Others (including patients' contact persons, visitors to
the AVL, subscribers to the newsletter/magazine, training
participants, volunteers, contact persons of suppliers &
cooperation partners, WiFi users and website visitors)
Antoni van Leeuwenhoek (hereinafter: AVL) prioritises the
careful handling of personal data. In addition to the personal data
of patients (see https://www.avl.nl/footer/privacy-statement/)
and employees, personal data are also processed for various other
categories of people involved with the hospital. Via this privacy
statement, we provide information on how we handle personal data.
The protection of personal data is regulated by law, including the
Medical Treatment Contracts Act (WGBO) and the General Data
Protection Regulation (GDPR). This privacy statement has been
drafted in accordance with the requirements of the GDPR.
1. Who is responsible (the processor) for the processing
of your personal data?
AVL (Formally: The Netherlands Cancer Institute - Antoni van
Leeuwenhoek Hospital) is the one responsible (the processor) for
the processing of your personal data. AVL has a Data Protection
Officer (FG) who supervises the processing of personal data with
regards to compliance with applicable laws and regulations. You can
reach the FG via firstname.lastname@example.org
2. What personal data do we process?
We record contact details, such as the name and e-mail address,
for patients' contact persons, subscribers to the
newsletter/magazine, participants in training courses, volunteers
and the contact persons of suppliers and cooperation partners. For
visitors to the AVL who use the Wi-Fi network and for visitors to
our website, we record the source and destination IP addresses, as
well as data from the device on which the Wi-Fi network was used,
the host name (the name you assign to your device, e.g.
iPhoneJeroen), MAC address, when you register your device and
obtain a local IP address, the websites visited and the network
protocols utilised.In addition, camera images are made of visitors
to the AVL.
3. For what purposes do we process your personal
The contact details are used to maintain contact when
communication with a patient is (temporarily) not possible or
because a patient's contact person has been designated as his/her
(legal) representative. In the context of the treatment agreement,
information relating to the treatment of the patient is
subsequently discussed with the contact person. In addition,
contact details are used to process requested information, to send
information relating to a course or to distribute the newsletter.
The processing of dataover the Wi-Fi network and during website
visits occurs, on the one hand, for support and diagnostics
purposes in case of problems and, on the other hand, for the
continuity and security of the network and for analytical purposes
(see also our statement on cookies: https://www.nki.nl/nkifooter/privacy-statement/).
We also use tracking cookies from Google so that you see relevant
and personalised ads on other websites, based on your surfing
behaviour. For example, you might be shown a vacancy or an
interesting event in our institute.
Camera images are recorded to protect employees and visitors of
the AVL and/or to prevent damage to property of AVL or those using
the building and/or to detect persons who may have committed a
criminal offence or an unlawful act.
4. What is the basis for the processing of your personal
- The processing is
necessary for the execution of an agreement in which you are
involved, such as a medical treatment agreement, a training
agreement or a supplier agreement;
- You have provided
unambiguous consent for the data processing, such as your statement
as a contact person or for registration for the newsletter;
- The processing is necessary to comply with a legal obligation,
for example, due to a court order;
- The processing is
necessary to protect your vital interests, such as the use of a
care provider in the event of a calamity;
- The processing is
necessary in view of a legitimate interest of the AVL, such as
measures in the interests of operational safety.
5. How long do we keep your personal data?
We only process your personal data insofar as this is necessary
for the purposes as described in this Privacy Statement. If the
personal data is no longer relevant, we will destroy or anonymise
it. The information that we receive from you, as a contact person,
for the treatment of a patient is included in the patient's medical
record. We are legally required to keep your medical record for at
least fifteen years after the conclusion of the treatment
agreement. We can retain this information for longer if this is
legally required or necessary for proper assistance or care. In
case a volunteer provides permission to that effect, after the
activities have concluded, the name and address details and the
date of termination will also be stored after the specified
retention period for the purposes of relationship management.
The data logged from the use of our Wi-Fi network or from visits
to our website is stored for twenty days. The cookies we use from
Google are not automatically deleted. Therefore, you will need to
remove them yourself. The retention period of camera images is, in
principle, four weeks.
6. Who will receive your personal data?
In the context of the treatment agreement, it may be necessary
to involve various care providers from the AVL or from other
healthcare facilities. In that case, the attending physician may
provide these healthcare providers with the information necessary
to treat the patient and, consequently, the details of the
patient's contact person. Data from participants in training
courses and volunteers are provided to internal management within
the AVL. Third party cookies are installed (e.g. from YouTube)
during visits to the website of AVL (with your permission). With
that, these third parties receive your IP address. See
Third parties will also receive your personal data if it needs
to be provided for the implementation of a law or court order or if
it is necessary to protect your vital interests.
7. Is your personal data processed outside the
Your IP address is shared, by installing
cookies, with parties from countries outside of the European Union,
including the United States. In an agreement with these parties, we
have set out for what purposes the data may be used, how the data
should be handled and how the data should be protected.
8. How do we protect your personal data?
We have taken and/or commissioned appropriate technical and
organisational security measures to protect your personal data
against loss or unlawful use. We secure our systems according to
the applicable standards for information security, and we also make
agreements about this with our service providers. Within the AVL,
personal data is only accessible to those who are allowed to
process this data. For the other situations, access to your
personal data will only be granted to third parties if we have a
valid reason for doing so.
9. Automated decision making and profiling
Automated decision-making and profiling is not applicable at
10. Your rights regarding your personal
- Right to forgetfulness: this concerns the right to be
- Right of inspection: this concerns the right to view your
personal data or request a copy;
- Right to rectification and supplementation: this concerns the
right to change your personal data if it is factually
- Right to restriction of processing: this concerns the right to
have less data processed;
- Right to object to data processing;
- Right to data portability: you can request that AVL hand over
the data you have supplied digitally so that you can make it
available to other organisations;
- The right not to be subject to a decision based solely on
automated processing (NB: this is currently not the case within the
To exercise your rights, you can contact us by e-mail: email@example.com.
We may ask you to prove your identity as a result of your
Anyone whose personal data is processed has the right to file a
complaint with the competent authority in case of (possible)
violations of the applicable law with regard to the protection of
personal data. In this case, this is the Dutch Data Protection
Authority. You can find more information on the website
This Privacy Statement can change from time to time. We
encourage you to consult this Privacy Statement from time to time.
If the changes so require, we will ask you to agree again on the
data processing as described in the Privacy Statement.
If you have a question about the way in which we process your
personal data, please contact the Data Protection Officer. You can
reach the FG via firstname.lastname@example.org. You can also
contact the Patient Information Center in the central hall of the
AVL (Plesmanlan 121, Amsterdam) or call 020-5129111. If you have
questions about your rights, you can contact us by e-mail: email@example.com.
25 May 2018