Data Protection Policy – OmniHealth B.V.

Last updated: 09-12-2025

1. Purpose
Ensuring secure and lawful processing of personal data.

2. Roles
Medical examinations: the physician is the controller of the medical file.
TopSide/Back-up: remote advice; no medical file; images deleted immediately; anonymised records retained.

3. Data minimisation
Only necessary data is processed. Employers never receive medical information.

4. Security
Encryption, firewalls, monitoring, staging environment, consent blocking, offline Vitalograph.

5. Processors
EQwise (hosting, technical management).
Sub-processors: Google Workspace, Dropbox, Google Analytics, Complianz.

6. Data breaches
EQwise notifies within 24 hours. OmniHealth assesses notification duties.

7.Data Subject Rights
GDPR rights are supported; medical records follow the requirements of the Dutch Medical Treatment Contracts Act (WGBO).