Dental practice name: Besth Dental Practice Email address: service@besth.nl

Article 1. General

Besth Dental Practice ensures that (special) Personal Data of patients is handled with care. We comply with applicable laws and regulations, including the General Data Protection Regulation. With this Privacy Policy we want to inform you in more detail about our policy.

Article 2. Definitions

For clarity, we briefly state what we mean by certain terms:

Personal data: any data by means of which the patient can be identified. Controller: the controller, as referred to in Article 4(7) of the Regulation. For this privacy regulation the dental practice. Processing/Processing: a processing of personal data, whether or not carried out by automated means, such as the collection, recording, organization, storage, updating, modification, retrieval, consultation, use, provision by means of transmission, dissemination or any other form of making available, bringing together, linking, as well as blocking, erasure or destruction of Personal Data. Processor: the person who takes care of the Processing of Personal Data on behalf of the dental practice, without being subject to its direct authority, such as auxiliary persons hired by the Controller. Data Subject: the person to whom the Personal Data relates, generally the patient. Implementation Act: the General Data Protection Regulation Implementation Act. Regulation: Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (OJEU 2016, L 119). Privacy regulations: this document. Pseudonomized data: Personal data that can no longer be linked to a specific data subject without the use of additional data. This additional data is kept in such a way that it cannot be linked to an identifiable person.

Article 3. How do we get the data?

Personal Data are derived or derived from data provided orally and in writing by the Data Subject or the Data Subject’s legal representative. Personal Data may additionally be provided by the health insurance company, the general practitioner, other practitioners, specialists, social workers or other persons or bodies other than the aforementioned.

Article 4. How and why do we process data?

Processing is done in a manner that is lawful, proper and transparent with respect to the Data Subject. In addition, the collection of Personal Data is done for specified, explicit and legitimate purposes. The Processing shall not be carried out in a manner incompatible with those purposes. Processing for archiving in the public interest, scientific or historical research or statistical purposes is not considered incompatible with the original purposes. The Processing is lawful only if and to the extent that at least one of the following conditions is met: Consent of the Data Subject; Entering into and performing a treatment (agreement); Safeguarding a vital interest of the Data Subject, such as emergency; Serving a legitimate interest of the Controller or a third party (e.g. business continuity); Necessity to fulfill a legal obligation or an agreement with the Data Subject. Personal Data shall only be Processed insofar as they are adequate, relevant and limited to what is necessary in view of the purposes for which they are Processed. The dental practice processes Personal Data for the following purposes: Treatment of the Data Subject; Informing and contacting the Data Subject(s); Financial administration; Proper operation of the website. Conducting patient satisfaction surveys.

Article 5. Conditions of consent

The Controller may prove that the Data Subject has given consent to the Processing. The Data Subject may withdraw a given consent at any time.

Article 6. Other data

Anonymized data does not fall within the scope of this Privacy Policy.

Article 7. What data is involved?

Processing may refer to the following data categories:

Name, first names, initials, title, gender, date of birth, address, zip code, place of residence, telephone number and similar data necessary for communication, as well as payment data of the Data Subject; An administration number that does not contain any information other than under a; Data as referred to under a, of the parents, guardians or caretakers of minor Data Subjects; Data as referred to under a, of the family or relatives of the Data Subject as well as others who are informed about the wellbeing and health of the Data Subject; Information regarding the Involved Person’s state of health and, in the case of hereditary conditions, his/her family and relatives; Other special Personal Data with a view to the proper treatment or care of the Involved Person; Information regarding the treatment followed and to be followed by the Involved Person as well as the medications or provisions provided; Information regarding the calculation, recording and collection of the fee; Information regarding the Involved Person’s insurance; Other data necessary for the treatment.

Article 8. Duty to inform

Before Processing Personal Data, the Responsible Party shall inform the Data Subject and/or the Data Subject’s legal representative of: Who is responsible for the processing with contact details; Why certain, concrete Personal Data will be Processed; If applicable, the contact details of the Data Protection Officer; In what manner the Personal Data will be Processed; The period for which the Personal Data will be stored, or, if that is not possible, the criteria for determining that period; Any other information that must be provided for the sake of due diligence. This also means: The more sensitive the Personal Data that the Controller intends to Process, the more thorough information must be provided. If Personal Data is requested through a third party, or is provided to a third party, then the duty to inform is fulfilled in the same way, before the Personal Data is obtained or provided, unless this can only be done with disproportionate effort.

Article 9. Right of access

The Data Subject has the right to access his Personal Data and may request the following information: A description of the purpose or purposes of the Processing of Personal Data; Any available information regarding the origin of the Personal Data; The categories of data to which the Processing relates; A list of recipients or categories of recipients who have received the Personal Data; If possible, the period for which the Personal Data is expected to be stored, or if that is not possible, the criteria for determining that period; That the Data Subject has the right to rectification, the right to data erasure and the right to restriction of processing. A request for access may be rejected for the following reasons: The requester is not a Data Subject or his/her request does not concern data relating to the requester only; The requester has not yet reached the age of 16 years and/or is under guardianship. In this case, only the legal representative can make the request; Respondent has already recently complied with a similar request from the same requester; Protection of the Data Subject or the rights and freedoms of others; Because of State security, and/or the prevention, detection and prosecution of criminal offenses.

Article 10. Other rights

The Data Subject has the right to object at any time to the Processing of Personal Data concerning him/her. In the event of an objection, the Processing shall be discontinued by the Controller.
The Data Subject has the right to obtain from the Controller without delay rectification of Personal Data concerning him that are inaccurate.
The Data Subject shall have the right to obtain from the Controller the erasure of Personal Data concerning him without unreasonable delay.
In addition, the Controller is obliged to delete data without unreasonable delay when the Data Subject has withdrawn his consent or the Controller no longer needs the Personal Data for the purposes for which it was collected.

If the accuracy of the Personal Data is disputed by the Data Subject, the Data Subject has the right to obtain from the Controller a restriction of the Processing.
The Data Subject shall have the right to obtain the Personal Data concerning him that he has provided to the Controller in a structured, common and machine-readable form.

Article 11. The exercise of rights by Data Subject

The Controller shall take appropriate measures so that the Data Subject receives the communication or information regarding the rights described in these Privacy Rules in a concise, transparent and accessible manner and in clear terms.

Article 12. Access to and recipients of Personal Data.

Access to Personal Data shall in principle only have those directly involved in carrying out the treatment of the Data Subject to the extent that such access is necessary for their work.
When a Processing is carried out on behalf of the Controller, the Controller shall only use Processors who provide adequate guarantees that the Personal Data will be Processed in accordance with the Regulation, the Implementing Act or regulations based thereon.
Otherwise, access/Personal Data may be granted to the following individuals and entities:

• Investigators referred to in Article 7:458 of the Civil Code;
• Health insurers to the extent necessary for the purposes of the obligations under the insurance contract;
• Third parties in charge of debt collection to the extent that access/disclosure is necessary and does not involve medical data;
• Others, when the basis of the Data Processed is:
  • (i) Consent of the Data Subject;
  • (ii) A need to fulfill a legal obligation;
  • (iii) Safeguarding a vital interest of the Data Subject.
• Others, where further Processing is for historical, statistical or scientific purposes, if the Controller has taken the necessary measures to ensure that further Processing is carried out only for these purposes.

Article 13. Register

The Responsible Party shall keep a register of the processing activities carried out under its responsibility. This register shall contain the following information:

• The name and contact information of the Controller and, if applicable, the Data Protection Officer;
• The processing purposes;
• The categories of data covered by the Processing;
• The categories of recipients to whom Personal Data is provided;
• If possible, the intended time period within which the Personal Data should be deleted;
• If possible, a description of the technical and organizational measures taken.

Article 14. Notification of breach

If a Personal Data breach has occurred, the Controller shall -if and to the extent required by law- communicate this to the Data Subject and the Personal Data Authority as soon as possible after becoming aware of it.
The notification referred to in the first paragraph shall include at least:

• The nature of the breach;
• The likely consequences of the breach;
• The measures taken by the Respondent as a result of the breach;
• A point of contact for more information.

Article 15. Retention periods

Medical data obtained to enter into or fulfill a treatment agreement shall be kept for 15 years. The Respondent is not bound to longer retention periods than required by law, in particular article 7:454 paragraph 3 of the Civil Code.
Other Personal Data will not be kept longer than necessary for the purposes for which it was Processed. If such Personal Data is no longer needed, it will be deleted.

Article 16. Secrecy

The Responsible Party, the Processor and anyone who has access to Personal Data under the authority of the Responsible Party are obliged to maintain the confidentiality of the Personal Data.
Data relating to the health of Data Subject(s) are considered ‘special Personal Data’. The Processing of special Personal Data is subject to a duty of confidentiality on the part of anyone processing it. This arises from that person’s office, profession or employment contract.

Article 17. Security

The Controller must ensure appropriate technical and organizational measures to secure Personal Data.
‘Appropriate’ means that the security measures taken are appropriate to the risk of the Personal Data being (further) Processed carelessly or unlawfully and the damage that would result. The measures taken must ensure that:

• Only authorized individuals have access to Personal Data;
• The Personal Data is accurate and not lost;
• The Personal Data is available without hindrance for lawful Processing according to the arrangements within the organization.
  In all cases, the Responsible Party shall ensure the information security policy and shall propagate this policy within the dental office.

Article 18. Final Provisions

The Respondent accepts no more obligations than those to which it is bound by law, unless otherwise agreed in writing with the Data Subject.
The Data Subject has the right to file a complaint with the supervisory authority.
Amendments to these Privacy Regulations shall be made by the Respondent. The amendments to the Privacy Regulations are effective with respect to Data Subject(s) after Data Subject(s) have been notified of the amendment.
These Privacy Regulations are effective as of 01-03-2020.