Privacy policy

Who we are and how to contact us

Rhyos is an early-stage company developing an optical sensor intended to measure cerebral blood flow from outside the head. We are based in the Netherlands.

A registered legal entity and business address have not yet been published. Until those details are available, the founders operating this website in the Netherlands are the people responsible for responding to privacy enquiries. You can contact them through their public LinkedIn profiles: Quinten Uivel and Cas Bramer.

Please do not send clinical records, health information, passwords, payment details, or other confidential material through this website. The contact receiver is not configured in this published version. Until it is configured, the form keeps a draft in the browser and displays that the message was not sent; it does not transmit the draft to Rhyos.

What personal data we process

We process different categories of personal data depending on how you use the site. We do not ask public visitors for health data, biometric data, or other special-category data.

Information you provide directly

• Contact form. If you complete the contact form, the browser may hold your name, email address, and message as an unsent draft. A random submission reference may be generated in the browser so a retry can be recognised without sending the same message twice. In the current published version, no contact form draft is transmitted because no receiver is configured. If a receiver is enabled later, this policy will be updated before that change is used.
• Staff sign-in. Invited staff members sign in through Google OAuth. We receive the account identifier, email address, and session data needed to verify active membership in our external identity and records service. Staff may also create or edit company records in the private workspace; those records are not public website content.

Information collected automatically

• Technical and security data. Our hosting provider and edge network may process your IP address, browser and device type, requested pages, response status, referrer, timestamp, approximate location derived from the IP address, and security signals. These data are used to keep the site secure, prevent abuse, and serve the requested pages.
• Essential session data. When staff sign in, our identity provider stores session tokens and access logs that are strictly necessary to maintain a secure private workspace.

The production host includes a first-party analytics script that reports page visits and website performance. It sends a session identifier, page address, referring page, browser information, browser language, and a country estimate derived from browser settings to the host's analytics service. Page addresses can include query parameters, so avoid placing confidential information in website URLs.

Why we use personal data and our legal bases

We use the information above for these specific purposes:

• Responding to enquiries. If a contact receiver is enabled, contact details are used to answer a message and maintain relevant correspondence. The legal basis is our legitimate interest in communicating with prospective partners and other interested parties, or consent where that is the applicable basis.
• Providing the staff workspace. Staff identity data is used to authenticate members, enforce access controls, and record permitted actions on company records. The legal basis is the staff or membership relationship and our legitimate interest in securing internal systems.
• Security and abuse prevention. Technical logs help us detect attacks, spam, or other misuse of the website or staff area. The legal basis is our legitimate interest in protecting the website, our systems, and visitors.
• Availability and improvement. Aggregate error, performance, and availability data may be used to fix problems and keep the site running. The legal basis is our legitimate interest in operating and improving the service.

Cookies and similar technologies

The production host's analytics script sets a first-party cookie named “session-id” to associate page and performance events with a browsing session. The script sets its expiry to 30 minutes and renews it when reporting an event. You can block or delete this cookie through your browser settings.

Staff sign-in relies on cookies or local storage that are strictly necessary to keep a requested private session secure. These are set by our external identity provider and are essential for the staff area to function.

We will update this policy when the site's analytics or cookie practices change.

Google sign-in for staff

The private staff area uses Google OAuth through our company-controlled Supabase project. When an invited staff member signs in:

• Google shares the account identifier and email address with Rhyos.
• Our Supabase project checks whether that account has an active Rhyos membership before granting access.
• Session tokens are stored in the browser and are used only to maintain the authenticated session.

We do not use Google sign-in for public visitors, and we do not request access to Google account data beyond what is needed for authentication.

Who we share information with

We do not sell personal information. We may share data with the following recipients:

• Hosting and edge providers. Technical logs are processed by the services that serve the website and protect it from malicious traffic.
• Host measurement provider. The production host receives page, session, and performance metadata through the analytics script described above.
• Identity and records service. Staff authentication and authorised record access are handled by our external, company-controlled Supabase project.
• Contact receiver. If a contact endpoint is configured, your message is sent to the company-controlled receiver selected by Rhyos.
• Legal and professional advisers. We may disclose information when required by law or to enforce our rights.

Each recipient is contractually or legally bound to use personal information only for the purpose for which it was shared and to protect it appropriately.

International transfers

Our hosting and identity providers may process data in the European Union, the United States, and other countries. When personal information is transferred outside the European Economic Area, we rely on appropriate safeguards such as Standard Contractual Clauses, adequacy decisions, or the provider's certification under recognised transfer mechanisms.

How long we keep information

We keep personal information only as long as necessary for the relevant purpose:

• Contact messages. Retained for as long as needed to respond and maintain a business relationship, and then deleted or anonymised unless legal obligations require a longer retention period.
• Staff access logs. Retained according to our internal security and audit policy, typically for a limited period necessary to investigate incidents and satisfy compliance obligations.
• Technical and measurement data. Retained by our hosting and measurement providers for the periods defined in their respective policies and then deleted or aggregated according to those policies.

Security

We use HTTPS for all public pages, enforce Content Security Policy headers, and rely on our hosting and identity providers for infrastructure security. Staff access is restricted to invited members and checked against an external membership service.

No internet service can guarantee absolute security. If we become aware of a breach that affects your personal information, we will notify you and the relevant supervisory authority in accordance with applicable law.

Your rights

Depending on your location, you may have the following rights regarding your personal information:

• Access. You can ask for a copy of the personal information we hold about you.
• Correction. You can ask us to correct inaccurate or incomplete information.
• Erasure. You can ask us to delete your personal information in certain circumstances.
• Restriction. You can ask us to limit how we use your information.
• Objection. You can object to processing based on legitimate interests.
• Data portability. You can ask for your information in a structured, machine-readable format.
• Withdraw consent. Where processing is based on consent, you can withdraw it at any time.

To exercise these rights, contact the founders using the contact routes in the “Who we are and how to contact us” section above. State that your message is a privacy request and tell us which right you want to use. We may ask for information needed to verify your identity before responding. We will respond within the time limits set by applicable law. If a contact form receiver is not configured, use one of the LinkedIn routes instead; entering a draft in the form alone does not submit a request.

Children's privacy

This website is not directed at children under 16, and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it.

Third-party links

This website may contain links to LinkedIn profiles and other external sites. We are not responsible for the privacy practices or content of those third parties. We encourage you to read their privacy policies.

Changes to this policy

We may update this privacy policy when the website, our services, or legal requirements change. The “Effective date” at the top of the page shows when this version was last updated. Material changes will be noted in a revised effective date.

How to contact us

For privacy questions, data requests, or complaints, contact the founders using the contact routes in the “Who we are and how to contact us” section. The current contact form is an unsent draft surface until a receiver is configured.

If you do not receive a satisfactory response, you have the right to complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl.

We will update this policy when the Rhyos legal entity, public privacy contact, contact receiver, or hosting measurement configuration changes. The effective date above identifies the version currently published.