for Health Professionals

for Patients

Rosa Privacy Policy

This page explains why and how Rosa processes personal information about health professionals and patients. “Rosa” is Rosa ASBL, a non-profit organization established at Cantersteen 10, 1000 Brussels, with enterprise number 0745.832.604.

If you have an agreement with Rosa as a health professional or as a registered patient, this privacy policy is part of that agreement.

To communicate with Rosa about processing of personal information or if to exercise your rights concerning personal information, please send an email to gdpr@rosa.be.

Guiding principles

Rosa wants to strengthen health relationships

Rosa helps health professionals and patients to exchange information in a confidential, secure and trusted environment. We have no other ambitions and we do not use personal data for other motives.

You are in control

Rosa has the ambition to give its users the control over their information. Over time, we will add functionalities to our applications to let you access more information and decide what to do with it, with whom you want to share it, etc.

There is nothing else

Rosa describes everything it does with personal information of health professionals and patients in this document. If something is not here, it means we don’t do it.

Categories of data processing activities

The data processing activities of Rosa are divided into two categories. This distinction has an important impact, because it determines who exercises the main control over, and is ultimately responsible for, the processing activity in question. This also determines who to contact if you have questions or requests about certain personal information.

Information that Rosa processes for health professionals. For the activities in this category, Rosa provides the tools and stores data on behalf of the health professionals who use the applications. Rosa does not determine what data will be collected and does not control the content of the information provided. The health professionals are in control and the role and obligations of Rosa are strictly defined in a contract between them and Rosa.
Information that Rosa processes for its own needs. The activities in this category are determined by Rosa and undertaken to fulfil its own objectives or obligations. Rosa takes full responsibility for these activities.

All individual data processing activities carried out by Rosa are described in the next sections.

Public profile data

What information does Rosa process?

Rosa processes public profile data when a health professional chooses to create, fill in and publish a public profile. Public profile data contains:

Identity of the health professional;
Specialities;
Professional address(es);
Contact details;
Availabilities for appointments.

About whom?

Public profile data contains information about health professionals.

On what basis?

Public profile data is processed by Rosa under the responsibility of the health professionals, for the purpose of achieving their legitimate interests (communicating their professional details and allowing their patients to book appointments)

Patient files data

What information does Rosa process?

Rosa processes patient files data when a health professional creates or modifies a file concerning a patient. Patient files contain:

Identity of the patient;
Date of birth;
Phone number;
E-mail address;
Address;
Notes;
Contact details of the person(s) of contact;
Link(s) to patient files of family members;
History of the appointments (see ‘Appointments data’ section)

About whom?

Patient files data contain information about patients.

On what basis?

Patient files data is processed by Rosa under the responsibility of the health professionals, for the purpose of providing health services to their patient.

Appointments data

What information does Rosa process?

Rosa processes information about appointments when a patient books an appointment online or when a health professional creates an appointment in their online calendar. For each appointment, Rosa may store the following information:

Identity of the patient;
Identity of the health professional;
Contact details of the patient;
Contact details of the health professional;
Date and place of the appointment;
Motive for the appointment (generic category);
If the patient cancelled the appointment without warning (“no-show”).

About whom?

Appointments data contain information about patients and health professionals.

On what basis?

Appointments data is processed by Rosa under the responsibility of the health professionals, for the purpose of providing health services to their patient.

SMS reminders data

What information does Rosa process?

Rosa processes SMS reminders data when a health professional activates that option to send reminders to their patients before a planned appointment. The information processed for this purpose is reused from the appointment data. For each reminder, Rosa processes the following information:

Mobile phone number of the patient;
Identity of the patient;
Identity of the health professional;
Date and place of the appointment;
Motive for the appointment (generic category);

About whom?

SMS reminders data contain information about patients and health professionals.

On what basis?

SMS reminders data is processed by Rosa under the responsibility of the health professionals, for the purpose of providing health services to their patient.

Information that Rosa processes for its own needs

User and account management data

What information does Rosa process?

When a user creates an account for the online calendar application or online appointment booking application, Rosa collects or generates the following information:

Identity of the users;
Email address;
Address;
Electronic authentication data;
INAMI/RIZIV number (health professionals only);

About whom?

User and account management data contain information about all users of the who have created an account.

On what basis?

Rosa processes user and account management data because it is necessary for the performance of its contracts with its users.

Customer data

What information does Rosa process?

For each customer, Rosa collects and processes information to set up and manage the contract, to communicate with the customer and (if relevant), to process invoices and payments. Customer data contains the following information:

Identity of the customer;
Email address;
Address;
Contact details;
INAMI/RIZIV number;
Enterprise/VAT number;
Electronic payment details;
Payment history;

About whom?

Customer data contain information about the customers of Rosa.

On what basis?

Rosa processes customer data because it is necessary for the performance of its contracts with its customers, to meet its legal obligation and to communicate with its customers.

Usage statistics

What information does Rosa process?

Rosa collects anonymous and aggregated data to generate statistics about the visits of its website and the usage of its applications. Usage statistics contain information about:

What content is accessed, when and how much;
What functionalities are used, when and how much.

About whom?

Usage statistics contain information about the visitors of the website of Rosa and the users of the applications of Rosa.

On what basis?

Rosa processes usage statistics for the development of its products and services, and for the improvement of its operations, which are legitimate interests.

Your rights regarding personal information processed by Rosa

All individuals have the right to:

know if Rosa processes personal information about them, what categories of data are being processed and for what purpose;
request the rectification of inaccurate information about them;
request the erasure of personal information about them, or oppose the further processing of personal information about them, for a legitimate reason.

To exercise these rights, the individuals should contact the following person(s):

The relevant health professional if the request concerns information that Rosa processes for health professionals; Rosa (at the address mentioned at the beginning of this page) if the request concerns information that Rosa processes for its own needs.

The Belgian Data Protection Authority is the regulatory agency in charge of data protection in Belgium. It is competent to handle individual complaints about the processing of personal information. More information about data protection regulations and how to file a complaint can be found on this website.

Sub-processors

Rosa relies on services provided by other companies to perform its data processing activities. These companies may be considered as “sub-processors” under the applicable privacy laws.

AWS
Auth0
CM
MongoDB

Security measures

Rosa must implement appropriate security measures to protect the personal data covered by this agreement against unauthorized access, modification or destruction. Rosa relies on technologies or services of its subcontractors for parts of these measures.

Rosa must evaluate these security measures regularly and adapt them if needed, to take into account the evolutions of the risks, the technology and the costs associated with these measures.

Modification of the privacy policy

Rosa may change this privacy policy over time to reflect the changes in its services and data processing activities. Rosa will do its best to notify the changes to the affected users.