Neurosurgical practice of Dr Eno Lavrysen — www.drlavrysen.be Version 1.0 — effective from 15/09/2026

1. Who processes your data?

The controller responsible for processing your personal data is:

• Dr Eno Lavrysen, specialist physician in neurosurgery

• Acting through dr. Eno Lavrysen Neurochirurgie BV, with its registered office in Mortsel.

• Company number / VAT number: BE 0728.507.018

• NIHDI (RIZIV/INAMI) number: 1-49792-73-170

• Registered with the Order of Physicians, Provincial Council of Antwerp

• Email: info@drlavrysen.be — phone: +3238901674

• Website: www.drlavrysen.be

For questions about this statement or about the processing of your data, you can use the contact details above, mentioning "privacy".

Data Protection Officer (DPO). No DPO has been appointed for this practice: the processing is carried out by an individual healthcare professional and is not considered large-scale within the meaning of Article 37 GDPR. Your questions are handled directly by the doctor. For care provided within AZ Rivierenland or AZ Zeno, the hospital itself is the controller for its own records; you can contact the hospital's DPO there.

2. What does this statement apply to?

This statement applies to:

• visiting and using the website www.drlavrysen.be;

• all contacts with the practice (phone, email, contact form, appointment system);

• the care itself: consultations, examinations, procedures and follow-up.

It supplements the practice's General terms and conditions and is without prejudice to medical professional secrecy (Article 458 of the Criminal Code), which takes precedence in all cases.

3. What data do we process?

Identification and contact data — surname, first name, date of birth, sex, address, phone number, email address, national register number, identity card data.

Administrative and insurance data — health insurance fund and membership number, insurability status (including entitlement to increased reimbursement), details of your hospitalisation insurance, workplace accident insurer or other insurer, details of your GP and referring physician.

Financial data — billing data, payment data, outstanding amounts.

Health data (special category, Art. 9 GDPR) — complaints and symptoms, medical history, medication use and allergies, results of clinical examination, medical imaging (CT, MRI, X-ray) and the associated reports, laboratory results, electrophysiological tests, operation reports, anaesthesia data, reports from other healthcare providers, data on incapacity for work and functional limitations, and — insofar as medically relevant — data on your lifestyle or family history.

Image and sound recordings — only when medically necessary (intra-operative images, clinical photographs) or with your explicit consent.

Website data — IP address, browser type, device, pages visited, date and time, referring website, and data you enter yourself in a contact or appointment form. See Article 10 on cookies.

Job application data — CV, cover letter and any data you provide on your own initiative.

4. Where does this data come from?

Usually from you. In addition, data may come from your GP or referring physician, from other healthcare providers and hospitals involved in your treatment, from imaging services and laboratories, from your health insurance fund (insurability status via the eHealth platform and MyCarenet), and — with your consent — from secure exchange platforms such as the health data vaults (hubs), in which data from previous care contacts is available.

5. Why do we process your data, and on what legal basis?

Purpose Legal basis (GDPR) Diagnosis, treatment, follow-up and continuity of care
Art. 9.2.h (preventive or occupational medicine, medical diagnosis and the provision of health care) in conjunction with Art. 6.1.c; under professional secrecy Creating and maintaining the patient record Legal obligation, Art. 6.1.c — Act of 22 April 2019 (Quality Act) and Patients' Rights Act of 22 August 2002 Appointment management, reminders and practical communicationArt. 6.1.b (performance of the contract) Billing, accounting, VAT and compulsory health insurance
Art. 6.1.c (legal obligation) and Art. 6.1.b Verification of your insurability and of entitlement to increased reimbursement
Art. 6.1.c — obligation under NIHDI (RIZIV/INAMI) regulations Recovery of outstanding amounts
Art. 6.1.f (legitimate interest: right to payment for services provided) Handling of complaints, insurance files and defence of legal claimsArt. 9.2.f and Art. 6.1.f Security and proper functioning of the websiteArt. 6.1.f (legitimate interest: security and availability) Non-essential cookies and statistics Art. 6.1.a (your consent) and Art. 129 of the Electronic Communications Act Scientific research, quality registries and training
Art. 9.2.j with appropriate safeguards — in principle pseudonymised or anonymised; for research in which you are identifiable, your consent is requested and the protocol is submitted to an accredited ethics committee
Job applications Art. 6.1.b (pre-contractual) and Art. 6.1.a

No commercial use. Your data is never sold, rented out or used for commercial profiling or advertising by third parties.

No automated decision-making. No decisions about you are taken based solely on automated processing or profiling within the meaning of Article 22 GDPR. Medical decisions are always taken by the doctor; supporting software or image analysis remains merely a tool.

6. With whom is your data shared?

Only when necessary, and always within the limits of professional secrecy:

• Other healthcare providers within your care relationship — your GP, the referring physician, other treating specialists, anaesthetists, radiologists, physiotherapists. Reports are sent by default to your GP and referring physician, unless you object.

• The hospital where the consultation or procedure takes place, for the organisation of care and for billing of hospital costs.

• Your health insurance fund and the NIHDI (RIZIV/INAMI), for reimbursement, third-party payment and statutory checks.

• Your insurer, employer, occupational physician, lawyer or any other third party — only with your explicit, written consent, and only the strictly necessary data. Data for insurers is, as a rule, provided via their medical adviser.

• Service providers processing data on our behalf (processors within the meaning of Art. 28 GDPR): the supplier of the electronic patient record, the appointment system, the website hosting provider, the email and telephony provider, the secretariat, the accountant and, where applicable, a debt collection partner. A data processing agreement has been concluded with each of them, binding them to confidentiality and appropriate security.

• Government and judicial authorities, when required by law or by a court order.

7. Is data transferred outside the European Economic Area?

Medical data is not processed outside the EEA.

The website runs on Squarespace. Squarespace may process data in the United States. For this transfer, Squarespace relies on the standard contractual clauses of the European Commission and on the EU-US Data Privacy Framework. For this reason, we expressly ask you not to enter any medical data in the contact form on the website: limit yourself to your name, contact details and the reason you would like to be contacted. Medical information should be discussed during the consultation or via a secure channel.

8. How long do we keep your data?

Data
Retention period
Patient record
At least 30 years and at most 50 years after the last patient contact (Quality Act, Art. 35)Medical imaging and reports
As part of the patient record, same period
Billing and accounting data
For the statutory accounting and tax retention period, counted from the end of the financial year
Messages via the contact form or email without a care relationship
Maximum 12 months, unless they become part of a patient record
Website server logs
Maximum 12 months
CookiesVaries per cookie, see Article 10
Job applications: Maximum 12 months after the procedure has closed; longer only with your consent

After that, data is deleted or irreversibly anonymised.

9. How is your data secured?

We take appropriate technical and organisational measures, including: access only for those who need it for care, personal logins and two-factor authentication where possible, encrypted connections and encrypted storage media, secure backups, locked rooms and cabinets for paper documents, an up-to-date antivirus and update policy, and contractual confidentiality obligations for everyone working in the practice. Everyone involved is also bound by professional secrecy.

Should a personal data breach nevertheless occur that poses a risk to your rights and freedoms, we will report it within 72 hours to the Data Protection Authority and, in the event of a high risk, to you as well.

10. Cookies and similar technologies

The website uses:

• Strictly necessary cookies — for basic functioning, security and language settings. No consent is required for these.

• Functional cookies — to remember your preferences, including your cookie choice itself.

• Analytical cookies — to measure aggregated visitor statistics and improve the site. These are only placed after you have given your consent via the cookie banner.

You can change or withdraw your choice at any time via the cookie settings at the bottom of the website, and delete or block cookies via your browser settings. Blocking strictly necessary cookies may disrupt the functioning of the website.

The website may contain links to external websites (hospitals, patient associations, scientific sources). This privacy statement does not apply to those sites; please consult their own policies.

11. Your rights

You have the following rights, which you can exercise free of charge:

• Right of access to your data and to a copy. For your patient record, the right of access under the Patients' Rights Act also applies: access within 15 days of your request, with the right to a copy. The doctor's personal notes and data relating to third parties are excluded from that right.

• Right to rectification of inaccurate or incomplete data. In the event of a dispute about a medical finding, your point of view is added to the record; the original finding is kept, because the record is also a historical document.

• Right to erasure — for medical data this right is severely limited: the statutory retention obligation of 30 to 50 years takes precedence. Administrative or marketing data can, however, be erased.

• Right to restriction of processing and right to object to processing based on a legitimate interest.

• Right to data portability for the data you have provided yourself and that is processed by automated means.

• Right to withdraw your consent, for processing based on consent. This applies to the future and does not affect the lawfulness of earlier processing.

• Right to object to reports being sent to your GP or referring physician, and to your data being shared via the health data vaults (hubs). You can manage your eHealth consent via www.myhealth.belgium.be.

• Right to leave instructions on what happens to your data after your death. In addition, the Patients' Rights Act provides for a limited, indirect right of access for certain surviving relatives through a designated doctor, unless you have objected to this.

How to exercise your rights? In writing, via info@drlavrysen.be or by post to the address above, with a copy or presentation of your proof of identity so that we can be sure it is you. We reply within one month; for complex or numerous requests this period may be extended by two months, in which case we will inform you.

12. Lodging a complaint

If you are not satisfied with the way we handle your data, please contact us first — most issues can be resolved that way.

You also always have the right to lodge a complaint with the supervisory authority:

Data Protection Authority Rue de la Presse 35 / Drukpersstraat 35, 1000 Brussels Tel. +32 (0)2 274 48 00 — contact@apd-gba.be www.gegevensbeschermingsautoriteit.be

For complaints about your rights as a patient, you can contact the ombudsman service of AZ Rivierenland or AZ Zeno, or the federal ombudsman service "Patients' Rights" (FPS Public Health).

13. Changes

This privacy statement may be amended, for example in the event of new legislation or changes to our services. The current version is always available on www.drlavrysen.be, stating the version date. In the event of significant changes, we will inform you actively.

Last amended: 15/09/2026 — Dr Eno Lavrysen, specialist physician in neurosurgery