Privacy Policy of the Couleurs Santé Medical Centre

Data Protection Policy

(Version 2 September 2025)

Introduction

Protecting your data is a priority for us. This policy explains how we use your data and sets out your rights in accordance with:

the General Data Protection Regulation (GDPR – EU Regulation 2016/679).
the Act of 30 July 2018 on the protection of natural persons with regard to the processing of personal data.

Who is responsible for processing your data?

The Couleurs Santé Medical Centre non-profit organisation, registered under company number 0812.128.837, whose registered office is situated at 206 Chaussée de Boondael – 1050 Ixelles, acts as data controller.

What personal data do we process?

In order to provide you with effective support in your dealings with us, we collect and process various categories of personal data. This section sets out, in particular: a) the main categories of personal data that we may process; b) the purposes of such processing; and c) the legal bases on which it is carried out. This section provides an overview of the main personal data processing activities carried out by:

Users of the Medical Centre

Processing category	Relevant data	Purpose	Legal basis	Shelf life
Appointment management and notifications	Surname, first name, telephone number, email address	Organisation of consultations	Performance of the contract (Article 6(1)(b) of the GDPR)	5 years for the data contained in our administrative software
Management of medical records (paper and digital)	Surname, first name, medical details	Quality and continuity of care	Legal obligation (Art. 6(1)(c) and 9(2)(h) of the GDPR)	30 years
Forwarding to external healthcare professionals (pharmacies, laboratories, hospitals)	Surname, first name, medical details	Prescriptions, medical tests, coordination of care	Legal obligation (Article 6(1)(c) of the GDPR)	The data is transmitted to the recipients, who retain it in accordance with their own legal obligations
Submission to insurance companies and social security bodies	Surname, first name, medical details	Reimbursement of medical expenses and recognition of a disability	Consent (Art. 6(1)(a) of the GDPR)	The data is transmitted to the recipients, who retain it in accordance with their own legal obligations

Staff at the health centre

Processing category	Relevant data	Purpose	Legal basis	Shelf life
Recruitment	CV, cover letter, contact details, qualifications, interview feedback	Selection and management of applications	Performance of the contract (Article 6(1)(b) of the GDPR)	Length of employment + 5 years Up to 24 months for unsuccessful applications
Personnel administration	Name, address, social security number, contact details, bank account details, contract, payslip details	Implementation of the employment contract, payroll, social security declarations	Performance of the contract (Article 6(1)(b) of the GDPR)	Length of employment + 5 years
Absence and working time management	Working hours, clocking in and out, leave, medical certificates	HR management, payroll, compliance (health and safety, insurance)	Legal obligation (Article 6(1)(c) of the GDPR)	Length of employment + 5 years
Occupational health (occupational medicine)	Health data relating to fitness, medical certificates	Compliance with statutory health and safety obligations	Legal obligation (Article 6(1)(c) of the GDPR)	The data is passed on to the partner, who retains it in accordance with their own legal obligations
Access control, business emails, computer workstations	Credentials, access logs, logs, use of business tools	Security, abuse prevention, account management	Legitimate interest (Art. 6(1)(f) of the GDPR)	Accounts are blocked or deleted when an employee leaves; logs are archived for evidential purposes and then deleted.

Users of the health centre’s website

Processing category	Relevant data	Purpose	Legal basis	Shelf life
Technical logging	technical IP address, User-Agent (browser, OS), date and time, pages viewed	Ensuring site security, and detecting and preventing abuse	Legitimate interest (Art. 6(1)(f) of the GDPR)	Up to 1 year, except in the event of a security incident (extended retention may be possible)
Essential cookies	Technical session ID, browsing preferences	Enable the website to function and display correctly	Legitimate interest (Art. 6(1)(f) of the GDPR)	Duration of the session
Google Maps integration	IP address, technical browser information, map display settings, Google session identifiers	Display of the interactive map; map tiles and services provided by Google	Explicit consent from the user (Art. 6(1)(a) GDPR)	Duration of the session and up to 13 months

Who do we share your data with?

The non-profit organisation may need to transfer personal data to third parties in the course of its activities. These transfers, which are based on various legal grounds under the GDPR and are always carried out in accordance with the principle of data minimisation, are made with:

Doctors, nurses and physiotherapists at the health centre.
E-health network (Réseau Santé Wallon, Abrumed) for the secure sharing of your medical records.
Health insurance organisations, laboratories, hospitals, pharmacies, social services.
Medical adviser (health insurance or mutual insurance scheme) and public health bodies (FPS Public Health, AVIQ, PHARE).

We use secure methods for these exchanges (secure servers, the eHealth platform, etc.).

What are your rights and how can you exercise them?

In accordance with the General Data Protection Regulation (GDPR), you have the following rights in relation to your personal data:

Right of access : You may obtain confirmation as to whether we are processing your personal data and, where applicable, access that data; ;
Right to rectification : You may request the correction of any inaccurate or incomplete data relating to you; ;
Right to erasure («right to be forgotten») : Under certain circumstances, you may request the deletion of your personal data; ;
Right to restriction of processing : You may request that the processing of your data be restricted, for example if you dispute the accuracy of the data; ;
Right to object : You may object, on grounds relating to your particular situation, to the processing of your data, in particular for marketing purposes or where the processing is based on a legitimate interest; ;
Right to data portability : You may receive your personal data in a structured, commonly used and machine-readable format, and transmit it to another data controller; ;
Right to withdraw your consent : If the processing is based on your consent, you may withdraw it at any time, without this affecting the lawfulness of the processing carried out prior to such withdrawal.

To exercise these rights, please contact us in writing or by email:

Couleur Santé Medical Centre (non-profit organisation)

206 Chaussée de Boondael – 1050 Ixelles

dpo@mmcs.be

You also have the right to lodge a complaint with:

Data Protection Authority

35 Rue de la Presse, 1000 Brussels

contact@apd-gba.be | https://www.autoriteprotectiondonnees.be

How do we protect your data?

We implement appropriate technical and organisational measures, including: access control, strong authentication, encryption of backups and sensitive data transfers, pseudonymisation where possible, granular access rights management, connection logging, secure backups and regular staff training. Access is strictly limited to operational requirements and is subject to a duty of confidentiality.

Updates to this policy

This data protection policy may be amended to take account of regulatory or organisational changes. The date of the last update is shown in the document header.

In the event of a substantial change (particularly regarding the purposes, the categories of data processed or the recipients), data subjects will be informed via the ASBL’s usual communication channels.

The most recent version shall prevail and supersede all previous versions.