Privacy Policy

1. Introduction

Effective date: 21st of October 2026

This Privacy Policy applies to the processing activities of Kaiko B.V., a private company with limited liability organized and existing under the laws of the Netherlands, having its registered address at Louwesweg 6 in (1066 EC) Amsterdam, and registered with the Chamber of Commerce under registration number 84155221, including its Zurich branch, having its registered address at Hardturmstrasse 11, 8005 Zurich, Switzerland, and registered with the commercial register of the Canton of Zurich under registration number CHE-445.930.110.

Kaiko B.V. (hereinafter: “kaiko”, “we”, “us”, “our”) understands that your privacy is important and that you care about how your personal data is used. We respect and value your privacy and will only collect and use personal data in the manner and for the purposes as described in this document and that is consistent with our obligations and your rights under the applicable legislation and regulations.

This external Privacy Policy covers kaiko’s business activities including but not limited to: customer relations management, financial administration, hiring & recruitment, website administration, and marketing, events and communications (including our newsletter and invitations to events and webinars). This external Privacy Policy does not cover:

• Research involving patient data, for which we instead refer to “Privacy Policy for Participating Patients”.
• Activities with respect to our employees, for which we instead refer to the Internal Privacy Policy, which we distribute to our employees.
• Use of kaiko workspace and our other products, for which the "Privacy Policy kaiko workspace" applies. That policy is available through the kaiko workspace interface. Where we provide kaiko workspace we usually act as processor for the customer (for example, the hospital), and the customer's own privacy policy governs that processing.

For the context described above we may collect, hold, use and/or otherwise process personal data about you. Based on applicable data protection and privacy law (such as the laws and regulations set out in paragraph 2 below), we qualify as ‘the controller’ with respect to the personal data that we process in that context.

Attention: By using our services and/or our website and by sharing your personal data with us, you acknowledge that your personal data will be processed in the manner as described in this Privacy Policy.

Note: This does not constitute your ‘consent’ to the processing of your personal data. We only process your personal data on the basis of your consent where we specifically say so in this Privacy Policy - in particular for our newsletter and other electronic marketing messages, and for the non-essential cookies described in paragraph 13. Where we need your consent, we will ask for it separately.

This Privacy Policy is intended to ensure compliance with European, Dutch, Swiss and United Kingdom privacy legislation and regulations, including but not limited to, the General Data Protection Regulation (GDPR), the national implementation laws with respect to the GDPR, such as the Dutch Implementation Regulation (Uitvoeringswet Algemene verordening gegevensbescherming, UAVG); the Swiss Federal Act on Data Protection (FADP) and its Data Protection Ordinance (O-FADP); and the United Kingdom General Data Protection Regulation (UK GDPR) together with the UK Data Protection Act 2018; and any other applicable legislation.

This external Privacy Policy is relevant for anyone whose personal data we may process in the context of our (business) activities, including but not limited to employees at, representatives of and/or (other) contact persons of our current and former contracting parties and/or business partners, job applicants, employee of and/or (other) contact persons of our current and former professional advisers, consultants and service providers, visitors of our website, subscribers to our newsletter and other communications, people who register for or attend events, webinars and conferences at which we take part, and people who contact us through our website, by email or through our social media and professional network channels (for example, LinkedIn).

As mentioned above, this external Privacy Policy is not applicable to patients participating in our research projects. Please refer to our “Privacy Policy for Participating Patients”. Similarly, this Privacy Policy does not cover activities with respect to our employees, for which we instead refer to the Internal Privacy Policy, as distributed to our employees.

This Privacy Policy explains on what legal basis we may process your personal data and:

• what personal data we collect;
• for what purposes and how we may use/process such personal data;
• how we collect the personal data;
• how we store the personal data;
• for what period we store the personal data; and
• what your rights are under the applicable data protection and privacy legislation.

In view hereof, we encourage you to carefully read this Privacy Policy. From time to time, we may need to update this Privacy Policy. This may be necessary, for example if the law changes or if we change our business in a way that affects the way we process personal data. The most recent version of this Privacy Policy will always be available on our website https://www.kaiko.ai/. You may also ask us to send you a copy of the most recent version of this Privacy Policy.

Note: Where you provide personal data to us, which personal data relate to another individual than yourself (for example, of the legal representative of the company you are representing), please provide the concerned individual with (a copy of) this Privacy Policy before providing us with his/her personal data.

Children. Our website, our services and our communications are not directed at children. We do not knowingly collect personal data from anyone under the age of 16. If you believe that we have received personal data of a child, please contact us using the details in paragraph 14 and we will delete it.

If we collect your personal data, we may collect information about you in various ways:

• Directly from you, for example when you provide us with your personal information by contacting us or when a contact person provides his/her personal data by email, by phone, on paper, or by means of a business card;
• Directly from you and automatically when you visit our website https://www.kaiko.ai/, through cookies and similar technologies - please see paragraph 13;
• Directly from you when you subscribe to our newsletter or other communications, or when you register for, or attend, an event, webinar or conference at which we take part;
• Directly from you, for example when you apply for a job with us (please see paragraph 6 for more information);
• From third parties, for example where we obtain your contact details from companies we work with (in the course of our business activities), your employer and/or colleagues, external advisers, head-hunters, recruitment agencies;
• Otherwise, for example by consulting public sources/public records (e.g. your website, the trade register, branch associations or media), by own research and by contacting companies.
• From professional networks and publicly available professional profiles (for example, LinkedIn), which we use to identify and approach business contacts;
  

Special categories of personal data. Other than as described in paragraph 6 for job applicants, we do not ask for and do not want to receive special categories of personal data about you - such as data revealing your health, racial or ethnic origin, religious or philosophical beliefs, political opinions, trade union membership, genetic or biometric data, or data about your sex life or sexual orientation. Please do not include such data in the messages you send us.

The legal grounds used for our processing activities are:

1. The processing is necessary for the performance and execution of a contract with you;
2. The processing is necessary for compliance with legal obligations (including our obligations under applicable tax laws, our legal administration obligations, to cooperate with supervisory authorities);
3. The processing is necessary for our legitimate (business) interests.
4. You have given us your consent (in particular for our newsletter and other electronic marketing messages and for the non-essential cookies described in paragraph 13).

If applicable laws require so, we will process your personal data upon your (explicit) consent. If any kind of processing is based on your consent, we hereby inform you that you have the right to withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

As part of your application process for a position within kaiko, we will collect and process certain personal data relating to you. This paragraph explains how we collect and use your personal data as part of your application procedure and for what purposes we process your personal data. Please note that this information only relates to your application process. Once we have accepted your application, you will receive our internal employee privacy policy.

In the context of the application procedure, we may collect and process the following personal data relating to you:

• Identification and contact details (e.g. name, date of birth, gender, place of birth, nationality, address, telephone number and email address);
• Resume and (additional) education and/or employment history;
• Professional certificates;
• Appraisals;
• References;
• Information on your legal and disciplinary history;
• Copy of an identification document (including a driver’s license, if and to the extent relevant for the position);
• Social security number (Burgerservicenummer);
• All other data relating to your work experience (if and insofar as relevant to the performance of work);
• All other data you include in your letter and/or resume;
• Government issued information, such as a copy of a residence permit or work permit (if applicable);
• Results of assessments;
• Information from your professional social media account(s);
• Your response to interview questions; and
• In the event that we decide to offer you a position, we may request a certificate of good conduct (Verklaring omtrent gedrag) to ensure suitability, integrity and reliability for the job.

We will only use your personal data as described above for the following purposes:

• To determine whether you are suitable for, and meet, the relevant requirements for the position for which you are applying;
• For our records;
• To contact you and to communicate with you;
• To enter into a contract with you; and
• To prevent reassessment of applicants.

We will collect, process and disclose your personal data where we consider it necessary to perform pre-contractual steps for purposes related to your job application or in order to pursue our legitimate interest. We may sometimes ask for your explicit consent for a certain processing activity. If we process personal data based on your consent, please note that you may revoke your consent at any time by contacting us via the contact details in paragraph 14.

We do not use automated tools to score, rank or filter applications, and we do not take hiring decisions by solely automated means. Any assessment of your application is made by a person.

Your personal data may be obtained directly from you, from publicly available sources or, where appropriate with your consent from the following third parties:

• Recruitment agencies or head-hunters;
• Your referees and/or (other) past employers;
• Teachers/providers of your education and/or training about your educational program and its completion; and
• Assessment agencies.

We may share your personal information with third parties, such as service providers we contract and our professional advisors to draft your employment agreement, but only for the purposes as set out above. We ensure that, if applicable, appropriate measures are taken when we disclose your personal data to third parties. Please refer to paragraph 9.

In case you have accepted a position within kaiko, we will include your application data in your employee file.

If you have not been offered or have not accepted a position within kaiko, we will erase your data as soon as is reasonably possible after the job application procedure has ended. Generally, this will be a maximum period of four (4) weeks from the date the job application procedure has ended.

Your personal data will only be retained for a longer period if it is necessary for defending our interests in the context of judicial proceedings (e.g. in case of a dispute) or where necessary to comply with our legal obligations.

If you want us to store your personal information for a longer period so that we can contact you in the event of another vacancy that suits your profile, please indicate your consent to us for retaining your personal data for a one (1) year period. You may withdraw your consent at any time after which we will delete your personal data as soon as is reasonably possible.

For your other rights regarding your personal data, we kindly refer to paragraph 10 and 11.

We will not store or keep your personal data for a longer period than is necessary in light of the purposes for which we process them (we refer to the purposes as listed above in paragraph 5). Only where we are legally obliged to, or where this is necessary for defending our interests in the context of judicial proceedings, we will store the personal data for longer periods.

In general, the following storage periods apply:

We will implement the necessary administrative, technical and organizational measures for ensuring a level of security appropriate to the specific risks that we have identified. We protect your personal data against destruction, loss, alteration, unauthorized disclosure of or access to personal data transmitted, stored or otherwise processed. To this end, we operate an information security management system that is certified against ISO/IEC 27001:2022. Our certificates and security documentation are available at https://trust.kaiko.ai. This includes measures such as: encryption of sensitive data, regular review of access rights, employees signing confidentiality agreements, etc.

Further, we seek to ensure that we keep your personal data accurate and up to date. However, you are responsible for this and we kindly request that you inform us of any changes to your personal data (such as a change in your contact details).

No method of transmitting or storing information is completely secure, so we cannot guarantee that our security measures will never be breached. If a personal data breach occurs that is likely to result in a high risk to your rights and freedoms, we will inform you without undue delay.

In the context of the purposes as listed above, we may share your personal data with third parties in the following situations:

• We may share your personal data with our branch in Switzerland where necessary for us to carry out our activities and provide our services.
• In some limited circumstances, we may be legally required to share certain personal data, which might include yours, if we are involved in legal proceedings or complying with legal obligations, a court order, or the instructions of insurers or a government authority such as data protection authorities.
• We may engage third parties to process the personal data on our behalf (for example, providers of certain IT applications that we use in the context of our activities, which also include generative artificial intelligence (AI) tools, software developers, cloud and hosting providers, CRM and marketing automation providers, email delivery providers and collaboration tools). We will enter into the required contractual arrangements with those parties to ensure lawful and fair processing of your personal data on our behalf.
• We may share certain personal data with your employer or business contacts, with individuals or organisations who have a direct (contractual) relationship with us and other relevant private organisations (such as recruitment and assessment agencies and head-hunters).
• We may also transfer personal data in the event of the sale or transfer of all or any part of kaiko’s business with external advisors, auditors, (potential) buyers, government authorities, if this is required in the context of that transaction.

Where relevant, we will implement safeguards to ensure the protection of your personal data when disclosing your personal data to a third party. For example, we will enter into data processing agreements with relevant parties (providing for restrictions on the use of your personal data and obligations with respect to the protection and security of your personal data).

Some of the parties with whom we may share your personal data may be located in countries outside the European Economic Area (EEA), which countries may offer a lower level of data protection than within the EEA. This is for example the case in the following situations:

• kaiko is sharing some of the collected personal data with its office in Switzerland.
• kaiko uses service providers established outside the EEA, in particular in Switzerland, the United Kingdom and the United States. This applies for example, to the providers of our email and productivity software, our CRM and marketing automation platform, our newsletter delivery platform, and our internal collaboration and documentation tools. In practice this means your personal data may be stored in, or accessible from, a country outside the EEA.

Where we transfer personal data outside the EEA (other than to a country covered by an adequacy decision, such as Switzerland or the United Kingdom), we ensure your data protection rights are upheld by using one or more of the following transfer mechanisms: the service provider is registered under the EU-US Data Privacy Framework, including the relevant annexes (the UK Extension and the Swiss-US Data Privacy Framework); or the transfer is subject to the Standard Contractual Clauses adopted by the European Commission under Article 46(2)(c) GDPR, combined with appropriate technical and organisational measures such as encryption in transit and at rest and restrictions on access.

We do not sell your personal data. A full and up-to-date list of the processors we use is available at https://trust.kaiko.ai.

If you want to know what personal data we have of you, you can ask us for details of that personal data and for a copy of it (where any such personal data is held). This is known as a ‘data subject access request’.

All such requests should be made in writing and sent to the email or postal addresses shown in paragraph 14 below. In principle, there is no charge for a subject access request. If your request is ‘manifestly unfounded or excessive’ (for example, if you make unnecessary repetitive requests), we may refuse to comply with the request or charge a fee to cover our administrative costs in responding.

We will respond to your subject access request within one month after receiving it. Normally, we aim to provide a complete response, including a copy of your personal data within that time. Where your request is complex, or where we receive a number of requests from you, we may extend that period by a further two months, giving three months in total. If we need to do so we will tell you within the first month, and explain why. In this case you will, of course, be kept fully informed of our progress.

Under certain circumstances you have the right to:

• receive additional information regarding the processing of your personal data;
• rectify your personal data;
• the erasure of your personal data;
• object to (part of) the processing of your personal data;
• the restriction of (part of) the processing of your personal data; and
• data portability (receive your personal data in a structured, commonly used and machine- readable format and to (have) transmit(ted) your personal data to another organization).
• withdraw your consent at any time, where we rely on your consent - this does not affect the lawfulness of what we did before you withdrew it;
• object at any time to the use of your personal data for direct marketing, which we will always act on, without you having to give a reason; and
• not be subject to a decision based solely on automated processing, including profiling, that has legal effects for you or otherwise significantly affects you.

Finally, you have the right to lodge a complaint to the local data protection authority. With respect to the Netherlands, the Autoriteit Persoonsgegevens, address: Hoge Nieuwstraat 8, postal code 2514 EL, The Hague (or: Postbus 93374, 2509 AJ, The Hague), telephone no.: 070-8888 500, or via its complaint page (https://www.autoriteitpersoonsgegevens.nl/een-tip-of-klacht-indienen-bij-de-ap) on its website. With respect to Switzerland, the Federal Data Protection and Information Commissioner, address: Feldeggweg 1, postal code 3003, Bern, telephone no. 058 462 43 95, or via its complaint page (https://www.edoeb.admin.ch/en/report-form-data-subjects) on its website. With respect to the United Kingdom, the Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, telephone no. 0303 123 1113, or via its complaint page (https://ico.org.uk/make-a-complaint/) on its website. Under the Data (Use and Access) Act 2025 the ICO expects you to raise your complaint with us first. If you reside in another EEA country, you may find the contact details of your local data protection authority here (https://www.edpb.europa.eu/about-edpb/about-edpb/members_en).

We do not take decisions about you based solely on automated processing that have legal effects for you or that otherwise significantly affect you, and we do not profile you in order to take such decisions. We do measure whether our emails are opened and which links are clicked, and we use website statistics, so that we can make our communications and our website more relevant. This does not lead to any automated decision about you, and you can object to it at any time.

Our use of AI tools. We use third-party artificial intelligence features that are built into the software we run our business on or are used as a standalone software, for example, AI assistants in our collaboration, documentation, CRM and support tools, as well as general-purpose AI assistants, to help us draft, summarise and organise our work. Where those tools process your personal data they do so as our processors, under a data processing agreement, and only for the purposes set out in this Privacy Policy.

We do not use the personal data described in this Privacy Policy to train artificial intelligence models. Our providers process it in accordance with their data processing agreements with us and do not retain it for their own purposes, including model training, unless they are legally required to do so (for example, for abuse monitoring). kaiko's own models for medical research are developed on separate data under separate agreements with the relevant institutions. Where you use kaiko workspace, the "Privacy Policy kaiko workspace" explains how personal data is handled in that product.

This website uses "cookies", which are text files placed on your computer, to help the website analyse how users use the website. We only place cookies that are strictly necessary or functional without asking you. Statistical and marketing cookies are placed only if you consent through the cookie banner shown when you first visit our website, and you can change or withdraw your consent at any time through the cookie settings on our website. We use this information to keep track of how you use the website, to compile reports on website activity and to offer other services relating to website activity and internet use.

There are different types of cookies. For example:

Necessary cookies
Necessary cookies
Necessary cookies help make the website usable by enabling basic functions such as page navigation and access to secure areas of the website. The website cannot function properly without these cookies. We place these cookies without asking for your consent.

• Preference cookies
  Preference cookies enable a website to remember information that changes the way the website behaves or looks, such as your preferred language or the region you are in. We do not use cookies of this type.
• Statistic cookies
  Statistic cookies help us understand how visitors interact with the website by collecting and reporting information anonymously - for example, which pages are visited, how long visitors stay and where they come from. Some of the data collected is also used to personalise content and measure advertising effectiveness. These cookies are placed only with your consent and are provided in part by third parties, which means information about your visit is shared with those providers.
• Marketing cookies
  Marketing cookies are used to track visitors across websites. The intention is to display ads that are relevant and engaging for the individual user. We use these cookies only with your consent, for example in connection with embedded video content.

Deleting cookies
Cookies are stored on your computer and can be deleted at any time. Click on one of the links below to find out how to do this.

• Chrome
• Microsoft Edge
• Firefox
• Safari
• Opera
  
  

It is important to know that the use of cookies on our website is safe. Cookies do not result in spam or unwanted e-mails or phone calls. Our own cookies are not used to build a personal profile of you. Where you consent to statistical or marketing cookies, the provider concerned may combine information about your visit with information it holds from other websites; you can withdraw your consent at any time. A full list of the cookies we use, what each one does, who provides it and how long it lasts is set out in our Cookie Statement, available on our website.

To contact us about anything related to your personal data and/or data protection, including exercising your data subject rights as discussed above in paragraphs 10 and 11, in particular your right to object, please use the contact details below:

For the attention of: Data Protection Officer
Email address: privacy@kaiko.ai
Postal Address: Kaiko B.V., Louwesweg 6, 1066 EC Amsterdam, The Netherlands

If you have a disability and are unable to read this Privacy Policy online, please contact us and we will provide it in an alternative format.

Last updated on the 21st of October 2026. Version v2_21102026.

Previous versions of this Privacy Policy are available on request via privacy@kaiko.ai.