Privacy Statement

Personal data is all data that can be traced directly or indirectly to you as an individual, such as name, date of birth, address, email address, telephone number and health data. We process this data when you undergo a treatment with us or contact us.

We process the following categories of personal data:

• Identification data (such as name, address, telephone number, email address, date of birth);
• Medical data relevant to your treatment;
• Referral letters and medical history (where applicable);
• Financial data for the purpose of declaration and invoicing;
• Communication data (such as email contact, completed questionnaires, consent statements);
• Other data you actively provide to us (for example via contact forms or complaints procedures).

We process your personal data solely on the basis of a valid legal ground under the General Data Protection Regulation (GDPR):

• Performance of the treatment agreement (both medical and cosmetic);
• Your explicit consent (for example to share data with third parties such as referrers or pharmacists; this consent is recorded in writing or digitally);
• Compliance with legal obligations (such as the WGBO, Wkkgz and tax retention requirements);
• Legitimate interest, only where the processing cannot be based on another ground (for example for quality assurance and internal audits, weighed against your privacy interest).

Your personal data is only shared with:

• Healthcare providers within our clinic who are directly involved in your treatment (on a 'need-to-know' basis);
• Your referrer or general practitioner, solely with your explicit consent, which we record in writing/digitally;
• Pharmacists, health insurers and administrative processors where applicable and legally permitted;
• External service providers (such as IT suppliers or accountants), with whom a GDPR-compliant processing agreement is always concluded;
• Government authorities where we are legally obliged to do so (such as the IGJ or the Tax Authority).

Your data is never provided to parties outside the European Economic Area (EEA). If we use cloud storage, these servers are located within the EEA.

We take appropriate technical and organisational measures to protect your personal data against loss, unauthorised access or unlawful processing, including:

• Secured access to systems (two-factor authentication, authorisation policy);
• Encryption of storage media and backups;
• Periodic review and updating of security measures;
• Logging and monitoring of access to medical records;
• Only authorised staff have access to your data, and they are bound by confidentiality;
• Electronic transfer of medical data (such as referrals) takes place via secure channels (for example ZorgMail).

Skin & Vision Clinics B.V. has appointed a Data Protection Officer (DPO). For questions about privacy you can contact the DPO via privacy@skinandvision.nl.

Your personal data is kept no longer than strictly necessary. For medical records, a statutory retention period of 20 years applies (Article 7:454 paragraph 3 of the Dutch Civil Code), counted from the last amendment. For cosmetic treatments we apply a retention period of 10 years, unless a different period applies under laws or regulations. After the retention period has expired, your data is destroyed safely and carefully.

Under the GDPR you have the following rights:

• The right to access and obtain a copy of your data;
• The right to correction (rectification) of inaccurate or incomplete data;
• The right to erasure ('right to be forgotten'), insofar as no statutory retention obligation applies;
• The right to restriction of processing;
• The right to object to the processing of your data;
• The right to data portability.

You can submit your request by email via privacy@skinandvision.nl. We will respond to your request within four weeks at the latest.

In the event of a security incident (data breach) with a possible risk to your privacy, we report this to the Dutch Data Protection Authority (AP) and, where applicable, also directly to you. We keep an internal register of data breaches and take appropriate measures to prevent recurrence.

If you believe that we do not handle your personal data correctly, you can contact our Data Protection Officer via privacy@skinandvision.nl. You can also file a complaint with the Dutch Data Protection Authority via www.autoriteitpersoonsgegevens.nl.

• Skin & Vision Clinics B.V.
• Louwesweg 6k
• 1066 EC Amsterdam
• E: privacy@skinandvision.nl
• W: skinandvision.nl