Privacy statement

Last updated: September 22, 2026

On this page12

1. Who are we
2. Which personal data do we process?
3. What do we use your data for?
4. On what basis are we allowed to process data?
5. With whom do we share personal data
6. Transfer outside the EEA
7. Cookies and similar techniques
8. Retention periods
9. Security
10. Your Rights
11. Questions or complaints
12. Changes

In this privacy statement we explain how we handle personal data via the website chiropractor.nl and within our practice. We process personal data carefully and in accordance with the General Data Protection Regulation (GDPR). Specific legislation also applies to the provision of care, in particular the Medical Treatment Agreement Act (WGBO).

1. Who are we

Spine Medical Center Physiotherapy is the controller for the processing of personal data via the website chiropractor.nl and within the practice.

Legal form: partnership
Chamber of Commerce number: 24478256
Location number: 000004986962
Trade names: Spine Medical Center Physiotherapy · Spine Medical Center Physiotherapy and Orthopedic Medicine · Manual Therapy Trainings
Address: Cor Kieboomplein 227, 3077 MK Rotterdam
Phone: 010-411 27 63
Email: contact@chiropractor.nl

The practice offers physiotherapy on a manual and chiropractic basis and orthopedic medicine according to the Cyriax method (by a doctor). Under the name Manual Therapy Trainings, the partnership also provides education and training for professionals.

This privacy statement applies to the use of the website chiropractor.nl, to our care provision (such as intake, examination and treatment) and to our training activities.

Data Protection Officer (DPO). We are not legally required to appoint a DPO and have not done so. If you have any questions about the processing of your personal data, please contact the practice via the contact details above.

2. Which personal data do we process?

2.1 Via the website

When you visit our website or contact us, we may process the following data, depending on what you enter and use:

Contact form. Your name, email address, possibly your telephone number and your message. This is sent to the practice as an email and is not stored on the website.
Make an appointment online and My environment. Your name, email address, telephone number and date of birth, and the appointment you make. Your appointments are in our Cliniko patient system. If you create an account, we will also store your login details; your password only encrypted.
Technical data, such as IP address, browser data and device type. These are necessary to make the website work and secure.
Search queries without results and non-existent addresses. To improve the website, we store which keywords yielded nothing and which addresses do not exist, without IP address and without other information about you.
Data about your use of the website, only via cookies for which you give permission (see chapter 7).

Important: It is preferable not to send extensive medical information via a web form or e-mail. If medical information is required, we will discuss this safely during a consultation or via an agreed secure channel.

2.2 In practice (care provision)

If you are or become a patient, we also process, where necessary:

Name and address details (name, address, place of residence)
Citizen service number (BSN)
Gender and date of birth
Phone number and email address
A valid ID (to verify your identity and BSN)
Insurance details and details for billing and declaration (if applicable)
Health data (special personal data): complaints, anamnesis, research findings, diagnosis and treatment data
Data from your GP and, if applicable, from other healthcare providers involved
Correspondence with you and, if necessary and on an appropriate basis, with other healthcare providers
The conversation during your consultation, if you agree to have your practitioner prepare the report with the AI assistant Heidi (see Chapter 5)

As a BIG-registered healthcare provider (physiotherapists and a doctor), we are obliged under the Supplementary Provisions for the Processing of Personal Data in Healthcare (Wabvpz) to use and record your citizen service number (BSN) in your file, and to use this when exchanging data with other healthcare providers. To determine that the BSN belongs to you, we ask you to identify yourself with a valid ID.

2.3 Participants in education and training (Manual Therapy Training)

If you follow an education or training with us, we process:

Name and contact details
Information about your profession, registration (number) and employer
Registration and attendance details
Ratings, results and certificates provided
Billing and payment information

We process this data to execute the training agreement, issue certificates and comply with any accreditation and administration obligations. This does not concern medical data.

3. What do we use your data for?

We only process personal data if there is a clear reason for this:

Answering questions and contact and appointment requests
Planning, carrying out and administering consultations and treatments
Keeping a medical file
Invoicing, administration and, where applicable, declaration to the health insurer
Effective management and policy of the practice
Supporting scientific research, education and information (in principle only with anonymized or pseudonymised data)
Organizing, carrying out and administering education and training, and issuing certificates
Improving and securing our website and services
Compliance with legal obligations

In principle, no processing takes place for other purposes. You will be informed that your personal data is being processed, for example by your healthcare provider or via this website.

4. On what basis are we allowed to process data?

We process personal data on the basis of one or more of the following principles from the GDPR:

Execution of an agreement, for example when you ask us to provide care or make an appointment
Legal obligation, for example obligations regarding the medical file or reporting a contagious disease under the Public Health Act
Consent, for example for exchanging data with other healthcare providers or for cookies that are not necessary; you can always withdraw consent
Legitimate interest, for example security of our website, preventing abuse and improving the website
Vital importance, in case of serious danger to your health or that of someone else

Health data is special personal data. In healthcare, these may only be processed under strict conditions, for example when this is necessary for treatment by a healthcare provider with professional secrecy, and with appropriate safeguards.

5. With whom do we share personal data

The employees of the Spine Medical Center Physiotherapy have committed themselves to treating your personal data confidentially. In principle, your explicit consent is required to provide your data to third parties. We only share data if necessary and appropriate for the purpose, for example with:

Other healthcare providers or healthcare institutions, only if this is necessary for your treatment and with an appropriate basis (consent or need for good care). If necessary, recorded data can be exchanged verbally, in writing or digitally with, for example, your GP, medical specialist or pharmacy.
Health insurers or a billing company, to declare and collect treatment costs (if applicable)
IT and hosting service providers, for running and securing the website and our systems. Our patient system is Cliniko; we use Heidi for the consultation report (see below); the website and e-mail are hosted by Dutch and German hosting companies.
Administration and accounting, for financial processing
Training and accreditation bodies, exclusively for participants in our courses and training, for registration of obtained certificates and accreditation points
Government agencies, only if we are legally obliged to do so

There are some legal exceptions to professional secrecy (the duty of confidentiality), for example in the event of a legal requirement or in the event of a serious risk to your health or that of a third party.

When external parties process personal data on our behalf, we conclude a processing agreement where required and make agreements about security and confidentiality.

Reporting with Heidi (AI assistant)

During the consultation, your practitioner can use Heidi, an AI assistant who transcribes the conversation and creates a draft report for your file. This way your practitioner can focus on you instead of the keyboard. Your practitioner will read the report, adjust it where necessary and remain responsible for it.

We only use Heidi if you agree. You can always say that you don't want it, even during the consultation; this has no consequences for your treatment.
The audio recording will not be saved after transcribing. We do not store the transcribed conversation and the concept in Heidi for longer than necessary; the final report is in your file.
Heidi processes the data on our behalf, via Heidi Health Ireland Limited and within the European Union. Heidi does not use your data to train its AI.
We have a processing agreement with Heidi.

Exchange of medication data

After you have given specific written permission for this, we can exchange medication information with your pharmacy and treating medical specialists. This concerns prescribed medication and any intolerances, contraindications and allergies, so that other prescribers and providers can take this into account.

6. Transfer outside the EEA

In principle, we process personal data within the European Economic Area (EEA). Our patient system Cliniko stores our data in the European region; Cliniko itself is an Australian company. Heidi, which we use for the consultation report, also processes our data in the European Union and has an Australian parent company. If data is processed outside the EEA, for example for support by a software or cloud service, we provide appropriate safeguards, such as standard contractual clauses (SCCs) and additional security measures where necessary.

7. Cookies and similar techniques

On your first visit, we will ask you in a cookie window which cookies you allow. Without your permission, we only place the cookies that are necessary for the website to work.

Necessary cookies: to make the website work, for example to remember what choice you made in the cookie window and to keep you logged in to My Environment.
External content: Maps from Google Maps and videos from YouTube will only load with your permission. Google can place cookies in accordance with its own privacy policy.
Statistics: We only use visitor statistics (Google Analytics) with your permission and never for advertisements.

The fonts and images of the website are on our own server; When you visit, your browser does not connect to other parties. You can always change your choice via “Cookie settings” at the bottom of each page. More information can be found in our cookie policy.

8. Retention periods

We do not store personal data for longer than is necessary for the purpose for which it was collected, unless we are legally obliged to keep it for longer.

Medical file: in principle 20 years, calculated from the last change in the file, or as much longer as is reasonably necessary for good care. This is at the discretion of the practitioner.
File of minors: 20 years, calculated from the age of 18.
Contact and appointment requests via the website: as long as necessary to handle your question, and then limited for administration and to be able to find what has been agreed.
Financial and administrative data: according to the legal retention obligation (usually 7 years).

9. Security

We take appropriate technical and organizational measures to protect your personal data against unauthorized access, loss or misuse, such as:

Access Restrictions: Only authorized employees have access
Secure connections and timely system updates
Policy on confidentiality and data protection, with a duty of confidentiality for all employees

10. Your Rights

You have various rights under the GDPR and the WGBO. You can submit a request to us for:

Inspection of the personal data that we process about you, and a copy thereof (insofar as this does not harm the privacy of someone else). You can use a statement to transfer your data to another practice (data portability).
Correction or addition of incorrect or incomplete data
Deletion or (partial) destruction of your data. A request for destruction of medical data can only be complied with if storage is not of significant importance to someone else and there is no legal obligation to retain data.
Restriction of processing
Objection to processing based on legitimate interest
Adding a self-declaration (of a medical nature) to your file
The withdrawal of consent, if the processing is based on it

How to exercise your rights

Send your request by email to contact@chiropractor.nl or contact the practice by telephone. To protect your privacy, we may ask you to identify yourself.

Your interests can also be represented by a representative (such as a written representative, curator or mentor). Please include the details of the person who is the subject of the file.

Under the WGBO, a patient aged 16 years or older is considered an adult. Young people aged 16 and over must submit a request for inspection or a copy of their own file.

If the patient has died, provision of medical data is only permitted if it can be assumed that the deceased would not have objected to this, or if there are compelling interests in breaking the obligation of confidentiality. This decision lies with the healthcare provider.

You can collect a file personally or have it collected by an authorized representative, where receipt will be signed for.

The exercise of your rights is free of charge, unless your request is manifestly unfounded or excessive, in particular due to its repetitive nature.

Transfer of your file

If you choose a different practitioner or practice, you can ask us to make your file available to you.

11. Questions or complaints

Do you have a question or complaint about how we handle your personal data, for example about who we share data with or about the handling of your medical data? Please contact us first; your practitioner will be happy to discuss this with you.

If you are unable to resolve the matter with the practice, you can contact the independent complaints officer and, if necessary, the dispute resolution body to which our practice is affiliated, within the framework of the Healthcare Quality, Complaints and Disputes Act (Wkkgz). You can read how this works and where you can go in our complaints procedure.

You can also always file a complaint with the Dutch Data Protection Authority via autoriteitpersoonsgegevens.nl.

12. Changes

We may adjust this privacy statement, for example in the event of changes in legislation or in our services. The most current version is always on this website.