Privacy statement

Version 1.1, last updated on 29 October 2026. In case of differences, the Dutch version prevails.

1. Who I am

Zorgverzekering.chat is a service of 11 Internet (Jan-Willem Bobbink), Piet Heinstraat 79, 2518 CD The Hague, the Netherlands, registered with the Dutch Chamber of Commerce (KvK) under number 09190645. I am responsible for processing your personal data as described in this privacy statement.

Privacy questions or requests: help@zorgverzekering.chat.

2. In short

You can use the website, the comparison tool, the MCP server and the API without an account and without me storing your answers.
Your answers in the comparison tool are only in the link (URL). I do not store them.
I only store your expected care use if you give separate, explicit consent, and at most until 90 days after the switching deadline.
I use no advertising cookies and no third-party cookies. For statistics I set one analytics cookie on my own domain, which you can turn off.
I do not sell data and do not pass your data on to insurers or comparison websites.
You can always view, download and delete your data.

3. What data I use and why

3.1 When you visit the website

Data: your IP address, the type of browser and device (user agent), the page you request and the time.
Why: to run the website, secure it and protect it against abuse (such as too many requests).
Legal basis: legitimate interest.
Retention: for a 10% sample of requests, my hosting provider Cloudflare keeps technical logs, without the query string of the URL. These logs are deleted after at most 7 days.

3.2 When you use the comparison tool

Data: what you enter: the year, the years of birth of the people you insure, policies, deductible (eigen risico), optionally your expected care use as types of care and counts, regular care providers, any group scheme (collectiviteit) and the payment term.
Why: to calculate the expected yearly costs of health insurance policies for you.
Legal basis: you ask me for this calculation yourself, and you decide whether to enter any care use.
Retention: none. I calculate immediately and then forget your answers.

Good to know:

I do not ask for diagnoses, names of medicines or free text. Only types of care and counts, and only if you want them included. All care questions are optional.
Your answers are in the link of the results page. The link is encoded, but not encrypted: anyone with the link can see the comparison. The link also stays in your browser history. Only share it with people you trust.
Information about your expected care use and regular care providers can say something about your health. A group scheme, for example through a trade union or patient association, can also be sensitive. Only enter what you want included.
If you enter data about your partner or children, let them know.

3.3 When you use me through an AI assistant (MCP server) or the API

You can use my data and calculations in AI assistants such as ChatGPT, Claude, Cursor, VS Code and Gemini CLI, through my MCP server (https://mcp.zorgverzekering.chat/mcp), and through my REST API.

How it works:

You ask the AI assistant a question, for example what health insurance costs for your family.
The AI assistant decides by itself to call one of my tools, and sends me the data needed for it. This can be a search (for example a town or the name of a hospital), but also a scenario with years of birth.
I calculate or search and send back the answer, with sources. Then I forget the request: I do not store the input and do not use it for other purposes.

My tools do not ask about your health. If you mention care you expect yourself, for example 10 physiotherapy sessions, the AI assistant can send it as a type of care and a count to estimate your costs. This does not affect your premium or your acceptance: the premium of Dutch basic health insurance is the same for everyone by law, and I only calculate with published premiums.

Data I receive: the input of the tool call; the IP address and user agent of the system calling me; for partners, a client token.
Why: to provide the requested information or calculation, and to prevent abuse (a maximum number of requests per minute per IP address or token).
Legal basis: you ask (through the AI assistant) for this information yourself; for abuse prevention: legitimate interest.
Retention: the input not at all. Counters for abuse prevention disappear after one minute.
Statistics: I record which tool was used, whether it worked, how long it took, the language, the type of AI assistant, the number of results and which policies were in the answer. For a contract check, I count which care provider (AGB code), which type of care and which year was asked about, without the IP address and without the type of AI assistant, so I can fetch frequently requested contracts in advance. None of these statistics contain data that tells me who you are.

Who sees what?

With AI assistants in a browser or app (such as ChatGPT and Claude), the provider of the assistant calls my server, not your device. I then see the IP address of that provider, not yours, and I do not know who you are.
With programs on your own computer (such as Cursor, VS Code, Gemini CLI or Claude Code), your device calls my server directly. I then see your IP address. I only use it to prevent abuse and do not store it.
Your conversation with the AI assistant, including what you say there about your health and the answers I return, is processed and possibly stored by the provider of that assistant, under its own privacy policy. I have no control over that. Read the privacy policy of your AI assistant.
If an answer contains a link to save your comparison (https://www.zorgverzekering.chat/s/…), your scenario is encoded in that link, just like in the comparison tool (3.2). That link is then also in your conversation with the AI assistant.
Links to policies in an answer go to the policy page on my website. You sign up there yourself (3.9).

3.4 Statistics

Data: which pages and features are used, with general characteristics (language, page type, year, number of people in a comparison, chosen deductible). No care use, no care providers, no group scheme.
How: with PostHog in the EU, through my own domain. One analytics cookie on my domain contains a random code for your browser and your visit (1 year), so I can count visits, sessions and returning visitors. I do not pass on your IP address and PostHog does not store it. If you are logged in, I link usage to your account ID (never to your email address); after logging out I remove that link from the cookie.
No session recordings: I do not record sessions. On pages without sensitive data, I do count which buttons and links are clicked. On the comparison tool, on shared comparisons and in your account, I register no clicks.
Why: to improve the service and find errors.
Legal basis: legitimate interest. For the cookie, the exemption for analytics cookies with little impact on your privacy applies (see 4).
Retention: PostHog keeps statistics for at most 7 years; that is a fixed period I cannot shorten. They are linked to the random code from the cookie, not to your name or email address.
Objection: you can turn statistics off on the cookie page, or object via help@zorgverzekering.chat. If Do Not Track or Global Privacy Control is on in your browser, I measure nothing.

3.5 When you create an account

Data: your email address, your language, your policy choice (current and chosen policy per year), when you created the account and when you last logged in.
Why: to log you in with a login link (no password), save your policy choice and send notifications.
Legal basis: performance of the contract (my terms of use).
Retention: as long as your account exists. If you do not log in for 12 months, I delete your account and all its data automatically. Login links are valid for 15 minutes and are deleted after 24 hours.

You must be at least 16 to create an account.

Data: your comparison. By default I save it without care use and without a group scheme. If you give separate consent, I also save your group scheme and the expected care use and regular care providers of you and of children under 18. I never save the care use of other adults in your comparison; it is only in your link.
Why: to recalculate your comparison when new premiums or conditions are published, and to send you the notifications you set up yourself (for example when a regular care provider no longer has a contract).
Legal basis: your explicit consent, which you give separately with a checkbox that is not ticked in advance.
Retention: until at most 90 days after the switching deadline of the year you compared. After that I delete the comparison automatically.
Withdrawal: at any time, with one click in your account. I then delete your comparison immediately.

I do not use your saved comparison for marketing, statistics or improving my product, and I share it with no one.

3.7 Notifications

Data: your email address, your language, which notifications you turned on and their settings (for example a threshold amount or the AGB codes of your regular care providers).
Why: to send you the notifications you chose.
Legal basis: personal notifications (your policy becomes more expensive than your threshold; the contract status of your care provider changes): performance of the contract. Seasonal emails (your policy’s premium is published; reminder on 15 December before the switching deadline): your consent for the newsletter (3.8); without that consent I do not send them. For the AGB codes of your regular care providers I ask for your explicit consent, because they can say something about your health.
Retention: until you turn the notification off, unsubscribe or delete your account. The unsubscribe link in every email turns off both the newsletter and all notifications.

Data: your email address, your language and when you subscribed or unsubscribed.
Why: to occasionally send you news and tips about health insurance. These emails may contain affiliate links.
Legal basis: your consent, which you give separately with a checkbox that is not ticked in advance.
Retention: until you unsubscribe. You can unsubscribe through the link at the bottom of every email, without logging in.

My emails contain no tracking pixels or external images. I do not measure whether you open them.

I do not sell insurance. If you click a sign-up link on my website, your browser goes through my redirect page (/go) to a licensed comparison website or to the insurer’s website.

I only record that a link was clicked (which policy, which site, from the website or the API), without knowing who you are.
I pass no data about you to the comparison website, the affiliate network (Awin) or the insurer. Not your comparison either.
After the redirect, the privacy rules of that party apply. They may set their own cookies, for example to record that you came through me.

Links to sources (such as an insurer’s premium list) go directly to the document. I add utm_source=zorgverzekering.chat so the insurer can see where the visit came from. That addition contains no data about you.

3.10 Care providers

To find care providers and show their contracts with insurers, I use public data about care providers: AGB code, name, type of care provider and practice address. This includes individual care professionals with their own practice. I add coordinates to the addresses through PDOK (Dutch Land Registry).

Legal basis: legitimate interest (giving patients insight into contracts and reimbursements).
Retention: as long as the registration is active in the AGB register.
Are you a care professional and is something incorrect, or do you want to object? Email help@zorgverzekering.chat.

3.11 When you contact me

I use your email address, name and message to answer your question. Legal basis: legitimate interest. I keep your message until 2 years after the last message in our conversation.

4. Cookies

I only set cookies on my own domain, no cookies from advertising networks or social media:

Cookie	Purpose	Duration	Type
`zv_sessie`	Keeps you logged in	7 days, or until you log out	Necessary
`zv_csrf`	Protects forms against abuse by other websites	24 hours	Necessary
`zv_flash`	Shows a message once after an action	2 minutes	Necessary
`zv_volgende`	Remembers which page to return to after logging in	1 hour	Necessary
`zv_bewaar`	Remembers which comparison you want to save while you log in	1 hour	Necessary
`ph_<projectkey>_posthog`	Statistics (3.4)	1 year	Analytics

PostHog also keeps track in your browser’s sessionStorage of which tab you are in (gone when you close the tab), and remembers in localStorage if you turned statistics off.

Necessary cookies and analytics cookies with little impact on your privacy do not require consent. The Dutch Data Protection Authority explains when that is the case: cookies on the website of the Autoriteit Persoonsgegevens (in Dutch). That is why I show no cookie banner. The cookie page also has this overview, and lets you turn statistics off. Parties I redirect you to (3.9) may set cookies on their own websites.

I do not sell data. I only share data with service providers that process it on my behalf (processors), under a data processing agreement:

Service provider	Purpose	Where
Cloudflare	Hosting of website, MCP server, API and databases; security; admin environment; sending all emails (login links, notifications, seasonal emails and newsletter); support mailbox	Storage in Europe; requests are processed in the data centre closest to the requester
PostHog	Statistics	EU (Frankfurt)

I only give data to others if the law requires me to.

6. Data outside the European Union

I store your account data in Europe. Some service providers have a parent company in the United States, and requests can be processed in a Cloudflare data centre outside the EU, for example when an AI assistant calls me from the US. In those cases I ensure the safeguards the GDPR requires: certification under the EU-US Data Privacy Framework or standard contractual clauses of the European Commission.

7. Security

Among other things: encrypted connections (HTTPS); login links that work only once and for 15 minutes, of which I only store a hash; a secure login cookie (HttpOnly, Secure, SameSite); no storage or logging of what you enter in the comparison tool or through AI assistants; an admin environment behind additional access control; automatic deletion when retention periods end.

8. Automated decisions

I make no decisions about you. The comparison tool and the tools calculate and sort the way you choose. You decide which insurance you take out.

9. Your rights

You have the right to:

view your data and get a copy (in your account: “Download my data”);
have incorrect data corrected;
have your data deleted (in your account: “Delete account”);
have processing restricted;
object to processing based on legitimate interest, such as statistics;
have your data transferred;
withdraw your consent (for your saved comparison and the newsletter), without affecting processing before that.

For other requests, email help@zorgverzekering.chat. I respond within one month. I do not store data from the comparison tool or the MCP server, so I cannot show or delete it either.

Do you disagree with how I handle your data? Let me know. You can also file a complaint with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens.

10. Children

An account is available from age 16. In the comparison tool, as a parent or guardian you can enter your children’s year of birth and expected care use; I only store that if you consent to saving your comparison (3.6).

11. Changes

I may change this privacy statement, for example when I add new features. For important changes I will announce this on the website and, if you have an account, by email. The date of the last change is at the top.