Privacy Statement

At Kliniek Zuidas, we attach great value to the protection of your personal data. In this privacy statement, we explain how we handle your data, in accordance with the General Data Protection Regulation (GDPR) and the Dutch Medical Treatment Agreement Act (WGBO).

1. Data controller

M3 Healthcare B.V. trading as Kliniek Zuidas
Gelrestraat 314
1079 MZ Amsterdam
Chamber of Commerce (KvK): 89362632
Email: info@kliniek-zuidas.nl
Tel: 020-3086055

2. What personal data do we process?

We process, among others, the following data:

• Identification data: name, address, date of birth, BSN (citizen service number), gender

• Contact details: phone number, email address

• Insurance data and financial data (for invoicing/claims)

• Medical data: treatment history, medical records, referral letters

• Login details and usage data of the patient portal (OASE Dental)

• Technical data: IP address, cookie information (Google Analytics, Google Maps)

3. Purposes and legal grounds

We process your personal data for the following purposes:

1. Medical care provision – carrying out treatments and maintaining medical records (WGBO / Art. 9(2)(h) GDPR).

2. Administration and invoicing – claims with health insurers, invoices via Infomedics (legal obligation).

3. Patient portal (OASE Dental) – providing secure access to appointments and your medical record (performance of the treatment agreement).

4. Communication – contact by phone or email, for example for appointments or treatment plans (legitimate interest).

5. Website and usage statistics – using Google Analytics, we measure the use of our website (consent via cookie banner).

6. Map display (Google Maps) – for directions on our contact page (consent via cookie settings).

We do not use personal data for commercial marketing without your explicit consent.

4. Sharing of data

Your data may be shared with:

• Health insurers (for claims)

• Referring general practitioners, dentists, orthodontists and medical specialists

• Infomedics (invoicing)

• Software providers of the electronic patient record (EPD)

• OASE Dental (patient portal)

• IT service providers for security and hosting (within the EU)

• Google (Analytics, Maps) – only with your consent via cookies

No transfer takes place outside the EU without appropriate safeguards.

5. Retention periods

• Medical records: at least 20 years (in accordance with the WGBO)

• Invoices and administrative data: 7 years (fiscal retention obligation)

• Cookie and analytics tracking: according to the retention periods set by Google Analytics

6. Security

We take appropriate technical and organisational measures, including:

• Encrypted storage and communication (SSL/HTTPS, encryption)

• Access restrictions: only authorised staff can view data

• Regular backups and security checks

• Use of NEN 7510 guidelines for information security in healthcare

7. Your rights

You have the right to:

• Access your data

• Have your data corrected or supplemented

• Have your data (partially) deleted (insofar as legally permitted)

• Have processing restricted or object to processing

• Transfer your data (data portability)

Requests can be submitted via info@kliniek-zuidas.nl. We respond within one month.

In addition, you can always file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens): www.autoriteitpersoonsgegevens.nl.

8. Cookies and tracking

Our website uses cookies and similar techniques:

• Necessary cookies: for the functioning of the website and the patient portal.

• Analytical cookies: via Google Analytics, only with your consent.

• External content: Google Maps on the contact page may process your IP address.

On your first visit to our website, you will be asked to make a choice via the cookie banner.

9. Changes

We reserve the right to amend this privacy statement. Changes will be published on our website and will take effect from the date of publication.