Privacy Policy
Version 1.1 — updated 2026-07-15
1. Data Controller
Cabinet Tadger — Philippe Tadger, kinésithérapeute INAMI
Address: Brussels, Belgium
Contact: via this portal or by email to the practice
2. What data do we collect?
- Identity: name, date of birth, NISS number, eID photo
- Contact: email, phone, address
- Health data: diagnosis, treatment reports, SOAP notes, PRO questionnaires (ODI, NDI)
- Administrative: appointments, invoices, payments
- Portal data: login history, uploaded documents
3. Legal Basis
Processing of your health data is based on Art. 9(2)(h) GDPR (medical care) and the Belgian Patient Rights Act of 22 August 2002. Contact data is processed under contract execution (Art. 6(1)(b) GDPR).
4. Purposes
- Providing physiotherapy care and follow-up
- INAMI billing and mutuality reimbursement
- Appointment management and reminders
- Legal retention obligation (medical file: 30 years)
5. Data Sharing
Your data is never sold. It is shared only with: your referring physician, your mutuality (INAMI reimbursement), and for accounting obligations. All processors are bound by GDPR-compliant data processing agreements.
We rely on the processors below. Some are located outside the EU; their transfers are covered by appropriate safeguards (DPF framework or standard contractual clauses). US-based providers may be subject to the US CLOUD Act.
Voice recording: if you consent to voice recording, the audio is transcribed on the practice's own EU server and deleted immediately — the audio never leaves that server. Only short transcripts of spoken commands may be processed by Google (Gemini, USA).
| Processor | Purpose | Data | Location / transfer |
|---|---|---|---|
| Hetzner | Application and database hosting | All record data | EU/EEA |
| Scaleway | Encrypted document backups | Clinical documents, prescriptions | EU/EEA |
| Billit | Accounting and invoicing | Invoices, amounts, billing identity | EU/EEA |
| Mollie / SumUp | Payment processing | Amount, payment reference | EU/EEA |
| Google Calendar | Appointment sync | Appointment date, time and title | USA — DPF framework + standard contractual clauses (subject to the US CLOUD Act) |
| Google Gemini | AI assistance: understanding the clinician's voice commands, drafting help | Short transcribed text (never the audio) | USA — DPF framework + standard contractual clauses (subject to the US CLOUD Act) |
| Anthropic (Claude) | AI assistance drafting clinical notes | Clinical note text | USA — DPF framework + standard contractual clauses (subject to the US CLOUD Act) |
| Telegram | Appointment reminders (opt-in) | Name, appointment time | Outside EU — standard contractual clauses |
| Cloudflare Turnstile | Anti-bot protection of forms | Technical browser signal (no health data) | USA — DPF framework + standard contractual clauses (subject to the US CLOUD Act) |
6. Retention Periods
- Medical file: 30 years (Belgian law)
- Invoices: 7 years (tax obligation)
- Portal account: until deletion on request
7. Your Rights (GDPR)
You have the right to:
- Access and copy of your data
- Rectification of inaccurate data
- Erasure (unless legal retention applies)
- Restriction of processing
- Objection to processing
- Complaint to the DPA: www.dataprotectionauthority.be
8. Security
Your data is stored on secure servers within the EEA. Access is restricted to authorised healthcare providers. Connections are encrypted via HTTPS.
9. Contact
For privacy questions or to exercise your rights, contact us via the messaging portal or directly at the practice.
10. Changes & change of control
We commit to informing you in advance, via this portal, of any material change to our processors, and within 30 days of any change of ownership or control of SomaLynk / the practice. In that case you have the right to object and to export your data before the change takes effect.