Short waiting times — including Saturdays & Tuesday evenings Same-day appointments for emergencies Dutch or English Digital dentistry & personal treatment plan

Privacy policy

ARTICLE 1. GENERAL

Loef Mondzorg ensures that (special categories of) Personal Data of patients are handled with care. We comply with the applicable laws and regulations, including the General Data Protection Regulation. With this Privacy Policy we would like to inform you in more detail about our policy.

ARTICLE 2. DEFINITIONS

For the sake of clarity, we briefly explain what we mean by certain terms:

  1. 1.Personal Data: all data by means of which the patient can be identified.
  2. 2.Controller: the data controller, as referred to in Article 4(7) of the Regulation. For this privacy policy: the dental practice.
  3. 3. Processing/Process: an operation on personal data, whether or not carried out by automated means, such as collecting, recording, organising, storing, updating, modifying, retrieving, consulting, using, disclosing by transmission, dissemination or any other form of making available, aligning, combining, as well as restricting, erasing or destroying Personal Data.
  4. 4.Processor: the party that takes care of the Processing of Personal Data on behalf of the dental practice, without being subject to its direct authority, such as assistants hired by the Controller.
  5. 5. Data Subject: the person to whom the Personal Data relate, generally the patient.
  6. 6. Implementation Act: the Dutch General Data Protection Regulation Implementation Act (Uitvoeringswet AVG).
  7. 7. Regulation: Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (OJ EU 2016, L 119).
  8. 8. Privacy Policy: this document.
  9. 9. Pseudonymised data: Personal Data that can no longer be attributed to a specific data subject without the use of additional information. This additional information is kept in such a way that it cannot be linked to an identifiable person.

ARTICLE 3. HOW DO WE OBTAIN THE DATA?

Personal Data originate from or are derived from data provided orally and in writing by the Data Subject or their legal representative. Personal Data may also be provided by the health insurer, the GP, other practitioners, specialists, care providers or persons or bodies other than those mentioned above.

ARTICLE 4. HOW AND WHY DO WE PROCESS DATA?

1. Processing takes place in a manner that is lawful, fair and transparent towards the Data Subject. In addition, Personal Data are collected for specified, explicit and legitimate purposes and are not processed in a manner incompatible with those purposes. 2. Processing for archiving purposes in the public interest, scientific or historical research or statistical purposes is not considered incompatible with the original purposes. 3. Processing is only lawful if and to the extent that at least one of the following conditions is met: a. Consent of the Data Subject; b. Entering into and performing a treatment agreement; c. Protecting a vital interest of the Data Subject, such as emergencies; d. Pursuing a legitimate interest of the Controller or of a third party (for example business continuity); e. Necessity to comply with a legal obligation or an agreement with the Data Subject. 4. Personal Data are only Processed to the extent that they are adequate, relevant and limited to what is necessary in relation to the purposes for which they are Processed. 5. The dental practice processes Personal Data for the following purposes: a. Treatment of the Data Subject; b. Informing and contacting Data Subject(s); c. Financial administration; d. Proper functioning of the website.

ARTICLE 5. CONDITIONS FOR CONSENT

1. The Controller can demonstrate that the Data Subject has consented to the Processing. 2. The Data Subject can always withdraw consent given.

ARTICLE 6. OTHER DATA

Anonymised data do not fall within the scope of this Privacy Policy.

ARTICLE 7. WHICH DATA ARE CONCERNED?

Processing may relate to the following categories of data: a. Surname, first names, initials, title, gender, date of birth, address, postcode, place of residence, telephone number and similar data required for communication, as well as payment details of the Data Subject; b. An administration number that contains no information other than that under a; c. Data as referred to under a of the parents, guardians or carers of minor Data Subjects; d. Data as referred to under a of family members of the Data Subject, as well as others who are informed about the well-being and health of the Data Subject; e. Information about the health of the Data Subject and, in the case of hereditary conditions, their family members; f. Other special Personal Data with a view to the proper treatment or care of the Data Subject; g. Information about the treatment followed and to be followed by the Data Subject, as well as the medication or facilities provided; h. Information about calculating, recording and collecting the fee; i. Information about the Data Subject’s insurance; j. Other data necessary for the treatment.

ARTICLE 8. DUTY TO INFORM

1. Before the Controller Processes Personal Data, they inform the Data Subject and/or their legal representative of: a. Who is responsible for the processing, with contact details; b. Why certain specific Personal Data will be Processed; c. Where applicable, the contact details of the data protection officer; d. How the Personal Data will be Processed; e. The period for which the Personal Data will be stored or, if that is not possible, the criteria used to determine that period; f. All other information that must be provided in the interest of due care. This also means: the more sensitive the Personal Data the Controller wishes to Process, the more thoroughly the Data Subject must be informed. 2. If Personal Data are requested via a third party, or supplied to a third party, the duty to inform is fulfilled in the same way before the Personal Data are obtained or supplied, unless this can only be done with disproportionate effort.

ARTICLE 9. RIGHT OF ACCESS

1. The Data Subject has the right to access their Personal Data and can request the following information: a. A description of the purpose or purposes of the Processing of Personal Data; b. All available information about the source of the Personal Data; c. The categories of data to which the Processing relates; d. An overview of recipients or categories of recipients who have received the Personal Data; e. Where possible, the period for which the Personal Data are expected to be stored or, if that is not possible, the criteria used to determine that period; f. That the Data Subject has the right to rectification, the right to erasure and the right to restriction of processing. 2. A request for access may be refused on the following grounds: a. The requester is not a Data Subject or the request does not relate to data that concern only the requester; b. The requester has not yet reached the age of 16 and/or has been placed under guardianship. In that case, only the legal representative can make the request; c. The Controller has recently complied with a similar request from the same requester; d. Protection of the Data Subject or of the rights and freedoms of others; e. State security and/or the prevention, detection and prosecution of criminal offences.

ARTICLE 10. OTHER RIGHTS

1. The Data Subject has the right to object at any time to the Processing of Personal Data concerning them. In the event of an objection, the Controller stops the Processing. 2. The Data Subject has the right to obtain from the Controller without undue delay the rectification of inaccurate Personal Data concerning them. 3. The Data Subject has the right to obtain from the Controller the erasure of Personal Data concerning them without undue delay. In addition, the Controller is obliged to erase data without undue delay when the Data Subject has withdrawn their consent or the Controller no longer needs the Personal Data for the purposes for which they were collected. 4. If the Data Subject contests the accuracy of the Personal Data, they have the right to obtain restriction of the Processing from the Controller. 5. The Data Subject has the right to receive the Personal Data concerning them, which they have provided to the Controller, in a structured, commonly used and machine-readable format.

ARTICLE 11. EXERCISE OF RIGHTS BY THE DATA SUBJECT

The Controller takes appropriate measures so that the Data Subject receives the communication or information about the rights described in this Privacy Policy in a concise, transparent and accessible form, using clear language.

ARTICLE 12. ACCESS TO AND RECIPIENTS OF PERSONAL DATA

1. In principle, only those directly involved in carrying out the treatment of the Data Subject have access to Personal Data, insofar as that access is necessary for their work. 2. When Processing is carried out on behalf of the Controller, the Controller only uses Processors that provide sufficient guarantees that the Personal Data are Processed in accordance with the Regulation, the Implementation Act or regulations based on them. 3. In addition, access may be granted to/Personal Data may be provided to the following persons and bodies: a. Researchers as referred to in Article 7:458 of the Dutch Civil Code; b. Health insurers, insofar as necessary in view of the obligations under the insurance agreement; c. Third parties charged with collecting claims, insofar as access/provision is necessary and does not concern medical data; d. Others, when the basis for the Processed data is: (i) Consent of the Data Subject; (ii) A need to comply with a legal obligation; (iii) Protecting a vital interest of the Data Subject. e. Others, when further Processing takes place for historical, statistical or scientific purposes, provided the Controller has taken the necessary measures to ensure that further Processing takes place solely for these purposes.

ARTICLE 13. REGISTER

The Controller keeps a register of the processing activities carried out under its responsibility. This register contains the following information: a. The name and contact details of the Controller and, where applicable, the data protection officer; b. The purposes of processing; c. The categories of data to which the Processing relates; d. The categories of recipients to whom Personal Data are provided; e. Where possible, the envisaged time limits for erasure of the Personal Data; f. Where possible, a description of the technical and organisational measures taken.

ARTICLE 14. DATA BREACH NOTIFICATION

1. If a breach involving Personal Data has occurred, the Controller notifies the Data Subject and the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) of this as soon as possible after becoming aware of it, if and insofar as required by law. 2. The notification referred to in the first paragraph contains at least: a. The nature of the breach; b. The likely consequences of the breach; c. The measures the Controller has taken as a result of the breach; d. A contact point for more information.

ARTICLE 15. RETENTION PERIODS

1. Medical data obtained in order to enter into or perform a treatment agreement are kept for 15 years. The Controller is not obliged to observe longer retention periods than required by law, in particular Article 7:454(3) of the Dutch Civil Code. 2. Other Personal Data are not kept longer than necessary for the purposes for which they were Processed. When those Personal Data are no longer needed, they are deleted.

ARTICLE 16. CONFIDENTIALITY

1. The Controller, the Processor and anyone who has access to Personal Data under the authority of the Controller are obliged to keep the Personal Data confidential. 2. Data relating to the health of Data Subject(s) are regarded as ‘special Personal Data’. Anyone who Processes special Personal Data is subject to a duty of confidentiality. This arises from their office, profession or employment contract.

ARTICLE 17. SECURITY

1. The Controller must take appropriate technical and organisational measures to secure Personal Data. 2. ‘Appropriate’ means that the security measures taken match the risk of the Personal Data being (further) Processed carelessly or unlawfully and the damage that would result from this. The measures taken must ensure that: a. Only authorised persons have access to Personal Data; b. The Personal Data are correct and are not lost; c. The Personal Data are available without obstruction for lawful Processing in accordance with the agreements within the organisation. 3. In all cases, the Controller is responsible for the information security policy and promotes this policy within the dental practice.

ARTICLE 18. WEBSITE

1. The Loef Mondzorg website uses cookies. Cookies are small text files sent by a website to the browser, which then stores this data. On a subsequent visit to the website, the stored data is sent back to the website by the browser. Cookies come in all shapes and sizes. Loef Mondzorg uses technical cookies, analytical cookies and marketing cookies. Below we explain what these cookies are used for.

Technical cookies Technical cookies are necessary for the website to function properly. These cookies are needed to ensure you have an optimal user experience. No personal data are processed through the use of technical cookies. Analytical cookies Analytical cookies are used to collect information about how website visitors use and experience our website. This information enables us to optimise the website, monitor how it works and improve the user experience. No personal data are processed through the use of analytical cookies. Marketing cookies Marketing cookies, also called tracking cookies, are used to follow the browsing behaviour of website visitors across the internet. If you have given your consent, we place tracking cookies in order to present personalised offers and promotions via various online channels.

You give consent for this processing by ticking the box in the cookie notice. You can change your preferences at any time via the cookie settings on the website. Loef Mondzorg takes appropriate technical and organisational security measures to protect personal data against loss or any form of unlawful processing. These measures aim to achieve an appropriate level of protection, taking into account the risks involved in the processing and the nature of the data to be protected. 2. Retention period of data via the website: Loef Mondzorg does not keep your data longer than necessary to achieve the purposes for which the data were collected, with a maximum of 2 years. 3. Management of and access to personal data of third parties: Except where required by laws and regulations, only those responsible for managing the client file and/or those involved in or necessarily involved in the processing of personal data, including employees and processors of Loef Mondzorg, have access to the personal data.

Loef Mondzorg uses the following online tools: • Hotjar • Facebook • Instagram • Google Analytics • Mailchimp • Vimeo

These online tools are used, among other things, to analyse the browsing behaviour of website visitors, to collect website statistics and to send newsletters. The parties mentioned above, such as Facebook, have their own privacy statements and bear their own responsibility for them.

ARTICLE 19. FINAL PROVISIONS

1. The Controller does not accept any obligations beyond those required by law, unless otherwise agreed in writing with the Data Subject. 2. The Data Subject has the right to lodge a complaint with the supervisory authority. 3. Changes to this Privacy Policy are made by the Controller. Changes to the Privacy Policy take effect with respect to Data Subject(s) after the Data Subject(s) have been informed of the change. 4. This Privacy Policy entered into force on 01-10-2022 and can be inspected at the dental practice.

For questions or to exercise the rights of the Data Subject, please contact us via: Address: Weena 91, 3013CH Rotterdam. Email: administratie@loef.nl