PrivacyPolicy
How Embody Chiropractie BV handles your personal data, in line with the GDPR and the SNRC privacy policy guideline 2026.
PRIVACY POLICY
Embody Chiropractie BV
Date policy drawn up: 2026
(in line with the SNRC privacy policy guideline 2026)
1. Practice details
The party responsible for the processing of personal data is:
| Company name | Embody Chiropractie BV |
|---|---|
| KvK number | 60963689 |
| Owner / chiropractor | Owner (as independent practitioner) |
| Address | Paradijslaan 30 |
| Postcode and city | Alphen aan den Rijn, the Netherlands |
| hello@embodychiro.nl | |
| Phone | +31 172 26 3073 |
| Website | embodychiro.nl |
2. Personal data that is processed
Embody Chiropractie processes personal data of patients and website visitors. Below is an overview per target group.
2.1 Patients — general personal data
- First and last name
- Gender
- Date and place of birth
- Address, postcode, city
- Phone number
- Email address
- Identity document number
- Health insurance number and name of the insurer
- Other data you actively provide in correspondence or when creating a profile
2.2 Patients — special categories of personal data
The following special categories of personal data are processed. This category requires extra protection under the GDPR:
- Medical data / health data (including anamnesis, treatment records, and X-ray images)
- Citizen service number (BSN)
2.3 Website visitors
- IP addresses (via cookies and server logs)
- Data collected via cookies, see section 8 for more information
Note on minors: Our services are not intended for persons under 16 without the consent of parents or guardian. If you believe we have collected data of a minor without consent, please contact us via hello@embodychiro.nl. We will then delete the data as soon as possible.
3. Purposes and legal bases for processing
We process personal data only when there is a legitimate purpose and a legal basis. Below you will find an overview per category.
| Data category | Purpose of processing | Legal basis | Provision mandatory? |
|---|---|---|---|
| Patient medical data (incl. BSN) | Delivering safe and effective chiropractic care; maintaining the medical record in line with legal obligations. | Legal obligation (WGBO and Wvbz); Art. 9(2)(h) GDPR for special categories of data. | Yes. Without this data no responsible chiropractic care can be provided. |
| General patient data (address, contact) | Administration: scheduling appointments, invoicing, communication about changes in services. | Performance of a contract (treatment agreement). | Yes. Necessary for managing the treatment and practice administration. |
| Identity document number | Verification of the patient's identity in the context of the use of the BSN in healthcare. | Legal obligation (Dutch BSN in healthcare act). | Yes. Legally required for care providers. |
| Newsletter subscribers | Sending the newsletter and relevant practice information. | Consent (can be withdrawn at any time). | No. Fully voluntary. |
| Website visitor data (IP addresses, cookies) | Technical operation, security, and optimisation of the website. | Legitimate interest. | No. Manageable via browser settings. |
Automated decision-making: Embody Chiropractie BV does not use automated processing for decisions with significant consequences for data subjects. All decisions are made with human oversight.
4. Security measures
Embody Chiropractie attaches great importance to the security of personal data. A risk analysis has been carried out on the basis of which the organisational and technical measures below have been taken. The security measures are reviewed periodically and adjusted in line with the plan-do-check-act cycle.
For information security in healthcare, the NEN 7510 standard is leading. Where applicable, the ISO 27002 standard for information security controls is also used as a reference.
4.1 Technical measures
- Access security: the practice software (Jane App) is secured with a username, password, and two-factor authentication (2FA).
- Authorisation: only the chiropractor has access to patient data; access is linked to a personal account.
- Encryption in transit: all data transfer between devices and servers runs via 128-bit encryption (SSL/TLS).
- Encryption at rest: patient data is stored with 256-bit encryption on the servers of Jane App.
- Back-ups: Jane App makes daily, weekly, monthly, and yearly back-ups with multiple availability zones.
- HTTPS: the website embodychiro.nl has a valid SSL certificate.
- Software up to date: browsers, operating systems, and applications are updated regularly.
- Automatic deletion: expired data is deleted in line with the retention periods in section 6.
4.2 Organisational measures
- Responsibility: the owner/chiropractor is responsible for information security within the practice.
- Processor agreements: processor agreements have been concluded with all processors who process personal data on behalf of the practice.
- Confidentiality: the chiropractor is bound by professional secrecy and legal confidentiality obligations.
- Protocols: protocols exist for data breaches and data subject requests (see sections 5 and 10).
- Minimal data processing: only data that is strictly necessary for the purpose is processed.
- Evaluation: the privacy policy and security measures are reviewed at least annually.
If you have the impression that your data is not properly secured or there are signs of misuse, please contact us immediately via hello@embodychiro.nl.
5. Your privacy rights
As a data subject you have the following rights. Requests can be submitted by email via hello@embodychiro.nl. We respond as soon as possible and in any case within 1 month. In special circumstances this period may be extended to 3 months. There are no costs attached to submitting a request.
Identity verification: to protect your privacy we ask you to send a copy of your identity document. You may redact the photo, the MRZ number (the strip at the bottom), the passport number, and the BSN. From the age of 16, or if you have parental authority over a child, you can invoke the rights below.
| Right | Explanation |
|---|---|
| Right to information | You have the right to know which data we process about you. You can request our privacy protocol (section 12). |
| Right of access | You can request a copy of the personal data we process about you. Personal working notes of the chiropractor are not included. Provision takes place in line with NEN 7510. |
| Right to rectification | Is your data incorrect or incomplete? Then you can request to have it corrected. If you disagree with an opinion or conclusion of the chiropractor, you can request to add your written response to your file. |
| Right to erasure (right to be forgotten) | In principle we will comply with this request. Medical data can be erased after we have pointed out the consequences to you in writing (no recourse to the file in later complaint procedures or health questions). We ask you to confirm this in writing. Fiscal data (7-year retention obligation) cannot be erased. A request to erase the medical file automatically ends the treatment relationship. |
| Right to restriction of processing | In certain cases you can request to restrict the processing of your data, for example if you contest that the data is correct or have objected to the processing. |
| Right to data portability | You have the right to receive your personal data in a structured, commonly used, and machine-readable format. Please note: conclusions, diagnoses, and treatment plans drawn up by the chiropractor based on your data are not included. |
| Right to object | You can object to the processing of your personal data because of your specific situation, insofar as the processing is based on a legitimate interest. |
| Right to human review of automated decisions | This right applies if automated decisions with significant consequences are made. Embody Chiropractie BV does not make automated decisions; this right is therefore not applicable. |
As a data subject you have the right to file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP) via www.autoriteitpersoonsgegevens.nl.
6. Retention periods
Personal data is not kept longer than necessary for the purpose for which it was collected. The legal retention periods below apply.
| Data category | Retention period | Legal basis |
|---|---|---|
| Medical records | 20 years after the last change to the file | Dutch Medical Treatment Agreement Act (WGBO, art. 7:454 Dutch Civil Code) |
| Financial and fiscal administration | 7 years | Tax legislation |
| Website data (IP addresses, logs) | 6 months | Security and analysis |
| Applicant data (if applicable) | 1 year after rejection | GDPR |
Expired data is deleted as soon as the retention period has passed. The chiropractor checks yearly whether data is deleted in line with the retention periods.
Minors: for minors the retention period for the medical record runs from the moment they turn 18 (SNRC recommendation, in line with art. 7:454 Dutch Civil Code).
7. Privacy by design and privacy by default
Embody Chiropractie applies the principles of privacy by design and privacy by default to all data processing.
7.1 Privacy by design
When setting up the practice and using software, security and minimal data processing are the starting point. Only data that is strictly necessary for the purpose concerned is processed. "Convenience" is not a basis for data processing.
7.2 Privacy by default
The default settings of the systems and forms used are configured so that only necessary data is processed. Examples:
- Newsletter sign-ups require an active opt-in (no pre-ticked box).
- Contact forms ask only for the data necessary to handle the request.
- Access to patient data in Jane App is limited to the chiropractor.
Compliance with these principles is reviewed annually in the evaluation of this privacy policy.
8. Data protection officer (FG)
Embody Chiropractie BV is a solo practice. The patient base is considerably smaller than the threshold of 10,000 patients in one information system as meant in the GDPR. There is therefore no legal obligation to appoint a data protection officer (FG).
No FG has been appointed voluntarily. Responsibility for compliance with privacy legislation rests with the owner/chiropractor. If in doubt about GDPR compliance, an external privacy expert is consulted.
9. Data Protection Impact Assessment (DPIA)
A DPIA is mandatory when the processing of personal data is likely to result in a high privacy risk.
Embody Chiropractie BV processes special categories of personal data (medical data) as a core activity. Given the size of the practice (well below 10,000 patients) there is no large-scale processing within the meaning of the GDPR. Moreover, there is no automated decision-making, systematic monitoring, linking of datasets, use of new technologies, or other criteria that trigger a mandatory DPIA.
Based on this assessment there is no obligation to carry out a DPIA. If the practice introduces new processing in the future that could pose a high risk, a DPIA will be carried out in advance.
10. Data breach protocol
In the event of a (suspected) data breach, the following steps are taken:
Step a — Map the situation
Determine as soon as possible: what kind of breach it concerns, what the cause is, when it arose, which data and how many persons are involved, and whether unauthorised parties (could) have had access.
Step b — Take measures immediately
Stop the breach as soon as possible. Examples of measures: wipe or lock devices remotely, take published files offline, block account access, contact the wrong recipient for confirmation of destruction.
Step c — Assess the notification obligation to the AP
Assess whether the data breach must be reported to the Dutch Data Protection Authority (AP) within 72 hours. Consult: autoriteitpersoonsgegevens.nl. Also assess whether data subjects must be informed without delay.
Step d — Register the breach in the internal breach register
Every data breach, also if it does not need to be reported to the AP, is recorded in an internal breach register. The register records per incident: the facts (cause, nature, scope), the consequences, and the corrective measures taken. The register is evaluated periodically in line with the plan-do-check-act cycle.
11. Processors and transfer to third parties
Embody Chiropractie never sells your data to third parties. We share data only with processors (external parties who process data on our behalf) if this is necessary for our services. Processor agreements have been concluded with all processors.
11.1 Overview of processors
| Processor | Service | Data location / note |
|---|---|---|
| Jane App (Jane Software Inc.) | Patient files, appointments, invoicing (practice management software) | Data stored on servers in the United Kingdom. The UK has an adequacy decision from the EU. See also 11.2. |
| QUIC.cloud | Website caching for a fast user experience | Temporary copy of web pages; no patient data; no access by third parties. See the QUIC.cloud privacy policy. |
11.2 Transfer outside the EU — Jane App
Jane App is a Canadian company. For EU customers Jane stores data in the United Kingdom, for which the European Commission has issued an adequacy decision. Transfer to the UK is therefore lawful under the GDPR.
Point of attention: certain features of Jane App make use of external service providers in the United States:
- SMS reminders and Secure Messaging: processing via a US sub-processor. Appointment data may be temporarily stored in the US.
- Telehealth (online appointments): processing may take place via a central server that is not guaranteed to remain within the UK/EU.
For these processing activities outside the UK/EU, Jane App uses standard contractual clauses (SCCs) or equivalent safeguards in line with Art. 46 GDPR. If you prefer not to use SMS reminders or telehealth to minimise transfer risks, you can indicate this to the practice.
A Data Processing Addendum (DPA) has been concluded with Jane App in line with GDPR requirements.
Embody Chiropractie does not receive personal data from other organisations, unless the patient explicitly requests this (e.g. transfer from another care provider).
12. Privacy protocol — information for data subjects
This protocol is intended for patients and website visitors and gives a concise overview of how Embody Chiropractie handles your personal data.
Who we are
Embody Chiropractie BV, KvK 60963689, Paradijslaan 30, Alphen aan den Rijn. Email: hello@embodychiro.nl | Tel: +31 172 26 3073 | Web: embodychiro.nl
Which data we process
From patients: name, address details, date of birth, contact details, identity number, health insurance number, BSN, and medical data.
From website visitors: IP addresses and cookie data.
For what purpose and on what basis
- Medical data: for delivering chiropractic care (legal obligation, WGBO).
- General patient data: for administration and invoicing (performance of the contract).
- Website data: for the technical operation and security of the website (legitimate interest).
- Newsletter: only on the basis of your consent.
Security
Embody Chiropractie considers it important to secure your data properly and has taken organisational and technical measures for that purpose in line with NEN 7510. If you have the impression that your data is not properly secured or there are signs of misuse, please contact us via hello@embodychiro.nl.
Your rights
You have the right to information, access, rectification, erasure, restriction of processing, data portability, and to object. We respond to your request as soon as possible and in any case within 1 month (max. 3 months in special circumstances). There are no costs attached. Send your request to hello@embodychiro.nl.
Retention periods
Personal data is not kept longer than necessary: medical records 20 years after the last change to the file (WGBO), financial administration 7 years, website data 6 months.
Processors
We use Jane App (practice management, servers in the UK), QUIC.cloud (website caching), Google (Google Analytics 4 and Google Ads), Meta Platforms (Meta Pixel and Conversions API) and TikTok (TikTok Pixel and Events API). Processor agreements have been concluded with all processors. We never sell your data.
Cookies
We use technical and functional cookies for the website to work. For statistics and advertising we use Google Analytics 4 (visitor statistics), Google Ads (ad conversions), the Meta Pixel (advertising on Facebook and Instagram) and the TikTok Pixel (advertising on TikTok). These analytics and advertising tools are only fully enabled after you explicitly consent via the cookie banner on this website. Without consent Google places no cookies and stores no identifiers, but minimal technical data is still transmitted that is not stored (including the IP address for country detection and the page URL you visit); the Meta Pixel is not loaded without consent, and without consent Meta only receives minimal, non-stored server-side signals without personal data (Limited Data Use); the TikTok Pixel is not loaded without consent, and without consent TikTok receives nothing. You can change your choice at any time via the "Cookie preferences" button at the bottom of the page or by clearing your browser cookies and showing the banner again.
As a data subject you have the right to file a complaint with the Dutch Data Protection Authority (AP) via www.autoriteitpersoonsgegevens.nl.
Amended 2026-08-25: the "Cookies" section now accurately describes the data transmitted without consent (Consent Mode v2; Google Analytics 4, Google Ads, Meta Pixel). Amended 2026-09-03: choices can now also be changed via the "Cookie preferences" button at the bottom of the page (persistent withdrawal control); Meta's no-consent data receipt clarified (minimal server-side signals only, Limited Data Use). Amended 2026-09-04: TikTok added as processor (TikTok Pixel + Events API, bead 7umv); without consent TikTok receives nothing.