PRIVACY POLICY, PERSONAL DATA PROCESSING AND CONFIDENTIALITY

1. Scope

This Policy applies to the processing of personal data when you:

• Visit our website or use forms.
• Contact us via WhatsApp, social media, or digital channels.
• Use our Chat Bot (on the website or WhatsApp).
• Request or receive dental care at our facilities.
• Schedule appointments, receive reminders, or manage payments.

2. Legal framework

We process data in accordance with the Landsverordening bescherming persoonsgegevens (LBP) of Curaçao (in force since 1 October 2013) and, where applicable, in accordance with the GDPR/AVG (for example, if we offer services to individuals in the EEA or carry out measurement/tracking targeted to that area).*

GDPR = General Data Protection Regulation (EU) 2016/679.

AVG = Algemene verordening gegevensbescherming (name used in the Netherlands for the same GDPR).

3. Data we process

Depending on the channel, we may process:

1. A) Identification and contact: First and last name, date of birth, address, email, phone number, document/ID (if applicable), emergency contact.
2. B) Health data (sensitive): Dental medical record, diagnoses, X-rays/images, treatments, allergies, medication, clinical notes and progress.
3. C) Administrative and billing: Estimates/quotes, invoices, payments, insurance data (if applicable).
4. D) Technical data (web/analytics/cookies): IP address, browser/device, cookies and identifiers, navigation metrics.
5. E) Messaging (Chat Bot/WhatsApp): Message content you send (including if you share clinical data).

Recommendation: Do not send sensitive clinical photos, full document numbers, or very detailed medical information via Chat Bot/WhatsApp. For that, we can direct you to an alternative channel.

4. Purposes

We use your data for:

1. Dental care (assessment, diagnosis, treatment, and follow-up).
2. Appointment and care management (scheduling, confirmations, reminders, rescheduling).
3. Administration and billing.
4. Patient quality and safety (internal improvement and quality control).
5. Chat Bot (web/WhatsApp): answering general questions, guiding you through ours services, and facilitating scheduling/care.
6. Legal compliance (health, tax, or competent authority requirements).
7. Marketing (only when applicable and/or with consent, always with an opt-out option).

5. Legal bases

• Care relationship / provision of health services (and related administrative management).
• Compliance with legal obligations.
• Consent, where applicable (e.g., marketing; non-essential cookies; certain Chat Bot flows).
• Legitimate interest (site security, abuse prevention, operational improvements), balanced with your rights.

6. Chat Bot and WhatsApp: terms of use and confidentiality

1. The Chat Bot does not replace a clinical consultation and is not for emergencies.
2. The Chat Bot does not make automated clinical decisions with legal effects without human intervention.
3. Conversations may be recorded for: (i) handling your request, (ii) security and abuse prevention, (iii) service improvement.
4. If you share clinical information, we may redirect the conversation to a more appropriate channel or ask you to contact the clinic.

WhatsApp (Meta Platforms)

• When you write to us on WhatsApp, your data is also processed under WhatsApp/Meta’s terms and policies, as they act as the messaging platform.
• We cannot guarantee WhatsApp/Meta’s operation or data retention outside our systems; therefore, we recommend not sending highly sensitive clinical information via WhatsApp.

7. Systems and storage (internal server)

Our main patient management system is RH Software (software provider: Eng. Ricardo Hernández).

Chat Bot operations and clinical/administrative data are managed mainly on our internal server at the clinic, with role-based restricted access and security measures.

8. Cookies, Google Analytics and Meta Pixel

Our site may use:

• Necessary cookies (site operation).
• Google Analytics (cookies/identifiers for usage measurement).
• Meta Pixel (cookies/identifiers for measurement and campaigns).

In line with the European approach to cookies/tracking technologies, non-essential cookies (analytics/marketing) generally require consent before being activated. Therefore, we use/implement a cookie banner so you can accept or reject.

9. Recipients and processors (who we share data with)

We share data only when necessary with:

• Authorized clinic staff (dentists, assistants, administration).
• Service providers (processors), for example: RH Software; web/email hosting; cybersecurity and backups (if applicable).
• Google (Analytics) and Meta (Pixel) only if you consent to those cookies.
• Messaging providers (WhatsApp) when you choose that channel.
• Laboratories, specialists, insurers (if applicable) only for your treatment/management.
• Authorities, when there is a legal obligation.

10. International transfers

By using global technology providers (e.g., Google, Meta/WhatsApp), processing may involve transfers and/or access from countries where those providers operate. We will apply reasonable safeguards (contractual and technical) where applicable.

11. Retention periods

We keep data only as long as necessary and according to applicable obligations.

As a reference aligned with the standard of the Kingdom of the Netherlands, medical records are kept at least 20 years from the last modification of the file, unless a clinical need or applicable rule justifies keeping them longer.

Chat Bot conversations are kept for a limited period for care/security/improvement and then deleted or anonymized, unless legally required.

12. Security and confidentiality

We apply reasonable technical and organizational measures:

• Role-based access and staff confidentiality.
• Internal server security, backups, updates and controls.
• Data minimization and access restrictions to clinical data.

13. Data subject rights

You may request (under the LBP and, where applicable, GDPR):

• Access, rectification, and updating.
• Deletion where appropriate, restriction or objection in certain cases.
• Withdrawal of consent (when processing is based on consent).

To exercise rights: write to ceocurazao@gmail.com and attach minimum information to verify identity.

14. Changes to this Policy

We may update this Policy. We will publish the current version with its update date.