Privacy policy

This is a courtesy translation. The Dutch version is legally binding.

Last updated: 5 September 2026. This statement covers everything you entrust to us through vatankliniek.nl: the registration form, the contact form and the measurement tools on the website.

Who processes your data

The controller is:

• Vatan Kliniek B.V., Bijlmerdreef 1169-4, 1103 TT Amsterdam, the Netherlands
• Chamber of Commerce 34393504
• info@vatankliniek.nl, +31 20 262 35 36

If you have a question or a request about your data, email info@vatankliniek.nl with "privacy" in the subject line. That way your message reaches the right person straight away.

What data we process

Through the registration form:

• About the patient: first name, surname and date of birth. For a very young baby we ask whether he weighs more than three kilos.
• About the person registering: first name, surname, the relationship to the patient (mother, father or guardian) and whether custody is sole or shared. With shared custody, also the name and telephone number of the second parent.
• Address, telephone number, WhatsApp number and email address.
• Your preferred location and roughly when you would like to come.
• Medical questions: medication and whether it includes blood thinners, clotting disorders, known conditions, allergies, fear or tension with your own explanation, excess weight, whether you want sedation, whether there is a medical indication with a referral, and the name, telephone number and town of the general practitioner.
• If you reached our site through an advertisement: the click number that Google attaches to that advertisement, and the choice you made in the cookie banner. This lets us see which advertisements lead to a registration. That number says nothing about you personally and we do not use it to recognise you on other websites.

Those medical questions are health data. The law calls this special category personal data and protects it more strictly. We do not ask out of curiosity: blood thinners, a clotting disorder or an allergy to anaesthetic determine whether a procedure can go ahead safely and how the doctor prepares for it. All but one are yes or no questions; we ask for an explanation only when you answer yes.

Through the contact form: your name, email address, your telephone number if you give it, the subject and your message. What you write there is up to you. People sometimes describe their medical situation, and we then treat that message just as confidentially as a registration.

Technical: your IP address, the language you used the site in and the time you sent the form. In addition, the data from cookies and measurement tools, but only if you consent to those; more on that below.

Why we use that data, and on what legal basis

• To prepare and safely carry out the treatment. Basis: the treatment agreement with you (Article 6(1)(b) GDPR). For the medical questions, the law also allows care providers to process health data for the care itself, under medical confidentiality (Article 9(2)(h) GDPR and the Dutch Medical Treatment Agreement Act, the WGBO). During registration we ask you to confirm that you have read this statement. That is not a separate consent: the processing rests on the grounds named above, so withdrawing such a confirmation does not affect your record. Consent for the treatment itself is asked separately, earlier in the form.
• To stay in touch about the appointment, such as the confirmation email and the reminder a few days beforehand. Basis: the treatment agreement.
• To answer your question from the contact form. Basis: your own request, and our legitimate interest in being reachable (Article 6(1)(f) GDPR).
• To prevent misuse of the forms. For this we keep the IP address briefly. Basis: legitimate interest. Without that brake an open form fills up with automated messages and real registrations get lost.
• To ask about your experience after you have been treated. Basis: legitimate interest in improving care. You can opt out and will then receive nothing further.
• To keep statistics and measure advertising. Basis: your consent (Article 6(1)(a) GDPR), which you can always withdraw.

We do not use your data for anything else. We do not sell it and we do not rent it out.

Do you have to fill in everything?

You are never obliged to register through the website. If you do, most fields are necessary: without a name, date of birth and contact details we cannot make an appointment, and without the medical questions the doctor cannot prepare the procedure safely. The details of your general practitioner are optional. If you would rather not enter something on the website, call us and we will go through it with you by telephone.

Children

Most patients are minors. A parent or guardian then registers and gives consent. With shared custody the consent of both parents is required; if only one parent comes along, we ask for a signed consent declaration from the other beforehand. From the age of twelve the patient has a say under the WGBO, and from sixteen decides independently.

How long we keep your data

We delete as little as possible, but we do not keep what we no longer need.

• The answers to the medical questions: twelve months, where no treatment followed. The server then deletes them automatically, while your name and contact details simply remain. You lose nothing by this: a doctor may not rely on medical information that is a year old, so if you register again later we will ask those questions afresh.
• The registration itself: five years, where no treatment followed. Parents often take a long time to decide and come back years later for a second child. For that period we keep your name, contact details and preferred location.
• If you were treated, the registration forms part of your medical record. The retention obligation from the WGBO then applies: at least twenty years, counted from the last change to the record, and longer where good care requires it. You can still ask for your record to be destroyed; see your rights below.
• A message from the contact form: two years.
• Your IP address: three months. After that we erase it while the rest of the message stays.
• Cookies each have their own lifetime. You can delete them yourself at any time through your browser.

Before a registration is deleted, we count it in a monthly overview: how many registrations came in that month, for which location, for which age group, in which language and through which advertisement. It contains no name, no address and nothing medical, and cannot be traced back to you. We do keep that overview; it is how we maintain our annual figures and our planning.

Who else sees your data

Within the clinic: the doctor and the staff of the location you visit, and the scheduling team. They all have a duty of confidentiality, and the practitioners are additionally bound by medical confidentiality.

Outside the clinic we engage companies that provide the technology. They may use your data only for the work we instruct them to do:

• the party that runs the website and the server;
• the party where the database is hosted;
• the email provider that sends the confirmation and the reminder;
• the calendar system in which the appointment is scheduled;
• the translation service that translates an explanation written in another language into Dutch for the clinic. Only the free text is sent there, never your name, address or contact details, and the translation is shown alongside the original.

Beyond that we pass on nothing, unless the law obliges us to. If you have a medical indication with a referral and want to claim the costs, we provide only what your health insurer needs for that, and only at your request.

Where your data is held

Your registration and your message are stored within the European Union. The website itself and the server that processes your registration also run there. The measurement tools below may process data outside the European Union, which is why we load them only after you have given consent, and no medical data ever goes to them.

How we protect your data

• All traffic with the website runs over an encrypted connection.
• The answers to the medical questions are stored separately from the rest of the registration, so that access to them can be arranged separately.
• The contents of a form never end up in our log files; they are left out when logs are written.
• Email containing patient data goes only to the clinic's own mailbox. We are working on a safer route, in which that email only reports that a new registration is ready and the medical data stays in a protected environment.

No automated decisions

No computer makes decisions about you here. What you fill in is read by a person. The cost indication you see at the end of the form is a calculation as well, not a decision.

Your rights

You have the right to:

• access your data and receive a copy of it;
• have it corrected if something is wrong;
• have it erased;
• restrict the processing, for example while a correction is pending;
• object to processing based on legitimate interest, such as the experience email;
• take your data with you to another care provider in a common file format;
• withdraw consent you gave earlier. That applies from the moment you tell us and does not affect what has already happened.

Send your request to info@vatankliniek.nl. We respond within one month. Because this concerns medical data we may first ask you to prove that you are who you say you are; that is not a formality, but the only way to prevent us from handing someone's record to another person. If the registration belongs to a treatment that has taken place, the WGBO applies to it. You can then ask for your record to be destroyed. We carry out such a request unless the law prevents it or someone else has a substantial interest in the data being kept. If we refuse a request, we explain why.

Not satisfied?

Tell us first and we will put it right. If we cannot resolve it together, you can lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl, or with the privacy supervisory authority of the country where you live. If your complaint is about the care itself rather than your data, please see our complaints procedure.

Cookies and measurement tools

On your first visit we ask for your choice in a window with four categories. Only the necessary category is always on; the other three are off until you switch them on yourself. As long as you have not made a choice, we load no measurement tools and place no third-party cookies.

• Necessary: always on, for your language choice, the security of the website and remembering your cookie choice itself.
• Media: videos from YouTube. Without consent we show an image instead of the video and nothing is requested from YouTube.
• Statistics: how many people visit the website and which pages they view.
• Marketing: measuring which advertisement led to a registration.

Which parties we engage

For statistics and marketing we use Google Tag Manager. It contains the following tools:

• Google Analytics: visitor statistics.
• Google Ads: measuring which advertisement led to a registration.
• Meta pixel: the same purpose, for advertisements on Facebook and Instagram.
• Contentsquare: insight into how visitors use the pages.

In addition we use Microsoft Clarity, separately from the Tag Manager. This tool shows how visitors use the pages: where they click, how far they scroll and at which point they drop out. To do so, Clarity also captures the structure of the page and plays it back as a recording. In the registration form that recording is shielded: what you fill in and tick is replaced by unreadable characters, so your details and your answers to the medical questions do not end up in it. Clarity, too, is loaded only after you have consented to statistics.

These parties may process data outside the European Union. We never pass on medical data to them. What can be inferred from the page you view is what you are interested in. That is precisely why we load these tools only after you have given consent.

Changing or withdrawing your choice

You can adjust your choice at any time via Cookie settings at the bottom of every page. You can also block or delete cookies through your browser settings; your browser's website has more information about that.

Changes to this statement

If anything changes in the way we handle your data, we will amend this text and change the date at the top. In the event of a significant change we will notify the people who have a registration with us at that time.