Privacy · GDPR
Your data, our work.
We keep a medical record because it makes your care better — not because data has value. Below is exactly what we keep, why, for how long, and what you can do about it yourself at any moment.
01
What we collect
Everything below sits in one record that you and your treating team see — the same record, the same rules.
What you fill in yourself
Your name, date of birth, contact details and your national register number, for invoicing and identification. In the intake: medication, allergies, medical history, earlier treatments, pregnancy or breastfeeding, and what you want to achieve. Those answers help determine whether a treatment is safe — which is why we ask them before the consultation and not after.
What is added during your journey
Consultation notes, your treatment plan, exactly what was administered with the dose per area and the batch number of every injectable, follow-up photographs in a fixed set-up, measured outcomes and your aftercare reports. The batch number is a legal traceability requirement and, at the same time, the reason we can look back at what worked for you.
What the app and the portal record
Your login details, your consents with their time and version, messages with the practice, check-ins after a treatment, and which knowledge articles you have read — the last of these so your physician knows what has already been explained and where questions remain. Connect a wearable and sleep, activity and HRV are added; only if you make that connection yourself, and only for as long as you keep it.
Your face scan
The scan produces a 3D model on a fixed topology of 1,220 points, plus derived measurements such as Fitzpatrick via ITA°, laxity in millimetres and asymmetry per area. This is biometric data. A scan for your care is part of the medical record (Article 9(2)(h) GDPR), not a consent. Using a scan for teaching needs separate explicit consent (Article 9(2)(a) GDPR).
Technical data from this site
IP address, device and browser type, and the error logs needed to keep the site running safely. Analytics are placed only after your cookie consent, and marketing cookies are off by default.
02
Why we collect it
Every processing operation has a legal basis. Where that basis is “consent”, you can withdraw it without any consequence for your care.
To treat you and follow you up
Care requires a record: without your history we cannot dose safely, and without a baseline we cannot judge the course honestly. Legal basis: Article 9(2)(h) GDPR (healthcare) together with the Belgian Patient Rights Act (Act of 22 August 2002).
Face scans
A scan made for your care follows your medical record: Article 9(2)(h) GDPR. It is not based on consent. A scan used for teaching needs your explicit consent: Article 9(2)(a) GDPR.
Because the law obliges us
Keeping a patient record, tracing injectables by batch number, and retaining accounts and invoices are legal obligations. We cannot delete that data on request, even if we wanted to.
To improve our protocols
We compare outcomes against the literature and against our own history. That happens exclusively on aggregated or pseudonymised data — never with your name, never with your images attached.
What we do not use your data for
No sale or rental to third parties. No advertising audiences based on your health. No comparison photographs of a treatment result in marketing. No training of models on your scan or images without new, separate and equally explicit consent. The imagery on this site is illustrative or AI-generated — never patient images. How we mark that is set out in our image disclosure.
Special category · Article 9 GDPR
Your face scan is biometric data.
A 3D scan identifies you uniquely. A scan made for your care is part of your medical record under Article 9(2)(h) GDPR, not a consent. Using that scan for teaching needs your explicit consent under Article 9(2)(a) GDPR. Without that consent we do not use the scan for teaching, and your care carries on.
Consent
Teaching use only: explicit consent under Article 9(2)(a) GDPR. The care scan follows the medical record.
Withdrawable
At any moment, with no consequence for your treatment.
Audit log
Append-only: who, when, which version of the text.
Storage
Encrypted, within the EU, visible only to your team.
No marketing
Never in campaigns, never as a comparison of a treatment result, never as model training.
Yours
Exportable if you stop, deletable if you ask.
You can withdraw in the app under Profile → Consents, or with a single e-mail. Your scans then disappear from your record; the consent log itself remains, because we have to be able to show when you allowed what, and when you withdrew it.
03
Your rights
Access and export sit in your record, not behind a form. The rest takes one e-mail.
Access and export
You see your full record in the app and in the portal: intake, consents, scans, treatments, outcomes. You can export it yourself, as a readable PDF and as a machine-readable file, so you can take it to another physician.
Rectification
If something is wrong, we correct it. Medical findings stay on record as findings, but we add your comment to the record — that is how rectification works in a healthcare file.
Erasure — and where it stops
Your consent for teaching, and the scans that are for teaching only, your imagery, your newsletter subscription and your wearable connection can go completely. Your medical record, care scans included, cannot: the law requires us to keep it for at least 30 and at most 50 years after your last contact. We would rather say that plainly than show you a button that cannot do it.
Withdrawing consent
For teaching use of a scan, your wearable, e-mails about campaigns or the use of imagery: you can withdraw at any time, in the app under Profile → Consents. Withdrawing teaching consent does not remove the care scan from the medical record. It has no consequence at all for the care you receive.
Objection and complaints
You can object to processing that rests on our legitimate interest, and you can always lodge a complaint with the Belgian Data Protection Authority.
04
How long we keep it
Every category has a period. After that period we delete or anonymise automatically.
Medical record
At least 30 and at most 50 years after the last contact, as the law requires for patient records. After that we delete it in full.
Consent forms for scans in teaching
We keep signed consent forms for using scans in teaching while your consent is in force, and then for 10 years after you withdraw it or after the scans are destroyed. Then we destroy them. This is separate from the retention period of your medical record.
Consent log
Kept, including after withdrawal. It is an append-only log: we add, we do not erase. That way we can always show what you allowed, and when.
Invoicing and accounts
Seven years, as accounting law prescribes.
Messages and analytics
Messages with the practice: two years after the last message, unless they are medically relevant and belong in the record. Analytics: fourteen months, pseudonymised.
05
Who we share with
As few parties as possible, and every access is logged.
Your own treating team
Only those involved in your care see your record. Every access is registered, including the physician’s.
Health insurance fund or insurer
Only at your request, and with the documents you need. We send nothing to an insurer of our own accord.
Our software suppliers
The record, the app and the accounts run with processors under a data-processing agreement and with storage inside the EU. The diary may also be processed outside the EU, as stated under Booking. If there is another transfer outside the EEA, it takes place under the European Commission’s standard contractual clauses.
Booking
Calendly (Calendly LLC): to schedule your appointment and send the reminder. We don't ask for medical data there. Calendly may also process data outside the EU (in the US), with the safeguards in our data-processing agreement with Calendly.
Never
Advertisers, data brokers, manufacturers of the products we use, or platforms that build profiles. There is no commercial party that can buy your data from us.
Arrange it yourself, without a request form
Access
Your full record is live in the app and the portal — including every consent and every treatment.
To My record
Export
Download your record as a PDF or a machine-readable file, ready to take to another physician.
Request an export
Erasure or withdrawal
We delete scans, imagery and connections on request. Where something has to stay for legal reasons, we say so.
Submit a request
Questions about your data
Put them to the person responsible for data processing at info@clinicdouce.be or XXX XX XX. We answer within thirty days, usually sooner.
Not satisfied with our answer
Then you can complain to the Belgian Data Protection Authority, the Gegevensbeschermingsautoriteit, Drukpersstraat 35, 1000 Brussels. You always have that right, including when you complain to us first.