Effective date: 1 January 2025. Last updated: 18 September 2026.
Datamonk B.V. ("Datamonk", "we", "us") builds data quality and migration software for medical imaging. This page explains how we handle personal data under the EU General Data Protection Regulation (GDPR) and the UK GDPR, both as a data controller for our own business and as a data processor for our healthcare customers.
1. Who we are
Datamonk B.V., Keizersgracht 520H, 1017 EK Amsterdam, the Netherlands. Chamber of Commerce 93092415. Contact: privacy@datamonk.ai
2. Two roles
For visitors to this website, prospects, customers' staff and our own team, we are the data controller and this policy applies in full.
For patient data contained in medical images and records that we process on behalf of a hospital or healthcare provider, the healthcare provider is the data controller and Datamonk is the data processor. That processing is governed by a Data Processing Agreement (DPA) with the customer, which takes precedence over this page. Section 9 describes how we handle customer data.
3. What data we collect as a controller
Contact details (name, email, phone, organisation); account details for our platform; usage data such as IP address, browser and pages visited; records of enquiries and support conversations; marketing preferences.
4. How we collect it
Directly from you when you contact us, book a demo or use our platform; automatically through cookies and analytics; and from service providers we use to run the business.
5. Why we use it and on what basis
To provide and support our services (performance of a contract); to communicate with you and manage your account (contract and legitimate interest); to improve our products and website (legitimate interest); to send marketing where you have agreed (consent, withdrawable at any time); and to meet legal obligations.
6. Who we share it with
Service providers that help us operate, under contract and confidentiality: cloud hosting (Amazon Web Services), database hosting (MongoDB Atlas), productivity and email (Microsoft 365), and analytics providers. Authorities where the law requires it. A successor in the event of a business transfer. We do not sell personal data.
7. Where data is stored and international transfers
Our own business data is hosted in the EU. Customer patient data is hosted in the region specified in the customer's DPA and does not leave that region. Where any transfer outside the EEA or UK does occur, we rely on adequacy decisions or the European Commission's Standard Contractual Clauses.
8. How long we keep it
We keep personal data we control only as long as needed for the purposes above or as required by law; accounting records are kept for the statutory seven years.
Customer data we process on behalf of healthcare organisations is securely deleted from all systems, including backups, within 90 days of project completion or on request, and a certificate of deletion is issued to the customer.
9. How we protect customer data as a processor
Data is processed only on the customer's documented instructions. Access is restricted to named, authorised staff using multi-factor authentication and role-based permissions, and every access is logged. Data is encrypted in transit (TLS 1.3) and at rest (AES-256). Our AI models are not trained on customer data. Sub-processors are listed in the DPA and customers are notified of changes. We support customers in responding to data subject requests and in completing Data Protection Impact Assessments. Security incidents affecting customer data are reported to the customer without undue delay after we become aware of them, so that the customer can meet its own notification obligations.
10. Your rights
You can ask us to access, correct, delete or restrict your personal data, to provide it in a portable format, to stop using it for direct marketing, or to withdraw consent. Email privacy@datamonk.ai and we will respond within one month. You may also complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or, for UK residents, the Information Commissioner's Office. If your request concerns patient data held on behalf of a hospital, please contact that hospital; we will assist them in responding.
11. Cookies
We use cookies for site functionality and analytics. You can change your choices at any time via the cookie settings link in the footer.
12. Changes and contact
We will post updates here with a new "last updated" date. Questions: privacy@datamonk.ai, or by post to the address above
Effective date: 1 January 2025. Last updated: 18 September 2026.
Datamonk B.V. ("Datamonk", "we", "us") builds data quality and migration software for medical imaging. This page explains how we handle personal data under the EU General Data Protection Regulation (GDPR) and the UK GDPR, both as a data controller for our own business and as a data processor for our healthcare customers.
1. Who we are
Datamonk B.V., Keizersgracht 520H, 1017 EK Amsterdam, the Netherlands. Chamber of Commerce 93092415. Contact: privacy@datamonk.ai
2. Two roles
For visitors to this website, prospects, customers' staff and our own team, we are the data controller and this policy applies in full.
For patient data contained in medical images and records that we process on behalf of a hospital or healthcare provider, the healthcare provider is the data controller and Datamonk is the data processor. That processing is governed by a Data Processing Agreement (DPA) with the customer, which takes precedence over this page. Section 9 describes how we handle customer data.
3. What data we collect as a controller
Contact details (name, email, phone, organisation); account details for our platform; usage data such as IP address, browser and pages visited; records of enquiries and support conversations; marketing preferences.
4. How we collect it
Directly from you when you contact us, book a demo or use our platform; automatically through cookies and analytics; and from service providers we use to run the business.
5. Why we use it and on what basis
To provide and support our services (performance of a contract); to communicate with you and manage your account (contract and legitimate interest); to improve our products and website (legitimate interest); to send marketing where you have agreed (consent, withdrawable at any time); and to meet legal obligations.
6. Who we share it with
Service providers that help us operate, under contract and confidentiality: cloud hosting (Amazon Web Services), database hosting (MongoDB Atlas), productivity and email (Microsoft 365), and analytics providers. Authorities where the law requires it. A successor in the event of a business transfer. We do not sell personal data.
7. Where data is stored and international transfers
Our own business data is hosted in the EU. Customer patient data is hosted in the region specified in the customer's DPA and does not leave that region. Where any transfer outside the EEA or UK does occur, we rely on adequacy decisions or the European Commission's Standard Contractual Clauses.
8. How long we keep it
We keep personal data we control only as long as needed for the purposes above or as required by law; accounting records are kept for the statutory seven years.
Customer data we process on behalf of healthcare organisations is securely deleted from all systems, including backups, within 90 days of project completion or on request, and a certificate of deletion is issued to the customer.
9. How we protect customer data as a processor
Data is processed only on the customer's documented instructions. Access is restricted to named, authorised staff using multi-factor authentication and role-based permissions, and every access is logged. Data is encrypted in transit (TLS 1.3) and at rest (AES-256). Our AI models are not trained on customer data. Sub-processors are listed in the DPA and customers are notified of changes. We support customers in responding to data subject requests and in completing Data Protection Impact Assessments. Security incidents affecting customer data are reported to the customer without undue delay after we become aware of them, so that the customer can meet its own notification obligations.
10. Your rights
You can ask us to access, correct, delete or restrict your personal data, to provide it in a portable format, to stop using it for direct marketing, or to withdraw consent. Email privacy@datamonk.ai and we will respond within one month. You may also complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or, for UK residents, the Information Commissioner's Office. If your request concerns patient data held on behalf of a hospital, please contact that hospital; we will assist them in responding.
11. Cookies
We use cookies for site functionality and analytics. You can change your choices at any time via the cookie settings link in the footer.
12. Changes and contact
We will post updates here with a new "last updated" date. Questions: privacy@datamonk.ai, or by post to the address above