Privacy Statement

Zorg van de Zaak is a network of companies in the field of occupational health care. Our vision is that people are happier when they can participate in work and society. With this philosophy, we strive to keep people healthy and employable. By bundling various specialisms in one network, we are able to quickly provide the necessary help.

With this privacy statement, Zorg van de Zaak informs you about the personal data that is processed and how it is protected as well as possible. This privacy statement describes the processing of personal data of clients, customers (employers), and visitors of Zorg van de Zaak websites.

The privacy statement applies to the following business units within the Zorg van de Zaak network:

Zorg van de Zaak NV, the occupational health and safety service of the Zorg van de Zaak Network, and its group companies:
-- Ardyn BV
-- Arbo-Vitale BV
Omwender BV
Care of the Business ICT BV (ICT supplier of Care of the Business)

In this privacy statement, the use of the name 'Zorg van de Zaak' refers to all these business units.

The vision of Zorg van de Zaak on privacy

Zorg van de Zaak offers services to employers and employees, focusing on keeping employees healthy and employable. Protecting your privacy in this process is the basis of the relationship of trust that Zorg van de Zaak enters into with you. You can therefore rely on the care and professionalism of Zorg van de Zaak. To ensure this, Zorg van de Zaak has appointed a Data Protection Officer, who ensures that Zorg van de Zaak acts in accordance with Privacy legislation. Below you can read what the principles of Zorg van de Zaak are in the field of privacy protection.

Minimal collection of personal data

Zorg van de Zaak only collects the personal data that is necessary to help you as a client or customer as best as possible. The collection of this personal data is for the execution of the service. Without your permission, no data is collected for other purposes. Zorg van de Zaak only asks for certain data, such as your citizen service number, when it is really necessary.

Protection of your data

Zorg van de Zaak does everything it can to optimally protect your personal data. To this end, it actively maintains a system of information security measures. The ISO 27001 and NEN 7510 standards for information security are leading in this respect. The Zorg van de Zaak ICT business unit is also ISO 27001 certified. Zorg van de Zaak therefore regularly carries out risk analyses, works in accordance with information security policy and also regularly checks the operation of security measures.
Only highly secured data centers within the Netherlands are used for the storage of personal data.

If you want to know more about the security measures that Zorg van de Zaak takes, you can find this under the heading ' The most important information security measures within Zorg van de Zaak '. In addition, you can always ask your contact person within Zorg van de Zaak for more information.

Care of the Case provides insight

When your employer (or a healthcare referrer) registers with Zorg van de Zaak, Zorg van de Zaak receives administrative absence and reintegration data (health data category A and B) and contact details. From the first substantive contact, a file is created that complies with the professional guidelines. Zorg van de Zaak believes it is important that you have insight into and control over the data that has been recorded about you. For this purpose, Zorg van de Zaak offers the employee portal 'My Zorg van de Zaak' and the employer portal 'Zorg van de Zaak Online'.

Care of the Case listens

If you think that Zorg van de Zaak has or stores data about you that it should not have, or if you want to withdraw previously given consent, you can always discuss this with your practitioner or contact person. Do you not have a practitioner or contact person? Then you can send a request to medischloket@zorgvandezaak.nl .

What is personal data and what is meant by processing?

Personal data

Personal data is data that tells something about you, or that can be linked to you. This concerns data that says something about you as a person. Examples of personal data are your name, your address and your contact details such as e-mail address and telephone number. Your citizen service number (BSN), your date of birth and the IP address of your computer are also personal data. Data that tells something about your personality, such as your interests, are also personal data.

Furthermore, the law also recognizes the category of special personal data. This is data about you that is extra confidential. Examples of special personal data are data about your health, financial position, race, sexual orientation, religious beliefs and political preference.

Process

Processing is a concept from the European privacy legislation (GDPR) . Processing includes almost everything that can be done with personal data, from collecting to consulting and destroying. The General Data Protection Regulation (GDPR), article 4, describes processing as “the collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, forwarding, dissemination or otherwise making available, alignment (bringing together) or combination, shielding, erasure and destruction of data”.

What does Zorg van de Zaak use personal data for?

Zorg van de Zaak only processes personal data that are necessary for the performance of its activities. Personal data are processed to achieve the following goals:

Providing professional care to prevent failure

You can think of:

Offering and holding a preventive consultation or consultation with a health professional for questions related to your (mental and physical) health.
Workplace visit by the company doctor or other occupational health and safety professionals.
Performing a preventive medical examination (PMO) and reporting on it at an individual or company level.
Providing occupational vaccinations.
Creating absence overviews and group reports and advising your employer and the staff representation on this, so that an adequate working conditions and sickness absence policy can be implemented. The information in absence overviews and group reports cannot be traced back to individual persons.

These are often services that are required by law to be offered to you by your employer or that are required by law to be performed by Zorg van de Zaak as an occupational health and safety service for your employer. The basis for these activities is, on the one hand, a statutory regulation (which determines which information Zorg van de Zaak may or may not share with your employer) and the agreement that Zorg van de Zaak has concluded with your employer (the type of activities offered, sharing the results and drawing up the invoice).

Permission for inspections, PMOs and vaccinations is arranged via your employer. As an employee, you can make use of this voluntarily. Vaccinations involve a medical intervention. This is based on a treatment agreement in accordance with the Medical Treatment Agreement Act (WGBO) between you and Zorg van de Zaak.

Working together on your recovery, functioning and reintegration

This concerns the implementation of professional absenteeism and reintegration guidance:

Looking for ways to restore the balance between stress and your resilience, between work and private life, and to restore your vitality.
Assessing the nature and severity of the limitations.
Researching and formulating the (problem) analysis.
Advising your employer on the degree of employability and the legitimacy of the absence.
Assessing the appropriateness of medical treatment.
Proposing additional treatments and interventions to promote recovery.
Coordinating the return to work process.
Drawing up a problem analysis, employability profile and an up-to-date assessment when you leave work due to illness or when a WIA application is pending.
Ensuring that your file meets professional requirements.

These are tasks of the occupational health and safety service that are legally established. Zorg van de Zaak performs these tasks for the employer with whom you have an employment relationship, and who has a (customer) agreement with Zorg van de Zaak. In this context, Zorg van de Zaak may process absenteeism and reintegration data on the basis of the implementation of the Gatekeeper Improvement Act and the WGA. Zorg van de Zaak does this in accordance with the Income Insurance Privacy Manual .

Supporting the absenteeism management process

Zorg van de Zaak supports employers in the execution of various administrative tasks. These tasks include:

Carrying out a WIA application and the administrative process (including submitting the 42nd week notification) at the UWV (Employee Insurance Agency) for the employer.
Supporting the employer in declaring absenteeism costs to the insurer.
Absence management in the context of the Sickness Benefits Act Self-Risk Bearer Scheme and/or WGA.
Providing advice regarding the 4-week or 26-week prognosis in the context of a dismissal procedure via the UWV.
Conducting research through the procedure by a Committee of three Physicians in accordance with the ARAR (only applicable to civil servants).
Supporting the employer in declaring the costs of absenteeism to the Replacement Fund (only applicable to school communities).

Zorg van de Zaak carries out these activities on behalf of your employer, with whom you have an employment relationship and with whom Zorg van de Zaak has an agreement.

Carrying out PAGO, PMO, occupational assessments, appointment assessments, Health Checks, rail safety assessments and occupational vaccinations

Zorg van de Zaak carries out Inspections, PAGOs, PMOs, Health Checks and occupational vaccinations on behalf of employers. This includes:

Carrying out an appointment assessment. The results of this will only be shared with your (future) employer if you give permission for this.
Conducting rail safety investigations. These are medical investigations linked to specific sectors.
Performing the Periodic Occupational Health Examination. This is reported on an individual level to the company doctor and client. The client receives a final report on a group level, which cannot be traced back to individuals.
Performing Periodic Medical Examination (PMO) following a Risk Inventory & Evaluation (RI&E). This is reported on an individual level to the company doctor and client. The client receives a final report on a group level that cannot be traced back to individuals.
Carrying out Health Checks (preventive examinations).

These services are performed exclusively on the basis of a specific assignment from the employer. A number of activities have a legal basis.

Telephone and video calling

Zorg van de Zaak uses telephony or video calling, if you have given explicit permission for this, when it is not possible to make a physical appointment due to circumstances. For example, customer appointments, consultations or inspections can be conducted via video calling. Zorg van de Zaak uses carefully selected IT facilities for this. Contractual agreements are made with the suppliers of these facilities in the field of privacy protection and information security. Where necessary, additional measures are taken in the field of sending and storing personal data and security. For more information, see the web page about video calling .

Evaluation of services and (financial) management

Zorg van de Zaak generates reports for internal analysis in order to comply with the legal obligation to evaluate the services provided and for the (financial) management of Zorg van de Zaak.

Generating reports for internal analysis to evaluate our services is performed on the basis of legal obligation. Generating reports for internal analysis for the (financial) management of Zorg van de Zaak is performed on the basis of legitimate interest.

For maintaining customer contacts

Asking you whether you, as a client, customer or referrer, are satisfied with Zorg van de Zaak

Zorg van de Zaak wants to continue to develop and improve itself. That is why Zorg van de Zaak regularly conducts client and customer satisfaction surveys. Your email address can be used to send you an invitation to complete a satisfaction survey. You are not obliged to participate in this survey.

Maintaining a good relationship with the client

Are you the contact person for the agreement with Zorg van de Zaak on behalf of the employer? In that case, Zorg van de Zaak will record your personal data in the customer tracking system. This enables Zorg van de Zaak to maintain a good relationship with you. This may include the following:

Recording contracts, contract evaluations, agreements made and dates of follow-up visits.
Recording the wishes and needs of your organization.
Informing you about developments in line with your existing services
Sending targeted offers for additional services to your organization.

And handle any complaint

It may happen that you as a customer or client are not satisfied with something that takes place within the activities of Zorg van de Zaak. Then you can file a complaint in accordance with the complaints regulations . When handling your complaint, Zorg van de Zaak uses your personal data – to the extent necessary – to handle this complaint. This also applies if there are suspicions of a data leak, in which your personal data may be involved.

Personal data for quality assessments & scientific research

For our occupational health and safety services and company health care, we continuously strive to improve our services and promote the health and well-being of employees. In order to achieve these goals, it is necessary to use customer and client data for (internal) quality assessments. In addition, we may process personal data for conducting scientific research.

Quality tests

The use of customer and client data for quality assessments includes analysing the effectiveness and efficiency of our services. This analysis enables us to improve our processes, identify bottlenecks and provide our customers and clients with an even better service. Quality assessments are carried out on the basis of “presumed consent”. This means that Zorg van de Zaak carries out quality assessments because it has a duty of care towards customers and clients. Processing or providing health data is permitted if it is necessary for the management of the professional practice. 'Management' also includes quality assurance of the care and services provided. You have the opportunity to object to the use of your health data for the quality assessment. You can do this by sending an e-mail to privacy@zorgvandezaak.nl .

Within Zorg van de Zaak, various quality assessments are carried out to guarantee the quality of the (reintegration and medical) files and procedures:

In order to improve the quality of the work of Zorg van de Zaak to support you, the company doctors regularly share their knowledge and methods with a colleague company doctor. In doing so, cases and files are occasionally discussed. This is done anonymously.
With your permission, we can use your file for a file review, intended to guarantee the quality of our services. In this, another BIG registered colleague doctor assesses the advice of your doctor.
In addition, procedural documents are also reviewed by non-medical professionals, such as the occupational expert. No medical data is viewed in this case. If you object to this, you can inform your company doctor. Your file will then not be used for reviewing procedural documents.
Is a physician in training to become an occupational physician (AIOS) involved in your treatment? The AIOS is supervised by a practical trainer. At Zorg van de Zaak, the practical trainer only has access to your medical file if you, as a client, give permission for this. If you do not give permission, the AIOS can only discuss your case with the practical trainer on an anonymous basis.

Scientific research

We also strive to promote scientific research in the field of occupational health and well-being. When conducting scientific research, personal data may be processed. This may be your data if you participate in a scientific study or fill in your data in a survey for this purpose.

We process your personal data only for the purpose of scientific research. We have asked for and received your permission for this. Under certain conditions, health data may be used for scientific research without asking for permission. Conditions include that the research serves the public interest and that the research cannot be carried out without this data. You can indicate that you object to this. You can do this by sending an e-mail to privacy@zorgvandezaak.nl . We do not process more personal data than is necessary for scientific research.

Security and retention period

We take appropriate technical and organizational measures to protect your personal data against loss, theft or unauthorized access.

We will not store your personal data for longer than is necessary for the research, or as long as is legally required. After the research, your personal data will be destroyed, anonymized or archived.

Provision to third parties

We do not provide your personal data for testing and research to third parties, unless this is necessary for the research, or if we are legally obliged to do so. If we share your personal data with other researchers or organizations, for example for collaboration or publication, we ensure that your personal data cannot be traced back to you, or that appropriate agreements are made about the protection of your personal data.

What personal data does Zorg van de Zaak collect?

We have bundled the information by category. For more information, click on the links below.

Basic data

Zorg van de Zaak collects the following basic data from you:

name;
residential address;
telephone number;
email address;
date of birth;
gender;
data of the organization where you work:
- employer name;
- contact person and/or manager;
- function;
- number of hours;
- location.

In addition, Zorg van de Zaak creates a unique code for you as a client. Your employer also receives a unique (company) code. These codes are used in correspondence to prevent mistaken identity and to ensure that the right people receive the right information. Your telephone number or email address can be collected separately to identify you. For example, if you want to log in to our customer portal.

Information about your health

When you use the services offered by Zorg van de Zaak, Zorg van de Zaak also stores data about your health. This can be about both your physical and mental health. Zorg van de Zaak collects this data to advise you as best as possible, to enable you and your employer to carry out the correct reintegration actions and to build a file that meets the requirements set by the UWV and the WGBO/Civil Code . This service usually starts when you receive a call to come to the company doctor for the absenteeism consultation hour. Your health data can also be processed if you come to a (voluntary) preventive consultation hour or are called for a medical examination.

Zorg van de Zaak distinguishes between absence & reintegration data and medical data. Medical data may never be shared with third parties without your permission. Zorg van de Zaak does this in accordance with the Income Insurance Privacy Manual .

Zorg van de Zaak has a strict authorization model when it comes to access to reintegration and medical data. This means that this data can only be viewed by Zorg van de Zaak employees who need this data to perform their duties. Zorg van de Zaak also distinguishes between reintegration and medical data, with the latter data only being viewable by the treating company doctor or medical examiner and the doctor's direct assistants, such as the company doctor's practice assistant and the medical examiner's assistant. This also includes substitutes and business representatives. Since January 1, 2020, Zorg van de Zaak has also been training co-assistants. They work under the supervision of the doctor. The Medical Desk also processes medical mail under the supervision of the doctor. Finally, certain ICT employees have access to this data to perform their duties. The co-assistants, employees of the Medical Desk and the ICT department have signed an additional confidentiality statement.

Digital preparation after an absence report

What do we do?
Zorg van de Zaak can make a digital preparation after the employer has submitted an absence report. We do this from the third day after we have received the absence report from the employer. The digital preparation consists of 1 question that the employer and employee receive by e-mail. We call this the “online survey”. You can find more about the online survey at www.zorgvandezaak.nl/online-uitvraag . We then use science and data science to determine more accurately what the best time is to schedule an appointment with our professionals. We use a combination of the following data for this: the answer to the online survey, the number of absence reports and days in the past 12 months, age, gender, whether the employee works in a small or large company and whether there are subsequent absence reports within 28 calendar days. There is never any automated decision-making.

What is the goal?
This allows us to better respond to the needs of the employee and employer. Do they want direct advice and support? If they do not want direct contact, we are better able to deploy our professionals at the right time. So that our advice and support can be offered as customized as possible.

What personal data do we process?
We only process the answer to the online survey. The personal data that we have already received with the absence notification from the employer and use in the e-mail to the employer with the online survey are: the name, date of birth, our client code and the employer (organization name). This is necessary so that the employer knows who it concerns. In doing so, we have minimized the personal data to the bare minimum. In the e-mail message, we also do not refer to an “absence or sick report”, but we state that the employer has made us a “notification”.

Your citizen service number

The citizen service number (BSN) is only processed when Zorg van de Zaak creates a medical file. This is usually when you first visit a company doctor. In order to prevent mistaken identity, Zorg van de Zaak is required by law to use the BSN in communication with other healthcare institutions and with government agencies such as the UWV.

Registrations when you visit one of our locations

When you visit a Zorg van de Zaak location, it is possible that your presence will be registered. There are two ways in which this happens:

Camera images. Only a limited number of persons who are authorised to do so by virtue of their function may view these images, and only if there is a specific reason to do so: for example, because an incident has occurred or to check the correctness of a complaint. Viewing camera images is only possible at the location where they were recorded, and not outside.
Visitor registration. When you report to the reception of one of the Zorg van de Zaak locations, it is possible that your first and last name and time of the appointment are registered at the reception. This information can be provided by yourself or by the person with whom you have an appointment at the location. The purpose of this registration is to ensure that the appointment proceeds correctly. The visitor registration is kept until the end of the working day at the latest.

Not every location of Zorg van de Zaak has cameras or visitor registration. If camera images or visitor registration are used, this will be announced to you at the location.

The use of Care of the Case websites

If you use websites of Zorg van de Zaak, Zorg van de Zaak stores data about you. For example, your IP address, data about your visit to the website and the device with which the website was visited. More information can be found in the cookie statement at the bottom of this page.

From whom does Zorg van de Zaak receive personal data?

Zorg van de Zaak receives data primarily from your employer (directly or indirectly), your absenteeism insurer or from yourself. Zorg van de Zaak also receives (medical) reports and decisions from the UWV. In addition, it is possible that Zorg van de Zaak receives data from other healthcare providers, such as your GP, an occupational expert, a reintegration company or a treating specialist, with your permission. Zorg van de Zaak does not collect personal data from public sources.

With which parties does Zorg van de Zaak share personal data?

Various companies may be involved in the activities of Zorg van de Zaak. These include other practitioners with whom Zorg van de Zaak collaborates in the provision of services and external parties that must be informed due to legal obligations. These parties only see your personal data if they need it to perform their task and when this is legally permitted. Zorg van de Zaak never shares medical information with other parties without your permission, unless there is a legal obligation or a court ruling to do so.

The (hired) practitioner

Therapists are medically and non-medically trained professionals who work at Zorg van de Zaak Netwerk in the context of your treatment. Sometimes Zorg van de Zaak Netwerk uses an external practitioner. This practitioner then works temporarily for Zorg van de Zaak. Zorg van de Zaak makes good agreements with these practitioners, so that they adhere to the professional guidelines and legislation just as well as the professionals who are employed by Zorg van de Zaak.

Employers

If you are a client of Zorg van de Zaak, your employer is in principle the client. For example, have you been to an absenteeism consultation hour? Then both you and your employer will receive a report about this at the same time. Of course, the professional of Zorg van de Zaak only mentions the information that is necessary for the absenteeism and reintegration process, such as:

the work you are (no longer) capable of doing;
the expected duration of the absence;
the degree of disability;
and advice for the employer to promote your reintegration.

There is never any medical information in the reports that go to your employer. Your employer receives an invoice for certain activities.

If you, as a client, use the services of preventive consultation, occupational health examination, health check or vaccination service, no information will be provided to your employer: the service will be charged to the employer in a manner that cannot be traced back to you as a person. If the company or medical examiner wishes to provide information to your employer on the basis of such a service, this will only happen if you have given explicit permission for this.

The employer and the staff representation can also receive absence overviews or group reports from Zorg van de Zaak. This information is adjusted so that it cannot be traced back to you as a person.

Do you want to know what your employer does with the personal data that he receives from Zorg van de Zaak about you? You can check this with your employer himself or in the privacy statement of your employer.

External parties

The external practitioner

When Zorg van de Zaak refers you to an external practitioner for intervention or because of the medical expertise that is required (you can think of a psychologist, rehabilitation expert, occupational expert or general practitioner), Zorg van de Zaak provides this practitioner with absence and reintegration data about you that he needs. The exchange of medical personal data only takes place with your explicit consent.

Do you want to know what this practitioner does with the personal data that he receives from Zorg van de Zaak about you? You can check this with the practitioner himself or in the privacy statement of the practitioner.

An occupational expert

When an occupational expert investigation is required, the occupational physician may be asked by the occupational expert for an employability profile. The occupational physician will only provide the absenteeism and reintegration data in the form of an employability profile that are necessary to carry out this investigation. This is not medical data.

Government agencies

Zorg van de Zaak provides personal data to government agencies when this is necessary for the statutory tasks of these agencies. For example, information is shared with the UWV if you, as a client, apply for a WIA benefit or expert opinion or leave employment due to illness. The company doctor then provides the UWV with an up-to-date opinion on your illness and necessary medical data for the UWV insurance doctor, so that he or she can assess your medical situation.

In addition, Zorg van de Zaak can submit a 42nd week notification to the UWV reintegration department on behalf of your employer.

Your absenteeism insurer

Do you or your employer have insurance with a disability insurer? Then the claims department of your disability insurer will receive disability data from Zorg van de Zaak, such as sick leave and recovery reports and administrative data. The insurer needs this data to determine the amount of the benefit. The reintegration department of your disability insurer may also receive reintegration data. Only the insurance physician has access to medical data.

Do you work in a school community? On behalf of the employer, Zorg van de Zaak can provide absence data to the Replacement Fund. The Replacement Fund gives your employer compensation to replace you during your absence.

The Dutch Centre for Occupational Diseases

The Netherlands Centre for Occupational Diseases (NCvB) is the reporting point for occupational diseases. Company and medical examiners are required to report to the NCvB if they determine that an occupational disease is present. The data that the NCvB receives cannot be traced back to you as a person.

Other parties, if you or your employer request this

If you wish, Zorg van de Zaak can exchange information with other parties in specific cases. For example, with a trustee, a doctor who gives a second opinion or a lawyer. This only happens if you request it, with your explicit permission. To exchange information with other parties, you can contact your healthcare provider. Do you not have a healthcare provider? Then send a request to medischloket@zorgvandezaak.nl .

It may happen that your employer chooses to outsource part of the absence management (such as case management) to a specialized party. On behalf of the employer, this party then receives personal data from Zorg van de Zaak. This is the same data that your employer receives. The specialized party therefore does not receive any medical data from Zorg van de Zaak unless you give explicit permission for this.

Other companies that Zorg van de Zaak collaborates with

In order to ensure that Zorg van de Zaak operates as effectively and efficiently as possible, some services have been outsourced to external companies. These include data centres, archive managers, companies that offer (supporting) software and web designers. Zorg van de Zaak also purchases services from companies that provide specialist services or perform specific research, such as parties that make home visits in the event of absenteeism, parties that perform blood tests and parties that perform satisfaction surveys on behalf of Zorg van de Zaak. Finally, there are parties that are given access to data in the context of certification processes.

These external partners have been carefully selected. Zorg van de Zaak requires them to handle privacy-sensitive data just as carefully as Zorg van de Zaak itself.

The vision of Zorg van de Zaak on privacy

Minimal collection of personal data

Protection of your data

Care of the Case provides insight

Care of the Case listens

What is personal data and what is meant by processing?

Personal data

Process

What does Zorg van de Zaak use personal data for?

Personal data for quality assessments & scientific research

Quality tests

Within Zorg van de Zaak, various quality assessments are carried out to guarantee the quality of the (reintegration and medical) files and procedures:

In order to improve the quality of the work of Zorg van de Zaak to support you, the company doctors regularly share their knowledge and methods with a colleague company doctor. In doing so, cases and files are occasionally discussed. This is done anonymously.
With your permission, we can use your file for a file review, intended to guarantee the quality of our services. In this, another BIG registered colleague doctor assesses the advice of your doctor.
In addition, procedural documents are also reviewed by non-medical professionals, such as the occupational expert. No medical data is viewed in this case. If you object to this, you can inform your company doctor. Your file will then not be used for reviewing procedural documents.
Is a physician in training to become an occupational physician (AIOS) involved in your treatment? The AIOS is supervised by a practical trainer. At Zorg van de Zaak, the practical trainer only has access to your medical file if you, as a client, give permission for this. If you do not give permission, the AIOS can only discuss your case with the practical trainer on an anonymous basis.

Scientific research

Security and retention period

We take appropriate technical and organizational measures to protect your personal data against loss, theft or unauthorized access.

Provision to third parties

What personal data does Zorg van de Zaak collect?

We have bundled the information by category. For more information, click on the links below.

Basic data

Zorg van de Zaak collects the following basic data from you:

name;
residential address;
telephone number;
email address;
date of birth;
gender;
data of the organization where you work:
- employer name;
- contact person and/or manager;
- function;
- number of hours;
- location.

Information about your health

Digital preparation after an absence report

Your citizen service number

Registrations when you visit one of our locations

When you visit a Zorg van de Zaak location, it is possible that your presence will be registered. There are two ways in which this happens:

Camera images. Only a limited number of persons who are authorised to do so by virtue of their function may view these images, and only if there is a specific reason to do so: for example, because an incident has occurred or to check the correctness of a complaint. Viewing camera images is only possible at the location where they were recorded, and not outside.
Visitor registration. When you report to the reception of one of the Zorg van de Zaak locations, it is possible that your first and last name and time of the appointment are registered at the reception. This information can be provided by yourself or by the person with whom you have an appointment at the location. The purpose of this registration is to ensure that the appointment proceeds correctly. The visitor registration is kept until the end of the working day at the latest.

Not every location of Zorg van de Zaak has cameras or visitor registration. If camera images or visitor registration are used, this will be announced to you at the location.

The use of Care of the Case websites

From whom does Zorg van de Zaak receive personal data?

With which parties does Zorg van de Zaak share personal data?

The (hired) practitioner

Employers

the work you are (no longer) capable of doing;
the expected duration of the absence;
the degree of disability;
and advice for the employer to promote your reintegration.

There is never any medical information in the reports that go to your employer. Your employer receives an invoice for certain activities.

The employer and the staff representation can also receive absence overviews or group reports from Zorg van de Zaak. This information is adjusted so that it cannot be traced back to you as a person.

External parties

The external practitioner

An occupational expert

Government agencies

In addition, Zorg van de Zaak can submit a 42nd week notification to the UWV reintegration department on behalf of your employer.

Your absenteeism insurer

The Dutch Centre for Occupational Diseases

Other parties, if you or your employer request this

Other companies that Zorg van de Zaak collaborates with

These external partners have been carefully selected. Zorg van de Zaak requires them to handle privacy-sensitive data just as carefully as Zorg van de Zaak itself.

The most important information security measures within Zorg van de Zaak

Zorg van de Zaak considers the security of your personal data to be of great importance and pays a lot of attention to it. Risk analyses are performed on a regular basis and new technological possibilities or threats are examined. We also test the functioning of our information security system. We use the ISO 27001 and NEN 7510 standard and guidelines for information security. The Zorg van de Zaak ICT business unit is also ISO 27001 certified.

An important principle is that Zorg van de Zaak only stores personal data within the European Economic Area (EEA). If personal data is stored outside the EEA, this will only happen if Zorg van de Zaak has determined that there is a level of protection that is in line with the requirements of the Privacy Legislation.

If, despite all measures, a data breach or information security incident occurs, Zorg van de Zaak will take immediate action to analyse the cause, limit the damage and, where necessary, inform the Dutch Data Protection Authority and stakeholders.

The retention periods within Zorg van de Zaak

Zorg van de Zaak adheres to the statutory retention periods. If there is no statutory retention period, Zorg van de Zaak will not retain data for longer than is necessary to perform the task.

By law, Zorg van de Zaak is required to retain medical records for 20 years.
In special cases, this can be 30 to 40 years*, from the date of the last change in the file (or longer if a claim or lawsuit is pending or shorter if the client requests destruction).
By law, Zorg van de Zaak is obliged to retain financial data for 7 years from the end of the calendar year.
Absence and reintegration data within the framework of the Gatekeeper Improvement Act will be retained by Zorg van de Zaak for a maximum of 2 years after termination of employment or after the end of the agreement with the client, or for a longer period if a claim or legal action is pending or for a shorter period if the person concerned requests that it be destroyed. Exceptions to longer retention periods also apply if there is a high probability that the employee will be absent due to the same absence or if the file contains permanent agreements.
If you are a self-insurer as a client, a retention period of 5 years after the end of employment applies. For Work Resumption for Partially Disabled Persons (WGA) files, a retention period of 10 years after the end of employment applies
Emails are kept for a maximum of 1 year after receipt.
Camera images are stored for a maximum of 4 weeks.
Standard log data is not retained longer than necessary. To the extent that the occupational health and safety service Zorg van de Zaak qualifies as a healthcare institution under the Wkkgz, the log data of the medical file is retained for at least 5 years from the writing of the log rule.

Do you want to know what the retention periods are for data that Zorg van de Zaak processes via its websites? You can find this under 'Information for website visitors'.

*The retention period for medical records may deviate from 20 years if there is exposure to hazardous substances.

Exercising your rights

Do you want to know what personal data Zorg van de Zaak has about you? Do you want to have certain data corrected or transferred? Or do you want to have parts of your (medical) file destroyed or your entire file removed from the administration?

If you wish to exercise your rights, you can send a request to medischloket@zorgvandezaak.nl or submit the request to your healthcare provider or contact person within Zorg van de Zaak. Zorg van de Zaak will comply with this request. Only in exceptional cases may Zorg van de Zaak not do so. You will then receive a written explanation. Before Zorg van de Zaak processes your request, it will verify your identity. This can be done by visiting the healthcare provider, by contacting you and verifying that the request came from you and, in exceptional cases, with a copy of your ID.

Your healthcare provider can provide further information about the possibilities and consequences that your request may have on the continuation of your treatment or on other activities of Zorg van de Zaak.

If (part of) your personal data is corrected or deleted from the medical file, a note of this will be made.

What rights do you have when it comes to the processing of your personal data?

The General Data Protection Regulation describes the rights you have as a person. In short, these are the following rights:

The right to access. You may request your file and other registrations of your personal data from Zorg van de Zaak and view them yourself.
The right to rectification and supplementation. Is information incomplete or incorrect? Then you can have it supplemented and/or corrected.
The right to restriction of processing. This means that Zorg van de Zaak may not process your data (temporarily).
The right to object. Do you want certain data that Zorg van de Zaak has about you not to be processed? Then you can object to that.
The right to data portability. This means that you can receive the personal data that you have shared with Zorg van de Zaak at any time in a machine-readable format, so that you can transfer it to third parties.
The right to have your (medical) file or personal data destroyed (the right to be forgotten). This means that all personal data that you want to have destroyed will be deleted, as long as this does not conflict with the legal obligations that Zorg van de Zaak must comply with.

In addition, as a client you have the right to a copy under the WGBO and the WABPVZ . This means that you can request an electronic copy of all processed personal data that Zorg van de Zaak has of you free of charge. Zorg van de Zaak will comply with your request for a right to an electronic copy, unless the privacy of another person outweighs your right to a copy.

Your rights under the GDPR and other laws

Zorg van de Zaak not only complies with the General Data Protection Regulation, but also with other laws. For example, Zorg van de Zaak is obliged to store medical data for twenty years. It is therefore possible that you invoke a right under the GDPR or the WGBO, but that Zorg van de Zaak must reject this request because it conflicts with another law. Zorg van de Zaak will always inform you of this. If your request can be granted in part, but not in part, Zorg van de Zaak will also inform you of this.

What can go wrong with your personal data?

Zorg van de Zaak handles your personal data as carefully as possible. No more personal data is collected than necessary and the best possible security of this data is ensured. This does not mean that something cannot go wrong. Zorg van de Zaak is aware that your personal data may end up with third parties who should not have access to this data. Sometimes, in extreme cases, this can lead to stigmatisation or exclusion. When it comes to identification data, such as name, date of birth and BSN, you may run the risk of identity fraud. Your contact details, in particular an e-mail address, can be misused by an unauthorised recipient for spam or phishing activities. For Zorg van de Zaak, this is a reason to pay particular attention to the security of your personal data.

What happens if you refuse to provide certain personal data?

In case of illness

If you report sick to your employer, there are certain obligations that you have:

You must provide the occupational health and safety service with information about your absence.
You must cooperate in determining, adjusting and implementing the plan of action.
You must accept the employer's offer to perform suitable work.
You must cooperate with reasonable measures for reintegration.

Zorg van de Zaak needs personal data relating to these obligations, for example when the practitioner helps you draw up a plan of action. If you refuse to provide this personal data, this is against the law. This may have the following consequences:

Wage suspension if you do not comply with the control regulations, for example because you do not appear at the consultation hour or refuse to provide information to the company doctor.
Wage freeze if you fail to comply with reintegration obligations, such as failing to cooperate in drawing up an action plan.
Failure to cooperate in your own recovery can also (eventually) lead to dismissal.

When your practitioner asks for your explicit consent to process certain personal data, you are free to refuse this consent. This has no legal adverse consequences. However, it may have consequences for your treatment. Your practitioner can tell you more about this.

During appointment assessments

Zorg van de Zaak performs appointment examinations for employers. If you conceal a defect that affects your performance during the appointment examination, while the examining physician has asked about it, this is against the law. This may result in you no longer being entitled to wages in the event of absence.

By the way, you are not obliged to cooperate in an appointment assessment. If you do not want to cooperate, it is up to the employer to decide whether or not you will be hired.

In other cases

In other cases, you are often free to provide personal data or not to do so. However, if you do not give Zorg van de Zaak any or very limited permission to process personal data, this may impact the services provided by Zorg van de Zaak. This privacy statement explains which personal data Zorg van de Zaak collects and for what reason. If you do not agree with this, Zorg van de Zaak would be happy to discuss this with you to provide an explanation and possibly look for other options.

File a complaint

Are you dissatisfied with the services of Zorg van de Zaak? Then you can share your complaints with us, for this we would like to refer you to our complaints procedure page .

You can also file a complaint with other authorities and initiatives, such as the National Healthcare Number (0900-2356708), the Occupational Health and Safety Services Disputes Committee, Disciplinary Judge or court after you have submitted the complaint to Zorg van de Zaak.

Other questions about privacy

Please contact us via info@zorgvandezaak.nl or your specific contact person within Zorg van de Zaak.

Do you believe that the processing of your personal data is not in accordance with privacy legislation? In addition, if you have a question or complaint in the area of the GDPR and/or privacy, you can contact the Data Protection Officer, Mr ACM van de Molen. He can be reached via functionarisgegevensbescherming@zorgvandezaak.nl . You can also file a privacy complaint with the Dutch Data Protection Authority. This is only possible after you have submitted your complaint to Zorg van de Zaak.

Care of the Case as data controller

The occupational health and safety service Zorg van de Zaak is independently responsible for processing the entire occupational health and safety service. This means that Zorg van de Zaak is responsible for processing, among other things, the management of the medical file, administration, company doctor services, POB services, employability coach/case management services, company social work, complaints committee, occupational experts, etc. See also the NVVA manual .

Care of the Case as a processor

Zorg van de Zaak is a processor if it processes personal data on behalf of another organization. Zorg van de Zaak is a processor in the following cases:

Providing a customer portal for customers (Zorg van de Zaak Online), where Zorg van de Zaak ICT BV is the processor and the customer is the controller. This is regardless of whether the customer actively uses the portal.
The use of a system owned by the customer or a third party designated by the customer.

For what purposes are personal data processed on the website?

Newsletter

Zorg van de Zaak Netwerk sends (on behalf of Zorg van de Zaak Arbodienstverlening) newsletters to keep you informed of news, updates and special offers in the field of work, health and our network. We process your personal data for this purpose in accordance with the applicable laws and regulations, including (but not limited to) the General Data Protection Regulation and the Telecommunications Act.

The personal data that we process for sending the newsletter are your first name, last name and email address. These are necessary for us to send the newsletter and are only processed for this purpose if you have given us permission to send the newsletter.

We use an external party to send newsletters. We share the above-mentioned data with this party only for sending the newsletter. This party is a processor of Zorg van de Zaak Netwerk and we have made agreements with this party about the processing of your personal data.

You can unsubscribe from the newsletter at any time by clicking here or via the unsubscribe link in the newsletter.

To request services

If you request a preventive consultation via the website

As an employee, you can request a preventive consultation. When you do this via the Zorg van de Zaak website, the following personal data will be processed:

Name
Email address
Company name

The purpose of processing this data is to contact you to schedule a consultation. Zorg van de Zaak will only do this if you have given explicit permission for this. You can withdraw your permission at any time.

When you request (quotes of) services for your staff

Do you want to offer a service to your employees as an employer, such as flu vaccinations, a 'quit smoking' course or a lifestyle program? Or do you want to have a preventive occupational accident analysis performed? Then you can request a quote via the Zorg van de Zaak website. Zorg van de Zaak then processes the following personal data:

Name
Phone number
Email address
Company name
Whether you are already a customer of Zorg van de Zaak

If you contact us via the contact form or request additional information via an information form

If you complete a contact or information form on one of the Zorg van de Zaak websites, Zorg van de Zaak processes the following personal data from you:

Name
Email address
Phone number
Company name
Whether you are an employee or an employer
Whether or not you are a customer of Zorg van de Zaak

The purpose of this is to contact you and to be able to answer your complaint or question. The processing of this data is necessary for the proper handling of your request.

If you request information or white papers

If you request an information booklet on the website, Zorg van de Zaak will process the following personal data about you:

Name
Function
Company name
Phone number
Email address
Address
Whether or not you are a customer of Zorg van de Zaak

The purpose of this is to be able to send you the requested information and to be able to contact you. The processing of this data is necessary for the proper handling of your request.

When you register for activities

Zorg van de Zaak offers activities that you can participate in, such as attending sporting events or a New Year's reception. When you register for this, Zorg van de Zaak will receive the following information from you:

Name
Email address
Company name
Whether you are an employer or an employee
Whether or not you are a customer of Zorg van de Zaak

If you want to report the next step in the event of long-term disability

In addition, as an employer you can also indicate via the website which follow-up step is required after two years of incapacity for work. In this case, Zorg van de Zaak processes the following personal data of the incapacitated employee in question:

Name and address details
Email address
Phone number
Whether there is a WIA application, dismissal permit via the UWV, wage sanction or self-risk.

If you unsubscribe from services

Do you want to cancel your subscription with Zorg van de Zaak? This can be done via the website. The following personal data is processed:

Name
Email address
Phone number
Function
Company name

Zorg van de Zaak needs this information to determine whether your cancellation meets the general terms and conditions. In addition, Zorg van de Zaak uses this contact information to contact you if there are any questions about your cancellation.

Cookie Statement

We would like to refer you to our cookie statement.

Retention periods for website visitors

Zorg van de Zaak adheres to the statutory retention periods. If there is no statutory retention period, Zorg van de Zaak will not retain data for longer than is necessary to perform the task.

Completed website forms are kept for a maximum of 3 months after receipt.
When you fill out a form on the website, it is sent to a mailbox. This mailbox is accessible to employees who handle the purposes as described earlier in this statement. These emails are stored for a maximum of 3 months after receipt.

About this privacy statement

This privacy statement applies to:

Colbe Network
Zorg van de Zaak NV, the occupational health and safety service of the Zorg van de Zaak Network, and its group companies:
- Ardyn BV
- Arbo-Vitale BV
Omwender BV
Care of the Business ICT BV

This version was amended on 03 June 2024. Zorg van de Zaak may amend this privacy statement and the cookie statement. We therefore recommend that you review this privacy statement periodically. Changes will be communicated via the website.