The Netherlands Cancer Institute (Locally and formally known as Het Nederlands Kankerinstituut – Antoni van Leeuwenhoekziekenhuis; henceforth: NKI) is committed to the protection of personal data.
The NKI processes the personal details of its patients, employees, and other parties involved with the hospital, such as patient contact persons, visitors to the NKI, newsletter subscribers, training program participants, volunteers, and suppliers. This privacy statement offers more information on our ways of handling and processing this personal data. Personal data is protected by law – the Medical Treatment Agreement Act (Wet inzake de geneeskundige behandelingsovereenkomst; WGBO) and the General Data Protection Regulation (EU GDPR). This privacy statement is in accordance with the data protection principles under the GDPR.
The NKI is responsible for processing your personal data. The NKI Data Protection Officer
(Functionaris Gegevensbescherming; DPO) ensures that all data is processed in accordance with all rules and regulations that apply. You can contact the DPO at privacy@nki.nl.
The NKI processes the following personal patient data:
What personal data belonging to other involved parties do we process?
We process the contact information (such as names and e-mail addresses) of other parties involved. These parties include contact persons, newspaper subscribers, training program participants, volunteers, or suppliers. We process the IP addresses of all visitors using the NKI WIFI network,
including the host name (the name you gave the device), MAC-address, the moment you connected and were given a local IP, all websites visited, and network protocols used. We also use cameras at our hospital that will record all visitors.
For which purposes do we process your personal data?
Patient personal data The NKI processes the personal data of patients in order to perform the medical tasks as defined in the treatment agreement. Your personal data will be stored in an electronic patient file. Personal data will be processed for quality and safety purposes to give you the best care possible. We process personal data in order to calculate, register, and collect treatment payment, and to handle complaints, disagreements, incidents, and calamities. The NKI provides personal data for the sake of audits, responsible business operations, legal tasks and/or responsibilities, and as part of the physical checks by health insurance providers. Your personal data will be used for scientific research, statistical analysis, or educational purposes in order to improve care. Finally, your personal data will be processed in order to deliver all requested information, guarantee the continuation and security of our network, and the protection of employees and visitors of the NKI.
The NKI processes your personal data in order to deliver the best care possible while complying with its legal obligations, such as the Healthcare Quality, Complaints and Disputes Act (Wet kwaliteit, klachten en geschillen zorg) and Healthcare Insurance Act (Zorgverzekeringswet). We process your personal data, imaging, and (remaining) body materials for medical scientific purposes. The specific purposes will depend on the type of research and its purposes. We only process data that is relevant to the study. Please find an overview of several studies conducted over the past years on our website, (https://www.nki.nl).
Personal data of other parties involved
The NKI processes contact details of family members and legal representatives if direct communication with the patient is not (currently) possible, or if a patient contact person is appointed as their (legal) patient representative. The NKI uses these contact details to deliver requested information, information about a training program, or our newsletter. The NKI processes personal data concerning the WIFI network and the pages visited in order to resolve any issues that may arise. The NKI uses this data for analytical purposes. Please see our cookie policy for more information. We use Google tracking cookies so we can show you relevant and personalized ads based on your browsing history, such as vacancies or interesting events at our institute.
The NKI processes personal data recorded by cameras at our institute that have been placed for the protection of employees and visitors to the NKI and/or to prevent damage of NKI property and/or to locate people who may have committed a crime or illegitimate act.
On what grounds do we process your personal data?
How long will we store your personal data?
We will only process your personal data if this is necessary for the purposes outlined in this privacy statement. When your personal data is no longer deemed relevant, we will destroy or anonymize your data. All data we receive from you as part of our treatment agreement as well as all data we receive from you as a patient contact person will be added to the patient’s medical file. We are required by law to keep these medical records for a period of 20 years or longer following the treatment agreement. We can keep these details for longer if this is legally required or essential for adequate care or treatment. All data processed for the purpose of medical studies and/or improvement of our care will be stored as long as required for its research purposes.
With the volunteer’s consent, all contact details and the date of termination will be stored after the aforementioned retention period on behalf of relations management. All logging details of the WIFI network or websites visited will be stored for 20 days. All camera recordings will be stored for four weeks (unless a crime was recorded, in which case the images will be stored as proof).
Who will receive my personal data?
For the performance of the treatment agreement, it may be necessary to involve various health care professionals at the NKI or other care institutions. In those cases, the practicing physician can share the personal data essential for patient treatment, as well as data belonging to their contact person. Personal details belonging to people participating in training programs or volunteers are only shared with supervisors at the institute itself. Upon your visit to the NKI or AVL websites, third-party services like YouTube may place cookies on your device (with your explicit consent). These third parties will receive your IP address. Please see our Cookie Policy for more information.
We will also send third parties your personal data if required by law or court decision, or if essential to protect your vital interests.
The NKI may share your personal details with parties outside of the European Economic Area (EEA). Before sharing data with these parties, the NKI will thoroughly consider the level of protection of the concerning country. The NKI will sign an agreement with these parties, which will further outline the research goal for which the personal data is required, as well as the ways in which the data can be processed and which safety measures should be used. Your IP address will be shared with parties outside of the European Union – including the US – through a cookie placement. We have an agreement with all third parties concerning the purposes of data processing, how all data should be processed, and what safety measures should be used.
We have taken the appropriate technical safety measures, or had them taken, to protect your data from loss or illegitimate use. We protect our systems in accordance with the current standards of information protection and we have established relevant agreements with all our service providers.
When possible, personal data used for research or health care improvements will be anonymized or pseudonymized, after which, no one will be able to connect your processed personal data to you. At the NKI, your personal data will only be accessible to the parties permitted to process personal data. In terms of your treatment agreement, these parties will be your doctors and nurses as well as employees at our financial department. They are sworn to secrecy regarding all personal data they process, unless required to share by law or court order.
Automated decision-making and profiling
Automated decision-making or profiling currently does not apply to treatment agreements nor medical scientific research or improvements of health care.
The General Data Protection Regulation (GDPR) has documented the rights of parties involved. Some of these rights cannot be fully called upon if doing so may damage your health or the health of others. Please find a clarification of your rights below.
You can ask the NKI to erase your patient file or a part thereof. We may not be able to comply, such as in the case of potential damage to you or third parties. We can also object to erasure if erasure is at odds with legislature
To exercise your rights, please contact us through privacy@nki.nl. We will ask for identification before we can comply with your request.
The NKI is committed to the protection of your personal data. If you have any questions about the ways in which we process your personal data, please contact our Data Protection Officer at privacy@nki.nl or our Patient Information Center in the NKI central hall (Plesmanlaan 121 in Amsterdam), or call 020 – 512 9111.
If you have a complaint about the protection of your personal data, please contact the Data Protection Officer through the email address mentioned above. You can also raise your issue with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens; Dutch DPA)
NKI reserves the right to change this Privacy Statement at any time. We recommend regularly consulting this statement.