Privacy Policy

Privacy statement

This Privacy Statement applies to all personal data processed by CDC Complete Dental Care. 

We believe it's important to handle the personal data entrusted to us in a transparent and responsible manner. We therefore process your personal data with care and in accordance with the General Data Protection Regulation (GDPR) and its implementing legislation.

In this Privacy Statement, we explain how we handle your personal data and what rights you have. We recommend that you read this Privacy Statement carefully and keep a copy for your records.

 I. PATIENT DATA

What personal data do we process?

If you come to us for an initial consultation or treatment, we will process your personal data. We will ask you to provide various information, such as your name and address, email address, telephone number, date of birth, health insurance information, and medical information. We also ask for your ID and your citizen service number (BSN). This information is necessary to identify you and verify your identity. We do not keep a copy of your ID.

We process your personal data in your patient file. Your dental and other health data, which are necessary for safe and responsible healthcare, are also processed in your patient file. Diagnoses, test results (including photographs and laboratory results), treatment plans, and medication use are all included in your patient file.

 

For what purpose and basis do we process personal data?

Providing dental care

We are legally required to maintain a patient file (dental file) for you. We process this information to provide proper (dental) care and treatment and to fulfill the treatment agreement we have with you.

The legal basis for this processing is: necessary for the performance of the treatment agreement concluded between us and to comply with our legal obligations.

 

General contact in the context of the treatment agreement

We may use your name, email address, and/or telephone number to make appointments, send appointment reminders, provide you with information you request, or handle your question and/or complaint.

The legal basis for this processing is: necessary for the performance of the treatment agreement concluded between us.

 

Billing for the (dental) care provided

In our patient administration, we process your name and address, citizen service number (BSN), dental and health data, health insurance information, bank and payment information, invoice information, and any other data necessary for our administration. We use this information to invoice our (dental) care, to submit claims for (dental) care to your health insurer (if relevant), and to perform other administrative tasks required under the treatment agreement concluded with you. For invoicing, we may use a factoring company with whom we have a data processing agreement for the processing of your personal data.

The legal basis for this processing is: necessary for the performance of the agreement concluded between us and to comply with our legal obligations.

Quality of systems, care provision and complaint handling

To ensure the quality of our systems and processes, we have implemented certain checks and activities that sometimes require us to collect random samples of personal data to perform these process and system checks and to keep our systems and processes up-to-date and correctly configured. We will not process more data than necessary. Where possible, data is also pseudonymized or anonymized so that it cannot be (directly) traced back to individual persons.

To improve our care, we may also use anonymized data from our patient files. We also conduct patient satisfaction and experience surveys for internal quality improvement. You are free to choose whether or not to participate in this.

If you submit a complaint (about our healthcare), this complaint can be handled by an internal complaints officer within the organization.

The legal basis for this processing is: necessary for the performance of the treatment agreement concluded between us and for the pursuit of our legitimate interest in the field of system, process and care quality monitoring and improvement.

Camera images

For your and our safety, camera footage may be recorded at the entrance and/or inside the building. This footage will be retained for a maximum of four weeks. If an incident is reported within the four-week retention period, the footage will be retained until the incident has been resolved.

The legal basis for this processing is: necessary for the purposes of our legitimate interest in security.

II. APPLICANTS AND SELF-EMPLOYED WORKERS

What personal data do we process and for what purpose and on what basis?

If you apply for a job with us or contact us to work for us as a self-employed person, we may process the following (personal) data: first and last name, address, email address, telephone number, date of birth, work experience, education level and motivation, additional information included in your CV, any results of tests and assessments you have taken, diplomas and certificates of education/training, and, if necessary, a Certificate of Good Conduct (VOG).

Recruitment and selection

We process the aforementioned data for the purposes of our recruitment and selection activities, including, where applicable, administering tests and assessments. Reference checks and/or other investigations using personal data may be part of the recruitment and selection process. The data, information, and results of tests, assessments, and/or other investigations may also be used to determine whether and which additional training and education are required for the applicant or self-employed person.

The legal basis for this processing is: necessary for the pursuit of our legitimate interest in the field of recruitment and selection.

Employment contract/self-employed person agreement

If an agreement is reached with the employee/self-employed person, the employment contract or assignment agreement will separately specify how we handle the privacy and personal data of the employees/self-employed persons.

In that case, the processing is necessary for the performance of the agreement with the employee or self-employed person.

III. MARKETING AND GENERAL CONTACT

What personal data do we process and for what purpose and on what basis?

Use and improvement of our website

When you visit our website, we may process technical data such as your device's IP address, the web page you visited, and the duration of your visit or session. This is done to manage and improve the functionality and availability of our website and to resolve any issues. To ensure you can find information on our website quickly and easily, we use cookies. For more information, please refer to our Cookie Statement on our website.

The legal basis for this processing is: necessary for the pursuit of our legitimate interest in improving the website. 

General contact

We may use your name, email address and/or telephone number to provide you with the information you request or to handle complaints or other requests.

The legal basis for this processing is: necessary for the pursuit of our legitimate interest in contacting clients. 

IV. GENERAL INFORMATION

Retention periods

We will not process your personal data for longer than is necessary for the purpose for which it is processed. If we no longer need to retain your personal data, we will destroy and/or anonymize your personal data, unless we are (i) required to retain certain personal data for a longer period by law (for example, under tax law) or (ii) required to provide evidence (for example, in the area of ​​email marketing). In which case, only your personal data that is specifically necessary for that purpose will be retained for the applicable retention period.

Your (personal) data in your patient file is subject to a specific (legal) retention period of at least 20 years. This period begins when the last change is made to the file. Data may also be retained beyond this period, for example, if there is a reason to do so based on the proper care for you or a legal obligation.

Is your data safe with us? 

The security of your personal data, including health-related data in particular, is our top priority. We implement appropriate technical and organizational measures to secure your personal data and protect it against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access, or against any other unlawful or unauthorized processing of such personal data. These measures, taking into account the state of the art and the costs of implementation, ensure an appropriate level of security in light of the risks presented by the processing and the nature of the data to be processed.

To prevent unauthorized access or disclosure of your information, maintain data accuracy, and ensure the correct use of information, we have put in place appropriate physical, electronic, and managerial procedures to safeguard and secure the information we collect. 

The processing of health data complies with the security guidelines included in ISO 27001 and NEN 7510

The personal data will only be processed within the European Economic Area (EEA).

Provision to third parties 

We do not provide your personal data to third parties, unless the situations mentioned below apply or you have given your express permission:

• Healthcare providers who are directly involved in your treatment may be given access to your personal data to the extent necessary to provide good care;
• Healthcare providers who replace your treating healthcare provider (for example due to illness or vacation) may have access to your personal data if this is necessary for the performance of their duties;
• if we refer you to another dentist or healthcare provider, we will provide the personal data relevant to the referral;
• We may provide personal data to your health insurer to request authorizations for treatments and to declare the care we provide (if you have insurance);
• if there is a legal obligation to do so or an order from a competent supervisory authority, we may provide personal data to competent (supervisory) authorities and bodies;
• We may also provide personal data to administrative offices, factoring companies (for invoicing our services), our holding company, Clinias Dental Group BV (for the provision of support services), hosting providers, technical suppliers, facility companies, suppliers of needlestick injuries services, and other suppliers who provide services to us. These suppliers (so-called "processors") process the personal data solely on our behalf. We have concluded a processing agreement with the processors in which the processor is obligated to comply with all obligations under the GDPR and this Privacy Statement. For questions about these processors, please contact us via info@cdctandzorg.nl.

What are your rights? 

You can at any time via info@cdctandzorg.nl Submit a request to access, obtain, correct, or restrict your personal data. We will always process your request without delay and inform you, in any case within one month of receipt of the request, of the action taken on it. If we cannot grant your request, we will always explain why.

If we grant your request to obtain your personal data, we will make the personal data available to you or to a third party designated by you in a standard format determined by us.

If you wish to withdraw your consent for the processing of personal data or object to the (further) processing of your personal data, you can also contact us via info@cdctandzorg.nl. We will process this request without delay, in any case within one month, and delete the relevant personal data, unless we are required to retain the relevant personal data longer on the basis of compelling legitimate grounds or a legal obligation. In that case, we will inform you of this and justify our decision.

If you have complaints about the way in which we process your personal data or handle your requests, you can contact us via info@cdctandzorg.nl. If this does not lead to a solution, you may exercise your right to lodge a complaint with the Dutch Data Protection Authority (www.autoriteitpersoonsgegevens.nl) or appeal to the competent court. 

How do we keep you informed of changes? 

We reserve the right to make changes to this statement. This privacy statement was last modified on August 31, 2022.