All health insurers · no referral needed

Legal

Privacy Policy

Last updated: 2026-09-16

Privacy Statement Physical Studio

Article 1. Introduction

This is the privacy statement of Physical Studio. This privacy statement applies to all privacy-sensitive information or personal data that you provide to us, for example when you send us an e-mail. We clearly explain how we store your data, how long it is retained and what exactly the purpose of the data processing is. In addition, we give you clear insight into how you can exercise your rights with regard to data processing.

What exactly does Physical Studio do? Physical Studio is a business with combined disciplines: a paramedical physiotherapy practice, massage practice and personal training, with a fitness facility for small group training. Physical Studio also sells products focused on health and wellbeing.

Because we process (or have processed) personal data in various situations, we have opted for a comprehensive privacy statement. It is important that you know what happens to your personal data and how you can inform us of your wishes regarding the handling of personal data.

Physical Studio takes your privacy seriously and will use and process personal information in a secure manner. All articles in this privacy statement are in accordance with the General Data Protection Regulation (GDPR). This European privacy legislation has applied in the Netherlands since 25 May 2018.

Do you have doubts or questions about the processing of data by Physical Studio? Please feel free to contact us via the details below.

info@physicalstudio.com | +31 20 782 82 82 Nieuwe Looiersstraat 33H | 1017 VA | Amsterdam Chamber of Commerce no. 82265321 | VAT no. NL862401719B01

Article 2. Categories of personal data

In order to support our visitors, customers and partners as well as possible, it is necessary for us to collect and process certain data, including personal data. Personal data is data that can be traced back to a natural person. The personal data we (generally) process is:

  • First and last name;
  • Address;
  • Place of residence;
  • Telephone number;
  • (Personal) e-mail address (please note: under the GDPR, certain business e-mail addresses may qualify as a personal e-mail address, for example janssen@company.nl);
  • Bank account number;
  • Gender;
  • Height;
  • BMI;
  • Weight;
  • Identification details;
  • Health insurance details;
  • Data relevant to physiotherapy or massage treatment;
  • General practitioner (GP) details;
  • Referral from a doctor or specialist;
  • Citizen service number (BSN), exclusively in the context of healthcare (see Article 3).

We only store and use the personal data that is provided directly by you, or of which it is clear upon provision that it is being provided for processing by Physical Studio.

Article 3. Legal basis and purposes of data processing

Under the GDPR, we are required to have a lawful basis for processing your personal data. We process your personal data on the following bases:

  • Consent (Article 6(1)(a) GDPR), for example for sending the newsletter;
  • Performance of a contract (Article 6(1)(b) GDPR), for example for delivering our services and products;
  • Legal obligation (Article 6(1)(c) GDPR), for example for our accounting records and, in the case of physiotherapy, the statutory obligation to keep a medical record under the Dutch Medical Treatment Agreement Act (WGBO);
  • Legitimate interest (Article 6(1)(f) GDPR), for example for maintaining the customer relationship.

Insofar as we process health data (special categories of personal data), this is done on the basis of Article 9(2)(h) GDPR (processing necessary for the provision of healthcare by a healthcare professional bound by professional secrecy) and, where applicable, your explicit consent (Article 9(2)(a) GDPR). We process the BSN exclusively insofar as this is legally permitted and required in the context of healthcare and claims with health insurers, on the basis of the Dutch Act on Additional Provisions for the Processing of Personal Data in Healthcare.

Article 13(1)(c) GDPR requires us to clearly indicate the processing purposes for which the personal data is intended. Below is an overview of the various processing purposes.

3.1 Contact If you have contacted Physical Studio in any way, the data you have provided will be stored and used for the course of further contact. This includes name, e-mail address and telephone number.

3.2 Newsletter For sending the Physical Studio newsletter, at least your e-mail address is processed. Other data, such as your name, may also be processed. You can unsubscribe at any time via the unsubscribe link in the newsletter.

3.3 CRM system Physical Studio uses a CRM customer system to maintain the customer relationship. Data stored for this purpose includes name, e-mail address and telephone number. In some cases we process data in the context of satisfaction surveys (name, e-mail address).

3.4 Surveys To collect information about the satisfaction of Physical Studio's customers, Physical Studio may conduct a periodic satisfaction survey. The satisfaction survey is sent to you by e-mail. You are under no obligation to take part in this survey.

3.5 Accounting Physical Studio is legally required to keep proper accounting records. For this purpose, the data reasonably present on quotations or invoices is stored, such as name and, where necessary, bank details.

3.6 Invoicing and insurance claims Certain data is processed for sending invoices, including name and address details and the invoice address. The BSN is used exclusively for submitting claims for physiotherapy treatments to your health insurer, insofar as this is legally required. The BSN is not stated on invoices for other services or products.

3.7 The agreement When an agreement is concluded, Physical Studio needs certain data. Without this data, it is not possible to properly perform the agreement. This includes first and last name, address details and, in the case of treatments, health data.

3.8 Communication between healthcare providers In order to provide the care you may expect from Physical Studio, it is in some situations important to communicate with previous or current healthcare providers, such as your GP or referring specialist. Data processed in this context includes, for example, health insurance and GP details. This data is only shared with other healthcare providers with your explicit consent, as it concerns special categories of personal data.

3.9 Keeping a medical record If you are receiving treatment from the physiotherapist, Physical Studio is legally required under the WGBO to keep a medical record. This contains data about, for example, the treatment and your complaints, such as first and last name, data relating to the treatment and medical data such as GP, health insurance and any referral. Without this data, it is not possible to build and maintain the record and the treatment cannot take place.

3.10 Cookies, placed via https://physicalstudio.com/ In order to use the website and for the website to function properly, certain data is stored. This includes IP address, location data, and statistical and aggregated data about browsing behaviour and website visits (scrolling and clicking behaviour). With regard to cookies, we comply with both the GDPR and Dutch cookie legislation (Article 11.7a of the Dutch Telecommunications Act). More detailed information about cookies can be found in a separate document: our cookie statement.

Article 4. Retention periods

Above we have indicated the processing purposes for which we use your personal data. In accordance with Article 13(2)(a) GDPR, we indicate below the retention period of the personal data.

4.1 Contact If the contact does not lead to the provision of a service or work, the data you have provided will be retained for a maximum period of two (2) years.

4.2 Newsletter We retain the data until you unsubscribe from the newsletter. After unsubscribing, the data will be deleted.

4.3 CRM system For this purpose, data is retained for five (5) years after the end of the customer relationship, unless a longer period is necessary in connection with legal proceedings. The five (5) year period also relates to the possibility that a contact may become a customer of Physical Studio again.

4.4 Surveys Data from satisfaction surveys is retained for five (5) years.

4.5 Accounting and invoicing For proper accounting, we are legally required to retain personal data linked to the financial administration for a period of seven (7) years (fiscal retention obligation). This is unless a longer retention period is necessary in connection with legal obligations, limitation periods and/or an anticipated legal dispute.

4.6 The agreement All data relating to an agreement is retained at least for the period during which the agreement is active. After the agreement has ended or been completed, data subject to the fiscal retention obligation is retained for seven (7) years; other customer data is retained for a maximum of three (3) years after the end of the agreement.

4.7 Medical record The statutory retention period for a medical record is twenty (20) years, calculated from the last change to the record, or as much longer as reasonably follows from the duty of care of a good healthcare provider (Article 7:454 of the Dutch Civil Code). After the retention period has expired, the record is destroyed. You also have the right to request earlier destruction of (parts of) your record, subject to the statutory exceptions.

4.8 Cookies, placed via https://physicalstudio.com/ All information regarding cookies and the associated retention periods is explained in our cookie statement.

Article 5. Recipients of personal data

Physical Studio shares personal data with third parties; this only happens when strictly necessary. In all cases, Physical Studio will, as controller, comply with the GDPR, in particular Article 28 et seq. GDPR. We conclude a data processing agreement with parties that process personal data on our behalf.

In order to guarantee the best service, Physical Studio works with certain external parties. Below is an overview of external parties that may receive your personal data:

5.1 Accountant For proper accounting, personal data may be provided to our accountant. This concerns strictly necessary data, which is also stated on invoices.

5.2 Tax authorities and government bodies In order to comply with our tax obligations and/or any other legal requirement, we share the necessary personal data with the Dutch Tax Administration and other government bodies, where we are legally required to do so.

5.3 Vecozo Vecozo is the national communication point for healthcare in the Netherlands. They offer a secure and high-quality digital environment in which parties in the healthcare chain can exchange administrative data, including for claims with health insurers.

5.4 Flux Physical Studio uses Flux for diary management, record keeping and insurance claims. Patient data is stored in this system. Only data relating to physiotherapy treatments is stored in this system.

5.5 PREM With the PREM questionnaire, we continuously conduct a patient satisfaction survey. PREM stands for Patient Reported Experience Measurement and is the national standard for measuring patient experiences. We use the results to improve patient care and service.

5.6 Hired staff In order to bring in additional external specialists, personal data may be processed by such third parties. The hired specialists are bound by a duty of confidentiality.

5.7 Health insurer If you are receiving treatment from us and the treatment is reimbursed by your health insurer, we exchange the necessary information with your health insurer.

5.8 Bsport Physical Studio uses Bsport as a CRM system and to indicate the various prices per subscription or session. Bsport only collects the necessary data; this will never include special categories of personal data.

Furthermore, we will not provide the data you have supplied to other parties, unless this is legally required or permitted.

Article 6. Security

Personal data is only accessible to authorised employees of Physical Studio. This personal data is protected with a password.

The devices on which your data is stored are locked with a password and/or fingerprint scan and/or facial recognition. This concerns the necessary devices, such as computers, laptops and mobile phones.

For the website and digitally transmitted data, Physical Studio uses firewalls, virus scanners and periodic backups. Data whose retention period has expired is not included in the backup. Passwords for systems are changed periodically and e-mails are periodically cleaned up.

Your visit to the Physical Studio website is secured with an https connection and an SSL certificate. This means that your connection with Physical Studio is encrypted and your personal data remains secure during your website visit. You can recognise this by 'https' and the padlock in the address bar.

Article 7. Your rights regarding your personal data

Below are the rights you can exercise with regard to your personal data.

a. Right of access (Article 15 GDPR) You always have the right to access the data processed and stored by Physical Studio. To exercise this right, you can send an e-mail with your request to info@physicalstudio.com.

b. Right to rectification (Article 16 GDPR) If the data stored by Physical Studio proves to be incorrect, you have the right to have this data rectified. Physical Studio will then replace the incorrect data with the correct data.

c. Right to data portability (Article 20 GDPR) You have the right to receive the personal data you have provided to Physical Studio in a structured, commonly used and machine-readable format, and to have this data transferred to another organisation of your choice, insofar as the processing is based on your consent or on the agreement.

d. Right to erasure (Article 17 GDPR) In certain cases, you can request Physical Studio to delete data (the right to be forgotten). Physical Studio must delete your data in, among others, the following situations:

  • If the data processed by Physical Studio is no longer necessary for the processing purpose;
  • If you withdraw your consent for the use of the personal data, for example via the unsubscribe button in the Physical Studio newsletter;
  • If you object to the processing of your data. In the case of direct marketing, you always have an absolute right to object. In other cases, the data will be erased if your interests outweigh those of Physical Studio;
  • If Physical Studio processes data unlawfully, for example where there is no legal basis for the processing;
  • If a statutory retention period has expired;
  • If you, as a data subject, are younger than 16 years of age and no consent has been given by a parent or guardian for the processing of the personal data.

There may be exceptions to the right to be forgotten, for example where a statutory retention obligation applies (such as for the medical record or the fiscal administration). For more information, you can consult the website of the Dutch Data Protection Authority: www.autoriteitpersoonsgegevens.nl. For the medical record, the right to destruction under the WGBO also applies.

e. Right to lodge a complaint with the Dutch Data Protection Authority If you believe that Physical Studio does not handle your personal data properly, you always have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), via www.autoriteitpersoonsgegevens.nl. The Dutch Data Protection Authority will handle your complaint further.

f. Right to object (Article 21 GDPR) You have the right to object to data processing at any time, particularly in the case of direct marketing.

We also draw your attention to the following rights:

  • Right to restriction of (part of) the processing (Article 18 GDPR): subject to conditions, you have the right to obtain from Physical Studio the restriction of the processing of your personal data. In short, this means that Physical Studio temporarily 'freezes' the processing of the data. You can invoke this right in four situations: (1) pending the assessment of a rectification request, (2) if data should actually be erased but you do not wish it to be deleted, (3) if Physical Studio no longer needs the data while it is still needed for (the preparation of) legal proceedings, and (4) pending the assessment of an objection.
  • Withdrawal of consent: insofar as we process your data on the basis of your consent, you have the right to withdraw consent once given at any time. This has no consequences for the past, but does mean that we may no longer process that data afterwards. As a result, Physical Studio may no longer be able to provide you with certain services.

Would you like to exercise the above rights? In most cases, an e-mail to info@physicalstudio.com is sufficient to exercise the aforementioned rights. If we have doubts about your identity, we may take additional measures to verify it, for example by asking you to provide a copy of your identity document in the manner prescribed by the Dutch government (with the BSN and photo obscured). In most cases, a less intrusive means of identification will suffice. Exercising the aforementioned rights is free of charge, except in cases of abuse. We will respond to your request within one month.

Please note that the rights described above are not absolute rights. There may be circumstances that prevent Physical Studio from complying with a particular request. We will assess each request on its own merits. If we are unable to comply with a particular request, we will of course inform you of this with reasons.

Article 8. Obligations

Physical Studio processes your personal data exclusively on the legal bases set out in Article 3. Your personal data will never be sold to third parties.

The data that you are required to provide is the minimum personal data necessary for the provision of the services. If you do not provide us with this required data, Physical Studio cannot offer the services (properly).

If it is necessary to share your data with parties other than those mentioned in this privacy statement, your consent will first be requested. We always announce changes to this privacy statement via the Physical Studio website.

Physical Studio reserves the right to disclose data where this is legally required, or where Physical Studio deems this justified in order to comply with a legal request or legal proceedings, or to protect the rights or property of Physical Studio. In doing so, we endeavour to respect your right to privacy as much as possible.

Do you have any questions about our privacy statement? Please feel free to contact us via the details below.

info@physicalstudio.com | +31 20 782 82 82 Nieuwe Looiersstraat 33H | 1017 VA | Amsterdam Chamber of Commerce no. 82265321 | VAT no. NL862401719B01

This English version is a translation provided for convenience. In the event of any discrepancy between the Dutch and English versions, the Dutch version shall prevail.

Last version: September 2026