1. Contact form
This policy was updated on 15 October 2026. The contact form processes your name, email address, an optional subject and the content of your message. The shorter form on the homepage does not request a subject. We use this information to respond to your question and contact you. Do not use the contact form for emergencies.
To prevent misuse and automated submissions, the form is checked by an external spam-prevention provider. This provider may process technical information such as your IP address and information about your browser or device.
2. New-patient registration form
The registration form processes your first name, last name, date of birth, email address, telephone number, street, house number, postcode, city and any questions or comments. The comments field may contain health information if you choose to enter it. We also record that you agreed to the use of your information for registration and related contact.
We use this information to assess your registration request, prepare a new-patient registration and contact you about the next steps. Submitting the form does not automatically create an appointment. This form is also checked by an external spam-prevention provider.
3. Service providers and recipients
Cloudflare helps host and protect the website. Turnstile helps prevent automated form abuse. Information submitted through a form is securely stored using Cloudflare D1 and delivered to the practice notification mailbox using Resend.
These providers process information only where needed for their services. Some providers may process information outside the European Economic Area, subject to the arrangements and safeguards offered by the relevant provider.
4. Technical data
When you visit the website, Cloudflare and Cloudflare Turnstile may process technical information such as your IP address, the time of your visit, the requested page and information about your browser or device. This information is used to deliver the website, investigate faults and prevent automated misuse.
Standard Cloudflare Pages Functions logging displays events during an active logging session and does not persist those logs. This is separate from information Cloudflare processes to operate and secure its services. The applicable processing arrangements and Cloudflare retention periods or criteria apply to that processing.
5. Google Maps and external links
Google Maps loads only after you allow external media or choose Load map. Your browser then connects directly to Google. Google may process information including your IP address, browser and device information, the page you visited and your interaction with the map. Depending on your settings, Google may use cookies or other browser storage.
The address, telephone number and directions link remain available when you do not load the interactive map. You can change your choice through Cookie settings in the website footer. Other external websites have their own privacy and cookie policies.
6. Cookies, browser storage and analytics
We retain your consent choice in necessary browser storage for no longer than 180 days. It contains only the consent version, selected categories, decision time and expiry time—not patient information or form contents.
With your consent, we use Google Analytics 4 to understand general website use and improve the website. This may involve device and browser information, pages visited and page interactions, and relevant analytics cookies such as applicable _ga cookies. Analytics is optional and does not load before you consent.
Our Google Analytics 4 settings retain event data for two months and user data for fourteen months. New user activity restarts the user-data retention period. These settings apply to the relevant event-level and user-level data, not to most standard reports based on aggregated information.
Google Maps is controlled separately as external media. Allowing analytics does not automatically load Maps, and loading a map does not automatically allow analytics. You can change or withdraw either choice at any time through Cookie settings. Withdrawal stops future analytics activity and removes accessible Google Analytics cookies; it cannot retroactively remove information already processed.
6a. Traffic-source attribution for forms
With your separate permission, we remember the first observed source and latest non-direct source, campaign, landing page and estimated device category, then link these to your contact message or registration. This helps us understand how people reach the practice. This option is off by default and independent of Google Analytics and Google Maps. Forms remain available without permission.
We read attribution signals only after consent and retain them in your browser for at most 30 days. We do not retain raw advertising click IDs, full referring URLs, search queries or form contents in this browser storage. Hidden referrals are labelled direct / unknown; activity before consent cannot be reconstructed. Withdrawal through Cookie settings removes browser attribution and stops future collection.
When you submit, attribution and its consent version and decision time are stored in Cloudflare D1 and included in the notification email. D1 attribution expires no later than the browser record; an hourly cleanup job removes expired attribution. Submission page, time and reference are operational information recorded even without attribution consent. Attribution already delivered by email remains part of that email, subject to the retention purposes and rights in sections 8 and 9. It is not sent to Google Analytics or advertising platforms.
7. Patient records and treatment data
If you become a patient, the practice may process information including your name, address and place of residence, contact details, insurance information and the medical history you provide for the treatment relationship. This information is used for patient registration, appointments, the dental record, treatment planning and the delivery and administration of dental care. This processing is separate from the technical website form, even when registration information is later transferred to the patient system.
Under the Dutch Medical Treatment Contracts Act (WGBO), medical records are generally retained for at least 20 years from the last amendment to the record. A different or longer period may apply in specific circumstances.
8. Retention of website submissions
Contact messages and patient registrations are stored in Cloudflare D1 and delivered through Resend to the notification mailbox used by the practice. The practice also retains the original submissions and email copies as backups. These are not automatically deleted after delivery or transfer to the patient system.
Retention of these separate copies depends on their purpose: handling your enquiry or registration, necessary follow-up communication and recovering relevant information if it is lost. An ongoing complaint, legal claim or statutory obligation can also justify retaining necessary information. Keeping a backup does not, by itself, justify indefinite retention. The statutory medical-record retention period does not automatically apply to every contact message or website copy.
Cloudflare D1 provides a recovery history of seven days on Workers Free and thirty days on Workers Paid. These recovery windows do not automatically delete records from the active database. Resend documents thirty days of email and log retention and seven days of backup retention for Free, Pro and Scale. Other plans or individual agreements may differ. These provider periods do not delete emails from the practice’s receiving mailbox.
After deletion from the active database, information may remain in recovery history until the applicable recovery window expires. You can contact us about retention or deletion of your information. We assess requests under applicable legal conditions and obligations.
9. Your privacy rights
Subject to applicable legal conditions and medical-record obligations, you may request access to or a copy of your personal data, ask for it to be corrected, deleted or transferred, request restrictions on its processing, or object to its processing. We may request additional information to verify your identity before acting on a request.
10. Questions and complaints
If you are dissatisfied with how we handle your data, please contact us first. You may also submit a complaint to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
Contact person: K.N. Malik.