Privacy Notice

1. Who we are

Digitale Balie provides a digital frontdesk for GP practices. Patients can submit regular requests in a structured way and practice staff can manage those requests.

2. Scope

This notice covers the website, demo/contact forms, free trial signup, practice accounts, platform administration, staff dashboard, and patient request forms.

It does not cover third-party patient portals. If a practice uses a separate portal, that portal has its own privacy notice.

3. Our role

For marketing, contact, free trial, account management, support, security, and administrative communication, Digitale Balie acts as controller.

For patient requests submitted through a GP practice's digital frontdesk, the GP practice determines the purposes and means of processing. Digitale Balie processes this data on behalf of the practice.

4. Data we process

Digitale Balie does not intentionally collect BSN and asks users not to enter unnecessary detailed medical information.

• Website/contact/demo: name, email, phone if provided, organisation, message, interest type, and technical logs.
• Free trial: owner, work email, phone, password hash, practice name, website, practice contacts, address, opening hours, portal setup, flows, languages, and trial status.
• GP staff: name, email, role, practice membership, login/session information, and audit events.
• Patient requests: name, date of birth, contact details if provided, preferred language, request type, structured details, short note, status, and handling notes.
• Analytics: aggregated counts, request types, languages, and usage statistics without patient personal data where possible.
• Security: login attempts, audit logs, request IDs, system logs, and IP/user-agent hashes for security and rate limiting.

5. Purposes and legal bases

For controller processing we rely on contract, steps before contract, legitimate interest, and legal obligation where applicable. For patient requests, Digitale Balie processes only on documented instructions from the practice; the practice is responsible for its lawful basis.

• Provide the service, create trial accounts, and configure GP practice workspaces.
• Route patient requests to the relevant GP practice and allow staff to manage them.
• Provide analytics and reporting to practices.
• Respond to contact and demo requests.
• Secure the platform, prevent abuse, and comply with legal obligations.

6. Special category data and emergencies

Patient requests may include health-related information. Digitale Balie does not provide diagnosis, medical advice, urgency assessment, or AI triage.

Patients are asked not to enter unnecessary or extensive medical information, BSN, or emergency details. For urgent matters, patients must contact the practice, out-of-hours GP service, or 112 directly.

7. Access and subprocessors

See the subprocessors page for the current list.

• Authorized GP practice staff.
• Authorized Digitale Balie platform administrators for support, security, and operations.
• Subprocessors for hosting, database, email, and logging/monitoring.
• Authorities where required by law.

8. International transfers

We aim to use EU/EEA hosting where possible. If data is transferred outside the EEA, appropriate safeguards will be used.

9. Retention

• Contact/demo inquiries: up to 12 months unless longer retention is needed for business or legal reasons.
• Trial, account, and practice data: while the account, trial, or agreement is active and afterwards according to applicable policy.
• Patient requests: according to GP practice configuration and DPA; suggested default 90 days after closure unless configured otherwise.
• Audit logs: for security and accountability, suggested 12 to 24 months.
• Aggregated or anonymized analytics may be kept longer.

10. Security

• TLS in transit, role-based access, password hashing, and audit logging.
• Tenant isolation, input validation, backup/availability measures, and limited admin access.
• No BSN collection, no file upload by default, and log minimization/no patient PII in logs where possible.
• We are working towards security practices aligned with healthcare expectations.

11. Rights

For data where Digitale Balie is controller, you may request access, rectification, deletion, restriction, objection, and portability where applicable. You may also complain to the Dutch Autoriteit Persoonsgegevens.

For patient request data, patients should primarily contact their GP practice. Digitale Balie will assist the practice where required.

12. Cookies

Digitale Balie currently uses essential cookies for login, sessions, and security. No advertising or tracking cookies are used unless added later with appropriate consent.

13. Contact and changes

We may update this notice. The date above shows the current version. Privacy questions: office@thepadel.pl. General questions: office@thepadel.pl.