Your data in the CAREPATH hackathons

This page explains what happens to your information when you sign up for or take part in a CAREPATH hackathon.

It applies to all hackathons in the Netherlands, Spain, Germany, Poland, Sweden and Israel.

Version 1.1 · 27 October 2026

The privacy law of the European Union (the GDPR) calls the organisation that decides what happens to your data the controller. In the CAREPATH hackathons, these organisations are responsible:

• The organiser in your country. This is the hospital, university or research institute that runs the hackathon where you live. It is responsible for your data and is your first point of contact. You find them in the contact list at the end.
• MaMa Producties B.V. in Eindhoven, the Netherlands. MaMa Producties BV designs and leads the hackathons. For your contact details and the practical arrangements, MaMa Producties and the organiser in your country are responsible together. The law calls this joint controllers.
• University Medical Center Groningen (UMCG) in the Netherlands leads this part of the CAREPATH project and helps to analyse the data with a code.

All CAREPATH partners have signed a Data Protection and Data Sharing Agreement (14 August 2026). It sets out who may see which data, how they must protect it, and who helps you when you have a question.

You can always go to the organiser in your country. They make sure your question or request reaches the right place. If you prefer, you can also contact MaMa Producties or any of the other responsible organisations directly. That is your right.

We only collect what we need. We do not look at your medical records and we do not ask which medicine you use. You decide what you share about yourself.

If you take part as a patient or caregiver, your role shows that you, or someone close to you, lives with a chronic condition. The law sees this as health information and protects it extra. That is why we ask your explicit permission for it on the consent form.

• Your permission. When you fill in the registration form, you give permission to use your contact details to organise the hackathon. When you sign the consent form, you give permission for the study (GDPR article 6(1)(a)). For health information, we ask your explicit permission (GDPR article 9(2)(a)).
• Other rules in some countries. In some countries the law requires the organiser to use a different legal basis, for example scientific research in the public interest. We then still ask for your permission, because we think you should decide for yourself. The information letter from your organiser tells you which basis applies.
• Side effects. If a company employee passes on a side effect of their company’s medicine, the company does this because the law requires it (GDPR article 6(1)(c) and 9(2)(i)). This report never contains your name. Read more under “What if I talk about side effects?”.

• You get a code made of your country and a number, for example NL-P03. We use this code instead of your name.
• The list that links codes to names is encrypted. Only the research team in your country has it.
• Paper consent forms are kept in a locked cabinet, separate from the other data.
• Data are stored on the secure systems of the organiser, inside the European Union (for Israeli participants: in Israel). Never on private computers or free cloud services.
• Nobody puts personal data into public online tools, including AI chatbots.
• Photos of group work are taken without people in them and checked for names before they are shared.
• Company employees who join the hackathon cannot see names or coded data of other participants. They may not collect your contact details or contact you afterwards.
• Everyone who works with your data must keep it confidential.

If something goes wrong, for example data end up with the wrong person, we report this to the data protection authority within 72 hours when the law requires it. If there is a high risk for you, we tell you personally.

Your data exist in three forms. The further to the right, the less it says about you, and the more people may see it.

The example name above is made up.

The results are the ideas, drawings, priorities, prototypes and reports that the groups make. They belong to the group, not to one person.

• We remove all personal information first. The organiser in your country and MaMa Producties BV check that results contain no names, recognisable personal stories, faces or anything else that could show who you are.
• Then all project partners may use them, including companies and partners outside the European Union. They may use them for research and to develop care, tools, products and services, also after the project has ended.
• You do not get payment or rights for the ideas you share, apart from the compensation for taking part.
• Partners may never try to find out who is behind the data. They promised this in the agreement.
• The main findings may be published in scientific journals. You receive a summary in plain language. Publications never contain anything that could identify you.
• If you stop, the results of your group stay in the study. We cannot take your part out, because the results are not linked to your name.

• Data with your name or a code stay in the European Union (the EU and the European Economic Area).
• Data of participants in Israel are kept by the organiser in Israel. The European Commission has decided that Israel protects personal data at the same level as the EU.
• Partners outside the EU or Israel only receive results without any personal information.

You are free to talk about side effects. You do not have to name your medicine. The hackathon is not meant to collect side effects.

Companies that make medicines must by law report side effects of their own products. If an employee of such a company hears you talk about a side effect of one of their products, they must pass it on to their company’s safety department.

• The report never contains your name or contact details. It only says: the date, the country, the product, the side effect in your words, your gender and age group, and whether you are the patient or a caregiver.
• The company may not contact you directly. If they need more information, they ask the research team.
• The research team only gives your contact details to the company if you said yes to this on the consent form, and after asking you once more.
• The research team keeps a short list of these reports, with your code instead of your name.

Worried about a side effect? Please contact your own doctor. You can also report it yourself to the national reporting centre in your country, for example Lareb in the Netherlands.

These are all optional. Saying no has no effect on taking part.

• Sound recordings. We only record a group if everyone in that group agrees. We write out the recording with codes instead of names and then delete it. At the latest three months after the hackathon.
• Photos and film. Only if you agree. They may be used in reports, on the CAREPATH website and on social media. If you do not want to be in photos, you get a sticker to wear on the day. If you take back your permission, we stop using the photos, but we cannot always remove photos that have already been published.
• Quotes. We only quote what you say if you agree, and never with your name.
• Participants do not take photos or make recordings themselves during the hackathon.

Companies may show products or plans that are not public yet. They always say clearly when something is secret. We ask you not to tell others about it and not to take photos of it. This applies for five years, or until the information becomes public.

You have these rights under the GDPR (articles 15 to 22). Using them is free.

Some limits. In scientific research, the law allows some rights to be limited if they would make the research impossible or seriously harm it. After the results are written up (without personal information) we cannot delete or change the part which came from you, because nobody can tell which part came from you. Data the law requires us to keep, such as your consent form, are kept for the required time.

How to use your rights. Contact the organiser in your country (see Contact). You may also contact MaMa Producties BV. We may ask you to show who you are. We answer within one month. If your request is complicated, this can take up to two months longer; we will then tell you why.

Not happy? Talk to the organiser. You also have the right to complain to the data protection authority in your country. If you suffer damage because the law was broken, you have the right to compensation.

What we never do. We do not sell your data. We do not use your data for advertising. No computer makes automatic decisions about you.

Questions, requests or complaints? Start with the organiser in your country.

Ventoselaan 1, 5611 BK Eindhoven, the Netherlands
Gudule Martens · [email protected]

Changes to this page. We update this page when something changes in how we handle your data. The version number and date at the top show which version you are reading. If a change matters for you, we tell you.

CAREPATH is funded by the Innovative Health Initiative of the European Union (grant agreement 101192133).