# Privacy text for your practice

> A privacy text to adopt: tell your clients and applicants that you work with ombra, what you keep and what their rights are.
>
> Canonical page: https://ombracare.com/en/privacy-notice-text/

## Tell your clients.

If you work with ombra, tell your clients. This text helps you get started.

Last updated: 19 October 2026

## Why you tell them

You are responsible for your clients’ and applicants’ data. That is why you tell them who you are, what you do with their data and which rights they have. The GDPR requires this (articles 13 and 14), and your professional code requires the same.

Copy the text below into your own privacy statement, and fill in the parts in brackets. With [Belgium] and [Netherlands], choose what applies to your practice, and delete the rest. It is a starting point, not legal advice: adapt the text to your practice.

For each purpose, fill in which legal basis you use and why you may process health data; have that checked if necessary. Say which data is required and why, which is not, and what happens if someone does not provide required data. If you receive data from others, say which and from whom. If you have a data protection officer, name them.

## The text

> ### Privacy at [name of your practice]
>
> [Your name], [psychologist, clinical psychologist, psychotherapist or therapist], [address of your practice], [e-mail address], is responsible for the data you share with us. [Do you have a data protection officer? Name them here, with their contact details.]
>
> ### What for
>
> We use your data to follow up your application, to make appointments with you and, if you come into care with us, to keep your patient record as the law requires. We use it for nothing else.
>
> ### Which data
>
> What you give us yourself: your name, your contact details and your question. If you come into care with us, also what is needed for your record, such as your [national register number (rijksregisternummer) or citizen service number (BSN)], your general practitioner if you wish, and reports of our sessions. [Do we receive data through someone else, such as your general practitioner or a referrer? Say here from whom, and which data.]
>
> ### What you must provide
>
> We need your name and contact details to follow up your application: without them we cannot help you. [Does the law, your health insurance fund (ziekenfonds) or your health insurer (zorgverzekeraar) require more, such as your national register number or BSN? Say here what, and what happens if you do not provide it.] Everything else you give only if you want to.
>
> ### Why we are allowed to
>
> We process your data to be able to give you care, and because the law obliges us to keep a record. What you entrust to us is covered by our professional secrecy.
>
> ### With whom
>
> We work with ombra, a secure electronic record. ombra stores your data on our behalf in datacentres in the European Union, and uses it for nothing else. For this, ombra works with Microsoft. For certain support and security, Microsoft may work from outside the European Union; the safeguards the GDPR requires then apply, such as the European Commission’s standard contractual clauses. You can ask us for a copy of those safeguards. [Do you share data with others, such as a general practitioner, health insurance fund or health insurer? Name them here, and when.] Beyond that we share your data with no one, unless the law obliges us to.
>
> ### How long
>
> If you come into care with us, we keep your record [Belgium: for at least 30 and at most 50 years after our last contact, as the Kwaliteitswet (Act on the quality of healthcare practice) requires] [Netherlands: for 20 years after the last change, or longer if that is necessary for good care, as the WGBO (Medical Treatment Contracts Act) requires]. If you do not come into care with us, we delete your application [the retention period your practice uses for this] after our last contact.
>
> ### Your rights
>
> You may see your record and get a copy of it. [Belgium: you get access as quickly as possible, at the latest within 15 days after we received your request, and the first copy is free.] [Netherlands: you get an answer as quickly as possible, at the latest within a month.] You can ask who has seen your record, have data corrected or completed, and in some cases have it erased or its use restricted. Data you gave us yourself and that we keep digitally, you can take with you in a common format; where technically possible, we send it directly to another care provider. [Netherlands: you can also ask us to destroy your record.] Send your request to [e-mail address].
>
> ### Questions or complaints
>
> Let us know if you are not satisfied with something. [Belgium: you can also turn to the Data Protection Authority (Gegevensbeschermingsautoriteit, www.dataprotectionauthority.be), and about your rights as a patient to the federal ombudsman service for patients’ rights (federale ombudsdienst Rechten van de patiënt).] [Netherlands: you can also turn to the Autoriteit Persoonsgegevens, the Dutch Data Protection Authority (www.autoriteitpersoonsgegevens.nl), and with a complaint about your care to our complaints officer (klachtenfunctionaris), [name or organisation].]

Want to tell your clients more about ombra itself? Then refer them to [ombracare.com/en/for-clients](https://ombracare.com/en/for-clients/).

## For groups

In a group, everyone hears what the others share. Point this out to your participants, for example with this sentence in your registration form:

> What is shared in the group stays in the group. We ask the same of you.

## Consent for an electronic record

If your professional code requires your client’s consent before you keep their data electronically, as the Belgian code of ethics for psychologists does, you can ask for it in your application form or at your first session:

> I agree that [name] keeps my data in a secure electronic record.

Your legal duty to keep and retain a record continues to apply alongside this.

## Where to put the text

- On the privacy page of your own website, with a link next to your booking page and your forms.
- In the privacy text of your application form in ombra, under Aanmeldingen (Applications) → Website. Summarise it there and refer to your website.
- In the privacy text of a group’s registration form, in that form’s settings.
- At your first session, on paper or in your e-mail.

What ombra does for you is set out in the [data processing agreement](https://ombracare.com/en/dpa/).

## See also

- [For clients](https://ombracare.com/en/for-clients/): Your psychologist or therapist works with ombra. What that means for your data.
- [Data processing agreement](https://ombracare.com/en/dpa/): How ombra processes your clients’ data: only on your instructions.
- [Terms and conditions](https://ombracare.com/en/terms/): The agreement between you and ombra when you use ombra for your practice.

## Be the first to hear when you can start.

Get updates about Ombra and the date of our launch.

[Follow our launch](https://ombracare.com/en/#wachtlijst)