Privacy statement
This is a translation for your convenience. The Dutch version is binding.
Version 9 October 2026
This is the English version, a translation provided for convenience. The Dutch version is binding. In case of any difference, the Dutch text prevails.
1. In short
- Sendis is a service for secure messages between healthcare providers and their clients.
- Sendis is a service of Neolyth, a sole proprietorship (eenmanszaak) of Marwand Ayubi.
- We decide ourselves about your account, the website and our own administration. We are responsible for that, and that is what this statement is mainly about.
- The healthcare organisation that uses Sendis decides about messages and client data. We process that data only on that organisation's behalf. Are you a client or patient? Please read section 4 first.
- We do not sell data, we show no advertising and we do not follow you across other websites. We count visits to our website with our own statistics software, without cookies. You can switch it off (see 9.5).
- We are open about what we can technically see. That is in section 8.
2. Who we are
| Name | Neolyth, sole proprietorship of Mr Marwand Ayubi, provider of Sendis |
| Address | Graafseweg 274, 6532 ZV Nijmegen, the Netherlands |
| Chamber of Commerce (KvK) | 95055592 |
| VAT number | NL005127223B03 |
| Privacy questions | hello@neolyth.io |
| Website | https://sendis.eu |
We have not appointed a data protection officer. At present we are not required to, given the limited scale of our processing. We will reassess this as that scale grows. You can contact us directly with any question using the details above.
3. Who this statement is for
This statement is for:
- visitors to our website sendis.eu;
- account holders: people with a Sendis account, such as clinicians and staff of a healthcare organisation, and independent practitioners;
- people who send a message through a contact link, as far as abuse prevention is concerned (see 5.4);
- anyone who contacts us, for example by email.
For this data we are the controller. That means we decide why and how the data is used.
4. Are you a client or patient? Read this first
Did you receive a message from a healthcare organisation through Sendis, or are you replying to one? Then that organisation is responsible for your data. We are only the processor: we provide the technology and act solely on the organisation's instructions. The arrangements are set out in the data processing agreement between us and that organisation.
This covers:
- the content of messages and attachments;
- your name, email address and telephone number as entered by the organisation;
- data about the message, such as the subject, times and whether you opened it;
- data recorded when you use the portal, such as your IP address;
- notes the organisation keeps about you in its contact list.
What this means for you
- If you want to know what data about you is kept, or want something corrected or deleted, contact the organisation that sent you the message. It decides.
- If your request reaches us anyway, we forward it to that organisation without delay and help it carry out the request. We do not decide on it ourselves.
- The organisation decides how long messages are kept. By default a message does not expire. When a message expires or is withdrawn, we delete the content and the keys. The data about the message (such as subject, sender, recipient and times) is then kept for as long as the organisation is a customer, and deleted afterwards in line with the data processing agreement.
- We never use your messages or data for our own purposes: not for product development, not for statistics and not to train AI models.
Section 8 explains how your messages are protected and what we can technically see. That is useful for you too.
5. Which data we use, why, and for how long
5.1 Overview
This table sets out, per purpose, which data we use, on which legal basis (Article 6 GDPR) and how long we keep it.
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Running and securing the website | IP address, date and time, requested page, browser type (server logs) | Legitimate interest (Art. 6(1)(f)): a secure and available website | Up to 90 days |
| Counting visitors to the website (see 9.5) | Page visited (without query parameters), referring website, type of browser, operating system and device, screen size, language setting and country (derived from the IP address). The IP address is not stored. No cookies. | Legitimate interest (Art. 6(1)(f)): understanding how the website is used, in order to improve it | Up to 12 months, then deleted automatically |
| Creating and managing your account | Name, email address, password (only as an unreadable hash), organisation and role, language and display settings, invitations | Performance of the contract (Art. 6(1)(b)) if you are the customer. If you work for a customer: our legitimate interest and your employer's in delivering the agreed service (Art. 6(1)(f)) | As long as the account exists, then up to 12 months |
| Securing your account | Log-in times, sessions with IP address and browser type, two-step verification settings, phone number for SMS codes, passkeys | Legitimate interest (Art. 6(1)(f)): preventing someone else from accessing your account | Session data up to 12 months after the session. Other data as long as the account exists |
| Sending service messages | Email address, name | Performance of the contract (Art. 6(1)(b)), or legitimate interest (Art. 6(1)(f)) if you work for a customer | As long as the account exists |
| Invoicing and payments | Customer name and email address, subscription, amounts, invoices, data from our payment provider | Performance of the contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c)) | 7 years, as required by Dutch tax law (Section 52 General State Taxes Act) |
| Preventing abuse of contact links (see 5.4) | Email address, phone number if you confirmed it, how often and when you were verified, block status, number of abuse reports | Legitimate interest (Art. 6(1)(f)): preventing Sendis from being used for spam, fraud or harassment of healthcare providers | 12 months after the last verification. If blocked or reported: 24 months after the last report |
| Answering your questions and requests | What you send us, your name and contact details | Legitimate interest (Art. 6(1)(f)): answering correspondence. For a question about a contract: Art. 6(1)(b) | 24 months after the matter is closed |
Honest about deletion. Sendis does not yet delete some of this data automatically. This applies to account data, session data and the abuse-prevention data. We therefore delete that data ourselves, manually, at least once per quarter, so that the periods in the table are met. Data may therefore exist for up to three months longer than the period in the table.
5.2 Do you have to provide this data?
Without a name, email address and password we cannot create an account for you. Without payment data we cannot provide a paid subscription. A telephone number is needed only if you want to use SMS codes.
5.3 Where the data comes from
Usually from you. If you work for a healthcare organisation, an administrator of that organisation may have invited you. We then receive your email address and possibly your name from that administrator. Sendis works by invitation only.
5.4 Contact links and abuse
A healthcare organisation can offer a contact link. Someone without an account can use it to send a message after confirming their email address.
- The message itself and everything that belongs to it is the organisation's responsibility (see section 4).
- To prevent abuse, we keep our own list of senders who use a contact link. That list covers all organisations together, so someone who abuses one organisation can also be kept away from others. We are responsible for that.
- An abuse report by a recipient, or suspicious behaviour, can lead to a block. We do not reveal who made a report. If you have been blocked and think that is wrong, email us. A person will then review your case.
5.5 What we do not do
- No newsletter, no marketing email.
- No selling, renting or trading of personal data.
- No profiling and no automated decisions with legal or similarly significant effects for you.
- No use of messages or other personal data to train AI models.
- No trackers and no third-party scripts or analytics services on the website, in the app or in the portal. In the app and the portal we do not measure anything ourselves either: no visitor statistics of any kind run there. Only on the website do we count visits, with Umami on our own installation (see 9.5).
We do not rely on consent as a legal basis anywhere. There is therefore no consent for you to withdraw.
6. Who we share data with
We use a small number of service providers. Except for Mollie, they act on our instructions and may not use the data for themselves. Mollie B.V., as a payment service provider, is itself responsible for the data it processes for the payment. In short:
| Provider | Purpose | Location | Role |
|---|---|---|---|
| IONOS SE | Servers and storage | Germany, EU | Processor; for healthcare organisations also a sub-processor |
| Cyso Cloud B.V. | Sending email (invitations, notifications, codes) | the Netherlands, EU | Processor; for healthcare organisations also a sub-processor |
| Amazon Web Services EMEA SARL | Sending SMS codes | Frankfurt, Germany (US parent company, see section 7) | Processor; for healthcare organisations also a sub-processor |
| Mollie B.V. | Payments | the Netherlands | Independent controller |
| Worldstream B.V. | Hosting of the sendis.eu website and visitor statistics | the Netherlands | Processor, for the website only; not a sub-processor |
A sub-processor is a processor we also engage for the data we process on behalf of healthcare organisations (see section 4). Mollie and Worldstream have no access to that data: messages, attachments and account data of the service do not pass through them.
Our technical logs are kept on a Neolyth-owned server in the Netherlands. Our key management system is located on our server at IONOS in Germany.
The website and the visitor statistics (Umami) run on our server at Worldstream in the Netherlands. That party only provides the server and processes the data on our instructions. We manage the software and the statistics ourselves.
The data each sub-processor receives is listed at sendis.eu/subverwerkers.
Otherwise we disclose data to others only when the law requires it, for example under a court order. If it concerns a healthcare organisation's data, we inform that organisation in advance unless the law forbids it.
7. Data outside the European Union
We store and process everything within the European Economic Area (EEA). There is one exception involving a company outside the EEA:
- SMS codes via Amazon Web Services. We use AWS only in the Frankfurt region (eu-central-1). Our software refuses other regions. AWS is, however, part of a US group, so access from the United States cannot be fully ruled out. AWS's data processing terms apply, which include the European Commission's standard contractual clauses. Only the phone number and the code pass through AWS, never messages or attachments.
Would you like a copy of these safeguards? Ask us at hello@neolyth.io.
8. How your messages are protected, and what we can see
We want you to know exactly what we can technically do, so we also describe the limits. A longer explanation is at sendis.eu/versleuteling.
8.1 The text of a message
The text of a message is encrypted in the sender's browser (AES-256-GCM) before it reaches our server. On our server the text is therefore stored only in encrypted form. Whether we can read it depends on how the message is delivered:
| Delivery | Can Neolyth technically read the text? |
|---|---|
| To a recipient with a Sendis account | Not without the recovery key of the sender's or the recipient's organisation. We do manage those keys (see 8.2). |
| Through the portal with an access code | The code never reaches our server. We cannot read the text without the organisation's recovery key. We do manage that key (see 8.2). The protection is as strong as the code: the longer the code, the better. |
| Through the portal with a code by email or SMS | Yes, technically. With this method our server stores an encrypted secret that can open the message, and our server can decrypt that secret. With this method we can therefore technically read the text. |
8.2 Organisations' recovery key
If you work at an organisation that uses Sendis, that organisation has a recovery key. The organisation can use it to open and read messages, for example when an employee loses their password or leaves. Every message of such an organisation can be opened with that recovery key, including messages to recipients with an account or an access code, and including attachments. If you send a message to a Sendis user in another organisation, that organisation can also open the message through its own recovery procedure.
- We store and manage that recovery key in our own key management system. Organisations cannot currently choose a different recovery method.
- This means we can technically open all messages of such an organisation.
- Within Sendis, an organisation can use the recovery key only with a stated reason, after notifying the employee concerned, after a waiting period of 72 hours by default and with approval from an administrator, plus a second administrator where the organisation has more than one. The waiting period can be skipped only where a legal obligation requires it, such as a court order. This is recorded.
- We do not use the recovery key on our own initiative. Only on the organisation's written instruction, or when the law compels us to. In the latter case we inform the organisation in advance unless the law forbids it.
If you have your own account without an organisation, there is no recovery key.
8.3 Attachments
Attachments are checked for viruses on our server. The server processes the attachment unencrypted only for that check and for encryption. The server then stores the attachment in encrypted form. The server generates that key itself. We can therefore technically read attachments with every delivery method.
8.4 What we can always see
To deliver messages, the following data is readable to us:
- the subject of a message;
- names, email addresses and phone numbers of sender and recipient;
- names, type and size of attachments;
- times: sent, delivered, opened, read, expiry date;
- the delivery method and the conversation a message belongs to;
- IP addresses and browser types of people who log in or use the portal;
- notes an organisation keeps about someone in its contact list.
Tip for senders: do not put sensitive information in the subject or in an attachment's file name.
Our technical logs contain IP addresses and recipients' email addresses. They never contain message text or attachments.
8.5 The email a recipient receives
If you receive a message through the portal, you first get an email with a link. It shows the sender's name and the organisation's name. It does not contain the subject or the text of the message. Note: your email provider can therefore see that you received a message from that sender and that organisation.
Exception: if an unread message is about to expire, you receive a reminder one day before. That reminder does contain the message subject.
8.6 Further
- All connections to the website, the app and the portal use HTTPS. Email is sent encrypted where the receiving mail server supports it, and otherwise unencrypted.
- Sendis works by invitation only.
- You can set up two-step verification (app code or SMS) or a passkey. We strongly recommend it.
- We use no third-party scripts, fonts or services in the browser.
- Access to our servers and databases is limited to the owner of Neolyth.
8.7 What we do not claim
Sendis is not certified under NEN 7510 or ISO 27001. No system is completely secure. If we discover a data breach that affects you, we act as the law requires: we notify the Dutch Data Protection Authority and, where necessary, you. If it concerns a healthcare organisation's data, we notify that organisation and it decides on further notifications.
9. Cookies and local storage
9.1 The website sendis.eu
The website sets no cookies. It has no trackers and no third-party scripts, fonts or analytics services. It does load a small script from our own statistics installation, Umami, to count visits (see 9.5). That script reads a few settings from your browser, such as screen size and language, and stores nothing in your browser itself. In addition, the server records visits in logs (see 5.1). Those are not cookies.
If you switch statistics off, we store that choice in your browser:
| Name | Type | Purpose | Duration |
|---|---|---|---|
umami.disabled |
Browser storage (localStorage) | Remembers that you switched visitor statistics off | Until you switch them back on or clear your browser storage |
9.2 The app (app.sendis.eu)
| Name | Type | Purpose | Duration |
|---|---|---|---|
refresh_token |
Cookie | Keeps you logged in securely | 7 days |
sendis-keys |
Browser storage (IndexedDB) | Your personal keys, themselves encrypted, so you can read your messages | Until you log out or clear storage |
sendis-drafts |
Browser storage (IndexedDB) | Encrypted drafts on your device | Until cleaned up |
sendis-theme, sendis-zoom, sendis-locale, and other settings starting with sendis |
Browser storage (localStorage) | Your display, language and layout choices, and notices you dismissed | Until you clear them |
Temporary settings starting with sendis, and pendingInviteToken |
Per-tab storage (sessionStorage) | Operation of the open tab and a pending invitation | Until you close the tab |
9.3 The portal (portal.sendis.eu)
| Name | Type | Purpose | Duration |
|---|---|---|---|
portal_session |
Cookie | Keeps you logged in after verification | 24 hours |
contact_link_session |
Cookie | Session when you send a message through a contact link | 30 minutes |
sendis_portal_prefs |
Cookie | Your language and display choice | 1 year |
sendis_account_prompt_dismissed |
Cookie | Remembers that you dismissed the invitation to create an account | 24 hours |
sendis_portal_feedback_dismissed |
Cookie | Remembers that you dismissed the feedback request | 30 days |
sendis.portal.lang |
Browser storage (localStorage) | Your language choice on contact-link pages | Until you clear it |
9.4 Why you see no cookie banner
The cookies and storage in 9.2 and 9.3, and the choice in 9.1, are Sendis's own. They are needed to provide the service you ask for, or to remember choices you made yourself. Such strictly necessary storage does not require consent (Article 11.7a(3) of the Dutch Telecommunications Act).
The website's visitor statistics (9.5) use no cookies, but the script does read a few settings from your browser. That does not require consent either. The same provision makes an exception for measuring the quality or effectiveness of a website where this has no or only minor consequences for your privacy. That is why we show no cookie banner. You can always switch the statistics off (9.5). There are no tracking, analytics or advertising cookies.
You can always clear cookies and storage in your browser settings. Logging in and reading messages will then work again only after you log in again. If you clear storage, your choice to switch statistics off is cleared as well.
9.5 Website visitor statistics
To see which pages of sendis.eu are read and how visitors find us, we use Umami. It is software we manage ourselves, on our server at Worldstream in the Netherlands. The script is loaded from sendis.eu itself. No data goes to any other party, and we do not use the statistics for advertising.
What we record. The page visited without query parameters, the referring website, the type of browser, operating system and device, screen size, language setting, and the country you visit from.
What we do not do. We set no cookies and do not keep your IP address. The IP address is used only briefly in working memory to determine the country, and to calculate a code that lets us group visits made on the same day. That code changes every day, so we cannot link your visits on different days. We do not follow you across other websites and do not link the statistics to an account, to messages or to any other data. No statistics run in the app (app.sendis.eu) or the portal (portal.sendis.eu).
Is this anonymous? Not entirely. Because we could in theory trace same-day visits back to an IP address and browser, we treat this data as personal data.
Legal basis and retention. Our legitimate interest in improving the website (Article 6(1)(f) GDPR). We keep the data for up to 12 months, after which it is deleted automatically.
Switching statistics off. The button below switches statistics off for this browser. Nothing is measured after that. Your choice is stored in your browser (see 9.1) and applies per browser and per device. If your browser sends a "Do Not Track" signal, we measure nothing either. The same applies if JavaScript is switched off.
Because we do not keep IP addresses, we usually cannot link earlier visits to you. We therefore cannot look them up or delete them individually (Article 11 GDPR). Switching statistics off is the way to object to this measurement (see section 10).
10. Your rights
For data we are responsible for, you have these rights:
- Access: you may know what data we hold about you and receive a copy.
- Rectification: you may have incorrect data corrected.
- Erasure: you may ask us to delete your data, unless we must keep it, for example for the tax authorities.
- Restriction: you may ask us to pause use temporarily, for example while we investigate a complaint.
- Portability: you may receive data you gave us in a common file format.
- Objection: you may object to use based on our legitimate interest. We will then stop, unless we have compelling reasons, which we will explain to you. For the website's visitor statistics you can do this yourself straight away, with the button in 9.5.
How: email hello@neolyth.io. Sendis does not yet have a button for this in the app; we handle your request ourselves. We may ask you to prove who you are, but no more than is necessary.
How fast: within one month. If your request is complex, we may extend this by up to two months. We will tell you within the first month, with the reason. Requests are free of charge.
Does your request concern messages or data of a healthcare organisation? Then we forward it to that organisation (see section 4).
A complaint? Please tell us first so we can look for a solution together. You may also always lodge a complaint with the Dutch Data Protection Authority:
Autoriteit Persoonsgegevens Postbus 93374, 2509 AJ Den Haag, the Netherlands www.autoriteitpersoonsgegevens.nl
If you live or work in another EU country, you may also contact the supervisory authority there.
11. Changes
If we change how we use data, we update this statement. The new version appears on this page with a new date. Earlier versions are available on request. For an important change, we notify account holders in advance, by email or in the app.
12. Contact
Neolyth, provider of Sendis Graafseweg 274, 6532 ZV Nijmegen, the Netherlands hello@neolyth.io
See also: Terms · Sub-processors · Legal notice