General Terms and Conditions Tessa.Care
Version number: EULA v2.1
These General Terms and Conditions were last modified on 15-11-2021.
Contact details
Tinybots BV
Van Nelleweg 1
3044BC Rotterdam
E-mail: help@tinybots.nl
Chamber of Commerce number: 64712311
Chapter 1: General provisions
1 Definitions
1.1 Without prejudice to what is stated elsewhere in these General Terms and Conditions, the following definitions in these General Terms and Conditions have the meaning stated therein:
Subscription:
A subscription to the Tinybots Service;
General Terms and Conditions:
These general terms and conditions of Tinybots;
Tinybots back-end system:
The Tinybots back-end system is the central software where data is stored and processed. A connection is established between the Tessa App, the Tessa owner dashboard, and the embedded software;
Consumer:
A natural person who uses the Service, without the intervention of the Healthcare Institution;
Data:
The information generated by means of the Software, whether or not via applications running on the Software; the Data may also consist of Personal Data;
Services:
The service of Tinybots, pursuant to the Agreement, consisting of the Product, the Web applications and the Support;
Embedded software:
The embedded software, which runs locally on the Hardware, controls the Hardware and synchronizes Data about the tasks with the Back-end Tinybots system. The embedded software (i) manages authentication with the Back-end Tinybots system, (ii) reports the status of the Hardware and/or whether the Hardware is functioning correctly and (iii) reports which tasks have been executed;
User:
A natural person who makes use of the Service, insofar as purchased by the Healthcare Institution;
Hardware:
The care assistant Tessa, developed by Tinybots, excluding the software;
IP rights:
All intellectual property rights and related rights, such as copyright, trademark rights, patent rights, design rights, trade name rights, database rights and neighboring rights;
Customer:
The Healthcare Institution or Consumer;
Quote:
The offer as made by Tinybots to the Customer at the time, for the provision of the Services;
Quotation terms:
The terms and conditions forming part of the Quotation;
Support:
The support and maintenance of the Product, as part of the Service;
Agreement:
The agreement between the Parties for the purchase of the Services;
Parties:
Customer and Tinybots;
Personal data:
All information that can be directly or indirectly traced back to a natural person as referred to in Article 4, opening paragraph and point 1, of the General Data Protection Regulation;
Privacy Statement:
The document which describes, inter alia, (i) which personal data Tinybots processes, (ii) how Tinybots handles this personal data and (iii) which obligations apply to Tinybots, whereby Tinybots complies with the duty to provide information, as set out in Articles 12 to 14 of the General Data Protection Regulation;
Product:
The Hardware, including the Software, provided by Tinybots as part of the Service;
Software:
The software developed by Tinybots for the use of the Product. The software consists of (i) the Embedded software, (ii) the Tinybots system back-end and (iii) the Tessa App;
Tessa App:
The Tessa App is used by the Customer to configure the hardware interface. The Tessa App is connected to the Tinybots back-end system;
Tessa-owner dashboard:
The Tessa owner dashboard is used to manage the hardware by the relevant healthcare institution;
Tinybots:
The private limited company Tinybots BV, trading under the name Tinybots, established and having its registered office at Van Nelleweg 1, 3044BC Rotterdam, registered in the Commercial Register under number 64712311;
Compensation:
The total price agreed for the Services;
Data Processing Agreement:
An agreement between a controller and a processor, which sets out how the processor must handle personal data, as referred to in Article 28 of the General Data Protection Regulation;
Web applications:
All web applications made available by Tinybots through which the Customer can receive the Services. Web applications include, but are not limited to:
(i) www.tinybots.nl
(ii) my.tinybots.io
(iii) dashboard.tinybots.io
Healthcare institution:
The healthcare institution that purchases the Service
.
1.2 Unless these General Terms and Conditions expressly provide otherwise, the following applies to the interpretation of these General Terms and Conditions:
a) The singular is deemed to include the plural and vice versa, and a reference to a masculine form is deemed to include a reference to a feminine form and vice versa;
b) The opening titles, headings, and numbering of the articles (or parts thereof) in or attached to these General Terms and Conditions are included solely to facilitate use and do not affect the interpretation of the articles;
c) The words "including" and words of similar meaning mean "including but not limited to".
2 Applicability of General Terms and Conditions
2.1 These General Terms and Conditions apply to any use of the Services provided by Tinybots. Chapter 2 of these General Terms and Conditions specifically applies to the Hardware. Chapter 3 of these General Terms and Conditions specifically applies to the Software.
2.2 The Customer's general terms and conditions are hereby expressly excluded.
2.3 Tinybots may amend these General Terms and Conditions at any time. Any changes will be notified to the Customer in advance, after which the changes will take effect and form part of the Agreement.
2.4 If any provision of these General Terms and Conditions proves to be void or voidable, or becomes or is for any other reason wholly or partially invalid, the remaining provisions of the General Terms and Conditions shall remain in full force and effect. Tinybots will replace the invalid clause with a clause that is valid and whose legal consequences, having regard to the content and intent of these General Terms and Conditions, correspond as much as possible to those of the invalid clause.
2.5 In the event of a conflict between provisions in the General Terms and Conditions, the Agreement, or the Quotation Terms, the following order of precedence applies:
a) The Agreement;
b) The Quotation Terms;
c) The General Terms and Conditions.
3 Services
3.1 Tinybots endeavors to perform the Service, whether or not on the basis of a Subscription, with care and in accordance with the Agreement. Tinybots will provide the Service on the basis of a best-efforts obligation. The Parties agree that any obligations are not obligations of result and/or that any delivery dates are not final (no strict deadlines), unless expressly agreed by the Parties or following an adequate notice of default by the Customer with a reasonable period to remedy the situation.
3.2 Tinybots does not guarantee that the Service will be accessible at all times and without interruptions or malfunctions. Tinybots is in no way liable or responsible to the Customer for any damage arising from or resulting from the (temporary) unavailability or (intermittent) failure of the Service and/or the Web applications.
3.3 Tinybots is entitled at all times, without prior notice and without becoming liable or responsible in any way to the Customer, to (i) make procedural and technical changes and/or improvements to the Web applications and/or the Service and (ii) disable, restrict or remove the Web applications or the Service (temporarily or permanently) if this is necessary for the proper functioning and/or continuity of the Service.
3.4 Tinybots may use third-party software. The Customer understands and accepts that Tinybots has no control over this third-party software and/or its operation. Tinybots offers no guarantees regarding this third-party software and is therefore not liable for any damage resulting from or arising out of (the use of) this third-party software (with the exception of third-party software used to process Personal Data).
4 Customer
4.1 The Customer is solely responsible for the purchase and/or proper functioning of the infrastructure and adequate telecommunication facilities (including internet connection) required to use the Service. The Customer guarantees that it will comply with all (technical) requirements set by Tinybots for the provision of the Service, as made known on the Web applications. Tinybots is not responsible or liable for costs arising from the use of telecommunications that are charged via the telecommunications provider.
4.2 The Customer is solely and fully responsible and liable for all actions performed by him and/or the User using the Service. Tinybots is in no way liable or responsible to the Customer for any damage arising from or resulting from the improper use of the Service.
5 Consumer
5.1 For Products purchased by Consumers directly from Tinybots, the Consumer has the right to cancel the Agreement for any reason during a period of fourteen (14) days from the delivery date at the delivery address. Tinybots will refund the purchase price and the original shipping costs actually paid (with the exception of (i) additional costs resulting from the choice of a delivery method other than that offered by Tinybots, (ii) cheapest standard delivery, or (iii) when multiple Products were ordered and not all purchased Products are returned). Tinybots will make the refund using the same payment method that the Consumer used for the initial transaction, unless expressly agreed otherwise.
5.2 To exercise the right of cancellation as described under 5.1, the Consumer shall contact Tinybots within fourteen (14) days after delivery of the Products and make this intention known by completing the right of withdrawal form. Subsequently, the Consumer must return the Product without delay by following the instructions in the confirmation email from Tinybots.
6 Support
6.1 Tinybots provides Support to the Customer. The Support will consist of the following:
a) Preventive maintenance of the Software;
b) Detecting and repairing malfunctions in the Software (following a report from the Customer);
c) Making updates available;
d) Making upgrades available, provided the customer has paid for upgrades;
e) Telephone support;
f) Support via the website, telephone or email.
6.2 Tinybots will do its utmost to contact the Customer within two (2) working days via the website and/or via email (or other channels made known to the Customer). However, Tinybots does not guarantee that all problems or requests submitted by you will be addressed or can be resolved.
7 Subscription
7.1 The Customer purchases the Service based on a Subscription.
7.2 The duration of the Subscription is determined in the Agreement.
7.3 The Subscription enters into force at the moment of confirmation of the Subscription application by Tinybots. Tinybots will provide the Customer with the login details for the Web applications at a time agreed upon between the Parties, or if no time has been agreed upon, within a reasonable period after the Subscription enters into force.
7.4 The subscription period starts automatically after a certain period (the auto-activation period), unless the Product has been activated earlier. As of July 15, 2019, the auto-activation period is 90 days after the Hardware is shipped.
7.5 Tinybots has the right to modify a Subscription at any time. Tinybots will notify Customer of a modification at least thirty (30) days in advance. A modification will be deemed accepted by the Customer and will take effect on the date indicated by Tinybots, unless the Customer notifies Tinybots via the email address help@tinybots.nl within thirty (30) days after the aforementioned notification that he does not accept the modification and cancels the Subscription.
8 Account
8.1 In order to make use of the Service, the Product and the Tessa-owner dashboard, as well as to gain insight into the Data, the Customer is required to create an account.
8.2 The Customer is responsible and liable for all activities that take place in or via their account. The Customer is responsible for their own username and activities in connection therewith. Tinybots is not responsible for any loss of Data entered by the Customer as a result of the unauthorized use of the account, with or without the Customer's knowledge.
8.3 The Customer shall inform Tinybots immediately of suspected access to or use of their account by third parties without the Customer's permission, or when the Customer notices any other possible security breaches.
9 Price, invoicing and payment
9.1 The Customer owes the Fee for the Services provided by Tinybots.
9.2 The prices for the Healthcare Institution are exclusive of value added tax (VAT) and other levies imposed or to be imposed by the government. The prices for the Consumer are inclusive of VAT. All prices are in euros and the Customer must make all payments in euros.
9.3 The payment term for invoices is thirty (30) days after receipt of the invoice, unless the invoice states a longer payment term or a different term has been agreed in writing.
9.4 Tinybots will send an invoice to the Customer for all amounts due and is entitled to invoice electronically.
9.5 Tinybots is entitled to adjust prices once per calendar year based on the Consumer Price Index (CPI).
9.6 If the Customer fails to pay the amounts due on time or in full, Tinybots is entitled to suspend the Services until the amounts have been settled.
9.7 In the event of late payment, the Customer shall be obliged, in addition to the amount due and the statutory interest accrued thereon, to fully reimburse both extrajudicial and judicial collection costs, including the costs for lawyers or legal experts, bailiffs, and collection agencies.
10 Confidentiality
10.1 The Parties shall ensure that all confidential information received from the other Party is kept confidential. The Party receiving such information shall use such information only for the purpose for which it was provided.
10.2 Unless otherwise permitted by these General Terms and Conditions, the Parties shall not disclose the contents of the Agreement or any confidential information provided by or on behalf of the Parties to third parties during the term of the Agreement and for a period of two (2) years after its termination.
10.3 Except as stated under 10.2, confidential information shall remain confidential even after two (2) years following termination in the event that the confidential information concerns Personal Data.
11 Software Security
11.1 Tinybots will take appropriate security measures to protect the Software and the Customer's Data against accidental or unlawful loss, access, or disclosure. The security measures are set out in more detail in the Privacy Statement .
12 Processing of personal data
12.1 If Personal Data is processed for the performance of the Services, the Healthcare Institution and Tinybots will enter into a Data Processing Agreement.
12.2 Which Personal Data is processed by Tinybots and for what purposes it is processed is described in the Tinybots Privacy Statement .
13 Intellectual Property
13.1 All intellectual property rights to the Web applications and the Service, including the functional and technical design, styling, programming, database structure, usability, and source code of the Service, the Hardware, the Software, and the Web applications, and all related documents, are vested exclusively in Tinybots or its licensor(s). The provision or use of the Service or any other service or product by Tinybots does not result in the transfer of any intellectual property rights to the Customer.
13.2 All rights of any nature whatsoever, including intellectual property rights, relating to the Data shall vest in the Customer. By entering the Data, the Customer grants Tinybots a free and worldwide license to use the Data for the performance of the Service.
14 Force Majeure
14.1 In the event of force majeure, the obligations of the Parties shall be suspended until the force majeure situation has been resolved. The Parties shall make every effort to resolve the force majeure situation as soon as possible. The Parties may only invoke force majeure against each other if the Party concerned notifies the other party in writing of such invocation of force majeure as soon as possible, accompanied by the necessary supporting documents.
14.2 In addition to what is considered to be such under the law, force majeure shall in any event include disruptions to the internet, disruptions in the telecommunications infrastructure, denial of service attacks, power outages, floods, earthquakes, fire, civil unrest, mobilization, war, transport disruptions, strikes, lockouts, business disruptions, and stagnation in the supply chain.
15 Guarantees
15.1 Tinybots offers a limited warranty that the Product (obtained solely from Tinybots) will be free from material and workmanship defects for a period equal to the subscription duration, but at least two (2) years from the date of purchase of the Product. During this period, the Product will be repaired or replaced by Tinybots (at the sole discretion of Tinybots) (at no cost for parts or labor). Tinybots is responsible for the transport and/or shipping costs related to the repair or replacement of the Product. This limited warranty is non-transferable.
15.2 This limited warranty does not cover damage caused by normal wear and tear or by the Product being opened or repaired by someone not authorized by Tinybots, and does not cover damage resulting from misuse, moisture, liquids, proximity to or exposure to heat and accident, abuse, failure to follow the instructions provided with the Product, neglect, or improper application. The limited warranty also does not apply to physical damage to the exterior of the Product.
15.3 This limited warranty does not apply to any third-party services, software, or material.
15.4 To invoke the limited warranty, the Customer must notify Tinybots of the defect and explain the defect to Tinybots by contacting Tinybots within the warranty period via help@tinybots.nl. The Products must be returned to Tinybots as soon as possible after notification of the defect, accompanied by an explanation of the defect.
15.5 If any part of this limited warranty is declared invalid or unenforceable, the remainder of this limited warranty shall nevertheless remain in full force and effect.
16 Liability
16.1 Subject to the earlier limitations of liability as set out in these General Terms and Conditions, Tinybots' total liability for direct damages, on any legal basis whatsoever (including an indemnity obligation or breach of warranty obligation), is cumulatively limited to the amount of the last three (3) invoices. In no event shall Tinybots' total cumulative liability for direct damages exceed the subscription period of one year. For this purpose, a series of consecutive or related events shall count as one (1) event. Liability for indirect damages is excluded.
16.2 Direct damage is understood to mean:
a) Damage to the Customer's property;
b) Reasonable costs that the Customer would have to incur to replace the Services. However, such damages shall not be reimbursed if the Agreement is terminated by the Customer;
c) Reasonable costs incurred for assessing the cause and extent of the damage, insofar as the assessment relates to direct damage as referred to in these General Terms and Conditions;
d) Reasonable costs incurred to prevent or limit damage, to the extent that the Customer demonstrates that such costs have led to a reduction of direct damage as referred to in these General Terms and Conditions.
16.3 Liability for damage other than direct damage is excluded.
16.4 The limitations of liability referred to in paragraph 1 of this article do not apply in cases of intent and/or willful recklessness on the part of Tinybots (“own actions”) and/or management personnel.
16.5 Any liability of Tinybots shall cease if a claim is not submitted within twelve (12) months after discovery.
17 Duration and termination
17.1 The duration and termination of the Service are further specified in the Agreement.
17.2 The Agreement may be terminated at any time by mutual consent.
17.3 The Parties may terminate the Agreement at any time on the basis of a serious reason of such a nature that continuation can no longer be reasonably expected.
17.4 Either Party may dissolve the Agreement with immediate effect if the Other Party fails to fulfill its obligations under this Agreement even after a reasonable period following written notice of default. The Party dissolving the Agreement shall not be liable for damages and/or reimbursement of other costs.
18 Other provisions
18.1 The Agreement is not transferable by either Party without the written consent of the other Party.
18.2 In these General Terms and Conditions, “written” also includes email, provided there is no reason to doubt the identity of the sender.
18.3 The Agreement may only be amended by means of a written document signed by both Parties.
19 Applicable law and dispute resolution
19.1 These General Terms and Conditions are governed by Dutch law.
19.2 Disputes in connection with these General Terms and Conditions, the Agreement and/or the Quotation Terms shall be submitted exclusively to the District Court of Rotterdam, to the exclusion of other courts.
19.3 The Parties shall make every effort to settle disputes amicably. Only if this proves impossible shall the Parties bring disputes before the court declared competent in the previous paragraph.
19.4 Should a (sub)clause be deemed non-binding by a court, the remainder of the agreement shall remain valid. This clause shall then be replaced by a new clause that is binding and remains as close as possible to the intent of the original clause.
19.5 Should a (sub)clause become unlawful or unenforceable due to a change in legislation, the remainder of the agreement shall remain valid. This clause shall then be replaced by a new clause that is binding and remains as close as possible to the intent of the original clause.
Chapter 2: Hardware
20 Hardware
20.1 Tinybots delivers the Hardware in accordance with the specification and schedule as agreed in the Quotation.
20.2 The Customer is not permitted to make changes to the Hardware (including the Software installed on the Hardware) supplied by Tinybots. Tinybots cannot be held liable for any damage resulting from such changes and may charge the Customer all reasonable costs incurred to repair or replace the modified Hardware.
20.3 Tinybots performs the configuration before the Hardware is delivered to the Customer for installation purposes. Tinybots provides the Customer with clear instructions on how to install the (configured) Hardware. A detailed installation manual is provided by Tinybots.
20.4 The physical installation of the Hardware, including connection to the Customer's infrastructure, is solely the responsibility of the Customer and/or any third parties engaged by the Customer. Any support requested in writing by the Customer from Tinybots regarding the installation of the Hardware is at the Customer's risk and is considered an additional service with extra costs. The Customer is obliged at all times to follow the instructions as stated in the installation manual and to comply with the stated requirements.
20.5 After the installation of the Hardware by the Customer, Tinybots is responsible for testing the Hardware to determine whether the Product is ready for operational use and for informing the Customer about this.
20.6 The Customer shall immediately notify Tinybots when the Customer becomes aware of technical problems or other difficulties regarding the Hardware.
Chapter 3: Software
21 Software
21.1 Tinybots hereby grants the Customer a limited, personal, non-transferable, non-exclusive, non-sublicensable right, upon both acceptance and payment of the Fee, to use the Service in accordance with these General Terms and Conditions, the Agreement, and the Quotation Terms.
21.2 The right to use the Software is limited to use by the Healthcare Institution, the User, and the Consumer. This license is personal. The Software may only be installed on the supplied Hardware.
21.3 It is not permitted:
a) To rebuild the source code of the Software;
b) To provide a copy of the Software to third parties;
c) To sublicense the Software or make it available to third parties, by means of rental, Software-as-a-Service arrangements or otherwise;
d) To make changes to the Software, except to the extent permitted by mandatory law;
e) To remove or render illegible any indications of Tinybots as the rights holder of the Software or parts thereof.
f) Make a backup copy of the Software.
21.4 The intellectual property rights to this Software remain with Tinybots. In the event that the Software contains third-party software, the Customer agrees that the terms and conditions of such third parties may apply directly to the Customer in addition to these Terms and Conditions. The Customer acknowledges and agrees that Tinybots is not responsible or liable for such third-party services and/or terms.
Tinybots BV Privacy Statement
Version 2.4
This privacy statement was last modified on 18-08-2026.
1. Introduction
This privacy statement applies to the processing of personal data by Tinybots BV (hereinafter: Tinybots) in the context of the use of Tessa, the care assistant, including the associated software.
2. Who is Tinybots?
Tinybots is a private limited company, having its registered office at Van Nelleweg 1, (3044 BC) Rotterdam, registered in the Trade Register of the Chamber of Commerce under number 64712311.
Tinybots is a Dutch company that develops technical aids to make people with cognitive impairments more independent. Tinybots has developed the care assistant 'Tessa' and the accompanying software to increase the self-direction, independence, and well-being of clients. When Tessa is made available to you through your care institution, we act as a processor . When you purchase Tessa directly from Tinybots, we act as the controller (see point 4 for definitions).
We value open, honest, and transparent service. In this context, we believe it is important that you know exactly which personal data we, as Tinybots, collect and for what purposes we use this personal data when we make Tessa available. We describe this in a clear manner in this privacy statement. Tinybots guarantees that personal data is processed carefully and in accordance with laws and regulations (including the General Data Protection Regulation, GDPR), which includes, at a minimum, the collection, use, and deletion of personal data.
3. What do we promise?
We promise that we:
- Clearly define our before we process personal data .
- Process as little personal data as possible and only the personal data necessary for the predetermined purposes .
- Take necessary security measures to protect your personal data. We also impose these obligations on parties that process personal data for us ;
- Respecting your rights , such as the right to access, correction, or deletion of personal data processed by us .
- Process as little special personal data as possible . This includes data concerning a person's health, ancestry or race, political views, sexual preference, religious or philosophical beliefs, trade union membership, genetic data, and biometric data for the purpose of uniquely identifying a person.
This privacy statement may change from time to time as new developments warrant. If a change occurs, we will announce it. You can find the most current privacy statement on our website: www.tinybots.nl/privacyverklaring
4. GDPR Definitions
In this privacy statement, we use several terms from the GDPR that are relevant to you. We explain these terms below:
Anonymize
Anonymization is a method whereby personal data is processed in such a way that it can no longer be used to identify a person. This processing is irreversible, meaning that it is impossible to trace back to a person in any way. Therefore, in the case of anonymization, there is no protection under the GDPR, as it no longer applies.
The person concerned
The person about whom personal data is processed. When it concerns your personal data processed by Tinybots, you are the data subject. This may concern the End User and App User.
End user
The end user is the person who uses the Tessa in their own living or working environment to support their own daily structure, self-management, independence, and well-being.
App user
The app user is the person who uses the Tessa app to configure, manage, and adjust Tessa's settings. This can be the healthcare institution employee who manages the Tessa app for you. It can also concern you personally if you purchase Tessa directly from Tinybots or manage your Tessa app yourself.
Recipient
A third party to whom the personal data are provided to process these personal data for their own purposes.
Personal data
All information that reveals something about you as a person. Personal data provides information about your person. This can happen directly, for example by registering your name. However, it can also happen indirectly, such as registering your postal code or describing a situation containing unique elements that can be traced back to you.
Pseudonymization
Pseudonymization is a method in which identifying data is replaced by encrypted data (the pseudonym) using a specific algorithm. The algorithm can consistently assign the same pseudonym to a person, allowing information from various sources to be combined. Therefore, after pseudonymization, it is still possible to identify the individual; the encryption can be reversed using the algorithm.
Process
The term 'processing' is very broad and essentially means everything that can be done with personal data. In addition to collecting or destroying personal data, consulting personal data is also a form of processing that requires compliance with the rules of the GDPR.
Processor
An organization may choose to engage another organization to process personal data on their behalf. For example, by outsourcing payroll administration or by using a cloud service that stores personal data. In such a situation, the engaged organization processes personal data on behalf of the first organization and acts as a processor. If you have purchased Tessa or obtained it via a healthcare institution, Tinybots is the processor for the healthcare institution. This means that the healthcare institution is the (primary) controller responsible for the processing of your personal data.
Controller
The controller determines the purposes for which and the means by which personal data are processed. Therefore, if an organization decides 'why' and 'how' personal data must be processed, it is the controller. If you purchased Tessa as a private individual, Tinybots is the controller. If you purchased Tessa through a healthcare institution, the healthcare institution is the controller, and you must address your questions and complaints regarding the processing of personal data to the healthcare institution.
5. What do we base the processing of your personal data on?
When you use Tessa, we process various personal data from you. Under the GDPR, we may only process personal data when we have a specific purpose for doing so and can base the processing on a lawful basis. A lawful basis means that the necessity for processing personal data can be based on one of the options (grounds) regulated by law. The grounds for the processing of personal data by Tinybots are:
- The performance of the agreement you have entered into with the healthcare institution where the use of Tessa is part of your treatment plan or where you work as an employee and manage the Tessa app for the client. Because we then act as a processor for the healthcare institution and act on behalf of and for the benefit of the healthcare institution, this legal basis extends to Tinybots. When you have purchased Tessa directly from Tinybots, we process this personal data to perform the service or agreement we have entered into with you, in which we act as the data controller. This is the case with the Basic service. See point 7
- Consent that we have obtained from you. We only do this if you truly have a free choice and there are no negative consequences if you do not give consent. Consent can also be withdrawn at any time. We do this when we wish to process more data in order to offer you an improved service. This is the case with the Advanced service. See point 7 for this.
6. Which personal data do we process?
To enable Tessa to function properly, various software applications and services are used, which may be linked to one another. Each software application has a different function and processes personal data for a different specific purpose. To keep things clear, you will find below an overview of the purposes for which Tinybots processes personal data about you. In each case, it is indicated which personal data Tinybots uses for that specific purpose, per software application and service, what the legal basis is for processing that personal data, and how long the personal data is retained by Tinybots.
a. Tessa App
(Personal) data
- Authentication to Tessa app account
- App user's email address
- App user's phone number
- App users first name + last name
- Password to Tessa app account
- Two-factor authentication (on or off)
- Tessa serial number
- Music files
- Music playlists created by App user
- Messages/questions/scripts created by App user
- Selected category of messages/questions/scripts
- Schedule of scheduled messages/questions/scripts
- Tessa configuration settings (night mode, speech speed, and volume)
- Tessa online status
Purpose
The Tessa App is used to configure the Tessa interface.
The Tessa App is connected to the back-end of the Tinybots system.
Legal basis
Performance of the contract, Art. 6 GDPR.
Retention period
Equal to retention period of Tinybots back-end system.
b. Embedded software (
(Personal) data
- Authentication of Tessa to connect to Tessa account on Tinybots system backend
- Wi-Fi settings: network name + password
- Audio clip answers to questions: Yes/No
- Synchronized schedules with tasks that still need to be performed
- The reporting of tasks performed
- Setting Tessa configuration (night mode, speech speed and volume)
- Tessa reset
Purpose
The software runs locally on Tessa, which controls Tessa and synchronizes data regarding the tasks with the Tinybots Back-end system. The software (i) handles authentication with the Tinybots Back-end system, (ii) reports the status of Tessa and/or whether Tessa is functioning correctly, and (iii) reports which tasks have been executed.
Legal basis
Performance of the contract, Art. 6 GDPR.
Retention period
The personal data is stored for the duration of the use of Tessa. The personal data is deleted immediately after resetting Tessa.
c. Tinybots back-end system
(Personal) data
- All (personal) data as shown for Tessa-App (see a) and Embedded software (see b)
- Tessa App App user accounts
- Tessa accounts
- Relationship between Tessa App user accounts and Tessa accounts
- Event logs (App users, Tessa and Tessa owner)
Purpose
(Personal) data is stored, processed, and a link is established between various software (Tessa-App, Tessa-owner dashboard, Embedded software).
Legal basis
Performance of the contract, Art. 6 GDPR.
Retention period
The personal data is stored for the duration of the use of Tessa. After deleting the Tessa App and resetting the Tessa, the personal data is anonymized.
d. Tessa-owner dashboard
(Personal) data
General
- Tessa owner account: log in with email address + password
- Two-factor authentication (on or off)
- Tessa serial number
- Box number (for shipping)
- Tessa online status
- Subscription (start and end date)
- Contact text field
- Note text field
In subscription view
- Relationship (customer organization)
- Subscription reference (subscription identification number)
- Subscription duration
- Invoice reference
- History of previous subscriptions
In Tessa view
- Hardware version
- Ethernet MAC
- WLAN MAC
- Registered Tessa-App username
- Registered Tessa-App user phone number
- Registered Tessa-App user email
In Contact view:
Details entered by the Tessa owner (optional):
- App user's contact name
- App User Department
- App user's contact address
- App user's phone number
- App user's email address
- Notes that the Tessa owner still wants to make themselves
Purpose
The (personal) data is required to manage the Tessa at the relevant healthcare institution.
Legal basis
Performance of the contract, Art. 6 GDPR.
Retention period
Upon termination of the agreement with the healthcare institution, the personal data will be deleted. In the event that the agreement has been concluded with an individual: upon termination of the agreement with the individual, the personal data will be deleted.
e. Admin dashboard
(Personal) data
Similar to the Tessa owner dashboard, but the Admin dashboard does not have a Contact View. Additionally, the Admin Dashboard has greater management capabilities and authorizations.
General
- Tessa owner account: log in with email address and password
- Two-factor authentication (on or off)
- Tessa serial number
- Box number (for shipping)
- Tessa online status
- Subscription (start and end date)
In subscription view
- Relationship (customer organization);
- Subscription reference (subscription identification number)
- Subscription duration
- Cancelled status
- Date of sending of Tessa subscriptions
- Invoice reference
- History of previous subscriptions.
- Note text field
In Tessa view
- Hardware version
- Ethernet MAC
- WLAN MAC
- Tessa active or blocked
- Free note text field
- Registered App username
- Registered App user phone number
- Note text field
- Registered app user email
In Heartbeat view
- History of Tessa's listed status (online/offline, local time)
- Download Reboot of Tessa Logs
Purpose
The (personal) data is required to manage the registered Tessa and subscriptions. In this way, the Tessa is also assigned to a healthcare institution (it then appears in the Tessa owner dashboard of that healthcare institution). In the event of complaints, questions, or requests from employees within a healthcare institution regarding the processing of a registered Tessa, the relevant employee will be referred to the Tessa owner. This means that the email and/or name of the Tessa owner may be shared with employees within their own healthcare institution.
Legal basis
Performance of the contract, Art. 6 GDPR.
Retention period
As long as the healthcare institution uses this data, the data will be retained. Deletion must be carried out by the healthcare institution. Tinybots has no responsibility for this.
f. ZOHO Desk
(Personal) data
- Contact name
- Contact phone number
- Contact email
- Tessa serial number (if relevant)
- Communication by email
- Notes from phone call
Purpose
Digital helpdesk where customers can ask questions via email, telephone, or via help.tinybots.nl. Questions are handled per ticket; for each ticket, the name, contact details (telephone number OR email), and notes regarding the issues are stored.
Legal basis
Consent, Art. 6 GDPR.
Retention period
Three years from the moment the ticket was closed.
g. Zoho Learn (
(Personal) data
- First name and last name of learning environment user
- Learning environment user's email address
- Organization where the learning environment user is employed
- Care team where the learning environment user works
- Date of birth of learning environment user
- BIG number / V&VN relationship number of learning environment user
- User learning environment progress (enrollment date, time spent, status (not yet started, started, completed), completion date, completion percentage)
Purpose
As a training provider, we are required to record attendance and personal data to award accreditation points in the Kwaliteitsregister V&V. User progress is retained so that it cannot be lost. Additionally, participation and progress can be fed back to the organization where learning environment users are employed, with the aim of monitoring the use of, and progress within, the learning environment.
Legal basis
Consent, Art. 6 GDPR.
Retention period
7. Our services involving the processing of personal data
Tinybots offers two different services: 'Basic' and 'Advanced Features'.
Basic
Tinybots reserves the right to use anonymized data, both during and after the use of the services, for the further development of its products and services. Upon termination of a specific end-user account, personal data will be deleted in such a way that there can no longer be any question of data traceable to natural persons, and thus of personal data.
Advanced features
If you use the Advanced features service, your personal data will be pseudonymized (with your consent) and used periodically so that Tessa can provide you with personalized suggestions and support you better. This concerns (personal) data indicated under points 6a, 6b, and 6c of this privacy statement.
8. Who has access to or receives your personal data?
In principle, we do not share your personal data with others. Your personal data is only shared when this is necessary for the provision of our services or if we have a legal obligation. In that case, we share your personal data with:
Tinybots employees
Our employees have access to the data as described under point 6(e) in order to carry out the management of Tessa. This applies only to employees for whose work it is necessary to process the data in the context of management.
Healthcare institutions
If you have purchased a Tessa or obtained it through a healthcare institution, we may share your personal data with the healthcare institution that is the lawful owner of your Tessa. The healthcare institution may use this personal data to contact you to locate the Tessa and to provide support in using the Tessa.
Suppliers and subcontractors of Tinybots
We work with service providers who our ICT systemsbuild and manage. Where legally required, we have entered into a data processing agreement or data exchange agreement with these parties, in which we agree with the parties that they may not process the personal data in any manner other than as described in this privacy statement and that they must adequately secure your data.
9. Location of storage of personal data
Your data is stored on Amazon ( AWS ) servers in Frankfurt (Germany). Your name and email are also exported to ZOHO . ZOHO stores the data in Amsterdam, the Netherlands.
10. Security of your personal data by Tinybots
The security of personal data is of great importance to us. We ensure that your personal data is well protected with us. We continuously adapt our security measures and pay close attention to potential vulnerabilities. In any case, we take the following measures:
- Tinybots is certified according to the NEN 7510 and ISO 27001 standards . These standards ensure the secure handling of personal data and information security within healthcare and organizational processes.
- Tinybots uses HTTPS on all its online services. HTTPS means that the data is encrypted when being exchanged between our server and website.
- Customer passwords are always stored encrypted by Tinybots and are not accessible to Tinybots employees.
- To assist you with a problem using Tinybots, the helpdesk may access your data. They have their own credentials for this and do not require your password. Accessing the data will always take place over an encrypted connection. Tinybots respects your privacy and will only view the files necessary to resolve the problem.
- Tinybots will have all its employees sign a confidentiality agreement – whether or not included in the employment contract with those employees – which stipulates, at a minimum, that these employees must maintain confidentiality regarding personal data.
- Your data is stored on Amazon's servers. Read here what measures Amazon has taken .
- Your contact details are also stored on ZOHO's servers. You can read more about the security of this data here.
11. What privacy rights are you entitled to?
As a data subject, you have certain rights regarding the processing of personal data. These concern the following privacy rights:
- Right of access : the right to view the personal data that we process about you.
- Right to rectification : the right to correct or supplement the personal data that we process about you, for example if it is inaccurate or incomplete.
- Right to object : in some cases, you can object to the processing of your personal data.
- Right to erasure : you can request us to delete your personal data.
- Right to data portability : you have the right to have the personal data that we process about you to perform the employment contract transferred to a third party in a digitally readable standard format.
- Right to restriction of processing: in some cases, you may request that the processing of your personal data be restricted (whether temporarily or not), which means that we process less data about you.
- The option to withdraw consent when we process personal data based on consent.
If you received Tessa through your healthcare institution, you can address a request to exercise your rights to the healthcare institution. Please refer to your healthcare institution's privacy statement for this.
If you purchased Tessa directly from Tinybots, you can exercise your rights by sending a request to help@tinybots.nl . We will process your request within one month. However, this period may be extended for reasons related to the complexity and volume of requests. If we extend this period, we will notify you in a timely manner.
File a complaint
If you believe that we or your healthcare institution are not processing your personal data lawfully, or if you have complaints about this, you have the right to file a complaint with the supervisory authority, the Dutch Data Protection Authority. You can do so here.
Contact details
If you have the impression that your data is not properly secured or there are indications of misuse, please contact our customer service via help@tinybots.nl.
Tinybots BV
(Unit: Tabak 14.13, 4th floor)
Van Nelleweg 1
3044BC Rotterdam
E-mail: help@tinybots.nl
Chamber of Commerce number: 64712311
Responsible information disclosure
Version 1.1
This RID was last modified on 20-12-2024.
Introduction
As a technology company in healthcare, we as Tinybots BV consider the security of our systems a top priority. But no matter how much effort we put into system security, there can still be vulnerabilities present.
If you discover a vulnerability, we would like to know about it so we can take steps to address it as quickly as possible. We would like to ask you to help us better protect our clients and our systems.
Please do the following:
- Use this form to inform our Incident Manager about your findings.
- Do not take advantage of the vulnerability or problem you have discovered, for example by downloading more data than necessary to demonstrate the vulnerability or deleting or modifying other people's data;
- Do not reveal the problem to others until it has been resolved;
- Do not use attacks on physical security, social engineering, distributed denial of service, spam or applications of third parties; and
- Do provide sufficient information to reproduce the problem, so we will be able to resolve it as quickly as possible. Usually, the IP address or the URL of the affected system and a description of the vulnerability will be sufficient, but complex vulnerabilities may require further explanation.
- If needed make use of our public encryption key to send details about the vulnerability. This key can be found at the bottom of this page.
What we promise:
- We will respond to your report with an initial response of reception within 5 business days;
- We will respond to your report within 4 weeks with our evaluation of the report and an expected resolution date;
- If you have followed the instructions above, we will not take any legal action against you in regard to the report;
- We will handle your report with strict confidentiality, and not pass on your personal details to third parties without your permission;
- We will keep you informed of the progress towards resolving the problem; and
- In the public information concerning the problem reported, we will give your name as the discoverer of the problem (unless you desire otherwise).
We strive to resolve all problems as quickly as possible, and we would like to play an active role in the ultimate publication on the problem after it is resolved.
PGP Key:
-----BEGIN PGP PUBLIC KEY BLOCK-----
mQINBGdk1cYBEADIZC0dzKayX0SRe0vOAPGOMgpUYZ0NpukSraW9awzX8FZYQQZ/
yHKRHYgZKoqg+9Rd0Y1miJOPIDjlK4rmilg/+3udtOsr8H5lVo9cF0qx0L2jrUCx
UvXSLH8jlHsQUmsUvI1E5sJU1yntq9TCpX4k9m9gtihC5PzAaYs/VYHBnAqscYBO
3t2LmpCRTrTcgbETXroeCtxvosAIqsF1Vj2VbtCJshM8DpxDa01iwx7IIyT9oVrL
Yh0yo14PZnvqoTSosYggoqMmS+RqSq4+w2FSCwNf1ZUzV+kPOrWwLQpNv1944M/2
5Mz4hpjIUwKLJeNWNpb+E9THRwBxCUsY71kBGFbJbHg1xryRfZdU5h3RsJz/wUip
wGyOmZ5HoMUO73tf00h7oYYZeh98i8GrFGILhzKqiywuObvowegAgNzA7yck+0XM
FJb51uvJbeK2hFJQ5lA0wXdoK5QLoFuF69rel4jkkKFIm8qhKAU9L08FWpkIoLL5
Zi1lASfFzlTQh72VYXziMXo5b8JpGm4eK389toyEu8NRxff9KSEzLRxuMTjs60sp
mN/97koFUoe/VNenkc7ZLhzC/HRHLgxLwsQh+vVCD4/gW/5QFhI0YTJsbpqgo+vE
O+nBRDGsh41maPPZFo68ZTCjwR3nbJ4XlklL/bhgvX+SVOAzp1p/ysQbqQARAQAB
tDdJbmNpZGVudCBNYW5hZ2VyIFRpbnlib3RzIDxpbmNpZGVudG1hbmFnZXJAdGlu
eWJvdHMubmw+iQJXBBMBCgBBFiEE/GMqQV8/QBol0VaGDeFtmF23O0gFAmdk1cYC
GwMFCQHhM4AFCwkIBwICIgIGFQoJCAsCBBYCAwECHgcCF4AACgkQDeFtmF23O0gD
lQ/9HeVAimtuu5j18HeGW3fO+hl2g3Kp3yiTqh11g1GXA35haM2VOTViy6RyQ5jd
5V6/c8B188aDQ3wpxpx+cyzIc5oWiN3MURkrAlN2vUf6Hq0FQVtXkqq7XsjZ5nWS
vGFsdl5WUcsTMemYtEoXtWqMnf0WfUb8tlBi8ZH74qMc/FubTzj0b5jQVVjNAoJY
1r6mtxi/ZtOTvDwsJtNflS6zES+AaUWPyiwkI8ut31pqKj4s3Jo459+1q97/ygGL
W5I8Z9AMHj7jXhdtl8ijbVmqfvW1vXmCmZ2v5jGOYEnzGPFUqxcKVxhIZlZrcOOE
f2tYKczvXv6wfBXBUfiiUldKDFym//aCKgAsMO4Ip6qxx+OwhD9+eF5RP5E4mfmh
mrpSZ85AY6GDF0OrI2UC0qMeto5QZ/XcAfArpKaqhDymBRZqABxseoIP1hSXhlYo
hK2+u33TFFmncJr2ZTxrn4JWUFxzYbmm3ZOLp7hf65Ifw1uFIAVWXdfieR8zdtll
hj5Zzy0BJK7v25oTkduQuNb05r9MbWawOw0XbLfxYpnMWLzisGQs6foFMYCUHGy/
opjjBVDu82UZ+d09qvZNRE5b8Ehovm29PihIZAPiTCn/SPqk+TG9WdYv890mN7Oa
nhsNIkxkvmbsJ5UkzcORCa00+99od4CcI7IfZAzCkstF0ie5Ag0EZ2TVxgEQANXg
QesIzBbX+yRIxbowgSU+YfUEhX2aLmktbQy7ki+yNsJ/y1xuzBo8n5U8A3PufQX1
jg8ssiK6K6bX6cKwXLYa5LCU9jBU3R3F7uplA96587AAUzCWqSLHAj74gf/pePvx
d+/+K+1i98M8LndAJh34RPg7Qg3nUezwAQ2he3iPZoOpHIceYzbkaw+s301lXp1I
ew6phFGG2lGIvgaTr9UldU0YLs7Wt1tp3u3tImYKGRBtW/JfU92M2gsdRW2S7c1r
2Q0HozZPwwhTI++fnJsMW48ZcglpaBjRGEdCdrQgZG7KQX+gjLI+0qwIYHPLAa6A
Q6qNuwJXwCwYPhPG6DkUzN9UuAl4fWHwfTV6xEZWijpDzKnZges33CdLB/vCbmGZ
Q80L0HlRTnWE0UwmLa8PxJ8zlQlInmdEWBIe3inFBAPrwKxyQh5OvtGtYp4oNnt8
HeG3DhwafgJGv9udgoSrk7qCVhQaMBjq/d0KoSHfqxZLUpNHWJwRbFkz1+pTfb5B
2LjDMxjAfbtzWMYIfqopDfsNtYPKU7NA7gqFvSkn+aYGH+pOTmzG6zhwdlh2Aazy
lpL+zGEkQzbN1mZdhVMO4cx1+Nl5UrVzjsKS2w1tDUKSsKAfLH7s4xOL9A0yCm1F
0GQaJ+ZTGUtfFqr7OUPvkmzrhFOyqTht93DyOEJzABEBAAGJAjwEGAEKACYWIQT8
YypBXz9AGiXRVoYN4W2YXbc7SAUCZ2TVxgIbDAUJAeEzgAAKCRAN4W2YXbc7SF9x
EACipMvvujMDue+iShGmCdL47XmQjXrZQL+2UXlPGNePsNlc+zVC8u2TYrXQ2oex
SOrR+E7HgSLEggibjtSEbVTLu5nvIr4tGF9dhEr/mlddZ2OhQ5yPm96iq4+DTGU9
Dnds+HAGfBIMzFmuBMPyonuZouUrFMJR4dZ2b8KXrLe7dewVdrTJ2RPV3sGn1l9W
FndlQhRf/tu8a4UygSWFxZ276WvNXsGj60H9DP+fNWpr/NhhH+aUTtxDHR+2G78Z
CDDfpt53QziratF0CuGduuRaEX8FXbPJ/Js41weFdChKiH9zZc6WkWTYi6iVFQtH
cUcsoRvrlxUNFz3aBQdWjBC/zIj47kXRoJ9sj59qUBT5lQKmueiRjPMULveVRkj2
e1SW0qVs4KdMjkS+sRpe6CzvF57QLTZoZ4MAFLsHqHW9rtvKwtzJ7zihLXIeHO7X
mKN4uw6wuQ4kiF77DdlW+e5H7/9X021BWXtPr8ZVJr3jUZwS0a60F+ZfqZI0RS15
e0cd8TCRMHVTYRJfWvlS4n9yJr387teNGMrKCq2xWkN6Nrew6C4qajj0OF9NIaWV
hrmfHPuwwefjxpT0eG2eGnkHIs5vIT69SRpBRR+eEPWpWfn/EyhHAlxgN6oep+Xb
tECWS5XSeeYzJK12gi2diATRADCCSYnt4pwHgixwbCvrpg==
=L95m
-----END PGP PUBLIC KEY BLOCK-----
