Rebeca van den Berg, Therapist

Registered office: Kanaalkade 57, 1811 LS Alkmaar, the Netherlands (the practice works online only) · Chamber of Commerce (KvK) no. 90824415 · Registered care provider (zorgaanbieder) under the Wkkgz

Version 3.3, in force from 1 October 2026

This statement explains what the practice does with personal data, on what basis, and what rights the person concerned has. It forms part of the General Terms and Conditions of the practice and is published separately on the website. It is written to be read.

1 Who is responsible

The controller is Rebeca van den Berg, sole proprietorship, registered with the Netherlands Chamber of Commerce under number 90824415, with registered office at Kanaalkade 57, 1811 LS Alkmaar, the Netherlands, reachable at info@rebecavandenberg.com.

The practice has no employees, and no other practitioner has access to client files. The service providers identified in section 5 process personal data in the roles described there. The Therapist is not required to appoint a data protection officer, the practice being a single-practitioner undertaking serving a limited number of clients.

2 What personal data is processed

In respect of clients receiving individual therapy:

• name, date of birth, address, country of residence, email address and telephone number;

• the name and telephone number of the client’s own doctor, and one emergency contact person;

• the answers given at the intake screening, which forms the first part of the first session;

• notes of the matters worked on, the client’s history and the progress of the work;

• details of bookings, payments and invoices.

A substantial part of this constitutes data concerning health, which Article 9 AVG treats as a special category of personal data. The practice treats all clinical material as such, including the intake screening.

In respect of other persons:

• those booking an introductory call: name, email address and notes of the call, which may contain data concerning health;

• participants in a Group Class: name, email address, country of residence and payment record;

• purchasers of a Digital Product: name, email address, country of residence and payment record;

• newsletter subscribers: name and email address, until unsubscribed;

• website visitors: technical data as described in section 9.

A note on the emergency contact and the huisarts. These are two people who have not themselves approached the practice, and whose data the practice nevertheless holds. Of the emergency contact the practice holds only a name and a telephone number, provided by the client so that one person can be reached if the client’s life is in danger. Of the doctor the practice holds professional contact details only. Neither is contacted except in the circumstances set out in Article 15.2 of the General Terms and Conditions, and neither is told anything about the client’s care unless the client has given written permission or one of those circumstances applies. The client is asked to tell her emergency contact that she has given this information. Either person may ask the practice what is held about them, and have it corrected or erased, by writing to info@rebecavandenberg.com.

3 Why, and on what legal basis

The law requires each purpose to have a named legal basis. These are they.

Provision of care and maintenance of the file — Article 9(2)(h) AVG, read with Article 30(3)(a) and 30(4) of the Dutch implementing act (UAVG): processing necessary for the provision of health care by a person subject to an obligation of professional secrecy, together with Article 6(1)(b) AVG. The obligation of secrecy arises under artikel 7:457 BW. Independently of that statutory duty, and whether or not it is held to apply to this practice, the Therapist is bound to observe professional secrecy on the same terms by Article 15.1 of her General Terms and Conditions. The requirement in Article 9(3) AVG is therefore satisfied on either footing. Screening before an agreement is entered into rests on Article 6(1)(b) AVG, being steps taken at the request of the person concerned prior to entering a contract, and on Article 9(2)(h) AVG as regards data concerning health.

Maintenance of a client record — Article 6(1)(c) AVG: compliance with a legal obligation under artikel 7:454 BW, applying to this practice directly or by analogy under artikel 7:464 lid 1 BW or artikel 7:400 BW. Where that obligation is held not to apply, the file is maintained under Article 9(2)(h) read with Article 6(1)(b) AVG, and for no longer than the period stated in section 7.

Delivery of a Group Class or Digital Product — Article 6(1)(b) AVG: performance of the agreement.

Invoicing and accounting — Article 6(1)(c) AVG: compliance with Dutch tax law.

Handling of a complaint, an incident or a calamiteit, or defence of a claim — Article 9(2)(f) AVG, and where a calamiteit is reported to the Inspectie Gezondheidszorg en Jeugd, Article 6(1)(c) and Article 9(2)(h) AVG, that report being required by the Wkkgz.

Action in an emergency where life is at risk — Article 9(2)(c) AVG, where the person concerned is not able to give consent.

A report to Veilig Thuis — the statutory right to report (meldrecht) under the Wet maatschappelijke ondersteuning 2015, which the Therapist exercises only after following the steps of her meldcode, as described in Article 15.2(b) of the General Terms and Conditions, and which the law allows her to exercise without the consent of the person concerned. The report concerns the client and, where relevant, other members of her household, and contains only what Veilig Thuis needs for its task.

Newsletter or publication of a testimonial — consent under Article 6(1)(a) and, where health data is concerned, Article 9(2)(a) AVG. Each consent is separate and may be withdrawn at any time. Refusal has no consequence for the care provided or for the price payable.

The practice does not rely on consent as the basis for retaining a client file. The file is retained on the legal basis described above and for the period stated in section 7. Consent is used only for the optional purposes identified above.

4 Where the data is kept

A separate file is maintained for each client, and no client’s records are kept in the same file or document as those of another. Client files are kept digitally, protected by encryption and access control, and only the Therapist has access to them.

The practice keeps no paper client records. The Therapist may write notes by hand during a session as a working aid. Those notes are transferred into the digital file within one working day and the paper is then destroyed by shredding. Until they are destroyed they are kept out of sight in a locked drawer.

Contact details, screening records, invoices and correspondence are held digitally in the systems identified in section 5, protected by strong unique passwords and two-factor authentication.

5 Who else is involved

The practice does not sell personal data. The practice uses a small number of service providers. Where a provider acts as a processor, it does so solely on the Therapist’s instructions, under a written processor agreement as required by Article 28 AVG. For some of their own activities, such as preventing fraud and meeting their own legal obligations, some providers act as independent controllers under their own privacy statements. The providers are:

Google Workspace (Gmail, Google Calendar, Google Meet, Google Drive) — professional email, scheduling and video sessions, under Google’s Cloud Data Processing Addendum, which incorporates the standard contractual clauses of the European Commission.

Squarespace — website, contact form and online payments.

Stripe — processing of card and iDEAL payments made through the Squarespace checkout or through a Stripe payment link sent by the Therapist. Stripe performs this processing whether payments are taken through Squarespace Payments or through a directly connected Stripe account.

ASN Bank — payment links generated in the Therapist’s own banking application, and receipt of funds. ASN Bank and the client’s own bank are independent controllers under their own privacy statements; the Therapist observes only that payment has been received.

Video sessions take place on Google Meet. The connection is encrypted in transit but is not end-to-end encrypted. The Therapist does not record Sessions.

Certain of these undertakings are established in the United States. Where personal data leaves the European Economic Area, it is protected by an adequacy decision of the European Commission or by the European Commission’s standard contractual clauses.

Beyond the service providers listed above, the practice discloses personal data only:

a. with the written permission of the person concerned, for instance where a client asks the Therapist to correspond with her own doctor;

b. to the independent complaints officer at Quasir B.V. or to Stichting Zorggeschil, where a complaint is made, and only to the extent the complaint requires;

c. to the emergency services, a client’s own doctor or Veilig Thuis, in the circumstances described in Article 15.2 of the General Terms and Conditions;

d. to the Inspectie Gezondheidszorg en Jeugd, and to the independent investigator engaged for that purpose, where a calamiteit is reported to that Inspectie as the Wkkgz requires, and only to the extent the report and investigation require;

e. to a court or authority where the law so requires. As the Therapist is not registered under the Wet BIG, she in all likelihood does not hold the legal privilege to decline to give evidence that a medical practitioner holds.

Where the Therapist engages professional supervision or peer consultation, cases are discussed only in anonymised form, with names and identifying particulars removed, and every person involved is bound by confidentiality. A client may object to that discussion, even in anonymised form, in which case it will not be.

6 A note on WhatsApp

WhatsApp is used for scheduling and practical messages only. It is not used for information about a client’s history, sessions or health, and forms are not sent through it. Anything of that kind goes by email, to an address the client has confirmed is hers alone, or by another method agreed in writing where she cannot safely use such an address.

Two reasons. WhatsApp is operated by Meta, which can observe communication metadata although it cannot read message content. And a mobile telephone is a physical device to which another member of a household may have access.

7 How long the data is kept

Client file: twenty years from the date of the last entry, in line with artikel 7:454 lid 3 BW (see section 3), or as much longer as the care of a good hulpverlener reasonably requires. A request for destruction of the file under section 8 is honoured so far as the law permits, and that right is not affected by this period.

Invoices and financial records: seven years, as Dutch tax law requires.

Enquiries, and notes of an introductory call, not resulting in an agreement: three months.

Group Class and Digital Product records: seven years, as part of the financial administration.

Newsletter subscription: until the subscriber unsubscribes.

Record of a personal data breach: as long as required to demonstrate compliance, and in any event no less than three years.

8 Rights of the person concerned

Any person whose data the practice processes may request access to that data and a copy of it; rectification of factual inaccuracies, or the addition of their own written statement to the file; erasure; restriction of or objection to processing; portability of the data they have provided; and withdrawal of any consent given.

One honest limit on erasure. The Therapist will generally comply with a request to destroy a client file. She cannot erase data which another statutory provision requires her to retain, including invoices retained for seven years, nor a file whose retention is required by a substantial interest of another person or by a pending complaint or claim. Where any part of a request must be refused, the Therapist identifies that part and states her reasons.

Requests are made to info@rebecavandenberg.com and are answered within one month, free of charge. The Therapist may take reasonable steps to verify the identity of the person making the request.

9 Website and cookies

The website is operated on Squarespace, which places cookies necessary for the functioning of the site and, subject to the visitor’s consent, cookies measuring use of the site. Consent is requested on first visit and may be changed at any time. The site remains functional where optional cookies are declined. Beyond the cookies Squarespace places, no analytics tool, advertising pixel or email marketing platform has been added to the site.

Information submitted through the contact form is delivered to the Therapist’s email. Visitors are asked not to include detailed personal history in that form.

10 Security and personal data breaches

The Therapist takes appropriate technical and organisational measures to protect personal data, including encryption, access control, strong unique passwords and two-factor authentication.

A personal data breach (datalek) is any breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data. Where one occurs, the Therapist records what happened, what data and how many people were affected, and what has been done; she notifies the Autoriteit Persoonsgegevens within seventy-two hours of becoming aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of those affected; and she informs the persons affected directly, in plain language, where the breach is likely to result in a high risk to their rights and freedoms. Every breach is recorded, whether or not it is notified.

11 Complaints

Complaints about the processing of personal data are addressed to the Therapist at info@rebecavandenberg.com. Any person concerned is further entitled to lodge a complaint with the Dutch supervisory authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).

Complaints about the care itself follow the Klachtenregeling of the practice, which is published on the website and sent free of charge by email on request, and which is summarised in Article 18 of the General Terms and Conditions: the Therapist first, then the independent complaints officer at Quasir B.V., and thereafter Stichting Zorggeschil.

12 Changes

Where the practice changes how it works — a new system, a new supplier — this statement is updated and the version date at the top is changed. Where a change materially affects current clients, they are informed directly rather than expected to notice.

Rebeca van den Berg · KvK 90824415 · registered care provider under the Wkkgz · klachtenfunctionaris via Quasir B.V. (Klachtenregeling Zorg of ZZP Nederland) · disputes via Stichting Zorggeschil

Version 3.3 · in force from 1 October 2026 · supersedes version 3.2