PRIVACY & COOKIE POLICY 

Article 1. General

Institut Marie ensures that patient (special) personal data is handled with care. We adhere to applicable laws and regulations, including the General Data Protection Regulation (GDPR). This Privacy Regulation aims to inform you about our policy.

Article 2. Definitions

For clarity, we briefly explain what we mean by certain terms:

  • Personal Data: All data through which the patient can be identified.
  • Controller: The data controller, as defined in Article 4(7) of the Regulation. For this privacy regulation, it refers to the dental practice.
  • Processing: Any operation or set of operations performed on personal data, whether automated or not, such as collecting, recording, organizing, storing, updating, altering, retrieving, consulting, using, transmitting, disseminating, or otherwise making available, combining, linking, as well as shielding, erasing, or destroying personal data.
  • Processor: The party responsible for processing personal data on behalf of the dental practice without being subject to its direct authority, such as assistants hired by the Controller.
  • Data Subject: The individual to whom the personal data pertains, generally the patient.
  • Implementation Act: The Implementation Act of the General Data Protection Regulation.
  • Regulation: Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons regarding the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC (OJ EU 2016, L 119).
  • Privacy Regulation: This document.
  • Pseudonymized Data: Personal data that cannot be linked to a specific data subject without the use of additional information. This additional information is stored separately to prevent linkage to an identifiable person.

Article 3. How do we obtain the data?

Personal data is derived from information provided orally and in writing by the Data Subject or their legal representative. Personal data may also be provided by the health insurer, general practitioner, other healthcare providers, specialists, helpers, or other persons or entities not previously mentioned.

Article 4. How and why do we process data?

  1. Processing is carried out lawfully, fairly, and transparently concerning the Data Subject. Additionally, the collection of personal data is for specific, explicitly stated, and legitimate purposes. Processing is not done in a manner incompatible with these purposes.
  2. Processing for archiving in the public interest, scientific or historical research, or statistical purposes is not considered incompatible with the original purposes.
  3. Processing is lawful only if at least one of the following conditions is met: a. Consent of the Data Subject; b. The conclusion and execution of a treatment (agreement); c. Safeguarding a vital interest of the Data Subject, such as emergencies; d. Serving a legitimate interest of the Controller or a third party (e.g., business continuity); e. Necessity to comply with a legal obligation or agreement with the Data Subject.
  4. Personal data is processed only to the extent that it is adequate, relevant, and limited to what is necessary for the purposes for which it is processed.
  5. The dental practice processes personal data for the following purposes: a. Treatment of the Data Subject; b. Informing and contacting Data Subject(s); c. Financial administration; d. Proper functioning of the website.

Article 5. Conditions for consent

  1. The Controller can demonstrate that the Data Subject has given consent for processing.
  2. The Data Subject may withdraw consent at any time.

Article 6. Other data

Anonymized data is not subject to this Privacy Regulation.

Article 7. What data is involved?

Processing may concern the following categories of data: a. Name, first names, initials, title, gender, date of birth, address, postal code, place of residence, phone number, and similar data necessary for communication, as well as payment data of the Data Subject; b. An administration number that contains no other information than under a; c. Data as referred to under a, of the parents, guardians, or caretakers of minor Data Subjects; d. Data as referred to under a of the family members of the Data Subject as well as others who are informed about the welfare and health of the Data Subject; e. Information about the health condition of the Data Subject and, in the case of hereditary diseases, their family members; f. Other special personal data for the proper treatment or care of the Data Subject; g. Information about the treatment followed and to be followed by the Data Subject as well as the provided medications or facilities; h. Information about the calculation, recording, and collection of the fee; i. Information about the insurance of the Data Subject; j. Other data necessary for the treatment.

Article 8. Information Obligation

  1. Before the Controller processes personal data, they must inform the Data Subject and/or their legal representative of: a. Who is responsible for the processing with contact details; b. Why certain specific personal data will be processed; c. If applicable, the contact details of the data protection officer; d. How the personal data will be processed; e. The period during which the personal data will be stored, or if that is not possible, the criteria for determining that period; f. Any other information that must be provided for the sake of due care. This means: The more sensitive the personal data that the Controller wants to process, the more thoroughly they must be informed.
  2. If personal data is obtained from a third party or provided to a third party, the information obligation is fulfilled in the same way before the personal data is obtained or provided unless this can only be done with disproportionate effort.

Article 9. Right of Access

  1. The Data Subject has the right to access their personal data and may request the following information: a. A description of the purpose or purposes of the processing of personal data; b. All available information regarding the origin of the personal data; c. The categories of data to which the processing relates; d. A list of recipients or categories of recipients who have received the personal data; e. If possible, the period during which the personal data is expected to be stored, or if that is not possible, the criteria to determine that period; f. That the Data Subject has the right to rectification, the right to erasure, and the right to restrict processing.
  2. A request for access may be denied for the following reasons: a. The requester is not the Data Subject, or their request does not relate to data solely about them; b. The requester is under 16 years of age and/or is under guardianship. In that case, only the legal representative can make the request; c. The Controller has recently responded to a similar request from the same requester; d. Protection of the Data Subject or the rights and freedoms of others; e. For reasons of state security, and/or the prevention, detection, and prosecution of criminal offenses.

Article 10. Other Rights

  1. The Data Subject has the right to object to the processing of their personal data at any time. Upon objection, the Controller will cease processing.
  2. The Data Subject has the right to obtain from the Controller the rectification of incorrect personal data concerning them without undue delay.
  3. The Data Subject has the right to obtain the erasure of personal data concerning them from the Controller without undue delay. Furthermore, the Controller is obliged to erase data without undue delay when the Data Subject has withdrawn their consent, or the Controller no longer needs the personal data for the purposes for which it was collected.
  4. If the Data Subject disputes the accuracy of the personal data, they have the right to obtain a restriction of processing from the Controller.
  5. The Data Subject has the right to receive the personal data concerning them, which they have provided to the Controller, in a structured, commonly used, and machine-readable format.

Article 11. Exercise of Rights by the Data Subject

The Controller takes appropriate measures to ensure that the Data Subject receives communication or information regarding their rights as described in this Privacy Regulation in a concise, transparent, and accessible manner, and in clear language.

Article 12. Access to and Recipients of Personal Data

  1. In principle, only those directly involved in the execution of the Data Subject’s treatment have access to personal data, to the extent that access is necessary for their work.
  2. When processing is carried out on behalf of the Controller, the Controller only uses processors who provide sufficient guarantees that personal data is processed in accordance with the Regulation, the Implementation Act, or regulations based on it.
  3. Access may be granted/provided to the following persons and entities: a. Researchers as referred to in Article 7:458 of the Dutch Civil Code; b. Health insurers as far as necessary for fulfilling obligations under the insurance agreement; c. Third parties responsible for collecting debts as far as access/provision is necessary and does not involve medical data; d. Others when the basis of the processed data is: (i) Consent of the Data Subject; (ii) A necessity to comply with a legal obligation; (iii) Safeguarding a vital interest of the Data Subject. e. Others, when further processing is for historical, statistical, or scientific purposes, if the Controller has taken necessary measures to ensure that further processing is exclusively for these purposes.

Article 13. Register

The Controller keeps a register of processing activities under its responsibility. This register contains the following information: a. The name and contact details of the Controller and, if applicable, the data protection officer; b. The processing purposes; c. The categories of data to which the processing relates; d. The categories of recipients to whom personal data is provided; e. If possible, the envisaged storage periods; f. If possible, a general description of the technical and organizational security measures.

Article 14. Incident Reporting

  1. If an incident has occurred with personal data that may result in a risk to the rights and freedoms of natural persons, the Controller must, without undue delay, report the incident to the Dutch Data Protection Authority and, if necessary, to the Data Subject.
  2. The Controller keeps a record of all incidents concerning personal data.

Article 15. Automated Decision-Making

The Controller does not use automated decision-making concerning the Data Subject without human intervention.

Article 16. Data Security

The Controller takes appropriate technical and organizational measures to protect personal data against loss or unlawful processing. In assessing the appropriate level of security, the Controller considers the risks that the processing entails.

Article 17. Retention Periods

  1. Personal data is not stored longer than necessary for the purposes for which it is processed.
  2. The Controller determines the retention periods in accordance with applicable laws and regulations.

Article 18. Final Provisions

  1. This Privacy Regulation may be updated or supplemented with new provisions. Changes will be communicated to the Data Subject.
  2. This Privacy Regulation is governed by Dutch law.
  3. Disputes arising from this Privacy Regulation will be submitted to the competent court in the Netherlands.

For questions or to exercise the rights of the Data Subject, you can contact us via:
Instituut Marie
Reinwardtstraat 350
1093 LA Amsterdam
info@instituutmarie.nl
Phone number: +31 20 4882488