Skip to main content
AndersGGZ
Privacy and data

Privacy statement

At AndersGGZ you turn to us with sensitive matters. That's why we want to be clear about how we handle your personal and health data, on what basis we process it, with whom we share it and what rights you have.

Draft text. This privacy statement is an initial draft, drawn up based on the practice details and the common requirements for a mental health institution. Have it checked legally and by the Data Protection Officer and fill in the parts marked [...] before publication.

01

Who is responsible for your data?

AndersGGZ.nl Zorg en Welzijn B.V. is the controller for the processing of your personal data. We are a transcultural, culturally sensitive mental health institution with locations in Eindhoven (Kerkakkerstraat 15) and Den Bosch (Koenendelseweg 9), and also online.

You can reach us via 085 080 50 47 or info@andersggz.nl. Our Chamber of Commerce number is 92023789 and our AGB code is 22221945.

02

Which data we process

To treat you well and to bill for care, we process, among other things:

  • Name, address, place of residence, date of birth, gender and your citizen service number (BSN).
  • Contact details such as phone number and email address.
  • Information about your insurance and the details of your referrer (such as your GP).
  • Health data: these are special category personal data. Think of your symptoms, your diagnosis, your treatment plan, records of conversations and correspondence about your treatment.
  • Data needed for billing and invoicing of care.
03

For what purpose and on what basis

We only process your data for clear purposes, with a legal basis:

  • Carrying out your treatment on the basis of the treatment agreement and our legal obligations under the Medical Treatment Agreement Act (WGBO).
  • Processing your health data (special category personal data) takes place on the basis of the healthcare exception in the GDPR and the WGBO.
  • Billing care to your health insurer, on the basis of legal obligations.
  • Complying with legal retention and accountability obligations.
  • Where necessary we ask for your explicit consent, for example to share information with your GP or referrer. You can always withdraw that consent.
04

With whom we share data

We don't share your data lightly. Sharing only happens when it's necessary for your care or when we are legally obliged to:

  • Your health insurer, for billing care.
  • Your GP or referrer, with your consent.
  • Chain partners involved in your treatment, only insofar as necessary and with the right agreements.
  • Processors who process data on our behalf (for example for our electronic patient record); we conclude a processing agreement with them.
  • Supervisory bodies such as the Dutch Healthcare Authority (NZa), when the law requires it.
05

How long we keep your data

We don't keep your data longer than necessary. For your medical record, the WGBO sets a statutory retention period of 20 years, counted from the last change in your record, or as much longer as is reasonably necessary for good care.

For financial and administrative data, the statutory tax retention periods apply. [Specify other retention periods and have them confirmed by a lawyer/DPO.]

06

How we secure your data

We take appropriate technical and organisational measures to protect your data against loss and unauthorised access. Only staff involved in your care have access to your record, and they are bound by professional confidentiality.

07

Your rights

Under the GDPR you have various rights regarding your data:

  • Right of access to your data.
  • Right to correction of incorrect data.
  • Right to erasure, insofar as no statutory retention obligation applies.
  • Right to restriction of processing and right to object.
  • Right to transfer of your data (data portability).
  • Right to withdraw previously given consent.
08

Submitting a request or question

Would you like to exercise one of these rights or do you have a question about your privacy? Then contact us via info@andersggz.nl or 085 080 50 47. To verify your identity, we may ask you for additional information.

Our Data Protection Officer (DPO) can be reached via [fill in name and contact details of DPO / confirm whether a DPO has been appointed].

09

Not satisfied about your privacy?

Do you disagree with how we handle your data? Let us know first, then we'll look for a solution together. You can also submit a complaint about a privacy matter via our complaints procedure.

In addition, you always have the right to lodge a complaint with the Dutch Data Protection Authority.

10

Reviews and experiences

If you leave an experience on our website, we process the name you choose yourself (or "anonymous") and the text of your review. We do not ask for an email address. Your review only appears online after we have checked and approved it.

  • Legal basis: your consent, which you give when submitting.
  • We only show the display name you choose; if you post anonymously, we show no name.
  • Please avoid medical details or the names of practitioners — your review is public.
  • You can always ask us to amend or remove your review via info@andersggz.nl.
  • For storage we use a database provider (processor) within the EU.
11

Changes to this statement

We may adjust this privacy statement from time to time. You'll always find the most current version on this page.

Last updated: [fill in date at publication] · Version: draft