Zeynep Tana Aslan

Basispsycholoog/Psychologist/Psikolog

General Conditions and Privacy of Data

Privacy Statement

I, Zeynep Tana Aslan, psychologist (basispsycholoog, registered with the NIP), based in Rotterdam and registered with the Dutch Chamber of Commerce (Kamer van Koophandel) under number 42155832 attach great importance to the protection of personal data.

This privacy statement explains how I handle information about an identified or identifiable natural person, within the meaning of the General Data Protection Regulation (GDPR / AVG).

Law and regulations

Dutch law requires me, as a healthcare provider, to keep a client file. In this file I record the data needed to provide good care and/or to conduct careful psychological assessment. The law requires me to retain client files for twenty years.

Who does this privacy statement apply to?

This privacy statement applies to the following categories of people whose personal data I process:

  • (potential) clients;
  • visitors to my practice;
  • visitors to my website:
  • participants in meetings or training sessions organised by and/or with me;
  • anyone else who contacts me or whose personal data I process.

Personal data I process

I process personal data that:

  • you have provided yourself, in person (during a session or meeting), by telephone, or digitally (via e-mail or the web form on the website), such as contact details or other personal data;
  • are obtained, with your consent, from other healthcare providers or referrers;
  • are generated during your visit to my website, such as your IP address and browsing behaviour on the website (e.g. pages viewed and how you navigate the site);
  • are obtained through possible video recordings during sessions, only with your explicit consent and according to the agreements made about this;
  • are collected when using e-health applications, according to the agreements made and with your consent.

Purposes of processing

I process personal data for the following purposes:

  • providing psychological care under a healthcare treatment agreement, and billing for the services provided;
  • maintaining contact, for example sending information you have requested yourself;
  • improving my practice website [website];
  • keeping usage statistics of the website. These are generic reports that cannot be traced back to individual visitors.

Legal basis

I process personal data on the basis of one of the following legal grounds:

  • your consent. You may withdraw your consent at any time, without affecting the lawfulness of the processing based on your consent before its withdrawal;
  • the performance of a healthcare treatment agreement (or steps taken prior to entering into such an agreement), including billing to third parties such as your health insurance company;
  • a legal obligation, for example the duty to keep a client file or to register your citizen service number (BSN);
  • a legitimate interest, for example using your contact details to schedule or confirm appointments.

Processors

For the processing of personal data I may engage service providers (processors), such as providers of electronic client files, IT services or payment services. These process personal data exclusively on my instructions, on the basis of a data processing agreement that meets the requirements of the General Data Protection Regulation (GDPR).

Sharing personal data with third parties

I share personal data with third parties only if this is appropriate in the context of your treatment (for example, a referral), or necessary to comply with a legal obligation, or if you have given your consent.

I am bound by professional confidentiality and therefore do not share personal data with third parties, and certainly not for commercial purposes.

Transfer outside the European Economic Area

In principle, I do not transfer personal data to (organisations in) countries outside the European Economic Area (EEA). If this should nevertheless be necessary, I take responsibility that the transfer only takes place if the European Commission has indicated that the country in question offers an adequate level of protection, or if appropriate safeguards within the meaning of the GDPR are in place.

Retention of data

I do not retain personal data for longer than necessary. In accordance with applicable laws and regulations, I apply the following retention periods as a starting point:

  • medical data: at least 20 years after the end of the treatment agreement;
  • financial and administrative data: 7 years after the data were recorded;
  • website visitors: 5 years after the last visit to the website, unless objection is made earlier, in which case the data will be destroyed.

Changes to this privacy statement

I may change this privacy statement at any time. I publish the current version of the privacy statement on my website [website]. It is advisable to consult this privacy statement regularly, so that you are aware of any changes.

Your rights, questions and complaints

You have the right to access, rectify, erase or transfer your personal data, to restrict its processing, and to object to its processing. You can send your request to me by e-mail at [e-mail].

If you have questions or complaints about the way I process your personal data, you can also contact me. I will try to resolve a complaint to your satisfaction. Should this not be possible, you can submit a complaint to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens: https://autoriteitpersoonsgegevens.nl/nl/).

Laws referred to: