Privacy statement — Stichting Med Partners
This translation reflects Stichting Med Partners' published privacy statement. The statement explains how SMP, based in Alphen aan den Rijn, processes patient personal data under the GDPR (AVG), the Dutch Medical Treatment Contracts Act (WGBO), the Additional Provisions for Processing Personal Data in Healthcare Act (Wabvpz) and the Dutch GDPR Implementation Act (UAVG).
Controller and contact
Stichting Med Partners, KvK 84640162. Email: info@lekarz.nl. Telephone: +31 628 741 004.
Purposes and legal bases
- Diagnosis, treatment and medical care, including records, appointments and consultations: GDPR Article 6(1)(b) and Article 9(2)(h), concerning healthcare.
- Legal obligations, including records and reporting: Article 6(1)(c), together with applicable Dutch healthcare legislation.
- Communication and organisation, including appointment confirmations and remote consultations: Article 6(1)(b) and (f), including continuity of care as a legitimate interest.
- Information security and system maintenance, including access logs and backups: Article 6(1)(c)/(f), guided by NEN 7510 principles.
Data processed
The published statement lists name, address, telephone and email, date of birth, BSN where required, insurance information, medical history, diagnoses, results, referrals, prescriptions, imaging and clinical notes.
Electronic sharing with other healthcare providers, such as a huisarts, follows the Wabvpz. Patients are informed and prior consent is generally obtained for electronic exchange; access is logged.
Recipients
Data are shared only as necessary with other care providers for continuity of treatment, laboratories and diagnostic centres, IT suppliers acting as processors under processing agreements, health insurers and public authorities where legally required.
Processing within and outside the EEA
The published statement says SMP stores and processes data in the European Economic Area. Exceptional transfers to third countries rely on GDPR Chapter V safeguards, such as an adequacy decision, standard contractual clauses or, where applicable for the USA, the Data Privacy Framework.
Retention
Medical records are generally retained for 20 years from the last recorded change under Dutch Civil Code Article 7:454 (WGBO). A longer period may be justified by chronic illness, continuity of care or hereditary considerations.
Information security
The statement describes appropriate technical and organisational measures, including access control, encrypted transmission, backups, minimisation and audits, guided by NEN 7510. Staff and contractors are bound by confidentiality.
Your rights
You can request access, correction, restriction, objection where processing relies on legitimate interests, portability for electronically processed data based on contract or consent, and erasure within the limits of medical law and record-retention duties. The practice normally responds within one month.
Exercising your rights
Send a request to info@lekarz.nl or by post to SMP. Identity verification may be necessary to protect medical confidentiality and prevent unauthorised disclosure. Collecting medical-record copies may require personal confirmation.
Complaints
You may complain to the Dutch supervisory authority, Autoriteit Persoonsgegevens. Its official website provides contact details and forms.
Cookies, remote care and external systems
Before using a patient portal, remote consultations or third-party services such as video calls or online booking, the statement says patients will be informed about providers, processing bases and potential transfers, including outside the EEA.
Updates
SMP reviews and updates its statement when needed; the current production version is published on its main website.
Patient rights and preparation · Patient portal guidance · Contact