PRIVACY AND PERSONAL DATA PROTECTION POLICY

Effective from: 4 October 2026

This Privacy Policy sets out the rules for the processing and protection of the personal data of patients, their parents, legal guardians and other persons who contact the private speech and language therapy practice operating under the name Polski logopeda w Holandii, run by Anna Maria Twarogowska in the Netherlands.

The Practice provides private speech and language therapy services. The Practice does not bill health insurers directly for its services. The Practice does not collect or process patients’ citizen service numbers (BSN).

Protecting patients’ privacy, in particular data concerning health and data relating to children, is of particular importance to the Practice.

This Policy has been prepared taking into account, in particular:

  • Regulation (EU) 2016/679 of the European Parliament and of the Council - the General Data Protection Regulation (GDPR / AVG),
  • Uitvoeringswet Algemene verordening gegevensbescherming - UAVG (Dutch GDPR Implementation Act),
  • the provisions of the Wet op de geneeskundige behandelingsovereenkomst - WGBO (Dutch Medical Treatment Contracts Act), to the extent that they apply to the services provided,
  • other applicable provisions of Dutch law concerning the protection of personal data and patients’ rights.

1. Controller

The controller of personal data is:

Anna Maria Twarogowska, running the practice under the name Polski logopeda w Holandii and acting as a sole proprietorship (eenmanszaak) registered with the Chamber of Commerce (Kamer van Koophandel) under the name A.M. Chachulska

Legal form: Eenmanszaak (sole proprietorship)
KvK-nummer: 63837706

Practice address:
Produktieweg 44 G
2382 PC Zoeterwoude-Rijndijk
the Netherlands

Telephone: +31 6 24239868
Email: logopedawholandii@gmail.com

hereinafter referred to as “the Practice” or “the Controller”.

Anna Maria Twarogowska conducts her business as a sole proprietorship (eenmanszaak) registered with the Chamber of Commerce (Kamer van Koophandel) under the name A.M. Chachulska.

The name Polski logopeda w Holandii is the name used by the Practice in its communication with patients, on its website and on social media.

For matters relating to the protection of personal data, you can contact the Controller using the details given above.

2. What personal data does the Practice process?

The scope of the data processed depends on the type of contact and the service provided. The Practice collects only the data needed for a specific purpose.

Identification and contact data

This may include:

  • the patient’s first name and surname,
  • date of birth,
  • home address, where necessary,
  • telephone number,
  • email address,
  • details of the parent or legal guardian in the case of a minor.

The Practice does not collect or store patients’ BSNs.

Data concerning health and development

In connection with speech and language assessment and therapy, information may be processed concerning, in particular:

  • speech and language development,
  • communication,
  • pronunciation,
  • oral functions,
  • breathing,
  • resting tongue posture,
  • biting, chewing and swallowing,
  • hearing,
  • the structure and functioning of the articulatory organs,
  • psychomotor development,
  • the child’s development,
  • illnesses or disorders relevant to the assessment or therapy,
  • test and examination results,
  • previous assessments or therapy,
  • information received from other specialists,
  • the results of the speech and language assessment,
  • the course of therapy,
  • progress and therapeutic observations,
  • recommendations for practice at home.

Data concerning health belongs to the special categories of personal data and is subject to enhanced protection.

Records relating to assessment and therapy

The Practice may keep, among other things:

  • case history forms,
  • registration forms,
  • notes from consultations and therapy sessions,
  • results of trials and tests,
  • therapy plans,
  • speech and language therapy reports and opinions,
  • recommendations,
  • information on the progress of therapy,
  • documents provided by the patient or parent,
  • documents received from other specialists on an appropriate legal basis,
  • correspondence relevant to the assessment or therapy.

Financial and administrative data

The Practice may process data needed to:

  • issue an invoice,
  • record the service provided,
  • record payments,
  • keep accounts and tax records.

3. Purposes and legal bases of processing

Personal data is processed only where there is an appropriate legal basis.

Contact and booking appointments

Data may be processed in order to:

  • respond to enquiries,
  • book, change or cancel appointments,
  • provide organisational information,
  • communicate about the services provided.

The legal basis is primarily taking steps at the request of the data subject prior to entering into a contract, or the performance of a contract that has been concluded - Article 6(1)(b) GDPR.

Speech and language assessment and therapy

Data is processed in order to:

  • take a case history and carry out the assessment,
  • plan and deliver therapy,
  • monitor progress,
  • prepare recommendations, reports and opinions,
  • ensure continuity and an appropriate quality of the services provided.

In the case of ordinary personal data, the basis for processing is, in particular, the performance of a contract.

Data concerning health may be processed on the basis of Article 9(2) GDPR, in particular to the extent that its processing is necessary for the assessment or therapy and the requirements arising from the relevant provisions on health care and professional secrecy are met.

Where a particular use of data is not necessary for the assessment or therapy and requires consent, that consent is obtained separately.

Accounting and tax obligations

Data may be processed for the purpose of issuing invoices, keeping accounts and fulfilling tax obligations.

The legal basis is the performance of a contract and a legal obligation to which the Controller is subject - Article 6(1)(b) and (c) GDPR.

Establishment or exercise of legal claims

To the extent necessary, data may be retained or used for the establishment, exercise or defence of legal claims, in accordance with an appropriate legal basis provided for in the GDPR.

4. Is providing data mandatory?

Providing contact data is voluntary; however, without it, it may not be possible to respond to your enquiry or book an appointment.

Providing the data necessary to carry out an assessment or therapy is required to the extent needed for the service to be performed properly.

A lack of information that is material to the assessment or to the safety of the therapy may make it impossible to provide a particular service or limit the ability to perform it properly.

Data required to issue an invoice or to fulfil tax obligations is processed to the extent required by law.

5. Children’s data

The Practice also provides services to children and therefore attaches particular importance to the protection of their data.

A minor’s data may be provided by their parents or legal guardians.

To the extent that the provisions of the WGBO apply:

Child under 12 years of age

Decisions about therapy are, as a rule, made by the parents with parental authority or by the legal guardian.

Parents or guardians in principle have access to information about the child’s therapy, subject to the exceptions arising from the law and the best interests of the child.

Child aged 12-15

Both the child and their parents or guardians have certain rights with regard to the therapy.

In cases provided for by law, consent to therapy may be required from both the child and their parent or guardian.

The child’s right to privacy must also be respected.

Patient aged 16 and over

A patient who has reached the age of 16 decides independently, in accordance with the rules of the WGBO, about their therapy and about access to their records.

Parents or guardians do not have an automatic right to information about the therapy or to inspect the records, unless the patient consents to this.

6. Where does the data come from?

Data is most often obtained directly:

  • from the patient,
  • from a parent,
  • from a legal guardian.

Where appropriate, information may also be obtained from other persons or specialists, for example:

  • a doctor,
  • an ENT specialist,
  • an audiologist,
  • a psychologist,
  • an educational specialist,
  • a physiotherapist,
  • an orthodontist,
  • a dentist,
  • another speech and language therapist,
  • a school or nursery.

Data obtained from third parties is processed only where there is an appropriate basis for receiving and using it.

7. Sharing data with other specialists

If contact with another specialist is needed in connection with the assessment or therapy, only the information necessary for the specific purpose is shared.

If sharing information requires the consent of the patient, parent or legal guardian, that consent is obtained before the data is shared.

Information concerning patients is treated as confidential and is not disclosed to unauthorised persons.

8. Recipients of data and cooperating parties

To the extent necessary, data may also be processed by parties providing services to the Practice, for example:

  • an accountant or accounting firm,
  • an email service provider,
  • a website hosting provider,
  • a provider of an appointment booking system,
  • a provider of an invoicing system,
  • a provider of a system for storing records,
  • an IT service provider.

Where such a party processes data on behalf of the Controller, an appropriate data processing agreement is concluded with that processor, where required by the GDPR.

Data may also be disclosed to public authorities where there is a legal obligation to do so.

The Practice does not sell patients’ personal data.

9. Health insurance and BSN

The Practice does not have contracts with health insurers for direct billing of the services provided.

The Practice does not routinely pass patients’ data on to health insurers for the purpose of billing therapy.

If a patient needs an invoice or other document in order to apply independently for any reimbursement of costs, they can receive an appropriate document.

The Practice does not collect or store patients’ BSNs.

10. How long is data kept?

Data is not kept for longer than necessary, unless the law requires a longer period.

Records relating to assessment and therapy

Records relating to assessment and therapy are kept for the retention period required by applicable law.

To the extent that the WGBO applies to the records, the retention period is, in principle, 20 years from the last change to the records, unless legal provisions or special circumstances justify a different period.

Accounting and tax records

Records covered by the Dutch statutory obligation for businesses to keep accounts are, in principle, kept for 7 years.

Enquiries from people who did not become patients

The data of people who only contacted the Practice is kept only for as long as needed to deal with the enquiry and any further correspondence, unless there is a legitimate need to keep it for longer.

11. Data security

The Controller applies appropriate technical and organisational measures designed to protect data against loss, unauthorised access, disclosure, alteration or destruction.

Depending on the type of data, these may include, in particular:

  • password protection of devices and accounts,
  • multi-factor authentication, where available,
  • regular software updates,
  • restricted access to records,
  • securing backups,
  • securing paper records,
  • careful transmission of documents containing data concerning health.

12. Email, telephone and messaging apps

The Practice may contact the patient or parent using the contact details they have provided.

Ordinary email and popular messaging apps are not always an appropriate means of sending detailed data concerning health.

The Practice therefore limits the amount of medical data shared through such channels and, where necessary, may suggest a more secure way of sending records.

13. Online therapy, photographs and recordings

If therapy or a consultation takes place online, the data is subject to the same protection rules as during an in-person visit.

Sessions are not recorded without an appropriate legal basis and without informing the patient or their representative in advance.

If photographs, voice samples or video recordings are used in the course of assessment or therapy, they are used only to the extent needed for that purpose.

The use of a person’s image or recordings for:

  • marketing purposes,
  • promotional purposes,
  • publication on the website,
  • publication on social media

requires a separate legal basis and, where required, explicit consent.

Refusing consent to the use of one’s image for marketing purposes does not affect the ability to use the Practice’s services.

14. Website, contact form and cookies

If the website has a contact form, the data provided through it is used to respond to the message and for any further contact.

Detailed medical records or other particularly sensitive data should not be sent via the contact form unless this is necessary.

The website may use cookies that are necessary for it to function properly.

If additional analytics, marketing or tracking cookies are used for which consent is required by law, they are only activated once that consent has been obtained.

Users may refuse consent and may later change or withdraw it.

15. Transfers of data outside the European Economic Area

Some IT service providers may process data outside the European Economic Area.

Where such a transfer takes place, it is carried out only in accordance with the requirements of the GDPR, on the basis of an appropriate legal mechanism, for example a European Commission decision confirming an adequate level of protection or appropriate safeguards provided for by the GDPR.

16. Rights of the data subject

Depending on the situation, the data subject has, among other things:

  • the right of access to their data,
  • the right to obtain a copy of the data,
  • the right to rectification of inaccurate data,
  • the right to have incomplete data completed,
  • the right to request erasure of data in cases provided for by law,
  • the right to restriction of processing,
  • the right to object to certain processing,
  • the right to data portability, where applicable,
  • the right to withdraw consent at any time, where particular processing is based on consent,
  • the right to lodge a complaint with a supervisory authority.

Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

The right to erasure is not absolute. Some data may be subject to a mandatory retention period.

Patients may also request access to their records and a copy of them, subject to applicable law and the rights of third parties.

17. How can you exercise your rights?

Requests concerning personal data can be sent to:

logopedawholandii@gmail.com

or by post to:

Polski logopeda w Holandii
Anna Maria Twarogowska
Produktieweg 44 G
2382 PC Zoeterwoude-Rijndijk
the Netherlands

If there are reasonable doubts about the identity of the person making the request, the Controller may ask for additional information necessary to confirm it.

The Controller responds to requests within the time limit set by the GDPR, as a rule within one month.

18. Automated decision-making

The Practice does not make decisions about patients which produce legal effects concerning them or similarly significantly affect them, based solely on automated processing of data.

The Practice does not use patients’ health data for marketing profiling.

19. Personal data breaches

In the event of a personal data breach, the Controller assesses the risk to the data subjects.

Where required by the GDPR, the breach will be reported to the Autoriteit Persoonsgegevens (the Dutch Data Protection Authority).

If the breach is likely to result in a high risk to the rights or freedoms of the data subject, that person will also be informed, where required by law.

20. Complaint to the Autoriteit Persoonsgegevens

Anyone who believes that their personal data is being processed unlawfully may contact the Controller:

logopedawholandii@gmail.com

Irrespective of this, they have the right to lodge a complaint with the Dutch supervisory authority:

Autoriteit Persoonsgegevens
www.autoriteitpersoonsgegevens.nl

21. Changes to this Privacy Policy

This Privacy Policy may be updated in the event of changes in the law, in the scope of the services provided, in the way data is processed or in the systems used.

The current version of the Privacy Policy is published on the Practice’s website.

Date of last update: 4 October 2026

Controller’s details

Polski logopeda w Holandii
run by Anna Maria Twarogowska

Legal form: Eenmanszaak (sole proprietorship)
KvK-nummer: 63837706

Address:
Produktieweg 44 G
2382 PC Zoeterwoude-Rijndijk
the Netherlands

Telephone: +31 6 24239868
Email: logopedawholandii@gmail.com