Privacy
Privacy Policy
As a dental practice, you trust us with your health data. That is the most sensitive category of personal data that exists. Below you will read exactly what data we keep from you, why we do so, with whom we share it and what rights you have.
1. Who processes your data
The data controller for the data described on this page is:
Data controller
Nüvodent BV, hereinafter "we"
Prins Albertlei 29, 2600 Antwerp
KBO and VAT: BE 0650.541.980
Phone: 03 344 33 32
Email: contact@nuvodent.be
Our clinics are located at Prins Albertlei 29, 2600 Berchem and at Sint-Jansplein 51, 2060 Antwerp.
The dentists and specialists working within Nüvodent are all bound by professional secrecy and the legal regulations regarding the patient file. If a practitioner works as a self-employed individual within our practice, they are the sole data processor for their own patient file. In the practice, you can contact us for all your questions using the contact details above.
2. What data we process
Depending on your patient status, whether you request an appointment, apply for a job, or simply visit our website, we process some of the data listed below.
Identification and contact
- Name, first name, date of birth and gender
- Address, phone number and email address
- National registration number and data from your eID for your identification in healthcare and for the third-party payer scheme
- Name of your health insurance fund and your insurance coverage details
- For minors: the details of the parent or legal representative
Health data
- Your medical and dental history, allergies, and use of medication
- Research results, diagnoses, treatment plans and treatment reports
- X-rays, intraoral scans, photographs and other imaging material
- Reports from and to referring healthcare providers
Administration and payment
- Appointment history, including appointments that were cancelled or not kept
- Invoices, payments, account number and any outstanding amounts
- Certificates for assistance provided and data exchanged with the RIZIV and your health insurance company
Website and communication
- The content of your messages via the contact form, email or phone
- Technical data such as IP address, browser type and pages visited, see the chapter about cookies
Applications
- CV, motivation letter, diplomas, visa number and RIZIV number, if applicable
- Notes from conversations and references that you have made yourself
3. For what and on what grounds
We never process your data just like that. For each purpose, there is a legal basis under the General Data Protection Regulation.
| Purpose | Legal basis |
|---|---|
| Conducting your examinations and treatments, and keeping track of your patient records | Necessary for the provision of healthcare, Article 6.1.c and Article 9.2.h GDPR, together with the Patient Rights Act and the Quality Act |
| Scheduling, confirming, and reminding appointments | Execution of the healthcare agreement, Article 6.1.b GDPR |
| Billing, tracking payments, and applying the third-party payer scheme | Legal obligation and performance of the agreement, Article 6.1.b and 6.1.c GDPR |
| Exchange reports with your GP, referral doctor or a colleague specialist | Continuity of care, Article 9.2.h GDPR, with your consent for the division itself |
| Compliance with accounting and fiscal obligations | Legal obligation, Article 6.1.c GDPR |
| Answer your question via the contact form or by email | Legitimate interest or steps prior to an agreement, Article 6.1.f and 6.1.b GDPR |
| Improving our practice and evaluating the quality of care internally | Legitimate interest, Article 6.1.f GDPR, with data that is as much as possible aggregated |
| Keeping track of website statistics and measuring how many signups our online ads generate | Your consent via cookie settings, Article 6.1.a GDPR |
| Sending newsletters or practice information | Your consent, Article 6.1.a GDPR, with a cancellation link in every shipment |
| Defending us in a complaint, dispute or liability claim | Legitimate interest and establishing or substantiating a legal claim, Article 6.1.f and 9.2.f GDPR |
| Processing applications | Steps before entering into an agreement and your consent to being kept in the recruitment reserve |
We do not make decisions about you based solely on automated processing, and we do not create any profiles of you ourselves. To learn how we measure our online ads, read the chapter Online advertising and measurements.
4. Professional secrecy
In addition to the GDPR, our therapists are subject to the professional secrecy provided for in Article 458 of the Criminal Code. This is stricter than privacy legislation alone. Employees without their own professional secrecy, such as reception and administration, are contractually bound by an equally strict duty of confidentiality and are only allowed access to the data they need for their duties.
5. Where the data comes from
Most of the data we receive directly from you, orally, through a form or via your eID. In addition, we can receive data from your referring dentist or physician, from a hospital or laboratory, from your health insurance fund and from the government departments that manage insurance coverage. In the case of minors or a patient who is unable to exercise their rights themselves, we receive data from the parent, guardian or representative.
6. With whom we share data
We never sell your data and do not share it for the commercial purposes of third parties. We only share what is necessary with:
- Healthcare providers within your treatment, such as the dentist, periodontist, orthodontist or oral hygienist who treats you
- Referral and treatment providers outside the practice, such as your GP, orthodontist or hospital, provided you give your consent
- Dental technology laboratories, For the manufacture of crowns, prostheses or equipment, with a minimum of identification data
- Your health insurance fund and the RIZIV, For reimbursement, eAttest and the third-party payer scheme
- Our software providers, including the practice management system, the agreements platform and our hosting, each time as a processor with a processor agreement
- Google (Google Ireland Limited), for website statistics via Google Analytics and measuring our ads via Google Ads, only after your consent and never with medical data. See the chapter Online advertising and measurements.
- Our accountant, auditor and revisor, for the legal accounting obligations
- Our insurer, lawyer or a judicial authority, Only in the event of a dispute, complaint or legal obligation
- An enforcement agency or court bailiff, Only with an outstanding invoice and without medical content
Online appointments
For online scheduling of appointments, we work with Doctena. The data you enter in the appointment module is processed by Doctena as our processor, based on a processor agreement. Their own privacy policy can be found on the Doctena website.
7. Transfer outside the EEA
We store your data preferably within the European Economic Area. If a supplier nevertheless processes data outside the EEA, this will only be done on the basis of an adequacy decision by the European Commission or of the standard contractual clauses, supplemented by additional technical measures. You can request an overview of the relevant processors from us.
Google may also process data in the United States. This is done in accordance with the EU-U.S. Data Privacy Framework and the standard contractual clauses of the European Commission.
8. How long we keep it
| Category | Retention period |
|---|---|
| Patient file, including imaging material | Minimum 30 years and maximum 50 years after your last contact with the practice, as required by Article 35 of the Quality Act of April 22, 2019 |
| Invoices and accounting documents | 7 years, according to the tax retention obligation |
| Contact forms and email traffic without healthcare content | Maximum 2 years after the last contact |
| Applications | Up to 1 month after completion of the procedure, or up to 2 years in our recruitment reserve if you give permission for that |
| Camera footage at the entrance to the practice [RESERVED FOR USE ONLY] | Maximum 30 days, unless they are needed as evidence in an incident |
| Cookies and website statistics | See the retention period per cookie in our cookie policy |
| Data for measuring ads on Google | According to Google’s retention periods, see the Google privacy policy. In Google Analytics, we store statistics for up to 14 months. |
9. Security
We take appropriate technical and organizational measures to protect your data. These include: access based on role and need, personal accounts with strong authentication, encrypted connections, encrypted backups, a locked server room and physically locked file cabinets, confidentiality clauses in every employment and collaboration contract, and processing agreements with all our suppliers.
If a data breach occurs despite everything that risks your rights and freedoms, we will report it to the Data Protection Authority within 72 hours and inform you when the risk is high.
10. Your rights
- Access. You are entitled to a copy of your data. In addition to this, your patient file is subject to the right of access under the Patient Rights Act: we respond within 15 days, and personal notes and data about third parties are not covered by this right.
- Improvement. If your information is incorrect or incomplete, we will correct or supplement it.
- Wissing. This right is limited to a patient file. As long as the legal retention period is in effect, we may not destroy your file, not even at your request.
- Restriction. If you dispute the accuracy of certain data, you can request that the processing be temporarily restricted.
- Objection. You can object to processing based on our legitimate interest for reasons related to your situation.
- Transferability. For data that you have provided yourself and that we process based on your consent or the agreement, you can request a structured digital copy.
- Withdraw consent. Where we rely on your consent, you can withdraw it at any time. Processing that took place before then remains valid.
How to exercise your rights
Send your question to contact@nuvodent.be Or hand them over to the reception. We require proof of your identity so that we don’t provide your details to anyone else. You will receive a response within 30 days. If your question is complex, we can extend this term by two months and we will let you know in good time.
11. Cookies and the website
Our website uses necessary cookies to function properly, and only with your consent do we also use analytical, functional, and advertising cookies. You can change your preferences at any time via the cookie settings at the bottom of the page. The full list of cookies, their purpose, and their retention period can be found in our Cookie policy.
The agenda module for online appointments is loaded from an external partner. As soon as you open it, that partner can place its own cookies.
12. Online advertising and measurements
We advertise our practice on Google. To know whether those ads are working, we measure how many people send an inquiry or request an appointment after clicking on an ad. This only happens if you allow advertising and analytical cookies in your cookie settings.
What we measure
- That someone came via an advertisement on our website and then reached the thank-you page of a form, for example after registering as a new patient.
- Technical data such as the pages visited, the type of device and a cookie ID.
Improved conversions
To make this measurement more accurate, we use the "enhanced conversions" function of Google Ads. When you submit a form, your email address and phone number are first encrypted (hashed) into an unreadable code in your browser. Only that code goes to Google. Google uses it exclusively to link the registration to a previous click on our ad.
What we never Send to Google: your national registration number, your date of birth, the type of treatment, your comments or other content of the form, and no data from your patient file.
Your choice
If you do not give your consent for advertising cookies, or withdraw it later via the cookie settings at the bottom of the page, this measurement will not take place. You can simply use our form and our services without consent. You can read more about how Google handles data in the Google privacy policy.
13. Questions or complaints
If you have a question about this statement or are not satisfied with how we handle your data, please contact us first. In most cases, we will resolve the issue together.
In addition, you always have the right to file a complaint with the Data Protection Authority. If your complaint concerns the care itself or your patient rights, you can turn to the Federal Ombudsman Service for Patient Rights.
14. Changes
We adapt this privacy statement when our operations, our suppliers, or the law require it. The date at the top indicates when the latest version came into effect. In the event of a significant change, we will actively inform you.