Orthoface BV – website mauricemommaerts.clinic

Version 2.0 – effective from 1 january 2026. This version replaces the version of 1 January 2026.

1. Who is responsible for your data?

The controller within the meaning of the General Data Protection Regulation (Regulation (EU) 2016/679, hereinafter the “GDPR”) is:

Orthoface BV, with registered office at Jef De Belderlaan 9, 9831 Deurle (Sint-Martens-Latem), Belgium, company and VAT number BE 0892.661.801 (hereinafter “Orthoface”, “we” or “us”).

Medical services are provided by Prof. Dr Maurice Y. Mommaerts, medical specialist, registered with the Belgian Order of Physicians. Consultations take place at Face Ahead Clinic, Van Putlei 35A, 2018 Antwerp, Belgium.

For any questions about privacy and to exercise your rights: info@mauricemommaerts.eu or +32 3 500 10 07. Orthoface is not required to appoint a data protection officer; the contact point above will handle your questions.

This privacy policy applies to the website https://mauricemommaerts.clinic (in all language versions), to contacts with our practice secretariat and to the processing of patient data. It supplements Article 12 of our General Terms and Conditions.

2. What data do we process, why and for how long?

We only process the data needed for the purpose for which it is collected. Below you will find, for each purpose, the data concerned, the legal basis we rely on and how long we keep the data.

Purpose	Data	Legal basis (GDPR)	Retention period
Answering questions and scheduling a (video) consultation	Name, email address, telephone number, content of your message; any photos or medical information you choose to send	Pre-contractual steps (Art. 6(1)(b)). For health data and photos you provide yourself: your explicit consent (Art. 9(2)(a)) and the provision of healthcare (Art. 9(2)(h))	Two years after the last contact if no treatment follows. If you become a patient, the data are transferred to your medical record
Account for the overview of procedures and fees	Email address, password (stored encrypted) or, when signing in with Google: name, email address and Google ID; date of registration and last sign-in	Performance of the user agreement for the account (Art. 6(1)(b))	Until you delete the account
Healthcare and medical record	Identification and contact details, national registration number, medical history, test results, clinical photographs and imaging, reports, consent forms, insurance details	Legal obligation (Art. 6(1)(c)) and performance of the treatment agreement (Art. 6(1)(b)); for health data: provision of healthcare under medical professional secrecy (Art. 9(2)(h) and 9(3))	At least 30 years and at most 50 years after the last patient contact, as required by the Belgian Act of 22 April 2019 on the quality of healthcare practice
Publication of before-and-after photographs (cases)	Facial photographs, a brief non-identifying description of the procedure	Separate, explicit, written consent (Art. 6(1)(a) and 9(2)(a)), which may be withdrawn at any time	Until you withdraw your consent; we then remove the photographs from the website as soon as possible
Invoicing and accounting	Name, address, invoicing details, payments	Legal obligation (Art. 6(1)(c))	Ten years, in accordance with accounting and tax legislation
AI chat assistant on the website	Content of your conversation, technical data (IP address, browser, time)	Legitimate interest in answering general questions quickly (Art. 6(1)(f))	90 days
Website management and security	IP address, browser type, pages visited, date and time, error messages (server logs)	Legitimate interest: a secure and properly functioning website (Art. 6(1)(f))	30 days
Website usage statistics (Google Analytics)	Pseudonymous usage data: pages visited, duration, device, browser, approximate location (country or city)	Your consent via the cookie banner (Art. 6(1)(a))	14 months (Google Analytics setting)
Establishing, exercising or defending legal claims	The data relevant to the dispute	Legitimate interest (Art. 6(1)(f)) and Art. 9(2)(f)	For as long as the limitation period runs

 

We do not use your data for advertising or newsletters without your prior consent, and we never sell or rent out your data. No automated decision-making or profiling with legal effects for you takes place.

About the AI chat assistant

The chat assistant on the website is an automated computer program based on artificial intelligence, not a doctor or staff member. Its answers are general information and not medical advice, a diagnosis or a treatment proposal. Do not share medical data, photographs or other sensitive information in the chat. For personal questions, please contact us directly.

3. Cookies

Cookies are small files stored on your device when you visit a website. We use:

• Strictly necessary cookies: needed for the website, language selection, signing in to your account and security to work, and to remember your cookie preferences. These cookies do not require consent.
• Analytics cookies (Google Analytics): only placed if you give your consent.
• Cookies from embedded services (such as the chat assistant and Google sign-in):

 

On your first visit, we ask for your consent via the cookie banner. Refusing is as easy as accepting. You can change or withdraw your choice at any time via the “Privacy Preferences” link at the bottom of every page. An overview of the cookies used, with their name, provider, purpose and retention period, is available in the preference centre of the cookie banner.

4. Who do we share your data with?

Within Orthoface, your data are only accessed by persons who need them for their tasks and who are bound by professional secrecy or a duty of confidentiality. We only share data with:

• Processors acting on our behalf, with whom we have concluded a data processing agreement: the web hosting provider EskiHost, the web agency ESKIDOOS for website maintenance, the supplier of the medical record and practice administration software (Microsoft 365), our email provider Microsoft, Google Ireland Ltd (Google Analytics and Google sign-in), Chatbase (chat assistant) and Microsoft 365 for online consultations via Teams.
• Other healthcare providers and healthcare institutions involved in your treatment, such as the hospital or day-surgery centre where the procedure takes place, the laboratory or your general practitioner, insofar as necessary for your care and within the limits of professional secrecy.
• Our accountant, our professional liability insurer (through Vanbreda Risk & Benefits) and legal advisers, insofar as necessary.
• Public authorities, where a legal obligation requires us to do so.

5. Transfers outside the European Economic Area

We process your data within the European Economic Area (EEA) as far as possible. Certain service providers (Google and Chatbase) may transfer data to the United States. This only happens with appropriate safeguards: the European Commission’s adequacy decision on the EU-US Data Privacy Framework (for certified companies) or the standard contractual clauses approved by the European Commission. On request, we will provide you with more information about these safeguards.

Medical records and clinical photographs are not stored outside the EEA.

6. Security

We take appropriate technical and organisational measures to protect your data against loss, misuse and unauthorised access. These include an encrypted connection (https) for the entire website, encrypted storage of passwords, role-based access restrictions, secure storage of medical data and regular back-ups. In the event of a personal data breach that poses a risk, we will notify the Belgian Data Protection Authority within 72 hours. Where there is a high risk to you, we will also inform you directly.

7. Your rights

You have the following rights:

• Access and copy: you can ask which data we process about you. As a patient, you also have the right to access and obtain a copy of your medical record under the Belgian Act of 22 August 2002 on patients’ rights. The first copy is free of charge.
• Rectification of inaccurate or incomplete data.
• Erasure of your data. Data we are legally required to keep, such as the medical record and invoices, can only be erased once the legal retention period has expired.
• Restriction of processing.
• Data portability: you can receive the data you provided yourself in a commonly used electronic format, or have them transferred.
• Objection to processing based on our legitimate interest.
• Withdrawal of your consent, at any time and without affecting processing that took place before.

You can exercise these rights via info@mauricemommaerts.eu. We may ask you to prove your identity. We will respond within one month. For complex or numerous requests, this period may be extended by two months; in that case we will inform you within the first month.

8. Complaints

If you are not satisfied with the way we handle your data, please contact us first. You also always have the right to lodge a complaint with the Belgian Data Protection Authority, Rue de la Presse 35, 1000 Brussels, Belgium, contact@apd-gba.be, www.dataprotectionauthority.be. Complaints about patients’ rights may also be addressed to the competent ombudsman service.

9. Minors

Our website is intended for adults. We do not knowingly collect data from persons under the age of 16 through the website. For the treatment of minor patients, their rights are exercised as provided for in the Act on patients’ rights, in principle by the parents or legal representative, with the involvement of the minor according to his or her age and maturity.

10. Changes

We may amend this privacy policy, for example when new services are added to the website or legislation changes. The date at the top indicates when the current version came into effect. In the event of significant changes, we will inform you through a clear notice on the website and, if you have an account, by email.

11. Contact

Orthoface BV, Jef De Belderlaan 9, 9831 Deurle, Belgium – info@mauricemommaerts.eu – +32 3 500 10 07