Privacy notice for children and parents

If we process your personal data, this indicates that we are going to do something with this data, such as:

• Collection
• Recording
• Organization
• Storage
• Adaptation or alteration
• Retrieval
• Consultation
• Use
• Disclosure
• Restriction
• Erasure or destruction

• Yours because you are being treated at the Máxima Center
• Your parents': a limited amount of personal data, such as name, contact details and relationship to you. This information is needed to contact your parents/guardians and to check who has parental authority if you are under 16 years old. In some cases, more data is processed, for example some KLIK questionnaires for parents/guardians.

The Máxima is responsible for the safe processing of your data and decides which personal data is processed, why and how.

The Máxima Center processes data to provide good care to you, to evaluate the quality of care (or have it evaluated) and for our administration. We receive this information from you and your parents. We also receive data from the healthcare providers from the referring hospital and we collect data ourselves during diagnosis and treatment.

This concerns the following personal data:

• First and last name
• Date of birth
• Gender
• Residential address
• Telephone number
• Email
• Insurance details
• Personal Identification Number (BSN)*
• ID number
• If applicable: information about your parents/guardians
• History of immediate family if this is important for your treatment and diagnosis.

*It is a legal obligation that we include your Personal Identification Number (BSN) in our administration and check it via an identity document. We want to avoid confusing you with another patient.

Special data are privacy-sensitive data such as data about your health that we process in the electronic patient file, for example a report of the consultations, results of examinations, photos and medication use. Other special personal data may also be processed, if this is important for the treatment, such as:

• Information about your faith
• Genetic data

The Máxima Center stores your data in an electronic patient file (HiX). You can view (part of) this data in the patient portal.

If you are younger than 12 years old, your parents can look in your file. If you are between 12 and 16 years old, you and your parents can look in your file. If you are older than 16 you can look into your file yourself and your parents can only look into your file with your permission.

The Máxima Center uses this data for:

• Providing good and safe care
• Exchanging data with referrers, general practitioners and other healthcare providers
• Evaluating care (or having it evaluated) in order to monitor and improve quality *
• Educational purposes*
• Scientific research
• Sending claims to the health insurer and conducting administration
• Accountability to, for example, the Health and Youth Care Inspectorate.

*If you do not want your data to be used for this, you can object to it. The contact details for objecting can be found at the bottom of the privacy policy.

In order to be able to process your data, a basis from the General Data Protection Regulation (GDPR; Dutch: AVG) is required, such as:

• The treatment agreement with the Máxima Center
• Consent to the processing
• Necessary for compliance with a legal obligation
• Necessary in order to protect vital interests(in emergency situations)
• For the purposes of legitimate interests.

The Máxima Center only shares your data for the purposes described in this privacy statement, with:

• Other healthcare providers, healthcare institutions or third parties who are or will be involved in your treatment, especially with the UMC Utrecht/Wilhelmina Children's Hospital (WKZ), shared care centers and other centers with which we collaborate. We have made written agreements about this. This exchange of data is increasingly done electronically.
• The GP will receive a letter with a summary of your treatment at the Máxima. If you don't want that, let your doctor know.
• The health insurer. Only a 'Diagnosis Treatment Combination' (DBC) is given, a code for the total treatment as a basis for charging the healthcare costs.
• Researchers from Dutch and foreign research institutions and companies. This is for scientific research. This includes the development and evaluation of medicines and medical devices. This only happens after permission from you and/or your parents/guardians.
• Cooperation partners involved in evaluating the quality of care provided, such as the Foundation for Pediatric Oncology in the Netherlands (SKION).
• External quality registrations, such as the national pathological-anatomical archive PALGA and the Dutch Cancer Registry (NKR).
• Other recipients if there is a legal obligation to do so, such as reporting an emergency to the Health and Youth Care Inspectorate (IGJ).

The Princess Máxima Center takes the protection and security of your personal data very seriously and takes continuous measures to optimally protect all data against abuse.

To demonstrate compliance to good information security, we as a center are both NEN7510 and ISO27001 certified.

We take technical and organizational measures to protect your data:

• All employees have signed for confidentiality.
• All healthcare providers are subject to medical confidentiality.
• Healthcare professionals are only allowed to view data if they are involved in the treatment.
• Other employees are only allowed to view (parts of) your file if this is necessary for their administrative tasks.
• We ensure that the computers are properly secured. We work according to nationally established security standards
• We check the viewing in medical files by employees randomly.
• Sometimes it is necessary for the Máxima Center to engage another party to carry out work. We ensure that this party uses the same level of security and confidentiality as the Máxima.
• If your data is used for scientific research, the data will be provided with a code instead of your name. We keep the 'key' of this code in a separate, secure place in the Máxima Center. For all scientific research and also in reports and publications, we only use a code, so that it cannot be traced back to you.
• If we use your data for evaluation of care to improve quality, we work with encrypted data if possible.

• We are legally obliged to store the data from your medical file for at least 20 years after the end of the treatment agreement. We store this data longer because it can be important for providing good help when you are an adult.
• Data that we have collected for scientific purposes is stored for at least 15 years in coded form, as explained above.
• We do not store administrative data for longer than is required by law or than that this is important for good help to you.

The Máxima Center conducts scientific research. We are always looking for new and better treatments. At the beginning of the treatment, we ask you and/or your parents/guardians for consent to use your data and body material (e.g. blood, urine, tissue) for scientific research by means of the Biobank Patient Information Folder (PIF). You can withdraw this permission at all time. For more information, you can visit our scientific research page.

We regularly ask a number of questions via the KLIK portal. For example, how you feel, how things are going at school, how the contact with your friends goes, how your energy is and whether you sleep well.

There are various questionnaires, namely for:

• Healthcare: these questionnaires will be part of your medical file.
• We protect this part of your data, as discussed in the section 'how do we protect the data?'
• This data can only be viewed by the specific healthcare provider(s) who issued the questionnaires
• Scientific research: These questionnaires are intended for research into quality of life (sometimes in addition to a study of new medicines in which you participate). We ask consent from you and/or your parents/guardians. This data will be used anonymously. This means that the data is not linked to you as a person.

If you want to know more, visit our KLIK page.

As a patient, you have the following rights*:

• Right of information
• Right of access
• Right to erasure
• Right to rectification and to complement
• Right to restriction of processing
• Right to data portability

If you want to make use of one of these rights, you can contact your physician.

*We will have to check your identity before your request can be fulfilled.

The Princess Máxima Center only uses personal data that you enter via our website, such as your name or address, for the purpose for which you enter it. For example, registering for a meeting or signing up for a newsletter.

In the Princess Máxima Center, filming and/or photography regularly takes place. To prevent you from being recorded in the video or in the photo against your wishes, we do the following:

• If you and/or your parents are visibly shown, your consent is requested before filming/photography
• In the room where filming/photography takes place, you will be informed about this by means of information signs. If you object, a sticker will be placed on your shoulder or chest, so that you will not appear in the image
• In the unlikely event that you can be seen in a photo or in a video, the images will be blurred during editing.

We use cookies when you visit our website, only functional and analytical cookies. For more information, please visit our cookies page.

Experiences of children and/or parent(s) and survivors are an important source of information to improve the care and services of the Máxima. We use the 'Patient Experience Monitor' (PEM) to measure these experiences. It has been specially developed to reliably measure the experiences of children and parents.

For more information, visit one of the following pages:

• Measuring patient experience
• Share your experience

We do our best to handle your data with care. However, you may have questions or may be dissatisfied with the way the Princess Máxima Center handles your privacy. What can you do?

• You can discuss your questions and/or dissatisfaction with your treating physician
• You can contact the Data Protection Officer. This is the person who, independently, supervises the application and compliance with privacy legislation within the Máxima. You can find the contact details below
• You always have the right to submit signals of dissatisfaction to the ombudswomen in the Máxima Center. They can also help you if you want to file a complaint
• Finally, it is also possible to report a complaint to the privacy regulator, the Dutch Data Protection Authority.

Postal address:

Princess Máxima Center for pediatric oncology

Attn. Data Protection Officer

P.O. Box 113

3720 AC Bilthoven

T: 088 972 72 72

E: FG@prinsesmaximacentrum.nl

This privacy statement does not apply to third-party websites with reference from our website. The Princess Máxima Center is not liable for the content of these other websites nor for the processing of personal data, cookies and other data by the administrators of these websites. For questions about these other websites, you can contact the administrator of the websites in question directly.