Privacy policy

Data controller

Patientvoice (ourpatientvoice.org) is an open-source platform operated by Joost Boer, trading as 31 Ventures (KvK 81019556, Netherlands). Contact: joost@start24.nl.

What personal data we process

From visitors we process the minimum necessary. When sharing an experience: the text you type (your choice), optionally an email address that is not made public (only for our review). We do not set tracking cookies and do not use external analytics. Server logs (IP, user-agent) are kept for up to 30 days for security purposes.

From healthcare providers on the site: name, profession, optional BIG number, optional employer link, public references (LinkedIn, ZorgkaartNederland, source URL), optionally a profile picture that exists in a public source with attribution.

Legal basis

For processing personal data of healthcare providers we rely on Article 6(1)(f) GDPR: the legitimate interest of patients in information about their healthcare provider and in free choice of provider. This basis was recognised by the District Court of Overijssel in 2019 for a comparable platform (ECLI:NL:RBOVE:2019:3755).

We only process professional data, no private data outside the professional context.

For experience texts submitted by visitors: by clicking submit you consent to the text being published (anonymously) under these terms.

Your rights as a provider featured on this site

If you are named on this site you have the following rights under the GDPR:

• Access: you may request what data we process about you.
• Rectification: you may have inaccurate data corrected.
• Erasure: you may request removal of your profile or specific experiences.
• Reply: after claiming your profile you may post a verified public reply under any experience.
• Objection: you may object to processing on the basis of legitimate interest.

All requests go to joost@start24.nl or via the takedown button on the site. Justified requests are handled within 48 hours. You always receive a motivated reply.

Right to complain

If we reject your request or fail to handle it within a reasonable time, you may lodge a complaint with the Dutch Data Protection Authority (autoriteitpersoonsgegevens.nl) or take the matter to the competent court.

Retention

Experiences remain publicly available until a justified removal occurs. After removal the text is no longer publicly shown, but we retain an anonymised audit log (request + decision + date) for as long as needed for our accountability obligation. Contact email addresses submitted with an experience are kept for up to 12 months or until the experience is removed.

Subprocessors

We use: Cloudflare (DNS + DDoS protection, EU/global, no content access), Anthropic (AI help for making experiences more coherent, only text you explicitly submit for rewriting, US — we use Anthropic's Zero Data Retention setting), Resend (email delivery for feedback and takedown notifications, EU/US, only the content of the notification). Hosting via mijn.host (Netherlands).

Cookies

We only use functional cookies: your language and country preference. No tracking, no ads, no external analytics.

Changes

Material changes are noted at the top of this page with a date. Non-material changes (typos, rephrasing) are made without notice.