Privacy statement

ADHD Medisch Centrum B.V. (hereinafter: ADHD Medisch Centrum or "we") provides specialist care to adults with (suspected) ADHD: diagnostics and treatment. We are located at Sloterweg 303, 1171 VC Badhoevedorp.

We are the controller within the meaning of the General Data Protection Regulation (GDPR, in Dutch: AVG). This means that we determine for what purpose and how your personal data are used, and that we are responsible for ensuring that this is done carefully and in accordance with the law. For the care itself, the Medical Treatment Contracts Act (Wet op de geneeskundige behandelingsovereenkomst, WGBO) and medical professional confidentiality also apply.

This statement applies to everyone whose personal data we process: clients, their loved ones, referrers and other healthcare providers, staff, applicants, visitors to our website and anyone who is in contact with us in any other way.

Personal data

All information that relates to you or can be traced back to you, such as your name, address, date of birth or telephone number.

Special categories of personal data

Data that receive extra protection, such as data about your health. Your citizen service number (burgerservicenummer, BSN) is not a special category of data, but may only be used where the law permits it.

Processing

Everything that can happen with personal data: collecting, recording, storing, consulting, using, sharing and ultimately destroying.

Which of your data we process depends on who you are and why you are in contact with us.

If you are a client of ours

• Your first name and surname, gender, date of birth and place of birth.
• Your address, telephone number and email address.
• Your citizen service number (BSN). Healthcare providers are required by law to use it.
• Details of your health insurance, so that we can claim for your care.
• Details of your GP or other referrer, and of your pharmacy if we prescribe medication.
• Health data in your medical record: including the referral, your symptoms and history, completed questionnaires, reports of conversations and assessments, the diagnosis, the treatment plan and your medication. If Care AI was used during a conversation, the transcript of the conversation (with names and personal data masked) also forms part of the report.
• Your answers to questionnaires on the effect of your treatment (ROM) and on your experiences with our care (CQ index).
• Appointments and contact with us, for example by telephone or email.
• Financial data, such as claims and invoices.

If you are someone close to a client

In the assessment for ADHD, we often ask a parent or someone else close to the client to complete a questionnaire about what the client was like as a child (the collateral history, heteroanamnese). What you tell us in it is added to the client's record. We may also record your name and contact details, for example if you receive the questionnaire directly from us.

If you are a referrer or healthcare provider

Your name, position, practice details and the data needed to communicate with you about the care of a client.

If you work for us

The data needed for your employment, such as your contact details, your employment contract, reports of performance reviews, salary and sickness absence data, and the documents that we are required by law to keep for payroll tax purposes, such as a copy of your identity document.

If you apply for a job with us

Your contact details, your CV and cover letter, and anything else you share about yourself during the procedure, such as diplomas and references. If you apply using the form on our website, your application is received by email by our management.

If you visit our website

Our website itself does not record any personal data about you, not even if you use the application form. In the chapter Website and cookies you can read exactly what does and does not happen.

We receive most data from you: when you register, in conversations, in questionnaires and when you contact us.

• From your GP or other referrer, if they refer you to us. This is usually done through ZorgDomein.
• From a parent or someone else close to you, if they complete the questionnaire about your childhood.
• From other healthcare providers, if, with your consent, we request data that are needed for your treatment.

We only use your data for clear purposes, and no more than is necessary for that purpose.

Your care

The assessment for ADHD, the diagnosis, the treatment and the prescribing and monitoring of medication, and keeping your medical record.

Contact with you

Scheduling and confirming appointments, informing you about your care pathway and sending information you have asked for yourself.

Informing your GP

With your consent, at the end of the care pathway we send your GP a letter with the diagnosis, the course of treatment, the medication that has been set up and our advice for follow-up.

Claims and invoicing

Claiming for the care from your health insurer or from you, and handling payments, including through a payment service.

Quality and safety

Monitoring and improving the quality of our care, handling complaints and keeping our practice and our systems secure. For this purpose, during and at the end of your treatment we ask you to complete questionnaires on the effect of the treatment (ROM, Routine Outcome Monitoring) and on your experiences with our care (CQ index).

Legal obligations

For example keeping a medical record, using your BSN and keeping the financial records.

Staff

Performing the employment contract, the payroll administration and support during sickness.

Applications

Assessing your application and contact with you about the procedure.

The GDPR only permits the processing of personal data on one of the legal bases set out in the law. We use these:

Treatment agreement

When you come to us for care, we enter into a medical treatment agreement. To perform it, we have to process your data.GDPR Article 6(1)(b)

Legal obligation

The law requires us, among other things, to keep and retain a medical record, to use your BSN and to retain our records.GDPR Article 6(1)(c)

Legitimate interest

For example for improving our services, handling complaints and the security of our practice. In such cases we always weigh our interest against your privacy.GDPR Article 6(1)(f)

Consent

For some things we first ask for your consent, such as requesting data from other healthcare providers, the closing letter to your GP, the use of Care AI in record-keeping and sharing your ROM data for national quality research. You can always withdraw your consent. What we did before that remains lawful, however.GDPR Article 6(1)(a)

Health data

Health data are special categories of personal data. They may only be processed if the law provides an exception for this. We process them because this is necessary for good care and the performance of the treatment agreement, by healthcare providers who are bound by professional confidentiality (GDPR Article 9(2)(h)).

Some of our practitioners use Care AI, a part of our electronic patient record CareCheck. Care AI helps with writing the report of a conversation, so that your practitioner has more attention for you and spends less time typing.

How it works

• Care AI records the conversation and converts it into text. The audio recording is then deleted immediately, within 60 seconds, and is not kept.
• Names and other personal data are masked in the text. Only that masked text goes to the AI service that produces the draft report (Gemini from Google). That service does not keep the text and does not use it to train AI. The processing takes place in Europe.
• Your practitioner reads the draft report in full, corrects it where necessary and only then records it in your record. The practitioner remains responsible for what is in your record.
• The transcript of the conversation, with the masked personal data, is kept with the session report in your record. The same rules apply to it as to the rest of your record, such as the retention period and your right of access.

Your choice

We only use Care AI if you have given your consent for this in our terms of care. If you would rather not have it used in a particular conversation after all, tell your practitioner: they will then write the report themselves. Your practitioner may also decide not to use Care AI. Your choice has no consequences for your treatment. You can always withdraw your consent.

No decisions by a computer

Care AI only helps with record-keeping. It is not used for a diagnosis, a treatment recommendation, the assessment of your registration or a decision about medication. We do not take decisions about you that are made solely by a computer: a healthcare provider always decides.

Only staff who need your data for their work can view them, and only the part they need. Your healthcare providers see your medical record. Staff in, for example, healthcare administration only see what is needed for appointments, claims and invoices.

Our healthcare providers are bound by medical professional confidentiality. All other staff, including temporary workers and self-employed professionals who work for us, have a duty of confidentiality.

We only share your data if this is necessary and there is a legal basis for it. We never sell your data.

Your GP or referrer

With your consent, for example the closing letter at the end of your care pathway.

Your pharmacy

If we prescribe medication, your pharmacy receives the prescription.

Other healthcare providers

If this is necessary for your treatment, and with your consent.

Your health insurer

For claiming for your care. Your health insurer only receives the data that are required by law for this.

National quality research

Only if you give your consent for this: your answers to the ROM questionnaires, without your name, address or BSN (pseudonymised), for national research into the quality of mental health care (GGZ). This is done through Akwa GGZ, into which the former Stichting Benchmark GGZ has been merged. If you do not give consent, this has no consequences for your treatment.

Our suppliers

Parties that support us, such as the suppliers of our electronic patient record, the referral system used by GPs, secure email, our IT, our invoicing and accounting, and the payment service through which you can pay a bill. We make arrangements with all our suppliers in a data processing agreement. They only process your data on our instructions and in accordance with those arrangements.

Authorities, if the law requires it

For example a supervisory authority such as the Health and Youth Care Inspectorate (Inspectie Gezondheidszorg en Jeugd). In that case we only provide data if we are obliged to do so.

Outside the European Union

If a supplier processes data outside the European Union, this is only done with the safeguards required by the GDPR. Examples are the EU-US Data Privacy Framework or the standard contractual clauses of the European Commission.

We do not keep your data longer than is necessary for the purpose for which we have them, or for as long as the law requires.

Medical record

20 years, calculated from the last change to the record, or for as much longer as is necessary for good care.Medical Treatment Contracts Act (WGBO), Article 7:454 of the Dutch Civil Code

Audio recording with Care AI

Is not kept: the recording is deleted within 60 seconds. The transcript of the conversation forms part of your record and falls under the retention period of the medical record.

Financial data

Invoices, claims and payments: 7 years after the end of the financial year.Statutory tax retention obligation

Staff and applicants

Personnel file

Such as the employment contract and reports of performance reviews: during employment and up to 2 years after the employment ends.

Sickness absence data

Up to 2 years after recovery or after leaving.

Payroll records

7 years after the end of the financial year.Statutory tax retention obligation

Documents for payroll tax

The payroll tax statement (loonheffingsverklaring), the copy of the identity document and the request to apply the payroll tax credit (loonheffingskorting): up to 5 calendar years after the year in which the employment ends.Statutory tax retention obligation

Applicants' data

4 weeks after the end of the application procedure. With your consent we keep them longer, up to a maximum of 1 year, for example in case a suitable vacancy comes up later.

We take appropriate technical and organisational measures against misuse, loss, unauthorised access, unwanted disclosure and unauthorised alteration of your data. For example:

• Your medical record is stored in encrypted form.
• Access to data is limited to the staff who need it.
• Our security is checked regularly.
• Our organisation is HKZ certified.

Data breach

If something does go wrong with your data, we report it to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) if the law requires this. If the data breach is likely to have consequences for you, we will let you know as soon as possible, with what happened and what you and we can do about it.

Found a weak spot?

Do you see a weak spot in our security, for example on our website? Let us know at privacy@adhdmc.nl, so that we can fix it as quickly as possible.

Our website is made to provide information, not to track you. In practice, this means:

• We do not place any cookies ourselves, and there are no cookies or pixels from advertising or social media companies on our website. We do not use Google Analytics.
• The party that hosts our website places two cookies: a technical cookie and a cookie for visitor statistics. With these, it counts the total number of visits and page views. It also keeps track of how quickly pages load and whether technical errors occur. We cannot see in this who visits our website. Which cookies these are and how long they last can be read in our cookie statement.
• The fonts and the video on our website are loaded from our own website, not from another company.
• The self-test and the cost calculator do not save your answers and do not send them. They disappear as soon as you close the page.
• The checklist on the Registration page only stores your ticks in your own browser, so that you can continue later. They are not sent to us. You clear them by deleting our website's data in your browser.
• There is one form on our website: the application form. What you fill in, with your CV and cover letter, is sent by email to our management, through our own email environment. The website does not store it. We keep your application for as long as stated under Retention periods.
• If you contact us by email or telephone, we only use your data to help you.

As with any website, the party that hosts our website processes technical data, such as your IP address, to make the website work and to secure it.

Our website contains links to other websites, such as Google Maps for directions and our pages on social media. If you click on them, the privacy statement of that website applies. We are not responsible for that.

You can read more about this in our cookie statement.

You have rights over your own data. Under the GDPR and the WGBO, you can ask us for the following:

Access and copy

To see which data we hold about you, and to receive a copy of your medical record.

Correction and addition

To have data corrected that are factually inaccurate or incomplete. If you disagree with what is in your record, you can also have a statement of your own added.

Destruction

To have your data or (part of) your medical record destroyed. We will do so, unless the law requires us to keep them or the interest of another person carries more weight.

Restriction

To have the use of your data temporarily restricted, for example while we assess a request for correction.

Transfer

To have your data transferred to you or to another healthcare provider, in a commonly used digital format.

Objection

To object to the use of your data on the basis of our legitimate interest.

Withdrawal of consent

To withdraw consent that you gave previously.

How to submit a request

Send your request to privacy@adhdmc.nl or call us on 020 303 34 65. We want to be sure that the request comes from you. We may therefore ask you to prove your identity. If you send a copy of your identity document, make your passport photo, the strip of numbers and letters at the bottom (MRZ), your document number and your BSN unreadable.

We respond to your request within four weeks. If we cannot carry out a request (in full), we will explain why.

Do you have a question about this privacy statement or about how we handle your data, or are you not satisfied with it? Then please contact us at privacy@adhdmc.nl or 020 303 34 65. We are happy to work with you to find a solution.

If you cannot resolve the matter with us, you can submit a complaint to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) (opens in a new window) (in Dutch), the supervisory authority for privacy in the Netherlands.