Privacy Policy

Date: March 29, 2026

Version: 1.0


​General

The GDPR is the law that protects privacy and personal data. Under this law, organisations that process personal data have certain obligations, and the people whose data is processed have certain rights. Specific rules for privacy in healthcare also apply in addition to this general law. These rules are set out, among other places, in the Medical Treatment Agreement Act (WGBO). This privacy policy is intended to inform you of your rights and our obligations under the GDPR and the WGBO.


Why does our practice process personal data?

In our practice, we may process various types of your personal data. This is necessary to provide you with proper medical care and to handle payment for your treatment. Processing may also be necessary, for example, to prevent a serious threat to your health or to comply with a legal obligation (such as the mandatory reporting of an infectious disease under the Public Health Act).


What are the practice’s obligations?

Under the GDPR, VitaLonga and the people working there are responsible for processing personal data at the practice. The practice meets the resulting obligations as follows:

Data collected:

  • Name
  • Address (Street + number, postcode, city)
  • Citizen service number
  • Gender
  • Date of birth
  • Phone
  • Email address
  • Medical records
  • GP

Purpose for collecting this data:

  • For healthcare professionals
  • For invoicing, bookkeeping and reporting on the care provided (our tax return)
  • For (anonymised) contributions to peer review, continuing education/teaching/information, medical articles and science in general.
  • ·        For sending our newsletter
  • ·        To contact you if necessary
  • ·        To deliver goods and services to you
  • As a rule, no processing takes place for other purposes.

The client is informed that their personal data will be processed and gives consent to this. This usually takes place when they complete the questionnaire sent to them through our Electronic Patient Record (EPD), before the intake appointment.

All VitaLonga staff (doctor and assistants) are required to handle your personal data confidentially.

Your personal data is protected against unauthorised access. We handle the personal data you entrust to us with care and take appropriate technical and organisational measures to keep it secure. No paper files are kept and no data is stored on paper. The computer and systems we use are optimally secured.


How long is your information stored?

Your personal data will not be kept longer than necessary to provide good care. Medical records are generally retained for 15 years (from the last treatment), unless a longer retention period is necessary, for example for the health of you or your children. This is at the treating practitioner’s discretion.

For children, records are kept for 15 years from their 18th birthday.


What are your rights, and how can you exercise them?

You have the following rights:

  • The right to know whether and which personal data of yours are being processed.
  • The right to access and receive a copy of these records (provided this does not compromise another person’s privacy). A copy may be used to transfer your records to another practice (data portability).
  • The right to have data corrected, supplemented or deleted where necessary.
  • The right to request the (partial) destruction of your medical records. This request can only be granted if retaining the records is not of significant importance to another person and the records are not required to be kept under any applicable law.
  • The right to add a personal statement (of a medical nature) to your file.
  • The right to object to the processing of your data in certain cases.

If you wish to exercise your rights, you can let our practice know by phone or email.

Your interests may also be represented by a representative (such as someone authorised in writing, or your legal guardian or mentor).

For this, please provide the details of the person whose medical records are involved. The Medical Treatment Agreement Act (WGBO) considers patients to be adults from the age of 16. Young people aged 16 and over who wish to access or obtain a copy of their medical records must submit the request themselves. If the client has passed away, medical information may be disclosed if it can be assumed that the deceased would not have objected, or if there are compelling interests that justify breaching the healthcare provider’s duty of confidentiality. This decision rests with the healthcare provider.

You can collect your records in person, or have an authorized representative collect them on your behalf; you will need to sign for receipt. Exercising your rights is free of charge, unless your request is unfounded or excessive, particularly if it is repetitive.


Are data shared with third parties, and if so, why?

No. Your data is not shared with third parties, and certainly not sold to them. If you would like your information to be shared or exchanged, your explicit written consent is required. This applies to correspondence with your GP or any other healthcare providers, including referrals to other providers. Separate consent is not needed for prescriptions sent to the pharmacy, because the prescription is sent to you digitally. You can then choose whether to share it with the pharmacist. Finally, a doctor’s duty of confidentiality may be overridden by law, or if there is reason to fear a serious threat to your health or someone else’s.


Transfer of your medical records

If you would like to transfer to another doctor specializing in integrative and lifestyle medicine, for example because you are moving, we can make your records available to you to ensure a smooth transfer. No information will be shared if you do not want it to be. If you would like this, please email us.


Question or complaint We take the protection of your data seriously and take measures to prevent misuse, loss, unauthorised access or disclosure. If you believe your data is not properly secured, or have reason to suspect misuse, please contact us by email or WhatsApp. We’ll get in touch as soon as possible to resolve the issue. If you have a complaint about how we process your data that we can’t resolve together, you have the right to submit a complaint to the Dutch Data Protection Authority.


Website cookies

A cookie is a small text file that is stored in your computer, tablet or smartphone browser when you first visit our website. We use cookies that are purely technical in nature. These ensure that the website works properly and, for example, remember your preferences. These cookies are also used to ensure that the website works properly and can be optimized.

You can opt out of cookies by setting your internet browser so that it no longer stores cookies. You can also delete all information previously stored through your browser settings.