This is an English translation provided for your convenience. The Dutch version of this privacy statement is binding.
Zclinics attaches great importance to the protection of your personal data. In this privacy statement we explain which data we process, why, and which rights you have. We process personal data in accordance with the General Data Protection Regulation (GDPR).
Who is responsible for your personal data?
The controller for the processing operations described in this privacy statement is:
Zclinics
Boxbergerweg 27-29
7412 BB Deventer
Chamber of Commerce (KvK) number: 42035558
Email address: info@zclinics.nl
Telephone number: 06-11909856
When the treatment agreement is concluded with another care provider named in the appointment confirmation, that care provider may be responsible for the processing of personal data independently or jointly with Zclinics. If this applies, the client will be informed about it.
Which personal data do we process?
Depending on the services provided, we may process the following data: name, contact details (such as email address and telephone number), data required to establish your identity, appointment details and data about the treatments you have requested or undergone, date of birth, medical and other health data including your medical history, medication use, allergies, contraindications, treatment indications, treatment reports and aftercare data, health data that is necessary for a safe treatment, questionnaires and informed-consent forms completed by you, photos and other image material created in the context of the treatment, correspondence and other communication with Zclinics, invoicing, payment and administrative data, data about complaints, incidents and any liability claims, technical data about the use of our website, such as IP address, device data, browser data and cookie data; and data that you provide to us yourself, for example via a contact form, by email, by telephone or during a consultation.
Health data are special categories of personal data. We process these data only insofar as there is a valid legal basis for doing so and appropriate security measures have been taken.
How do we obtain your personal data?
We obtain personal data mainly:
a. directly from you, for example when you make an appointment, complete a form, contact us or undergo a treatment;
b. via the online appointment and patient system used by Zclinics, including Clinicminds;
c. from another care provider, only when there is a valid basis for doing so; and
d. automatically when you use our website, for example by means of necessary and – after consent – analytical or marketing cookies.
For which purposes and on which legal bases do we process data?
We process personal data for the following purposes.
- Making and managing appointments;
- Providing care and performing treatments;
- Administration and payment;
- Quality, complaints and legal matters
- Safeguarding the quality and safety of the treatment;
- Invoicing and financial administration;
- Complying with legal obligations;
- Communication about appointments and, if you have given your consent, sending newsletters;
- Photos and image material
Online appointments via Clinicminds
Zclinics uses Clinicminds for making and managing appointments and may in addition use Clinicminds for patient registration, communication, forms, treatment data and record-keeping.
When you make an appointment via Clinicminds, the data you enter is processed via this system. Zclinics determines for which purposes these data are processed. Insofar as Clinicminds processes the data solely on behalf of Zclinics, Clinicminds acts as a processor.
Zclinics makes written arrangements with Clinicminds regarding, among other things, confidentiality, security, the engagement of sub-processors, data breaches, retention periods and the deletion or return of data.
With whom do we share personal data?
Within Zclinics, only persons have access to personal data insofar as they need that access for their work. These may include, among others, the treating physicians and other care providers directly involved in the treatment and authorised administrative staff.
We may in addition share personal data with:
a. other care providers directly involved in the treatment or aftercare;
b. IT, hosting, communication and software suppliers, including Clinicminds;
c. payment, accounting and administrative service providers;
d. professional advisers, such as lawyers, accountants and insurers;
e. a complaints officer or disputes body;
f. supervisory authorities and other government bodies; and
g. other third parties when this is necessary to comply with a legal obligation or to establish, exercise or substantiate a legal claim.
Medical data are not shared with third parties without a valid basis. Where consent is required for provision, we ask for that consent in advance.
Service providers that process personal data solely on our behalf may not use these data for their own purposes. Where necessary, we conclude a processing agreement with these service providers.
Confidentiality and medical professional secrecy
The care providers involved are bound by medical professional secrecy. Other persons who have access to personal data by virtue of their position are also bound by a statutory, contractual or professional duty of confidentiality.
Information from the medical file is only provided when:
a. you have given consent for it;
b. provision is necessary for the treatment and is legally permitted;
c. Zclinics or the care provider is legally obliged to do so; or
d. another statutory exception to the duty of confidentiality applies.
Processing outside the European Economic Area
Zclinics strives to process personal data within the European Economic Area – the EEA.
When a supplier engaged by us processes personal data outside the EEA, we ensure that there is a valid transfer basis for this and that appropriate safeguards have been taken. This may happen, for example, on the basis of an adequacy decision of the European Commission or approved standard contractual clauses, possibly supplemented with additional security measures.
You can contact us for more information about the safeguards applied in a specific case.
How long do we retain personal data?
We do not retain personal data longer than is necessary for the purposes for which they were collected, unless a longer retention period follows from the law or is necessary for the establishment, exercise or substantiation of legal claims.
We retain medical files in accordance with the statutory retention period of at least 20 years (or as much longer as follows from good care provision). We do not retain other data longer than is necessary for the purposes for which they were collected.
How do we secure personal data?
Zclinics takes appropriate technical and organisational measures to protect personal data against loss, unauthorised access, alteration, disclosure and other unlawful use.
These measures may include, among other things:
a. access security and personal user accounts;
b. limitation of access rights based on roles and activities;
c. secure connections and encryption where appropriate;
d. secure storage and back-ups;
e. logging and monitoring of access to medical data;
f. confidentiality arrangements;
g. periodic updating of security measures; and
h. arrangements with suppliers regarding security and data breaches.
Despite these measures, no system can guarantee absolute security.
Data breaches
In the event of a security incident or data breach, Zclinics investigates as soon as possible what has happened and what consequences this may have.
Where this is legally required, Zclinics reports the data breach to the Dutch Data Protection Authority. When a data breach is likely to result in a high risk to your rights and freedoms, we will also inform you about it, unless a statutory exception applies.
Which rights do you have?
Depending on the circumstances, you have the right to:
a. receive information about the processing of your personal data;
b. access your personal data and medical file;
c. receive a copy of your personal data or medical file;
d. have factually incorrect personal data corrected;
e. have your own statement added to the medical file;
f. in certain cases have personal data erased or the medical file destroyed;
g. in certain cases have the processing restricted;
h. object to a processing operation based on a legitimate interest;
i. receive or have transferred data that you provided yourself in a structured, commonly used and machine-readable form, insofar as the right to data portability applies; and
j. withdraw consent given at any time.
These rights are not absolute. A request may, for example, be refused in whole or in part when retention of data is legally required, when destruction conflicts with good care provision or when the data are also of significant importance to another person.
A correction request relating to the medical file can be used to correct factually incorrect data. A professional opinion or medical finding is not adjusted solely because you disagree with it. In that case, you can request that your own statement be added to the file.
You can submit a request via info@zclinics.nl. We may ask for additional information to establish your identity and to prevent misuse of personal data. We respond within the applicable statutory period.
Automated decision-making
Zclinics does not take decisions that have legal consequences for you or otherwise significantly affect you based solely on automated processing, without meaningful human intervention.
An online selection or request for a treatment does not entail an automatic medical assessment or a guarantee that the treatment will be carried out. The treating physician assesses whether a treatment is medically and professionally justified.
Website and cookies
Our website may use functional, analytical and marketing cookies or similar techniques.
For cookies that are not strictly necessary for the functioning of the website, we ask for consent in advance where the law requires this. More information about the cookies used, the suppliers involved, retention periods and changing your preferences is included in our cookie statement.
Links to third-party websites
Our website may contain links to websites or services of third parties. Zclinics is not responsible for the way in which these third parties process personal data. We advise you to consult the privacy statement of the relevant third party.
Changes to this privacy statement
Zclinics may amend this privacy statement, for example when our services, the systems used or the applicable laws and regulations change.
The most current version is published on our website. The top of the privacy statement states when it was last updated. In the event of significant changes, we may additionally inform you about them.
Contact and complaints
For questions about this privacy statement, the processing of your personal data or the exercise of your rights, you can contact us via:
Zclinics
Boxbergerweg 27-29
7412 BB Deventer
Email address: info@zclinics.nl
Telephone number: 06-11909856
Are you not satisfied with the way we handle your personal data? Then please contact us first, so that we can investigate your complaint. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).