Privacy Policy
Last updated: August 20, 2026
At Echos & Roots, I am committed to protecting your privacy. This Privacy Policy explains how I handle your personal and medical data in accordance with the European General Data Protection Regulation (GDPR / AVG) and the Dutch Medical Treatment Contracts Act (WGBO).
As a solo acupuncture practitioner, I am the Data Controller responsible for processing your personal data.
1. Data I Collect and Why
I only collect personal data that is strictly necessary to provide you with safe acupuncture treatments and to manage my practice responsibly.
* Contact & Administrative Data: Your name, address, phone number, email address, and date of birth.
* Why: To schedule appointments, contact you regarding your treatments, and process invoices.
* Medical & Health Data: Your medical history, current symptoms, lifestyle habits, and treatment notes.
* Why: To safely diagnose and treat you, and to maintain a legally required medical file under the WGBO.
* Website Contact Form Data: Any information you actively type into the contact form on my website.
* Why: To reply to your inquiries or booking requests.
2. Legal Grounds for Processing
Under the AVG, I process your data based on the following legal grounds:
1. Execution of a Contract: To provide the acupuncture treatment you have requested.
2. Legal Obligation: To comply with Dutch medical administrative laws (WGBO) and tax regulations (Belastingdienst).
3. Explicit Consent: For sensitive health data, which you provide when filling out an intake form or during our first consultation.
3. Data Sharing with Third Parties
I will never sell your personal data. I only share your data with trusted third-party service providers (Data Processors) necessary to run my practice, including:
* My invoicing and accounting software (wix).
* My website hosting platform (Wix), which securely hosts my online contact forms.
All third-party processors are legally bound by strict Data Processing Agreements to ensure your data remains confidential and secure. I will only share your medical details with other healthcare professionals (like your GP) if you give me explicit, advance permission.
4. How Long I Keep Your Data
I do not store your data longer than legally required:
* Medical Dossiers: Legally kept for 20 years from the date of your last treatment, as strictly mandated by the Dutch WGBO.
* Financial & Billing Records: Kept for 7 years to comply with the statutory retention period of the Dutch Tax Authority (Belastingdienst).
* Website Inquiries: Deleted from the website platform within 30 days once the inquiry has been handled or transferred to your secure patient file.
5. Security Measures
I take the protection of your data very seriously. I use industry-standard security measures to prevent loss, theft, or unauthorised access. This includes:
* Password-protected, encrypted devices and professional healthcare software.
* Two-factor authentication (2FA) on accounts where personal data is stored.
* Secure physical storage (locked cabinets) for any paper-based records.
6. Your Rights
Under the AVG, you have the following rights regarding your personal data:
* The right to access and view the personal and medical data I hold about you.
* The right to correct or update incorrect data.
* The right to request the deletion of your data (please note: this right is limited by the WGBO law, which legally requires me to keep medical files for 20 years).
* The right to withdraw your consent for data processing at any time.
7. Contact Details
If you have any questions about this Privacy Policy, or if you wish to exercise your rights, please contact me directly:
Echos & Roots
+31649266042
KvK Number: 85249513
If you believe your data is not being handled correctly, you also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).