Privacy Policy | Blooming Plastic Surgery

1. Introduction

Blooming Plastic Surgery, located at Vondelweg 999, 2026 BW Haarlem, values the privacy of its patients and website visitors. This privacy policy explains what personal data we collect, why we collect it, and how we handle it.

We process personal data in accordance with the General Data Protection Regulation (GDPR) and its implementing legislation. This privacy policy applies to all services of Blooming Plastic Surgery and to the use of our website.

2. Data controller

The controller responsible for the processing of personal data is:

Name: Blooming Plastische Chirurgie
Address: Vondelweg 999, 2026 BW Haarlem
Email: info@bloomingpc.nl
Phone: 023 54 44 974

3. Personal data we collect

3.1 Via our website

When you visit our website or fill in a form, we may collect the following data:

Name and contact details (when submitting a contact form or consultation request)
Email address and phone number
Address details
Date of birth
Treatment preferences and comments
IP address and browser data (via cookies and analytics tools)

3.2 As a patient

If you are a patient at our clinic, we additionally process:

Medical data and treatment history
Photographs taken before, during and after treatments
Insurance details (where applicable)
BIG registration numbers of treating physicians

3.3 Job applications

When you submit a job application, we collect:

Name, address and contact details
CV and cover letter
Availability and preferred contact moment

4. Purposes of processing

We use your personal data for the following purposes:

Responding to your questions via the contact form
Scheduling and carrying out consultations and treatments
Maintaining your medical record (legal obligation)
Processing payments and invoicing
Sending appointment confirmations and reminders
Improving our website and services
Complying with legal obligations
Processing job applications

5. Legal bases

We process your personal data on the basis of:

Consent: for example, for placing analytical cookies
Performance of a contract: for providing medical care and services
Legal obligation: such as retaining medical records
Legitimate interest: such as improving our website

6. Cookies

Our website uses cookies. We distinguish the following categories:

6.1 Necessary cookies

These cookies are essential for the functioning of the website. Without them, certain features cannot work. No consent is required for these cookies.

6.2 Analytical cookies

We use Google Analytics 4 to gain insight into how visitors use our website. This data is processed anonymously. You can decline these cookies via the cookie banner.

6.3 Marketing cookies

These cookies are used to make advertisements more relevant. We only place these cookies with your explicit consent.

You can adjust your cookie preferences at any time by changing your browser settings or by deleting cookies in your browser.

7. Google reCAPTCHA

Our forms are protected by Google reCAPTCHA to prevent spam and abuse. When using reCAPTCHA, data is sent to Google. Google's Privacy Policy and Terms of Service apply.

8. Retention periods

We do not retain your personal data longer than necessary:

Medical records: 20 years after the last treatment (legal obligation)
Contact forms: maximum 1 year after handling
Job application data: maximum 4 weeks after the procedure is completed, unless you consent to longer retention
Website statistics: 26 months (Google Analytics)

9. Sharing with third parties

We do not share your personal data with third parties, unless this is necessary for the performance of our services or when we are legally required to do so. We may share data with:

Referring physicians or specialists (with your consent)
IT service providers who manage our systems (processors)
Government authorities when legally required

9.1 Processors

For the operation of our website and services, we use the following processors:

Supabase (US): hosting our database and storing data. Data is processed within the EU. Supabase is SOC 2 Type II certified.
Vercel (US): hosting our website. Vercel processes visitor requests via a global network. No personal data is stored by Vercel.
SendGrid / Twilio (US): sending emails, including confirmation emails after form submissions and internal notifications.
Google (US): Google Analytics 4 for website statistics (only with your consent) and Google reCAPTCHA for spam prevention on forms.

We have data processing agreements in place with all processors who process personal data on our behalf. Where data is processed outside the EU, this is done on the basis of an adequacy decision or EU Standard Contractual Clauses (SCCs).

10. Security

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss or theft. These include:

Encrypted connections (SSL/TLS) on our website
Secure storage of data
Restricted access to personal data
Regular evaluation of our security measures

11. Your rights

Under the GDPR you have the following rights:

Right of access: you can request what data we process about you
Right to rectification: you can have incorrect data corrected
Right to erasure: in certain cases you can request deletion of your data
Right to restriction: you can request that processing be restricted
Right to data portability: you can receive your data in a structured format
Right to object: you can object to processing based on legitimate interest
Right to withdraw consent: you can withdraw previously given consent at any time

To exercise these rights, please contact us at info@bloomingpc.nl. We will respond to your request within 30 days.

12. Complaints

Do you have a complaint about the processing of your personal data? Please contact us first — we would be happy to find a solution together. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens). More information at autoriteitpersoonsgegevens.nl.

13. Changes

We reserve the right to amend this privacy policy. Changes will be published on this page. We recommend reviewing this privacy policy regularly.

14. Contact

Do you have questions about this privacy policy or about the processing of your personal data? Please feel free to contact us:

Email: info@bloomingpc.nl
Phone: 023 54 44 974
Address: Vondelweg 999, 2026 BW Haarlem