1. Data controller

Campus UT General Practice, located at Campuslaan 99, Building 58 (De Sleutel), 7522 NJ Enschede, is responsible for processing your personal data. Chamber of Commerce: 08172455. AGB code: 01-093456.

You can reach us at info@campushuisarts.nl or on 053 - 20 30 204.

2. Which data do we process?

We process the following categories of personal data:

Identification data: name, date of birth, gender, citizen service number (BSN), address, telephone number, e-mail address.
Insurance data: insurer, policy number, UZOVI code.
Medical data: your medical record (complaints, diagnosis, treatment, medication, test results, correspondence with other care providers).
Communication data: correspondence by phone, e-mail or the patient portal.
Logging: who accessed your record and when (for auditing and security).

3. Why do we process your data?

To provide general practice care.
To claim your care from your health insurer.
To communicate with other care providers (specialists, pharmacists, hospitals) with your consent.
To comply with legal obligations (for example the Dutch Medical Treatment Agreement Act, WGBO).
Quality monitoring and improvement of our care.
Sending appointment reminders or newsletters (only with your consent).

4. On what legal basis do we process?

We process your data on the basis of:

Treatment agreement: the care you receive from us (Article 6(1)(b) GDPR).
Legal obligation: WGBO, the Health Insurance Act and the Act on additional provisions for the processing of personal data in healthcare.
Your explicit consent: for processing medical data (Article 9(2)(a) GDPR) and for optional matters such as newsletters.
Vital interests: in emergencies when you cannot give consent yourself.

5. How long do we keep your data?

We keep your medical record in line with the statutory retention period of 20 years (Article 7:454 of the Dutch Civil Code), counted from the last treatment. For minors the period starts when they reach the age of majority.

Temporary data you submit through our website (for example a registration form or prescription request) is kept for a maximum of 30 days after it has been handled. After that it is automatically deleted from our interim storage.

Audit logs of who viewed what are kept for 5 years.

6. With whom do we share your data?

We only share your data with third parties when this is necessary for your care or when we are legally obliged to do so. These may be:

Other care providers (specialists, pharmacists, physiotherapists) — with your consent.
Your health insurer — for claims.
The out-of-hours GP service in Enschede — for urgent care outside office hours.
The National Switch Point (LSP) — only if you have given explicit consent.
Vecozo — to check your insurance details (COV check).

7. Processors

To deliver our services we use a number of external parties that process your data on our instructions. We have concluded GDPR-compliant processing agreements with all of them. The main processors are:

Tetra HIS — our GP information system (medical records).
Supabase (EU region): temporary storage of registrations and requests before processing.
Vercel (EU region): hosting of our website and patient portal.
Resend: sending confirmation e-mails and correspondence.
Vecozo / Vektis: insurance checks (COV).

We select our processors carefully and make sure they meet the same security standards as we do. We avoid data transfers outside the EU as much as possible; where unavoidable, they take place on the basis of standard contractual clauses (SCCs) or an adequacy decision.

8. Security

We take appropriate technical and organisational measures to protect your data against loss, unauthorised access, destruction or alteration. Specifically:

Encrypted connections (TLS) for all data traffic.
Encryption of sensitive fields in our databases.
Multi-factor authentication for all our staff.
Strict access rights — only the clinician treating you has access to your record.
Audit logging of all access and changes.
Regular security testing.

9. Your rights

Under the GDPR you have the following rights regarding your personal data:

Right of access — you may view your record.
Right to rectification — you may have incorrect data corrected.
Right to erasure — within the legal limits of the retention obligation.
Right to restriction of processing.
Right to data portability — you can request a copy of your data.
Right to withdraw consent — for processing based on your consent.
Right to object — to certain processing.

You can submit a request via info@campushuisarts.nl or in writing by post. We ask you to enclose a copy of valid photo identification (you may black out your BSN and photo). We respond within 30 days.

10. Complaints

Do you have a complaint about how we handle your data? Please discuss it with us first — we would like to resolve it. If we cannot reach a solution together, you can lodge a complaint with the Dutch Data Protection Authority.

11. Changes to this statement

We reserve the right to amend this privacy statement, for example when legislation changes. We advise you to check this page periodically for the most recent version.

Questions? E-mail info@campushuisarts.nl or call 053 - 20 30 204. Our data protection officer can be reached at the same address.

Urgent care

Life-threatening

During the day (weekdays 08:00–17:00)

Evenings, nights and weekends