Privacy Statement
Embloom respects your privacy. We ensure that the personal information you provide to us is treated confidentially. This privacy statement explains which data we collect, for which purposes and on which legal basis. We do so on the basis of the various ways in which we obtain personal data. We may amend this statement from time to time, so we recommend that you consult the privacy statement regularly.
This privacy statement applies to our website (www.embloom.nl) and the services we offer. It is important to note that there is a difference between the website and the Embloom e-health platform. The e-health platform (portal.embloom.nl) can only be accessed through your user account, by logging in with your username and password or by using your unique login link.
Personal data
In order to offer our website and services, we process personal data. The term “personal data” refers to all data by which you can be identified as a person, such as your name, address and email address.
Who is responsible for processing your personal data?
The controller for all processing of personal data described below is Embloom B.V., Gelissendomein 8-10, 6229 GJ Maastricht, the Netherlands (Chamber of Commerce no.: 50976524).
Why do we process personal data?
When you complete a form on our website, or contact us by email or via the contact form on the website, the data you provide (your email address and, where applicable, your name and telephone number) is stored by us in order to handle your request, inform you about our services and/or answer your questions. The legal basis for processing this data is that it is necessary for the purposes of our legitimate interests within the meaning of Article 6(1)(f) GDPR, namely providing information about our services and answering your question or request. If you contact us with the aim of entering into an agreement, Article 6(1)(b) GDPR additionally applies as the legal basis for processing.
If you provide data to us through a user account, the sections “User account – healthcare provider” and “User account – client” (included later in this privacy statement) are particularly relevant. As soon as it is no longer necessary to store the data collected in this context, we delete it, unless a statutory retention obligation applies.
Below we inform you in detail about how we proceed when we make use of authorised service providers for individual functions we offer. We also state the criteria that apply to the retention period.
What are your rights?
If we process your personal data, you have the following privacy rights:
-
the right of access;
-
the right to information;
-
the right to rectification;
-
the right to erasure (“right to be forgotten”);
-
the right to restriction of processing;
-
the right to object to processing;
-
the right not to be subject to automated decision-making, including profiling;
-
the right to data portability.
You can exercise these rights by contacting us at info@embloom.nl. You also have the right to lodge a complaint about our processing of your personal data with a supervisory authority.
Website
When you use the website purely for information purposes (i.e. when you do not register or otherwise provide information to us), we only collect the personal data that your browser sends to our server. When you wish to view our website, we collect the data below, which is technically necessary for us to display our website to you and to guarantee its stability and security (the legal basis for this is Article 6(1)(f) GDPR):
-
IP address (anonymised);
-
date and time of the request;
-
access status/HTTP status code;
-
amount of data transferred;
-
website from which the request originates;
-
browser;
-
name, language and version of the browser software.
The data is deleted as soon as it is no longer required to achieve the purpose for which it was collected. Where data is collected in order to display the website, it is deleted when the relevant session has ended.
Data stored in log files is retained for a maximum of 7 days. It is possible to store the data for longer. In that case, users’ IP addresses are deleted or anonymised, so that it is no longer possible to link them to the person from whom the request originated.
Cookies
In addition to the data mentioned above, cookies are stored on your computer when you use our website. Cookies are small, simple text files that your computer or mobile device stores when you use our website.
By using cookies we ensure, among other things, that browsing our website is easy for you and that you do not repeatedly receive the same information or have to enter the same details when visiting the website. Cookies also allow us to see how the website is used and where we can improve it.
Below we explain which types of cookies we use and how you can adjust this.
-
Functional cookies Functional cookies are necessary for the proper functioning of our website. Without these cookies, the website cannot work properly. The legal basis for processing data by means of these cookies is legitimate interest within the meaning of Article 6(1)(f) GDPR.
-
Preference cookies Preference cookies allow the website to remember information that affects the behaviour and appearance of the website. These cookies optimise the functionality of the website and enable us to make your web experience as user-friendly as possible by keeping track of your personal preferences, such as your preferred language. The legal basis for processing data by means of these cookies is legitimate interest within the meaning of Article 6(1)(f) GDPR.
-
Marketing cookies Marketing cookies collect data anonymously so that we can analyse browsing and visiting behaviour on our website and optimise the user experience. These cookies are also used to plan, analyse and optimise marketing campaigns. The legal basis for processing data by means of these cookies is your consent within the meaning of Article 6(1)(a) GDPR.
Cookies are also placed on our website by third parties, such as social media companies. Click here for an overview of the cookies we use on our website, including the purposes for which they are placed, by whom they are placed and how long they are used.
You can configure your browser settings according to your wishes and, for example, block third-party cookies or all cookies. Please note that you may then no longer be able to use all the functions of this website.
Analytics tools and advertising
The tracking measures listed below and used by us are applied on the basis of Article 6(1)(f) GDPR and, where applicable, on the basis of the explicit consent of the site visitor within the meaning of Article 6(1)(a) GDPR. This tracking allows us to ensure that our website is tailored to your interests and can be continuously optimised. We also use tracking to statistically record and evaluate the use of our website, which enables us to further optimise the user experience. These interests are to be regarded as legitimate within the meaning of the aforementioned provision.
Google Analytics
Our website uses Google Analytics. This is a tool provided by Google Ireland Ltd. (Gordon House, Barrow Street, Dublin 4, Ireland) that can be used to track how a website is used. This tool allows us to analyse browsing behaviour on our website and improve the user experience. This is done by means of cookies stored on the visitor’s device, which enable an analysis of the use of our website. The information generated by the cookies is usually transmitted to a Google server in the United States and stored there. Google uses this information to track how our website is used, to provide us with reports on the website and to provide us with information about the effectiveness of our campaigns. Google may pass this information on to third parties where legally required to do so, or where third parties process the information on Google’s behalf. We have not permitted Google to use the information obtained for other Google services. For further information about Google Analytics, please refer to the Google Analytics privacy policy and Google’s privacy policy.
You can prevent cookies from being stored by adjusting your browser software settings. To prevent Google from collecting and processing the data generated by the cookie about your use of the website (including your IP address), you can download the Google Analytics Opt-out Browser Add-on.
Google Remarketing
Our website uses the Google Analytics Remarketing functions. This is a tool provided by Google Ireland Ltd. (Gordon House, Barrow Street, Dublin 4, Ireland) that can be used to analyse the behaviour of website visitors in order to assign them to specific advertising target groups and subsequently show them relevant advertisements when visiting other web pages. This tool allows us to analyse user interaction on our website and show users personalised advertisements based on their interests and previous visits to our website. This is done by means of cookies stored on the visitor’s device, which record and evaluate user behaviour as the visitor visits different websites. In this way, Google can identify previous visits to our website. The information generated by the cookie is usually transmitted to Google’s servers in the United States and stored there. Google’s policy on the processing and protection of personal data is independent of Embloom, which means we have no influence on the scope and further use of the data by Google. For further information on the purpose and scope of data collection and processing by Google, please refer to Google’s privacy policy.
You can prevent cookies from being stored by adjusting your browser software settings. If you have a Google account, you can object to personalised advertising via this link.
Matomo
Our website uses Matomo (InnoCraft Ltd., 150 Willis St, 6011 Wellington, New Zealand). This is a tool that can measure and analyse the behaviour of website visitors (clicks, mouse movements, scroll depth, etc.) and the IP address of the device. This tool provides us with valuable information to make our website even faster and more user-friendly. This is done by means of cookies stored on the visitor’s device. The data collected is anonymous and therefore does not allow us to draw conclusions about the identity of the user. The information generated by the cookies is transmitted exclusively to our own servers in the Netherlands and stored there. The information obtained is then processed by us in accordance with the stated purposes (for example, for sending a white paper) and is not passed on to third parties. The legal basis for this data processing is Article 6(1)(a) and/or (f) GDPR.
You can prevent cookies from being stored by adjusting your browser software settings.
Facebook pixel
Our website uses the Facebook pixel. This is a tool provided by Facebook Ireland Ltd (4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland) that can be used to track the behaviour of website visitors after they have viewed or clicked on a Facebook advertisement. This tool allows us to evaluate the effectiveness of our Facebook campaigns, optimise future campaigns and show you advertisements tailored specifically to your interests. This is done by means of cookies stored on the visitor’s device that can track the visitor’s behaviour. The data collected is anonymous to us and therefore does not allow us to draw conclusions about the identity of the user. The information generated by the cookies is transmitted to Facebook’s servers in the United States and stored there. As a result, the data can be linked to the relevant user profile and Facebook can use this data for its own advertising purposes. Facebook’s policy on the processing and protection of personal data is independent of Embloom, which means we have no influence on this use of the data. For further information on the scope of data collection and processing by Facebook, please refer to their privacy policy.
You can prevent cookies from being stored by adjusting your browser software settings. You can also change your advertising preferences via the settings of your Facebook account. If you do not have a Facebook account, you can deactivate Facebook’s usage-based advertising on the Digital Advertising Alliance website.
LinkedIn Insight Tag
Our website uses LinkedIn Conversion Tracking and the Insight Tag. These are tools provided by LinkedIn (Wilton Place, Dublin 2, Ireland) that can be used to track the behaviour of website visitors after they have viewed or clicked on a LinkedIn advertisement. These tools allow us to evaluate the effectiveness of our LinkedIn campaigns, optimise future campaigns and show you targeted advertisements outside the website that are tailored specifically to your interests. This is done by means of cookies stored on the visitor’s device that can track the visitor’s behaviour. The data collected is anonymous to us and therefore does not allow us to draw conclusions about the identity of the user. The information generated by the cookies is transmitted to LinkedIn’s servers in Ireland and the United States and stored there. LinkedIn may use the data as part of its own marketing. LinkedIn’s policy on the processing and protection of personal data is independent of Embloom, which means we have no influence on this use of the data. For further information on the scope of data collection and processing by LinkedIn, please refer to their privacy policy.
You can prevent cookies from being stored by adjusting your browser software settings. You can also change your advertising preferences via the settings of your LinkedIn account. If you do not have a LinkedIn account, you can deactivate LinkedIn’s usage-based advertising on the European Interactive Digital Advertising Alliance website.
Your consent
If you have given consent to the processing of your data, you may withdraw it at any time. Withdrawal of your consent only affects the lawfulness of the processing of your personal data after you have notified us of it.
Where we base the processing of your personal data on a balancing of interests (Article 6(1)(f) GDPR), you may object to this processing. This is the case where the processing is not necessary for the performance of an agreement with you, as we will indicate in the following description of each function. In the event of such an objection, we ask you to explain the reasons why we should not process your personal data as we have done. If your objection is well-founded, we will examine the situation and either stop or adjust the data processing, or point out to you the compelling legitimate grounds on the basis of which we continue the processing.
User account – healthcare provider
As a healthcare provider, you can open a user account. When opening this account, your details (name, address, email address, telephone number, profession and company details) as well as your user data (username and password) are processed. This enables us to identify you as a customer and allows you to manage your user account and data. The data is processed on the basis of the agreements concluded with you (Article 6(1)(b) GDPR).
Through the user account, you have access to various applications with which you can process medical data of your clients (where “client” is mentioned, “patient” is also meant). Assuming that a treatment agreement exists between you as a healthcare provider and your client, the medical data is processed by you, or under your responsibility as a professional bound by professional secrecy under Dutch law or under rules established by a competent Dutch body, as referred to in Article 9(3) GDPR. Your data processing is necessary for the provision of healthcare and medical diagnosis as referred to in Article 9(2)(h) GDPR. We conclude a data processing agreement with you, which sets out how the data processed by you or under your supervision is handled. In all cases, you remain the controller. We are to be regarded as the processor and follow your instructions, with due observance of the provisions of the data processing agreement.
User account – client
As a client, you may also have a user account. This account has been created by your healthcare provider. Your data is processed within Embloom on the basis of the treatment agreement between you and your healthcare provider. We process data solely on the instructions of your healthcare provider, because by law they are the controller. To enable this processing, your healthcare provider concludes a data processing agreement with us. This sets out how this data must be handled. For example, we cannot view or edit your data without the healthcare provider’s permission, and we are bound by confidentiality. We do not process and retain your personal data for longer than until the end of the data processing agreement between your healthcare provider and Embloom. Upon termination of this agreement, your data will therefore be deleted from our system.
CRM/mailing tool
We use Microsoft Dynamics 365. We use this system for email marketing, which allows us to send automated messages to (potential) customers, and as a CRM system to record contact moments and manage general customer data. This system allows us to process enquiries and requests from interested parties and customers more quickly and efficiently, and to improve communication with interested parties and customers for marketing and contract management purposes.
Dynamics 365 only processes data, such as name and contact details, of persons with whom we have a business agreement or persons who have provided their details via a form on our website. The legal basis for the data processing is our legitimate interest in responding to the enquiry or request in accordance with Article 6(1)(f) GDPR. If the personal data is provided to us for the performance of an agreement or the creation of a user account, the additional legal basis for processing is Article 6(1)(b) GDPR.
The information obtained is stored on Microsoft’s servers in the West Europe region and subsequently processed by us in accordance with the purposes for which it was provided (for example, for sending a quotation). We have concluded a data processing agreement with Dynamics 365 for the processing of data.
If you do not want your data to be included in Dynamics 365, you can let us know by sending a message to info@embloom.nl. In addition, every automated message contains an unsubscribe link. Please note that in that case you may no longer be able to make optimal use of our service and services.
Newsletter
With our newsletter, we regularly inform you about current information and our updates. You can subscribe to our newsletter by entering your email address in the form provided on our website. The legal basis for collecting and processing this data is your consent in accordance with Article 6(1)(a) GDPR.
If we have obtained your email address because you have purchased a product and/or service from us, we may also send you newsletters relating to similar products and/or services without your prior consent, unless you have objected to receiving such newsletters. The legal basis for this processing is Article 6(1)(f) GDPR.
We use Microsoft Dynamics 365 to send the newsletter and provide it with the data mentioned above.
You may withdraw your consent to receive the newsletter at any time. You can do so by clicking the link included in every electronic newsletter or by sending a message to info@embloom.nl. When you unsubscribe, we keep your details on our suppression list so that you no longer receive any mailings from us (Article 6(1)(c) GDPR).
Do we transfer your data to other countries?
We may use the services of third parties to process your data in accordance with this statement. We try to process personal data within the European Economic Area (EEA) as much as possible, but we cannot avoid also using processors that are established outside the EEA or that use servers located outside the EEA.
To safeguard your privacy, we will only transfer your personal data to countries outside the EEA if the European Commission has decided that the third country in question ensures an adequate level of protection, or if other appropriate safeguards are provided, such as standard data protection clauses approved by the European Commission, supplemented by additional measures where necessary.
How do we protect your personal data?
We have taken appropriate organisational and technical measures to protect your personal data against misuse and unlawful or unauthorised use. These measures provide a level of security appropriate to the data we process. For example, we restrict access to personal data to those who need it to perform their duties. Where necessary, pseudonymisation and encryption are also applied when processing personal data.
If you have the impression that your personal data is not properly secured or there are indications of misuse, please email us at info@embloom.nl.
How long do we retain your personal data?
Unless stated otherwise above, we store your personal data only for as long as is necessary for the purposes for which it is processed, or until you withdraw the consent you have given. Where statutory retention obligations apply, the retention period for certain data may be up to ten years, irrespective of the purposes of the processing.
Contact
For questions or comments about this privacy statement, you can contact us at info@embloom.nl or +31 (0)88 203 7 203, or contact our Data Protection Officer (DPO) at iso@embloom.com.
If you have a complaint about the processing of your personal data by Embloom, we would be happy to discuss it with you. If you are not satisfied with the handling of your complaint, you can lodge a complaint with the national supervisory authority.
