[et_pb_section fb_built=”1″ next_background_color=”#ffffff” _builder_version=”4.27.4″ _module_preset=”default” background_color=”RGBA(255,255,255,0)” background_image=”https:\/\/dekernleiden.nl\/wp-content\/uploads\/2026\/04\/ReceptiesDeKern.webp” z_index=”446″ min_height=”22vw” min_height_tablet=”22vw” min_height_phone=”22vw” min_height_last_edited=”on|phone” bottom_divider_style=”wave2″ bottom_divider_height=”30px” hover_enabled=”0″ global_colors_info=”{}” theme_builder_area=”post_content” title_text=”ReceptiesDeKern” sticky_enabled=”0″][et_pb_row _builder_version=”4.27.4″ _module_preset=”default” global_colors_info=”{}” theme_builder_area=”post_content”][et_pb_column type=”4_4″ _builder_version=”4.27.4″ _module_preset=”default” global_colors_info=”{}” theme_builder_area=”post_content”][\/et_pb_column][\/et_pb_row][\/et_pb_section][et_pb_section fb_built=”1″ _builder_version=”4.27.4″ _module_preset=”default” global_colors_info=”{}” theme_builder_area=”post_content”][et_pb_row _builder_version=”4.27.4″ _module_preset=”default” custom_padding=”||20px||false|false” global_colors_info=”{}” theme_builder_area=”post_content”][et_pb_column type=”4_4″ _builder_version=”4.27.4″ _module_preset=”default” global_colors_info=”{}” theme_builder_area=”post_content”][et_pb_text _builder_version=”4.27.4″ _module_preset=”default” text_font_size=”22px” header_font_size=”36px” text_orientation=”center” hover_enabled=”0″ header_font_size_tablet=”36px” header_font_size_phone=”36px” header_font_size_last_edited=”on|desktop” global_colors_info=”{}” theme_builder_area=”post_content” sticky_enabled=”0″]<\/p>\n
[\/et_pb_text][et_pb_text _builder_version=”4.27.4″ _module_preset=”default” theme_builder_area=”post_content” hover_enabled=”0″ sticky_enabled=”0″]<\/p>\n
Verloskundigenpraktijk de Kern, Herenstraat 7, Leiden<\/p>\n
Article 1. General<\/strong> Article 2. Definitions <\/strong><\/p>\n 1. Personal data: All data by which the client can be identified. Data concerning the health of the individual(s) involved is considered \u201cspecial personal data.\u201d <\/p>\n 2. Controller: The party responsible for processing under this privacy policy of the practice, as referred to in Article 4(7) of the General Data Protection Regulation.<\/p>\n 3. Processing: Any operation performed on personal data, whether or not by automated means, such as collection, recording, organization, storage, updating, modification, retrieval, consultation, use, disclosure by transmission, dissemination or any other form of making available, alignment, combination, as well as blocking, erasure, or destruction of personal data.<\/p>\n 4. Processor: The party that processes personal data on behalf of the midwifery practice without being subject to its direct authority, such as auxiliary personnel hired by the controller.<\/p>\n 5. Data subject: The person to whom the personal data relates, generally the patient.<\/p>\n 6. Implementing Act: The Dutch Implementing Act for the General Data Protection Regulation.<\/p>\n 7. Regulation: Regulation (EU) 2016\/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95\/46\/EC (GDPR).<\/p>\n 8. Privacy policy: This document.<\/p>\n Article 3. How do we obtain the data? <\/strong><\/p>\n Personal data comes from or is derived from information provided orally or in writing by the data subject or their legal representative. Personal data may also be provided by the health insurer, general practitioner, midwife, other practitioners, specialists, caregivers, or other persons or organizations. <\/p>\n Article 4. How and why do we process data? <\/strong><\/p>\n 1. Processing is carried out in a manner that is lawful, fair, and transparent toward the data subject. In addition, the collection of personal data occurs for specified, explicit, and legitimate purposes. <\/p>\n 2. Processing for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes is not considered incompatible with the original purposes.<\/p>\n 3. Processing is lawful only if and to the extent that at least one of the following conditions is met:<\/p>\n a. Consent of the data subject (via an actively checked consent form); <\/p>\n b. The performance of a treatment agreement; <\/p>\n c. Protecting a vital interest of the data subject, such as in emergencies; <\/p>\n d. The legitimate interests of the controller or a third party (for example, business continuity; <\/p>\n e. Necessity to comply with a legal obligation or an agreement with the data subject. <\/p>\n 4. Personal data is processed only insofar as it is adequate, relevant, and limited to what is necessary in relation to the purposes for which it is processed.<\/p>\n 5. The midwifery practice processes personal data for the following purposes:<\/p>\n a. Treatment of the data subject; <\/p>\n b. Informing and contacting the data subject(s); <\/p>\n c. Financial administration; <\/p>\n d. Proper functioning of the website and\/or registration with our practice; <\/p>\n e. Client satisfaction surveys. <\/p>\n Article 5. Conditions for consent <\/strong><\/p>\n 1. The controller must be able to demonstrate that the data subject has given consent for the processing.<\/p>\n 2. The data subject may withdraw consent at any time.<\/p>\n Article 6. Other data <\/strong><\/p>\n Anonymized data does not fall under the scope of this privacy policy.<\/p>\n Article 7. What data is involved? <\/strong><\/p>\n Processing may relate to the following categories of data:<\/p>\n a. Name, first names, initials, title, gender, date of birth, address, postal code, city, telephone number, email address, and similar data required for communication, as well as payment details of the data subject; <\/p>\n b. An administrative number linked to the treatment file of the data subject; <\/p>\n c. The personal consent statement for the use, processing, and disclosure of personal data; <\/p>\n d. Data as referred to under (a) of practitioners who are informed about the well-being and health of the data subject; <\/p>\n e. Information regarding the relevant medical and obstetric history of the data subject, including data taken over with consent from a co-practitioner (such as general practitioner, youth health service, maternity care, gynecologist, or midwife); <\/p>\n f. In the case of hereditary conditions, medical data of family members; <\/p>\n g. Other special personal data necessary for the proper treatment of the data subject, such as date of birth; <\/p>\n h. Information about the nature of the treatment, the diagnosis, the outcome and\/or advice regarding follow-up treatment (such as data in the context of horizontal and vertical referrals) of the data subject, as well as the provided treatment report; <\/p>\n i. Data for quality monitoring and follow-up of treatment in the context of the Population Screening Act (counseling data and prenatal screening); <\/p>\n j. Information for calculating, recording, and collecting payment for the treatment; <\/p>\n k. Information about the data subject\u2019s insurance, including the insurance number and Citizen Service Number (BSN); <\/p>\n l. Complaints and comments about the treatment of the data subject; <\/p>\n m. Other data that is strictly necessary for proper treatment and handling of the treatment. <\/p>\n Article 8. Information obligation <\/strong><\/p>\n 1. Before the controller processes personal data, it informs the data subject and\/or their legal representative of:<\/p>\n a. Who is responsible for the processing, including contact details; <\/p>\n b. Why specific personal data will be processed; <\/p>\n c. If applicable, the contact details of the data protection officer; <\/p>\n d. How the personal data will be processed; <\/p>\n e. The period during which the personal data will be stored, or, if not possible, the criteria for determining that period; <\/p>\n f. All other information that must be provided in the interest of fairness. This also means: the more sensitive the personal data the controller wishes to process, the more thoroughly the information must be provided. <\/p>\n 2. If personal data is requested from or provided to a third party, the information obligation is fulfilled in the same way before the data is obtained or provided, unless this would require a disproportionate effort.<\/p>\n Article 9. Right of access <\/strong><\/p>\n 1. The data subject has the right to access their personal data and may request the following:<\/p>\n a. A description of the purpose(s) of the processing of personal data; <\/p>\n b. All available information about the origin of the personal data; <\/p>\n c. The categories of data to which the processing relates; <\/p>\n d. An overview of recipients or categories of recipients who have received the personal data; <\/p>\n e. If possible, the period during which the personal data is expected to be stored, or the criteria for determining that period if not possible; <\/p>\n f. That the data subject has the right to rectification, erasure, and restriction of processing. <\/p>\n 2. A request for access may be refused for the following reasons:<\/p>\n a. The requester is not the data subject or the request does not relate solely to data concerning the requester; <\/p>\n b. The requester has not yet reached the age of 16 and\/or is under guardianship. In that case, only the legal representative may make the request; <\/p>\n c. The controller has recently responded to a similar request from the same requester; <\/p>\n d. Protection of the data subject or the rights and freedoms of others; <\/p>\n e. Reasons of state security and\/or the prevention, investigation, and prosecution of criminal offenses. <\/p>\n Article 10. Other rights <\/strong><\/p>\n 1. The data subject has the right at any time to object to the processing of personal data concerning them. Upon objection, the controller will cease processing. <\/p>\n 2. The data subject has the right to obtain immediate rectification of inaccurate personal data from the controller.<\/p>\n 3. The data subject has the right to obtain erasure of personal data concerning them from the controller without undue delay.<\/p>\n In addition, the controller is obliged to erase data without undue delay when the data subject has withdrawn consent or when the controller no longer needs the personal data for the purposes for which it was collected.<\/p>\n 4. The data subject has the right to obtain restriction of processing from the controller if they contest the accuracy of the personal data.<\/p>\n 5. The data subject has the right to receive the personal data they provided to the controller in a structured, commonly used, and machine-readable format.<\/p>\n Article 11. Exercising rights by the data subject <\/strong><\/p>\n The controller takes appropriate measures to ensure that the data subject receives the communication or information regarding the rights described in this privacy policy in a concise, transparent, and accessible manner, using clear and plain language.<\/p>\n Article 12. Access to and recipients of personal data <\/strong><\/p>\n 1. In principle, only those directly involved in the execution of the data subject\u2019s treatment have access to personal data, to the extent necessary for their duties.<\/p>\n 2. Software suppliers without a data processing agreement do not have access to personal data themselves and do not place cookies in their programs.<\/p>\n 3. When processing is carried out on behalf of the controller, the controller only uses processors who provide sufficient guarantees that the personal data will be processed in accordance with the Regulation, the Implementing Act, or related regulations.<\/p>\n 4. In addition, access may be granted or personal data may be provided to the following persons and organizations:<\/p>\n a. Researchers as referred to in Article 7:458 of the Dutch Civil Code; <\/p>\n b. Health insurers, insofar as necessary for obligations under the insurance contract; <\/p>\n c. Third parties tasked with debt collection, insofar as access\/disclosure is necessary and does not concern medical data; <\/p>\n d. Others, when the basis for processing is: <\/p>\n (i) Consent of the data subject;<\/p>\n (ii) Necessity to comply with a legal obligation;<\/p>\n (iii) Protection of a vital interest of the data subject.<\/p>\n e. Others, when further processing is for historical, statistical, or scientific purposes, provided the controller has taken the necessary measures to ensure that further processing is carried out solely for these purposes. <\/p>\n Article 13. Processing register <\/strong><\/p>\n The controller maintains a register of processing activities carried out under its responsibility. This register contains the following information: <\/p>\n a. The name and contact details of the controller and the data protection officer; <\/p>\n b. The purposes of the processing; <\/p>\n c. The categories of data to which the processing relates; <\/p>\n d. The categories of recipients to whom personal data is disclosed; <\/p>\n e. The intended period for erasure of the personal data; <\/p>\n e. The intended period for erasure of the personal data; <\/p>\n Article 14. Breach notification <\/strong><\/p>\n 1. In the event of a personal data breach, the controller will notify the data subject and the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) as soon as possible after becoming aware of it, if and to the extent legally required.<\/p>\n The notification referred to in paragraph 1 must include at least:<\/p>\n a. The nature of the breach; <\/p>\n b. The likely consequences of the breach; <\/p>\n c. The measures taken by the controller as a result of the breach; <\/p>\n d. A contact point for more information. <\/p>\n Article 15. Retention periods <\/strong><\/p>\n 1. Medical data obtained for entering into or fulfilling a treatment agreement will be retained for 20 years. The controller is not required to retain data longer than mandated by law, in particular Article 7:454(3) of the Dutch Civil Code. <\/p>\n 2. Other personal data will not be kept longer than necessary for the purposes for which it was processed. When the data is no longer needed, it will be deleted. <\/p>\n Article 16. Confidentiality <\/strong><\/p>\n 1. The controller, the processor, and anyone under the authority of the controller who has access to personal data is obliged to keep the personal data confidential.<\/p>\n 2. Anyone who processes special personal data is subject to a duty of confidentiality. This arises from their office, profession, or employment contract. <\/p>\n Article 17. Security <\/strong><\/p>\n 1. The controller must implement appropriate technical and organizational measures to secure personal data.<\/p>\n 2. \u201cAppropriate\u201d means that the security measures are appropriate to the risk of careless or unlawful further processing of the personal data and the potential damage that could result. The measures must ensure that: <\/p>\n a. Only authorized persons have access to personal data; <\/p>\n b. The personal data is accurate and not lost; <\/p>\n c. The personal data is available without hindrance for lawful processing in accordance with the agreements within the organization. <\/p>\n 3. In all cases, the controller is responsible for the information security policy and promotes this policy within the practice.<\/p>\n Article 18. Final provisions <\/strong><\/p>\n 1. The controller does not accept any more obligations than those required by law, unless otherwise agreed in writing with the data subject.<\/p>\n 2. The data subject has the right to file a complaint with the supervisory authority.<\/p>\n 3. Changes to this privacy policy are made by the controller. The changes take effect with respect to the data subject(s) after they have been informed of the changes. <\/p>\n 4. This privacy policy entered into force on May 1, 2018, and can be viewed on the website of Verloskundigenpraktijk De Kern: dekernleiden.nl.<\/p>\n
The midwifery practice ensures that (special) personal data of clients is handled with care. We comply with applicable laws and regulations, including the General Data Protection Regulation (GDPR). This privacy policy provides you with more detailed information about our policy. <\/p>\n