Privacy Policy

Article 1 — Who Are We?

DentalZorg Tandheelkunde is the controller responsible for processing your personal data.

• Name: DentalZorg Tandheelkunde
• Address: Rustenburg 118, 1506 AT Zaandam
• Email: [email protected]
• Phone: 088 252 3800
• Website: www.dentalzorg.nl
• CoC number: [kvk-number]

Article 2 — What Personal Data Do We Process?

Depending on the service you use, we process the following categories of personal data:

Identification and contact details

• Name, date of birth, gender
• Address, postcode, place of residence
• Phone number, email address
• BSN (Dutch citizen service number — for insurance claims)

Medical data (special categories)

• Medical and dental history
• Diagnoses, treatment plans and treatment records
• Medication use, allergies and contraindications
• X-rays, photographs and other diagnostic images
• Anaesthesia data for treatments under general anaesthesia
• Other data in the medical file (in accordance with WGBO)

Insurance data

• Name and policy number of health insurer
• UZOVI code of insurer

Website and contact form data

• Name and phone number (via contact form)
• IP address, browser type (via analytical cookies)

Article 3 — Purposes of Processing

We process your personal data for the following purposes:

• Performing the treatment agreement and providing dental care
• Maintaining your medical file in accordance with the WGBO
• Scheduling and confirming appointments
• Submitting claims to your health insurer
• Sending invoices and processing payments
• Answering questions by phone, email or WhatsApp
• Complying with legal obligations
• Improving our services (anonymised statistics)

Article 4 — Legal Bases for Processing

We process your personal data on the basis of the following legal grounds (Article 6 GDPR):

• Performance of a contract — for treatment and administrative handling
• Legal obligation — for maintaining the medical file (WGBO) and invoicing obligations
• Consent — for use of images, newsletters or other non-essential processing
• Legitimate interest — for security of our systems and improving our services

Medical data is a special category of personal data. We process this on the basis of Article 9(2)(h) GDPR (healthcare) and the WGBO.

Article 5 — Retention Periods

• Medical file: minimum 20 years after last contact (WGBO Article 7:454)
• Financial records: 7 years (Dutch Tax Act)
• Contact form data: maximum 1 year after last contact
• Website analytics data: maximum 26 months (anonymised)

Article 6 — Sharing With Third Parties

• Health insurers — for treatment claims
• Referring healthcare providers — for continuity of care (with your consent)
• Dental laboratories — for manufacturing prostheses and restorations
• Anaesthesiologist / anaesthesia team — for treatments under general anaesthesia
• IT service providers — for managing our practice software (data processing agreement)
• Collection agencies — in the event of payment arrears (name and invoice data only)

We enter into data processing agreements with processors who process personal data on our behalf, in accordance with Article 28 GDPR. We do not transfer personal data to third parties outside the EEA unless an adequate level of protection applies.

Article 7 — Security

• Encrypted data storage and transmission (SSL/TLS)
• Access security with passwords and two-factor authentication
• Secure practice management software in accordance with NEN 7510
• Confidentiality obligations for all staff (professional secrecy and processing agreements)
• Regular backups and security audits

In the event of a data breach that poses a risk to your rights and freedoms, we will report this to the Dutch Data Protection Authority within 72 hours and inform you if required.

Article 8 — Cookies

• Functional cookies — necessary for the website to function (no consent required)
• Analytical cookies — for measuring website visits (Google Analytics, anonymised)
• Marketing cookies — for personalised advertising (only with your consent)

Article 9 — Your Rights

• Right of access — you can request access to the data we process about you
• Right to rectification — you can have incorrect data corrected
• Right to erasure — you can request deletion of your data (unless a legal retention obligation applies)
• Right to restriction of processing — in certain cases you can have processing restricted
• Right to data portability — you can request your data in a structured format
• Right to object — you can object to processing based on legitimate interest
• Right to withdraw consent — you can withdraw previously given consent at any time

Submit your request via [email protected]. We will respond within 1 month.

Article 10 — Complaints

• DentalZorg — via [email protected]
• Dutch Data Protection Authority — via autoriteitpersoonsgegevens.nl

Article 11 — Amendments

DentalZorg reserves the right to amend this privacy policy. The most recent version is always available on our website. For substantial changes we will inform you by email or a notice on the website.