Version 1.0 — Effective 1 January 2025

1. Data Controller

Cabinet Tadger — Philippe Tadger, kinésithérapeute INAMI
Address: Brussels, Belgium
Contact: via this portal or by email to the practice

2. What data do we collect?

• Identity: name, date of birth, NISS number, eID photo
• Contact: email, phone, address
• Health data: diagnosis, treatment reports, SOAP notes, PRO questionnaires (ODI, NDI)
• Administrative: appointments, invoices, payments
• Portal data: login history, uploaded documents

3. Legal Basis

Processing of your health data is based on Art. 9(2)(h) GDPR (medical care) and the Belgian Patient Rights Act of 22 August 2002. Contact data is processed under contract execution (Art. 6(1)(b) GDPR).

4. Purposes

• Providing physiotherapy care and follow-up
• INAMI billing and mutuality reimbursement
• Appointment management and reminders
• Legal retention obligation (medical file: 30 years)

5. Data Sharing

Your data is never sold. It is shared only with: your referring physician, your mutuality (INAMI reimbursement), and for accounting obligations. All processors are bound by GDPR-compliant data processing agreements.

6. Retention Periods

• Medical file: 30 years (Belgian law)
• Invoices: 7 years (tax obligation)
• Portal account: until deletion on request

7. Your Rights (GDPR)

You have the right to:

• Access and copy of your data
• Rectification of inaccurate data
• Erasure (unless legal retention applies)
• Restriction of processing
• Objection to processing
• Complaint to the DPA: www.dataprotectionauthority.be

8. Security

Your data is stored on secure servers within the EEA. Access is restricted to authorised healthcare providers. Connections are encrypted via HTTPS.

9. Contact

For privacy questions or to exercise your rights, contact us via the messaging portal or directly at the practice.