Date: 5 November 2024

Version: v2.0

Who we are

The digi.me service is owned by World Data Exchange B.V., Kvk No 88297772, Zuid-Hollandlaan 72596 AL Den Hagg (we, our, us).

We can be contacted in several ways:

By email to: privacy@worlddataexchange.com

In writing to:

Privacy Manager
World Data Exchange B.V.
C/- Spaces Rode Olifant
Zuid Hollandlaan 7
2596 AL Den Haag 
Netherlands 

Or contact us at www.digi.me

What is the digi.me service? Overview, background, context and functions

The digi.me App, website and associated technology platforms (together referred to as the digi.me service) are designed to function within and support the MedMij appointment system. More information about this appointment system can be found at: https://afsprakenstelsel.medmij.nl/asverplicht/mmverplicht/

The digi.me service provides a solution for the secure exchange and storage of your health information by making it readily available using an encrypted cloud-based data vault.

MedMij is the standard for the secure exchange of health data between healthcare providers and healthcare users in the Netherlands. The digi.me service has been specially built to form a personal health environment (in Dutch: een Persoonlijke GezondheidsOmgeving or PGO) that works within the MedMij appointment system. In general, a PGO  is an app or a website where you can retrieve a copy of your health records for free. Often, you can also add health data that you measure yourself. For consistency, this text will refer to the personal health environment, using  the Dutch abbreviation PGO.

The MedMij appointment system consists of technical, regulatory and standards-based requirements and safeguards to achieve MedMij's goal of enabling individuals to exchange health data in a vault and reliable manner. Compliance with these, together with the advanced functionalities of the digi.me service, enables this data exchange. It also enables participating PGOs  to use the MedMij label referred to later in this section.

As a PGO within the MedMij appointment system, the digi.me service enables you to securely and independently connect to, access and obtain your personal and health data from healthcare providers participating in the MedMij appointment system, and to download your personal and health data to your individual encrypted cloud-based data vault. You can also add your own health data to your data vault  such as blood pressure, weight, etc. You can then share this health data yourself with your healthcare provider.

Another feature of the digi.me service is that your connected personal and health data from all your participating healthcare providers can be viewed and managed by you in one location, in real time or near real time, on your own computer or device.

All organisations accredited to offer technologies and services that meet MedMij's high standards are allowed to use the MedMij label, giving healthcare providers and users the assurance that the service is reliable, safe and secure. After achieving the relevant MedMij functional accreditation, ISO and NEN 7510 security certification requirements, the digi.me service is entitled to use the MedMij label. World Data Exchange B.V. is therefore certified to work according to the MedMij standards and thus offer the Digi.me service.

The MedMij framework operates against a background of laws and regulations, including the General Data Protection Regulation (GDPR), which requires organisations to provide individuals with information about control, processing, collection, use, disclosure and other handling of their personal data. This Privacy Policy is designed to meet these requirements.

Our approach to data protection

Our approach to data protection is in line with the requirements of Article 25 of the AVG (in English: GDPR), which requires organisations that manage and process personal data to adopt a ‘data protection by design and by default’ approach. This includes technical and organisational measures that support this methodology.

These requirements are complemented by the specific rules and standards established by MedMij under the MedMij agreement system.

Legal Basis for Processing

The legal basis on which we process your  personal data (including your health data) is:

• Consent, where you have provided us with consent. You should note that you may withdraw your consent at any time by contacting us using the contact details set out at the beginning of this privacy policy. If you do so, this may affect our ability to provide some or all of our services to you.

• Necessity,  processing  your personal and health data is necessary for the performance of our agreement. We process your personal data in order to provide our services.
  Some specific examples are the need to collect  your e-mail address which is necessary for a login name, and your mobile phone number, which is necessary to enable robust security measures for the 2-factor authentication required. If you are using the digi.me App with a mobile device  this can also be done with face recognition or finger print.

• For administration, security and possibly mandatory adaptation to future services of the encrypted data  vaults, we need this personal data. If you do not wish to provide this data, the consequence is that you will not be able to use the digi.me service.

• Customer contact and communication
  We use your data to communicate with you in connection with our services, but only with your explicit consent to do so.

• The processing is necessary to comply with a legal duty.This includes keeping records, complying with legitimate requests from competent authorities (e.g. police/judiciary) or to combat terrorist financing, money laundering and fraud.

• The processing is necessary to pursue our legitimate interest. We consider processing of your data to be justified if it concerns our interests in relation to your application, the improvement of our services, the maintenance, development and incident management of our services and the performance of general business processes. We also process your data to ensure the security of our services. For example, to detect and prevent fraud, theft and other misuse of our services.

• Execution of general business processes, internal management. This includes archiving, insurance and other administrative purposes. But we also process your data for some internal operational processes, for example when we migrate customer data to a new database.

What personal data do we collect?

The personal data collected by the digi.me service is the personal data we collect through or as part of the registration process and to enable us to access your health data in order to encrypt it

Creating an account and logging in

The first step in using the digi.me service is to create an account and log in to the service.

The digi.me service can be accessed through two different ways - through a web browser on your computer or through the digi.me App that you can download on your device, such as a smartphone or tablet.

When you visit the digi.me app (either directly or via the website using the ‘Launch app’ function), you will be asked to create an account or, if you already have an account, to log in.

The personal data required to create your account that we process are:

• your e-mail address; and

• a mobile or other telephone number capable of receiving a text message used to provide you with the one-time, time-limited verification code required to complete account creation and login.

It is optional to provide your name as part of the sign-up process.

After this, you can select a healthcare provider. Once selected, you will be automatically redirected to MedMij. MedMij will then ask you to authenticate with your DigiD. Once the authentication process is complete, MedMij refers you back to the healthcare provider you selected and you will be asked to grant permission for the digi.me service to access your personal and health data from that healthcare provider. The verification process is carried out and managed by MedMij and DigiD.

How the digi.me service collects personal and sensitive data

Personal and health data collected in the digi.me service are subject to:

• the rules and functionalities established for the MedMij appointment system by the MedMij foundation; and

• the functionalities of the digi.me service.

These rules and functionalities allow you to select the sources of your health data that you wish to access and to download them via the digi.me service to a unique and encrypted data vault for which you possess the master access key of 256-bit encryption linked to the login ID of your account.

The decision as to which personal and health data is collected by the digi.me service in the encrypted data vault is made by you. Personal and health data retrieved, downloaded and stored in your own encrypted data vault are processed at your direction and with your consent after verification of your account with DigID.

We merely facilitate the data exchange between your digital vault and your healthcare providers. We do not access or use  any of your personal data in this process.

You yourself make a copy of the data you want to move and you put the copy in the digital vault yourself. We do not process this copy either as it is encrypted and we do not hold the decryption keys.

You yourself link the digital vault to your healthcare providers' information systems.

You cannot change or modify your health data using the digi.me service.

If necessary, your personal and health data are converted for you so that IT systems can communicate with each other as part of the automated process. Here, too, we do not process your personal data.

Although the digi.me service collects your personal and health data, as determined by you, we do not  access  this data. Your data is transmitted and stored in encrypted form.

Processing: use and disclosure of personal data

The digi.me service uses your login data to create, maintain and service your digi.me account.

The digi.me service does not and will not access the personal and health data you download to your encrypted data vault using the digi.me service.

If a competent, legally authorised body, such as an enforcement or regulatory authority, requires us to provide access to your digi.me service account, we will have to comply with this requirement as required by law. To the extent permitted, we will take reasonable steps to notify you of any such requirement so that you may contest or otherwise oppose such requirement.

The personal and health data vault is provided by a third-party cloud service provider, Microsoft Azure cloud services, under a service agreement with us. Your personal and health data is encrypted in transit from us to it, within it and when accessed by you using your individual encryption/decryption key.

How does the digi.me service store your personal and sensitive data in your digital vault?

As part of our privacy-by-design approach, we have adopted ‘security-by-design’ to ensure the security and integrity of your personal and health data. We and our service providers take all reasonable measures to protect your personal and health data from misuse, unauthorised access or disclosure. As required under MedMij, the digi.me service is certified to comply with the security standard NEN 7510-1:2017.

When you choose to download your health data, it is automatically encrypted in transit. The data you download or upload to the digi.me service is encrypted with Secure Socket Layer (SSL) technology and placed in your personal digital data vault. We therefore do not process any data from you about your personal and health data in these circumstances.

Other security measures we implement include access controls, regular security audits and ongoing security training for staff.

Localisation of data

The digi.me service locates all your personal and health data on servers, computer facilities and infrastructure within the European Union in accordance with the requirements of the Medmij foundation.

Age restrictions

According to the rules of the MedMij foundation, you must be 16 or older to participate in the PGO framework. This means that you may only use the digi.me service if you are sixteen years of age or older.

Time we keep your personal data

We only keep your personal data for as long as it is needed for the purposes for which it was collected or used and/or as long as required by law.

If you no longer use the digi.me service, we will mark you as ‘inactive’ in our database. In this case, we will no longer actively use your personal data.

Cookies

We only use cookies that enable us to ensure the functionality of the digi.me service, including proper log-in.

We do not use or implement performance, functionality, targeting or advertising cookies.

What are your data protection rights?

Your rights to access data

You can ask us to grant you access to the personal data we hold about you. To do so, please contact us by email at privacy@worlddataexchange.com.

Your right to rectification

You have the right to request us to rectify personal data that we hold about you.

To do so, please contact us by email at privacy@worlddataexchange.com.

If you wish to rectify personal or health data that you download from healthcare providers that participate in and hold your personal or health data as part of MedMij, you must contact the healthcare provider to amend, correct, annotate or rectify the data in question in accordance with the relevant laws and regulatory processes of the Netherlands and all applicable clinical rules and standards.

Your right to erasure

The digi.me service includes a feature that allows you to delete your personal data by deleting your account.
You can delete your account by selecting ‘Delete my account’ from the digi.me main menu icon and following the instructions. Once you have deleted your account, all your data is immediately deleted. This means that copies will no longer be available.

Your right to restrict processing

We do not use, disclose or provide your personal data to third parties for remuneration or otherwise. We do not access your personal and health data for any purpose or reason, unless we are compelled to do so by a law enforcement agency, regulatory authority or otherwise by a person or organisation legally authorised to do so.

Your right to data portability

You may request that we provide you with an accessible copy of the personal data we hold about you in a readily available format.

Such a request can be made by sending an email to privacy@worlddataexchange.com.

Changes

We review this Privacy Policy from time to time to ensure that it remains accurate and up-to-date. If we change this policy, we will notify you in advance via the digi.me/en website and explain the changes. This will not be done by email unless you have given your explicit consent.

Questions or complaints

If you have any questions about how we use your personal data, please contact us at privacy@worlddataexchange.com.

Through this route, you can also ask for our Data Protection Officer.

In addition, you have the right to file a complaint with the supervisory authority, the Authority for Personal Data. You can submit your complaint via the website of the Personal Data Authority. (https://www.autoriteitpersoonsgegevens.nl/en/about-the-dutch-dpa)