Privacy statement

1. Who is responsible for your data

The data controller is NutriHealth Diëtistenpraktijk, located at Louwesweg 6, 1066 EC Amsterdam, registered with the Dutch Chamber of Commerce (KvK) under number 67753736, AGB code 24052516. The owner and first point of contact for privacy questions is Hosai Safi, dietitian, registered in the Dutch Quality Register for Paramedics (Kwaliteitsregister Paramedici, KP 19101626789). You can reach us at info@nutri-health.nl or 06-40164874.

2. Who this statement applies to

This statement applies to everyone whose personal data we process: visitors to www.nutri-health.nl, people who sign up, ask a question or use the nutrition check or review page, and clients who are in treatment with us, at one of our locations, at home or online.

3. Which data we process via the website

On the website we only process data that you enter yourself. We never ask for your citizen service number (BSN) via the website and ask you not to send medical details by e-mail; we discuss those in the consultation.

Sign-up form

• Contact details: name, e-mail address, phone number and date of birth.
• Planning details: preferred location or online, preferred time, whether you have a referral and, if you wish, your health insurer.
• Your request for help: the topic you are seeking help with, your goal and what you would rather not change. This is data about your health. We process it solely to prepare your intake properly and only with your consent, which you give when submitting.

Contact form

Name, e-mail address and your message. We use them only to answer your question.

Free nutrition check

Your answers stay in your browser and are only sent to us when you enter your name and e-mail address at the end to discuss the plan of action. Until that moment we receive nothing.

Review page

The score you give and, only when giving feedback to the practice, your message and, if you wish, your name and e-mail address. Feedback may be anonymous; we only get in touch if you ask us to. If you choose to leave a public review on Google or Trustoo, that platform’s terms apply there.

Technical data

Our hosting provider keeps short-term technical log files (IP address, time, page requested, browser type) to keep the website secure and available. We do not link that data to you as a person.

4. Data in treatment

If you become a client, we create a file in accordance with the WGBO in our secure electronic client record system, not on this website. It contains your name, address, date of birth, BSN, insurance details, the details of your GP or referrer, your request for help, medical history and medication where relevant, measurement data such as weight and body fat percentage, the treatment plan and the reports of the consultations. We are legally required to record the BSN for billing your health insurer.

Only the dietitians involved in your treatment and the administrative support that handles billing have access to your file. Everyone in our team is bound by a duty of confidentiality.

5. Why we may process data

• Treatment agreement: to be able to guide you and plan the appointments.
• Legal obligation: the duty to keep records and the retention period under the WGBO, billing your health insurer under the Dutch Health Insurance Act (Zorgverzekeringswet) and the tax retention obligation.
• Consent: for data about your health that you share via the sign-up form or the nutrition check, and for sharing information with your GP outside integrated care. You can withdraw consent at any time.
• Legitimate interest: securing and improving our website and services, without profiling.

6. Who we share data with

We never sell data and only share it when necessary for your care or when required by law:

• Your health insurer: to bill covered consultations we share the legally prescribed data (name, date of birth, BSN, insurance number, service code and treatment date). Never the contents of your file.
• Your GP or referrer: within integrated care (type 2 diabetes, cardiovascular risk management and COPD via ROHA, ReHA Almere, Zorg voor Zuid, Huisarts en Zorg) we report to your GP and practice nurse as part of your treatment. Outside integrated care we only share with your consent.
• Processors: suppliers who work on our behalf and with whom we have a data processing agreement: the supplier of our client record and billing system, the website hosting provider and the e-mail service that sends your confirmation. E-mail from the website is processed in the European Union (Ireland). Where a supplier processes data outside the European Economic Area, this happens exclusively with the safeguards approved by the European Commission.
• Government: only when a legal obligation compels us to.

7. How long we keep data

• Medical file: twenty years after the last change, the statutory period under the WGBO, or longer if good care requires it.
• Sign-up or nutrition check without treatment: no later than twelve months after receipt, after which we delete the data.
• Contact questions and feedback via the review page: no later than twelve months after being handled.
• Financial records: seven years, the tax retention obligation.
• Technical log files of the website: a maximum of thirty days.

8. Security

The website is only accessible via a secure connection (HTTPS). Form data is sent encrypted and arrives in the practice’s secure mailbox; the confirmation you receive deliberately contains no health details. Our client record system is a secure healthcare system with personal login and access logging. Access is limited to those treating you. In the event of a data breach that poses a risk to you, we inform you and the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) in accordance with the statutory duty to report.

9. Cookies and statistics

This website places no tracking or advertising cookies and uses no analytics services or social media pixels. Fonts are loaded from our own server, so no data goes to third parties when you visit a page. Only technically necessary functions are used to make the website work; these require no consent, which is why we show no cookie banner. Links to Google, Trustoo, Instagram, Facebook and LinkedIn open that party’s site, where their own privacy policy applies.

10. Your rights

Under the GDPR you have the right to:

• Access the data we hold about you, and a copy of your file.
• Rectification of incorrect or incomplete data.
• Erasure, insofar as the statutory retention obligation allows; for the medical file you can request destruction in accordance with the WGBO.
• Restriction of processing and objection to processing based on legitimate interest.
• Portability of data you have provided yourself.
• Withdrawal of consent, without affecting what was lawfully processed before that.

Send your request to info@nutri-health.nl. We respond within one month and may ask you to identify yourself, so that we do not give data to the wrong person. If you are not satisfied with how we handle your data, please let us know; you also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

11. Children and young people

For clients under the age of 16 we only process data with the consent of a parent or guardian. For young people aged 12 to 16 we also ask, as the WGBO requires, the young person themselves for consent. If you sign up a child via the website, please do so as a parent or guardian.

12. Changes and contact

We update this statement when our services or the law change. The current version is always on this page, with version number and date. Questions about your privacy can be put to NutriHealth Diëtistenpraktijk, Louwesweg 6, 1066 EC Amsterdam, info@nutri-health.nl, 06-40164874.