google Gemini: https://policies.google.com/privacy (supplemented by the Gemini Apps Privacy Notice)
• xAI (Grok): https://x.ai/legal/privacy-policy

Customer service and helpdesk

If you contact us about a question or problem, we may process personal data from you. The legal basis for this is the performance of the agreement with you. If we do not yet have an agreement with you, but the contact relates to the (possible) entering into of an agreement, this also falls under that legal basis (pre-contractual phase).

Communication from Memory Lane

We may send newsletters and messages to you and in that context we may process your personal data. This may be because you have subscribed to them, in which case the legal basis is consent. We may also send you newsletters and messages with relevant information about our services and service provision, in which case the legal basis is performance of the agreement with you.

Customer satisfaction surveys

We may conduct customer satisfaction research in various ways, in order to optimise our services. The legal basis for the processing of personal data related to this is our legitimate interest.

Use of the Memory Lane and/or Memory Lane App

If you use the Memory Lane and/or the Memory Lane App, we process the personal data necessary to enable the use of the Memory Lane and/or the Memory Lane App. We do this on the basis of the legal basis of performance of the agreement with you.

The data you enter during use, such as your profile data and the photos you place in the photo album, are processed by us. These data are stored on a server/cloud to which we, as controller, have access. We also process data to, for example, adjust the rotation or size and to analyse (by means of software) and tag them, so that the photos are correctly grouped.

IP address and location data

We collect your IP address and the GPS coordinates for security reasons. Using this data we can detect security breaches, for example when repeated login attempts are made from an unknown (foreign) IP address. We process the location data to be able to locate a possibly lost Memory Lane. The basis for these processings is our legitimate interest, to be able to secure your data.

Health data

The Memory Lane can be used for a customised exercise programme. To compile this personal exercise programme we ask for a limited number of health data. For example, we ask whether there is fear of falling, dementia and whether you suffer from certain joints. We ask this so that the exercise programme can be adapted to your possibilities and circumstances. You can also skip these questions, but that means the function may work less well. We therefore only process this data when you give us explicit consent for it. You can also withdraw this consent, in which case we will delete this health data.

Payments or refunds

If we receive payments from you or we have to make (re)payments to you, we process your personal data for this on the basis of the legal basis of performance of the agreement with you. The payment process runs via our partner S.P. Abonneeservice B.V. (for more information and the privacy statement of that party, see http://www.spabonneeservice.nl/privacy.html). We have concluded a processor agreement with this partner, in which we have made agreements about how your data must be handled.

4. How long we retain your data

We do not retain your personal data longer than necessary for the purpose for which we process the data.

If we no longer have an agreement with you, we will in principle also delete the personal data we have from you within six (6) months. We do not delete the personal data immediately, because we must still be able to handle any service requests. Within that period of six months it is possible to renew the Memory Lane subscription without loss of data, after that it is no longer possible. If you have subscribed to our newsletter or messaging service, we will still retain that data until you indicate that you no longer wish to receive it.

Some personal data must be retained longer because we are legally obliged to do so (for example data relating to payments). We retain that data for as long as the legal obligation continues.

5. How we secure your data

We ensure appropriate security of your personal data and we take appropriate technical and organisational measures to protect your personal data against unlawful processing or loss.

The security measures we have taken include, among others but not exclusively, the following measures:

• • Our IT systems are and will be regularly updated and secured in accordance with the standards that apply in the market;
• • Our app uses encrypted connections with the Microsoft Azure Cloud platform and an image server from TransIP. All information is stored in this cloud environment, so that no personal data (with the exception of your login name) is stored locally on your device. For performance purposes, certain photos may be temporarily stored in the local cache of the Memory Lane;
• • Only authorised persons have access to your personal data;
• • We conclude processor agreements with third parties that process your personal data on our behalf.

6. Where your personal data is processed

The processing of your personal data by Memory Lane itself takes place in the Netherlands. If we use third parties for the processing of your personal data, they are generally located in the European Union, but possibly also outside it.

Your personal data will not be processed in or transferred to other countries without appropriate safeguards being taken to protect your data.

7. Who has access to your data

We will not provide your personal data to third parties, except to the categories of third parties mentioned below or if you have given us prior consent to share your data with a particular third party.

We may share your personal data with the following categories of third parties:

• • Professional advisers such as lawyers and accountants
• • Third parties to whom we outsource certain services, such as: IT systems or software suppliers, IT service providers, document and information storage providers
• • Third parties that support us in the context of our service provision, such as debt collection and collection services
• • Service providers that help us with analyses, such as SAS Analytics and Google Analytics
• • AI Service Providers – for providing AI functionality in the app (only after your explicit consent and choice of service provider), such as OpenAI, Google Gemini or xAI (Grok).

We reserve the right to share your personal data with (other) third parties when this is legally required or when this is necessary for the protection of the interests of you, us or third parties.

8. Changes to our policy

This Privacy Statement may be amended in the event of changes to our services or changes in privacy legislation. We will announce any changes on our website. In the case of changes that apply to you, we will inform you personally, for example by sending you an email.

9. How you can exercise your rights

Under privacy legislation (including the General Data Protection Regulation (GDPR)) you have a number of rights. These rights are described in Articles 12–23 of the GDPR and in related legislation. You have at least the following rights with regard to your personal data:

• • Right to request access to your personal data;
• • Right to request correction of your personal data if they are incorrect (rectification);
• • Right to request deletion of your personal data;
• • Right to request restriction of your personal data;
• • If we have processed your personal data on the basis of our legitimate interests: right to object to the (further) processing of your personal data (objection)
• • If we have processed your data on the basis of your consent or on the basis of an agreement that we have entered into with you: right to request transfer of the personal data (data portability)

If you wish to exercise one or more of these rights, you can contact us.

10. Right to complain

Do you not agree with a decision of ours, for example when we decide not to delete your personal data? You can then make use of one or more of the following options:

• • Contact us via support@mymemorylane.com: in that case we will try to reach a solution together with you.
• • File a complaint: you have the right to file a complaint with the Dutch Data Protection Authority: https://www.autoriteitpersoonsgegevens.nl/
• • Request mediation: you can ask the Dutch Data Protection Authority to mediate between you and us: https://www.autoriteitpersoonsgegevens.nl/
• • Legal proceedings: you have the right to take the matter to the competent court to settle the dispute.

11. Contact

The responsibility for processing the personal data referred to in this privacy statement lies with:

e-mail: support@mymemorylane.com

If you contact us with a question or request about your personal data, it is important that we are certain that the request or question has actually been made or submitted by or on behalf of you. Therefore, we ask you to send a copy of your proof of identity, otherwise we cannot process the request or question. In this copy, please black out your passport photo, MRZ (machine readable zone, the strip with numbers on the ID), document number and Citizen Service Number (BSN) to protect your privacy. We will respond to your request or question as soon as possible.