Privacy Policy

BEC., operated by Drs. Rebecca Hietink, provides integrative and lifestyle medicine consultations and related health services in the Netherlands through www.bec-health.com.

The services provided by BEC. include medical and lifestyle consultations, laboratory testing, microbiome testing, and personalised advice relating to nutrition, lifestyle, supplements, stress management and other aspects of health and wellbeing.

I, Drs. Rebecca Hietink, respect your privacy and consider the careful and confidential handling of personal data to be of great importance. I process your personal data in accordance with applicable privacy and healthcare legislation, including the General Data Protection Regulation (GDPR/AVG) and the Dutch Medical Treatment Agreement Act (WGBO).

This Privacy Policy explains what personal data I collect, why I collect it, how I use and protect it, and what rights you have regarding your personal data.

1. Data controller

BEC. is the data controller responsible for the processing of your personal data.

BEC.
Drs. Rebecca Hietink
The Netherlands
Website: www.bec-health.com
Email: info@bec-health.com

If you have any questions about this Privacy Policy or about the processing of your personal data, you can contact me at info@bec-health.com.

2. Personal data

When you use the services of BEC., I may process personal data that you provide directly to me or that is generated as part of your care.

Depending on the services you use, this may include:
- First name and surname
- Date of birth
- Contact details, such as email address and telephone number
- Billing and payment information
- Information provided through questionnaires and intake forms
- Information relating to your health and medical history
- Information about your lifestyle, nutrition, stress, wellbeing and other health-related factors
- Results of laboratory and microbiome investigations
- Information relating to consultations, advice and treatment plans
- Other information that you voluntarily provide in the context of your care

Special categories of personal data

Health information is considered a special category of personal data under the GDPR. Because BEC. provides healthcare and health-related services, health information may be processed when this is necessary for the provision of care and in accordance with applicable legislation.

I treat health information as strictly confidential and process it with appropriate safeguards.

3. Purposes of processing

I process your personal data only where there is a lawful basis for doing so and only for purposes that are relevant to the services provided by BEC.

Your personal data may be processed for the following purposes:
- Providing medical, integrative and lifestyle medicine consultations
- Assessing your health and lifestyle history
- Preparing and documenting consultations
- Providing personalised health and lifestyle advice
- Requesting and interpreting laboratory and microbiome investigations
- Communicating with you about your appointments, results and care
- Scheduling appointments and managing your patient administration
- Processing payments and issuing invoices
- Maintaining your medical and healthcare records
- Complying with legal and professional obligations
- Maintaining the security and quality of my services
- Responding to questions, requests or complaints

Your personal data will not be used for unrelated purposes without an appropriate legal basis.

BEC. does not currently send newsletters or use your health information for marketing purposes.

4. Legal basis for processing

The processing of your personal data is based on the applicable provisions of the GDPR and Dutch healthcare legislation.

Depending on the circumstances, the legal basis may include:
- The performance of an agreement with you
- Compliance with a legal obligation
- The provision and management of healthcare
- Legitimate interests, where applicable and where these interests do not override your fundamental rights and freedoms
- Your consent, where consent is legally required

For the processing of health data, the additional requirements that apply to special categories of personal data under the GDPR are observed.

Where your consent is used as the legal basis for a particular processing activity, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing that took place before the withdrawal.

5. Medical confidentiality

As a physician, I am bound by professional medical confidentiality.

Information relating to your health and treatment is treated as confidential. Personal and medical information will only be shared with third parties where this is permitted or required under applicable legislation, where this is necessary for the provision of your care, or where you have provided the required consent.

In certain circumstances, information may need to be exchanged with other healthcare professionals, laboratories or other parties involved in your care. Such information will only be shared where necessary and using appropriate security measures.

6. Healthcare and laboratory providers

Where laboratory or microbiome testing is requested as part of your care, relevant personal information may be shared with the laboratory or testing provider responsible for carrying out the investigation.

BEC. currently works with, among others:
- EMB
- Labor Stein
- NL-Lab

For laboratory testing, the information shared may include your first initial, surname and date of birth, as necessary to correctly identify and process your sample.

Laboratory providers process personal data in accordance with applicable privacy legislation and their own privacy policies.

7. Service providers and data processors

BEC. uses a limited number of trusted service providers to support the administration and secure delivery of its services.

MijnDiAd: BEC. uses MijnDiAd for the secure administration of patient information, including appointment management, questionnaires, consultation records and other information related to your care. Patient information is stored and processed within MijnDiAd in accordance with applicable privacy and security requirements.

Zivver: BEC. uses Zivver for the secure exchange of sensitive and confidential information, including patient-related information and documents. Where sensitive personal or medical information is shared electronically, secure communication methods such as Zivver are used where appropriate. Zivver uses encryption and additional security measures to protect sensitive communications.

Google Workspace: BEC. uses Google Workspace for business email and other administrative purposes. Your contact information and other information may therefore be processed within Google Workspace where this is necessary for communication and administration. Where external service providers process personal data on behalf of BEC., appropriate contractual and organisational safeguards are put in place where required by law.

8. Sharing personal data with third parties

BEC. does not sell your personal data to third parties.

Personal data will only be shared with third parties where this is necessary for the provision of services, required by law, necessary to comply with professional obligations, or otherwise permitted under applicable privacy legislation.

Where a third party processes personal data on behalf of BEC., appropriate agreements and safeguards are used where required.

9. Retention of personal data

BEC. does not retain personal data for longer than necessary for the purposes for which it is processed, unless a longer retention period is required by law.

Medical records are subject to the statutory retention period under the Dutch Medical Treatment Agreement Act (WGBO). In principle, medical records must be retained for 20 years from the date on which the information was last amended, unless a different statutory requirement or specific circumstance applies.

Financial and administrative records may be subject to separate statutory retention requirements.

10. Security

BEC. takes the security and confidentiality of your personal data seriously and implements appropriate technical and organisational measures to protect personal data against loss, unauthorised access, misuse, unauthorised disclosure or alteration.

These measures include, where applicable:
- Secure access controls and strong passwords
- Multi-factor authentication where available
- Appropriate security measures for computers and devices
- Encrypted communication when sharing sensitive information
- Secure processing and storage of patient information through MijnDiAd
- Secure exchange of sensitive information through Zivver
- Regular attention to software and security updates
- Limiting access to personal data to what is necessary for the provision and administration of care

Because medical information is particularly sensitive, additional safeguards are applied to its processing.

11. Cookies and website use

The BEC. website may use cookies and similar technologies to ensure that the website functions properly and, where applicable, to understand how the website is used.

Where cookies require your consent under applicable legislation, you will be given the opportunity to provide or refuse consent through the website's cookie settings.

Information about the specific cookies used on the BEC. website will be provided in the applicable cookie policy.

12. Your rights

Under the GDPR, you have various rights regarding your personal data. Depending on the circumstances and applicable legal requirements, these include:
- The right to access your personal data
- The right to request correction of inaccurate or incomplete data
- The right to request restriction of processing
- The right to object to certain processing activities
- The right to data portability, where applicable
- The right to withdraw consent where processing is based on consent

You may also request deletion of your personal data in circumstances where this is legally possible.

However, the right to deletion is not absolute. For example, BEC. may be legally required to retain medical records for the statutory retention period and therefore cannot always delete medical information upon request.

You can submit a request concerning your personal data by contacting:

info@bec-health.com

For security reasons, I may need to verify your identity before processing a request concerning your personal data.

I will respond to your request within the period required under applicable privacy legislation.

13. Complaints

If you have concerns about the way BEC. processes your personal data, I encourage you to contact me first so that I can try to resolve the matter with you.

You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) if you believe that your personal data is not being processed in accordance with applicable privacy legislation.

14. Changes to this Privacy Policy

BEC. may update this Privacy Policy from time to time, for example when services, legislation or the way personal data is processed changes.

The most recent version will be published on the BEC. website.

15. Contact

If you have any questions about this Privacy Policy or about the way BEC. handles your personal data, please contact:

BEC.
Drs. Rebecca Hietink
The Netherlands
Email: info@bec-health.com
Website: www.bec-health.com