Introduction
Daza Connect is a professional alarm forwarding solution for healthcare institutions. Xanthoz B.V. processes personal data to deliver this service securely and reliably. This privacy policy explains which data we process, for what purposes and on which legal bases, and how we protect it. This policy applies to the Daza Connect web portal and mobile app, as well as to visitors of xanthoz.nl and dazaconnect.nl.
Company details
- Company name: Xanthoz B.V.
- Address: Sluisweg 8, 6121 JR Born, The Netherlands
- Email: privacy@xanthoz.nl
- Chamber of Commerce number: 89350669
Scope, target audience and roles
This app is intended solely for healthcare organisations and their staff (not for consumers or children). Xanthoz B.V. develops and maintains the system; the healthcare facility is responsible for the follow-up of alarms. In most cases, Xanthoz acts as the data processor for the healthcare facility, which is the data controller. This is laid down in a data processing agreement.
Important disclaimer (Emergency/First Aid)
Daza Connect does not provide medical advice, triage or first aid instructions, and does not contact emergency services. In acute emergencies, always call the local emergency number (e.g. 112).
What personal data do we process?
Users (healthcare staff)
- Identification and access: name, email address, user role, access rights
- Organisation & configuration: facility/department, assigned location(s) for alarm forwarding
- App/device data: login timestamps, IP address, error and usage logs
- Notifications: push token (e.g. FCM) for delivering alerts
Residents/clients (provided by the healthcare facility)
- Low-granularity identification: name and/or room number linked to an alarm
- Alarm metadata: sensor type, timestamp, status and handling, assigned staff member
Purposes
- Correct routing and display of alarms to authorised staff
- Access control, authorisation and audit logging
- Maintenance, security, incident analysis and customer support
Legal bases (GDPR Art. 6)
- Performance of a contract with the healthcare facility (delivery of the alarm service)
- Legitimate interest of Xanthoz and the healthcare facility (safe, reliable and demonstrable functioning of the system)
- Legal obligation where applicable (e.g. audit or incident reporting)
- Consent only where relevant outside the app, such as when using a contact form on the website
App permissions
- NFC: for scanning/registering sensors so they can be added to the system
- Push notifications: via Firebase Cloud Messaging (FCM) to send alerts
- The app does not request access to location, contacts, camera, microphone or media files
Security
- All communication is encrypted (TLS/HTTPS)
- Role- and rights-based access with minimal privileges
- Encryption of data at rest where possible and strict key/secret rotation
- Monitoring, logging and regular updates
Sharing with third parties (processors)
We do not sell personal data and do not share data with third parties for their own purposes. To deliver the service, we use processors, such as:
- Hosting/platform: Mendix Cloud on AWS (EU)
- Push services: e.g. Firebase Cloud Messaging (only push tokens and necessary delivery data)
- Support/monitoring: where necessary for maintenance and incident analysis
All processors have signed a data processing agreement. Data remains within the EEA or is covered by adequate safeguards (such as EU Standard Contractual Clauses).
Data location and international transfers
Hosting takes place in the EU via Mendix Cloud on AWS: primarily in Germany (Düsseldorf region) with backups in Ireland. Any transfers outside the EEA (e.g. for push/email) are carried out only with adequate safeguards.
Retention periods
- Account and authorisation data: as long as the account is active + 3 months after termination
- Operational alarm logs: 30 days
- Incident/audit logs: 1 year
- Backups: up to 30 days in accordance with retention policy
Data subject rights
You have the right to access, rectify, delete, restrict, port and object to the processing of your data. Requests should normally be made via your healthcare facility (data controller). You can also contact Xanthoz directly at privacy@xanthoz.nl. We may ask you to identify yourself. You will receive a response within one month.
Account management and deletion
Staff accounts are managed by the healthcare facility. Requests for deactivation or deletion are submitted by the facility; Xanthoz executes these and deletes data no longer needed, subject to legal retention obligations.
Changes
We may update this privacy policy in response to legal or service changes. The latest version is available in the app and on our websites.
Contact and complaints
Questions or complaints? Email privacy@xanthoz.nl. You can also file a complaint with the Dutch Data Protection Authority: autoriteitpersoonsgegevens.nl.