Describe here which personal data is involved (name, email, medical, …):
There are a number of forms on our websites and iOS app that we use to collect data:

1. The first is the form on our home page that records a consumer’s name, phone number, email address and location. The location can also be kept empty so that it is not registered. This data is then processed in the Touristdoc iOS app and deleted after 72 hours.

2. On every Touristdoc website there are also contact forms where the following information is collected: name, telephone number and e-mail address. These contact forms are used for customers or companies that want to work with us.

3. We register the name and address details of doctors via the Touristic app. In addition, also the public registration number of doctors. This way we can determine whether this is a licensed doctor. In addition, the specialties and whether the doctor in question has insurance.

For what purpose and in what process is this data used?
Touristdoc collects three different data streams. The first is for customers where we collect the data to contact a customer and also complete billing to the customer or insurers.

The second data stream is the registration data of doctors. We collect this data because we want to determine whether we are dealing with a licensed doctor.

The third data stream is from people who want to contact us and we collect this data because they also want to contact the person who contacts us.

Which groups of data subjects are the personal data of (website visitors, students, customers, …):
The groups involved are linked to the visitors of the website and doctor in the form as users of the app.

Is this DPIA for an existing situation, or for a newly proposed situation?
This DPIA is for a newly proposed situation.

A DPIA is only required if a data processing is likely to pose a high privacy risk for the data subjects (the people whose data the organization processes). At least that’s how an organization:

1. systematically and comprehensively evaluate personal aspects, including profiling;
2. processes special personal data on a large scale;
3. Widely and systematically monitor people in a publicly accessible area

(for example with camera surveillance).

To determine whether there may be a high risk, the supervisors use the rule of thumb below. There is a high risk if two or more of the following nine criteria are met:

1. evaluation of persons or scoring;
2. automated decision-making with legal effect or similar material consequence;
3. systematic monitoring;
4. sensitive data or data of a very personal nature;
5. widely processed data;
6. matching or merging of data sets;
7. data relating to vulnerable data subjects;
8. innovative application of new technological or organizational solution;
9. Blocking of any right, service or contract.

What criteria does this processing meet? Provide a short motivation for each criteria:

1. The evaluation of persons or possible scoring thereof always takes place between the personal conversation between patient and doctor. We collect the data on our website(s) to facilitate contact between both parties, but do nothing for evaluation or scoring. This takes place in the confidential conversation between doctor and patient.
2. Automated decision-making does not take place.
3. Systematic monitoring does not take place. 
4. Sensitive data in the field of name and address, doctor’s data and additional patient data are included in our forms and these are used to facilitate contact between both parties and also to ensure the quality of doctors. 
5. The data will not be processed on a large scale. Touristdoc has different subdomains per location, each of which manages and processes their information. This allows us to split the data processing into small pieces, so that no large-scale processing takes place. 
6. Data sets will not be merged
7. The data related to vulnerable data subjects will not be stored if it will ever be processed at all. 
8. This is an application of an innovative new technology that enables patient requests to be identified and acted upon.
9. There is no blocking of any right, service or contract

Systematic description of the data processing Describe here in more detail how the data processing works:
The data processing takes place in the field of a form on the website that collects the name, telephone number, e-mail address and location of patients. In addition, the information of patients and doctors is processed on the app, which is processed via a secure connection.

How/where is the information collected?
The data is collected via a registration form on the website and a form on the Touristdoc app.

Where is it stored? Who can join here?

The data is stored at a Netherlands web hosting provider on a secure server. The name of the web hosting provider is Vservs which then rents servers from Transip which is a Dutch ISP. No one can participate in this without explicit permission and access from us. 

How is the information used? Is every field used?

The information is used to contact the patient and make an assessment of whether further steps are necessary.

What are the purposes of the processing? Can these goals be achieved without the data?
The goals of the processing of the data are that a follow-up step can be successfully continued and a successful assessment can be made based on the information.

Is permission requested within the process? Are there any later unsubscribe/opt-out options?
Within the process, permission is requested in advance for the use of certain hardware functionalities such as Bluetooth and when filling in the form, the patient or doctor is made aware of the privacy policy of Touristdoc.

What is the retention period of the data? How is the deletion of the data arranged?
The data of patients is stored on our server for 72 hours and a copy of the consultation is stored for 3 years on the Microsoft exchange mail account of Touristdoc. 

What hardware and software are used for data processing?
No hardware is used for the data processing and the software uses APIs that link the WordPress websites of Touristdoc and the iOS app of Touristdoc. 

Which departments, suppliers and other parties are involved in the processing as a processor?
As a processor in the processing, Vservs are involved as an ISP and Microsoft as a cloud service where the e-mails are stored.

Is there an international transfer? Which countries does this concern?
There is no automatic international transfer, it is possible that the patient can take his data on paper abroad.

Where is the data archived? Is this paper or digital?
The data is digitally archived on the server(s) of the organization.

What is the expected scope of the data processing (number of data subjects):
There is as yet no insight into the expected scope of the data processing.

Is there a clearly specified goal? What exactly is this purpose, and why is it legitimate?

The clearly specified goal is the treatment of tourists by local general practitioners.

Can this goal also be achieved without this personal data? Why not, or why not do it differently?

This goal cannot be achieved without personal data that we retrieve from the app or the website, because patients must be contacted that we do not yet know and cannot get somewhere else in advance.

Is there a clear maximum retention period?

The legal retention periods in the field of medical law are adhered to.

Is sufficient information provided to the data subject? Is it clear to data subjects what rights they have and how they can exercise them?

The information provided to the data subjects is our privacy policy which is reflected in every request that is sent.

How is the right of access guaranteed?

The right of access is guaranteed by emailing our privacy officer at info@touristdoc.com.

How is the right to rectification guaranteed?

The right to rectification is guaranteed by emailing our privacy officer at info@touristdoc.com.

How is the right to removal guaranteed?

The right to erasure is guaranteed by emailing our privacy officer at inf@touristdoc.com.

How is the right to data portability guaranteed?

The right to data portability is guaranteed by emailing our privacy officer at info@touristdoc.com. 

How do you estimate the probability and impact of the following risks:

What is the exact impact of data leakage on data subjects?

In the even of a data breach, information from doctors and patients may be extracted. This is data from the last 72 hours. In the case of doctors, this is general contact information. 

Does this have any negative consequences for the person?

The information that can be extracted from both the doctors and the patients is not sensitive in nature. If this is extracted, we will report this to the relevant persons so that they can take action. 

Is there a risk of financial damage?

With the information that is extracted, the risk of financial damage is relatively small. 

Is there a risk of identity theft or fraud?

With the information that is extracted, the risk of identity theft or fraud is relatively small. 

Can you indicate per risk which measures you take to protect the data:

Are there any additional organizational measures you are taking?

No, we do not yet have any additional organizational measures that we are taking.

Are there any additional technical measures you are taking?

No, we do not yet have any additional organizational measures that we are taking.

Is it clear who is responsible for maintaining and evaluating the measures taken at the end of the project? Who is this:

This is Guido Terhorst

Have you appointed a Data Protection Officer (DPO)? Then it is mandatory to ask this person for advice. Record the advice of the DPO below:

A DPO has not yet been determined and will be determined in due course.

Name FG:

This should be determined in due course. 

Date of advice:

This should be determined in due course. 

Answers from FG:

This should be determined in due course. 

Are the data processing and purposes clearly described?

This should be determined in due course. 

Is the processing of the personal data necessary or proportionate for the purposes?

This should be determined in due course. 

Have the privacy risks been sufficiently identified? Which risks are still missing?

This should be determined in due course. 

Have there been discussions with those involved or representatives for this DPIA? What response did they give? How was this response processed?

This should be determined in due course. 

Does the DPIA indicate that the processing poses a high risk if you do not take risk mitigation measures? Answer and motivation below:

No, because the architecture of our website, cloud services and app is designed in such a way that is not a high risk if risk mitigation measures are not taken.

If yes, you must request a prior consultation with the Dutch Data Protection Authority (AP). You must provide the DPIA to the AP.