Version: 22 October 2026
Who are we?
Maatschap Fysico Rotterdam (hereinafter: Fysico) is a practice for physiotherapy and related disciplines with its own training centre (Fysico Fitness). We are responsible for processing your personal data as described in this privacy statement. (This English translation is provided for convenience; in case of any difference, the Dutch version prevails.)
- Blijdorp: Bentinckplein 12, 3039 KL Rotterdam (physiotherapy and Fysico Fitness)
- Delfshaven: Nieuwe Binnenweg 257B, 3021 GD Rotterdam (physiotherapy)
- Chamber of Commerce (KvK): 86369288
- Email: info@fysicorotterdam.nl · Phone: 010 465 43 50
Which data do we process and why?
1. If you are being treated by us
For your treatment we create a medical record. It contains your name, address, date of birth, contact details, citizen service number (BSN), health insurance details, your GP or referrer, and information about your health and treatment.
Why: to treat you properly, to bill your treatment to your health insurer and to comply with our legal obligations.
Legal basis: the treatment agreement and our legal obligations (including the Dutch Medical Treatment Contracts Act (WGBO) and the Act on the use of the citizen service number in healthcare). Health data is a special category of personal data; we process it on the basis of Article 9(2)(h) GDPR and Article 30 of the Dutch GDPR Implementation Act (UAVG), exclusively by healthcare professionals bound by professional secrecy.
2. If you are a member of Fysico Fitness
Name, address, date of birth, contact details, bank account number, membership details and your visit records. For medical training programmes, also relevant health information.
Why: to carry out your membership, collect the membership fee and guide your training.
Legal basis: the agreement (your membership) and our statutory obligation to retain records for tax purposes.
3. Newsletter
Your name and email address, and whether you open the newsletter and click on links.
Legal basis: your consent, or our legitimate interest if you are already a patient or member. You can always unsubscribe via the link at the bottom of every newsletter.
4. Contact, appointments and website
Data you send us by email, phone, WhatsApp, the contact form or the online booking module. On our website we measure visits with Google Analytics. We only place analytical and other non-essential cookies if you give consent via our cookie banner. You can read more about this in our cookie policy.
Legal basis: your consent or our legitimate interest in answering questions and improving our website.
5. Client stories and photos
We only publish stories, names or photos of clients with their explicit written consent. You can withdraw that consent at any time.
6. Job applications
We keep data from your application until four weeks after the end of the procedure, or with your consent for up to one year.
How long do we keep your data?
- Medical record: 20 years after the last treatment (statutory period), or longer if necessary for good care.
- Financial and billing data: 7 years (statutory retention period for tax purposes).
- Fysico Fitness membership records: for as long as you are a member and then up to 7 years for the financial records.
- Newsletter: until you unsubscribe.
Who do we share your data with?
We never sell data. We only share data if this is necessary for your treatment or membership, if required by law, or if you give consent (for example with your GP or specialist). We work with the following processors, with whom we have a data processing agreement:
- Fysiomanager (World of Health) – electronic patient record
- MijnZorgtoegang – online appointment booking
- VECOZO and Zorgmail (Enovation) – billing and secure communication in healthcare
- Sportivity (B.O.S.S.) – Fysico Fitness membership administration
- Technogym – training app and equipment
- Mailchimp (Intuit) – newsletter
- Microsoft 365 – email and office software
- Google – website statistics
- Mediquest – client experience survey
- Our website developer, hosting provider and IT administrator
- Our accountant and payroll administration
Data outside the European Union
Some suppliers (such as Mailchimp, Google and Meta/WhatsApp) are based in the United States. They participate in the EU-US Data Privacy Framework or work with standard contractual clauses approved by the European Commission.
Minors
For children under 16 we ask for consent from a parent or guardian. Under Dutch law, treatment of children aged 12 to 16 requires the consent of both the child and the parent(s).
Security
We take appropriate technical and organisational measures to protect your data, such as two-factor authentication on our systems, a record system that complies with the NEN 7510 standard, encrypted connections and a duty of confidentiality for all our staff, interns and locums. Only staff involved in your treatment or training have access to your data.
Your rights
You have the right to access your data, have it corrected, have it deleted (as far as the law allows), restrict its processing, object to processing and have your data transferred. You can always withdraw consent you have given. Send your request to info@fysicorotterdam.nl. We will respond within one month and may ask you to verify your identity.
Complaints
Do you have a complaint about how we handle your data? Please contact us first. You can also file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
Changes
We may change this privacy statement. The most recent version can always be found on this page.