Privacy policy

1. Controller

• de Kunst van Werken B.V., trading as York and Philip
• KvK number: 94098344
• General email: info@dekunstvanwerken.nl
• Medical and privacy matters: medisch@dekunstvanwerken.nl
• Telephone: +31 (0) 6 38 90 32 64

York and Philip is the English-language practice of [de Kunst van Werken] in Amsterdam. The controller for all processing described here is de Kunst van Werken B.V.

2. Which personal data we process

Depending on the service, we process the following categories of data.

• Contact and identification data: name, role, business telephone number and email address of contact persons at employers and clients.
• Work-related data of employees: name, role, department, first day of absence, expected return date and reintegration status.
• Health data (special category): medical data necessary for absence management, assessment by the occupational physician, periodic medical examinations and pre-employment medicals. These data are processed only under the responsibility of the occupational physician and are covered by medical confidentiality.
• Communication data: the content of emails, telephone notes and correspondence.
• Technical data about website use: see section 8.

3. Purposes and legal bases

We process your data only for the following purposes.

• Performance of the agreement with clients (article 6(1)(b) GDPR): providing occupational health services such as absence management, consultation hours, periodic medical examinations, pre-employment medicals and return-to-work support.
• Legal obligations (article 6(1)(c) GDPR): compliance with, among others, the Dutch Working Conditions Act (Arbeidsomstandighedenwet), the Gatekeeper Improvement Act (Wet verbetering poortwachter), the Healthcare Quality, Complaints and Disputes Act (Wkkgz) and the fiscal retention obligation.
• Legitimate interest (article 6(1)(f) GDPR): administration, file management, security of our systems and business communication with existing and prospective clients.
• Health data: article 9(2)(h) GDPR (medical diagnosis and occupational medicine assessment) and its elaboration in the Dutch GDPR Implementation Act (UAVG).

4. Medical confidentiality

Health data are processed under the responsibility of the occupational physician and are covered by medical confidentiality. The employer receives only the information necessary for reintegration, such as limitations and possibilities at work, and never the medical diagnosis. Access to the medical file is strictly limited to authorised staff bound by a duty of confidentiality.

5. Retention periods

• Medical files: 20 years after the last treatment or contact, or longer where the duty of care of a good practitioner reasonably requires it (Medical Treatment Contracts Act, WGBO).
• Reintegration and absence files (non-medical): up to two years after the file is closed, unless the law requires longer retention.
• Financial records and invoices: 7 years (fiscal retention obligation).
• Contact data and correspondence: as long as needed for the purpose for which they were collected, and thereafter according to our retention periods or the periods required by law.

6. Recipients and processors

We share your data with third parties only where necessary to provide our services or because of a legal obligation. This concerns, among others:

• The employer, for non-medical reintegration information only.
• UWV, the Dutch Employee Insurance Agency, under the Gatekeeper Improvement Act.
• Registered core experts we engage: occupational physician, occupational hygienist, safety expert, work and organisation expert.
• Processors such as suppliers of absence management and email software. We conclude a processing agreement with these parties.
• Competent public authorities where we are legally obliged to do so.

We do not transfer your data to parties outside the European Economic Area unless appropriate safeguards are in place and the transfer is necessary for the agreement.

7. Security

We take appropriate technical and organisational measures to protect your personal data against loss or unlawful processing: access control with strong authentication, encrypted connections (TLS), logical separation of medical and non-medical data, and periodic review of our security measures.

8. Cookies and website use

This website places no tracking or marketing cookies. Functionally necessary cookies may be used for the website to work correctly. The typefaces are loaded from Google Fonts, so your IP address may be processed by that third party when a page loads. We keep no visitor statistics that can be traced to individuals.

The enquiry form on the contact page sends your name, company, employee range, email address and message to our own server, where they are stored and used only to answer you. No email service or other third party is involved.

9. Your rights

Under the GDPR you have the following rights.

• The right of access to your personal data.
• The right to rectification of inaccurate data.
• The right to erasure (the right to be forgotten), within the limits of the law.
• The right to restriction of processing.
• The right to data portability.
• The right to object to processing based on legitimate interest.

You can submit a request to medisch@dekunstvanwerken.nl. To verify your identity we may ask for additional information. For access to your medical file, contact the occupational physician directly.

10. Complaint to the supervisory authority

If you believe we do not handle your personal data with care, we ask you to raise this with us first. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at www.autoriteitpersoonsgegevens.nl.

11. Changes

We may amend this privacy policy from time to time, for example when legislation or our services change. The current version is always on this page, with the date of the last update at the top.