Privacy policy

Data controller and contact

EKE Diëtistenpraktijk
info@ekedietistenpraktijk.nl
+31 6 13 99 54 19

• Practice locations: Aelbrechtskade 82, 3023 JA Rotterdam; Honswijkpolder 17, 3453 NS De Meern

What data do we process?

Which data we have depends on how you get in touch with us:

• Contact form: your name, email address, phone number (if you enter it), preferred location, your message and when you sent it. To limit misuse of the form we also store an encrypted (hashed) version of your IP address and your browser type. We send you a confirmation by email.
• If you become a client: your name, address, date of birth, contact details, citizen service number (BSN), health insurer and policy number, a referral if there is one, and the health and nutrition data needed for your guidance. Together these form your record.
• Visiting the website: our hosting provider logs technical data such as IP address and browser in server logs to keep the website secure and available.
• Contact by WhatsApp, phone or email: the details you share with us yourself.

What do we use your data for?

To answer your question and plan appointments, to guide you and keep your record, to claim the guidance from your health insurer or invoice you, to meet legal obligations, and to keep the website secure. We never sell your data and do not use it for advertising.

On what legal basis?

We only process personal data when the GDPR (AVG) provides a legal basis:

• Consent: for the contact form and (only if you give it) for analytics cookies. You can withdraw your consent at any time.
• Performance of the agreement: to plan and carry out your guidance (the medical treatment agreement under the Dutch WGBO).
• Legal obligation: keeping and retaining your record (WGBO), using your BSN in healthcare (Dutch Act on the use of the citizen service number in healthcare) and the tax retention obligation.
• Legitimate interest: securing the website and limiting misuse of the contact form.
• Health data is a special category of personal data. We only process it for your guidance, under the professional confidentiality that applies to us as dietitians (Article 9(2)(h) GDPR).

How long do we keep your data?

We keep your data no longer than necessary or than the law requires:

• Messages sent through the contact form: as long as needed to handle your question, for no more than 12 months. If you become a client, what is needed moves to your record.
• Record: 20 years after the last change, as the WGBO requires, or longer if reasonably necessary for good care.
• Invoices and payment details: 7 years, because of the statutory tax retention period.
• Website server logs: briefly, only as long as needed for security.

Who do we share your data with?

We only share your record with your consent (for example feedback to your GP or referrer) or when the law requires it. For claims, your health insurer only receives the data needed for that. We also work with service providers that process data on our behalf (processors), with agreements on security and confidentiality:

• Vercel: website hosting.
• Supabase: storage of contact form messages, in a data centre in the European Union (Frankfurt).
• Our email provider: sending and receiving email.
• Google: only if you consent to analytics cookies (Google Analytics, with anonymised IP addresses and no advertising features).
• OpenStreetMap Foundation: shows the map on the contact page and receives your IP address to do so, without cookies.
• WhatsApp (Meta): only if you contact us via WhatsApp yourself. Please do not share medical details there; we discuss those during your appointment.

Data outside the European Union

Some providers (such as Vercel and Google) are US companies. If data ends up outside the European Economic Area as a result, this only happens with the safeguards the GDPR requires, such as the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.

Children

The guidance of children follows the Dutch WGBO: up to age 12 the parents or guardian decide, from 12 to 16 both the child and the parents must consent, and from 16 young people decide for themselves. Children under 16 should preferably send the contact form together with a parent or guardian.

Security

We take appropriate technical and organisational measures to protect your data, such as a secure connection (HTTPS), secured access to our systems and our professional confidentiality. Only those who need the data for your guidance can access it.

Your rights

You have the right to access your data and receive a copy, to have it corrected or completed, to have it erased, to restrict its processing, to object and to data portability. You can withdraw consent at any time. For your record, we cannot delete data while the law requires us to keep it, unless you ask for its destruction and the law allows it (WGBO).

Send your request to info@ekedietistenpraktijk.nl. We respond within one month. To prevent misuse we may ask you to confirm the request from the email address we have on file; we will not ask for a copy of your ID.

We do not make decisions about you that are based solely on automated processing.

Changes

We update this privacy policy when the way we work or the law changes. The date at the top shows when it was last updated. The Dutch version of this policy prevails.

Cookies

The website uses functional cookies, for example to remember your language. Analytics cookies are only set after you choose so yourself.

Read the cookie statement

Complaints

If you are not happy with how we handle your data, please let us know; we would like to find a solution together. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens). Complaints about the guidance itself fall under the practice's complaints procedure (Dutch Healthcare Quality, Complaints and Disputes Act, Wkkgz).

Autoriteit Persoonsgegevens (Dutch Data Protection Authority)