Privacy & Data Protection Policy

The data controller is Expat Health Clinic | Suki Health, registered with the Dutch Chamber of Commerce (KvK) under number 83221638, with its registered (correspondence) address at Gravin Juliana van Stolberglaan 31, Box A63, 2263 AB Leidschendam, Zuid-Holland, Nederland. This address is not a clinic site.

For any question about this policy or to exercise your rights, contact our data protection contact at privacy@expathealthclinic.com or care@expathealthclinic.com.

Depending on how you interact with us, we may process the following categories of personal data:

• Identity and contact data – name, email address, telephone number, date of birth, nationality and preferred language.
• Appointment data – requested service, chosen location, appointment date and time, and booking references generated by our booking platform.
• Medical data (special category data) – health concerns you share with us, medical history, medication, examination results, referral letters, second-opinion documents and consultation notes.
• Insurance and billing data – insurer name, policy number, invoices and payment status. We do not store full card details; payments are processed by our booking and payment providers.
• Corporate / TPA data – company name, contact person and case references when we act on behalf of an employer, insurer or third-party administrator.
• Website usage data – IP address (anonymised for analytics), browser type, pages visited and interactions, only if you consent to analytics cookies.
• Website assistant conversations – text or audio you share with our automated assistant, only if you consent to loading it (see section 7).

• Providing medical care (consultations, screenings, second opinions, referrals) – Article 9(2)(h) GDPR together with the treatment contract under the WGBO and Article 6(1)(b) GDPR.
• Maintaining a medical record – legal obligation under the WGBO (Article 6(1)(c) GDPR).
• Scheduling, invoicing and administration – performance of a contract (Article 6(1)(b)) and legal obligations under Dutch tax law (Article 6(1)(c)).
• Responding to enquiries submitted via our contact form, email or telephone – legitimate interest (Article 6(1)(f)) and, where health information is included, your explicit consent (Article 9(2)(a)).
• Corporate and TPA services – performance of the agreement with the organisation, and your explicit consent or the treatment relationship for any medical data.
• Website analytics and the automated assistant – your consent (Article 6(1)(a)), which you can withdraw at any time via the "Cookie preferences" link in the footer.
• Safety, security and legal claims – legitimate interest (Article 6(1)(f)).

We never sell personal data and we do not use medical data for marketing.

We share data only where necessary and with parties bound by confidentiality and data processing agreements:

• Our physicians and medical staff, who are bound by medical professional secrecy.
• Your regular GP (huisarts) or other healthcare providers – only with your explicit permission, for example when we send a referral or consultation summary.
• Booking and payment platform (Trafft) – for appointment scheduling and payments.
• Website hosting (Vercel Inc.) – for serving this website and, with consent, privacy-friendly visitor statistics.
• Google Ireland Ltd. (Google Analytics) – only with your consent; IP anonymisation is enabled.
• ElevenLabs Inc. – provider of our automated website assistant; only loaded with your consent.
• Email and document providers used for secure communication and record storage.
• Insurers, employers or TPAs – only the information you have authorised us to share, or where they are the contracting party for your care.
• Authorities – where required by law, for example the Dutch Health and Youth Care Inspectorate (IGJ) or tax authorities.

Some providers (Vercel, Google, ElevenLabs) may process data outside the European Economic Area, mainly in the United States. Where this happens we rely on the EU–US Data Privacy Framework and/or the European Commission's Standard Contractual Clauses, together with additional safeguards. Medical records themselves are stored within the EEA.

• Medical records – at least 20 years after the last change to the record, as required by the WGBO, or longer where good medical practice requires it.
• Financial and invoicing records – 7 years, as required by Dutch tax law.
• Contact form and email enquiries that do not lead to a treatment relationship – up to 12 months.
• Analytics data – up to 14 months (Google Analytics default) in aggregated form.
• Assistant conversations – retained by ElevenLabs according to their retention settings and our processing agreement; we do not add them to your medical record unless you ask us to.
• Cookie consent choice – 6 months.

When you first visit, only strictly necessary cookies are set. Optional tools are loaded only after you click "Accept all" in the cookie banner. You can change your choice at any time via the "Cookie preferences" link in the footer.

• Essential – ehc_cookie_consent stores your cookie choice (6 months).
• Analytics (optional) – Google Analytics (_ga, _ga_*, up to 14 months) and Vercel Analytics (cookieless, aggregated) help us understand how the website is used.
• Website assistant (optional) – the EHC Assistant is an automated conversational tool provided by ElevenLabs. It answers general questions about our services. It is not a doctor, does not provide medical advice or diagnosis, and must not be used in an emergency (call 112). Please avoid sharing detailed medical information with it; use the contact form or book an appointment instead.

We apply appropriate technical and organisational measures, including encrypted connections (TLS), access controls limited to staff who need the data, confidentiality obligations for all staff, data processing agreements with suppliers, and regular review of our systems. Medical information is handled in line with the NEN 7510 information security principles for Dutch healthcare.

Email is not fully secure. If you prefer, you can share sensitive documents during your appointment or ask us for a secure upload option.

Under the GDPR and the WGBO you have the right to:

• access your personal data and receive a copy of your medical record;
• have inaccurate data rectified or supplemented;
• request erasure, subject to our statutory retention duties for medical records;
• restrict or object to processing based on legitimate interest;
• receive your data in a portable format;
• withdraw consent at any time, without affecting processing that took place before withdrawal;
• lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl).

To exercise a right, email privacy@expathealthclinic.com. We respond within one month and may ask you to verify your identity before releasing medical information.

We treat children and families. For patients under 16, we process data with the consent of a parent or legal guardian in line with the WGBO, and we involve children aged 12 to 15 in decisions about their own care as the law requires.

We may update this policy when our services or the law change. The date at the top shows the latest version. Material changes will be highlighted on this page.

See also our Terms & Conditions, including our complaints procedure.