The Mental Move is the data controller of your personal data. If you have any questions about this, please feel free to fill out the form below.
When you use the prevention platform, participate in a care program, or complete the preventive health check, you agree to our privacy statement. This means that we may collect and use your personal data.
You choose whether to share information with us. If this is unexpectedly insufficient information, it may be possible that we cannot provide our services.
If our services change, we may in some cases also need to make changes to our privacy statement. At the bottom of this page, you will find the version number and date of change. We will do our best to inform you of any changes.

We collect several categories of personal data:

1. Personal data and contact information
2. Data about your health
3. Data about the progress of the treatment
4. Shared documents

These categories are briefly explained below.

Personal data and contact information.

As part of a treatment (via the Mental Lifestyle Helpdesk or Business Care), you share with us, among others, the following information:

• Name
• Gender
• Date of birth
• Email address
• Phone Number
• Your employer

Data about your health

As part of sessions within the Mental Lifestyle Helpdesk or treatment within Business Care, you can share information about your physical and mental health such as:

• Your mental state
• Complaints
• Medical history

You can share this information as part of online exercises, complaint registration, when completing the preventive health check, or for example during a video call with a therapist.

What data do we explicitly not collect?

We do not store video call conversations.

Our prevention platform (also available as an app within Teams, Apple’s App Store, and Google’s Play Store)

The Mental Move offers an open prevention platform to all participants. This platform offers preventive modules around (mental) health and is also the starting portal to initiate other services (Mental Lifestyle Helpdesk, anonymous chat, Business Care, Preventive Health Check).

No login is required for this platform. However, you are asked for the company code to gain access. No personal data is processed when using the preventive modules. The use is completely anonymous. Even when filling out short questionnaires (as part of the modules), no personal data is requested or processed.

It may also be that your employer already provides the company code when you open the platform from the intranet or from Teams. Even then, no personal data is used (such as your name, email address, or phone number).

When starting other services from our prevention platform, such as the Mental Lifestyle Helpdesk, Workshop registration, or the Preventive Health Check, personal data will be shared. You will need to provide this information yourself. At these moments, explicit consent will be requested for this processing.

In the case of the Mental Lifestyle Helpdesk, information is requested before and after the session. This information can be provided voluntarily and is not necessary for the execution of the Mental Lifestyle Helpdesk. This information is processed and stored anonymously and only anonymously and aggregated feedback is provided to the employer.

We use Juvoly. This is a tool that converts spoken text into a summary for the EPD (electronic patient record). This helps the practitioner’s work, improving the service. The spoken text is not stored anywhere, and the summary, after being checked for accuracy by the practitioner, is kept in the EPD.

In the case of a workshop registration, an email is sent after the workshop asking for feedback. This information can be provided voluntarily and is not necessary for the execution of the workshop. This information is processed and stored anonymously and only anonymously and aggregated feedback is provided to the employer.

The handling of your information when using these services is detailed in this Privacy Statement.

Within the prevention platform, Google Analytics is used to monitor the use of the different modules. This is done anonymously and not on a personal level, but the number of visitors is tracked at an organizational level. No IP addresses are stored in this process.

When the prevention platform is used via the iOS or Android app, Google Firebase is also used for Push Notifications. The following information is collected: the version of our app that is installed, metadata of the device (version of the OS, brand, model, size), the app used to install our app (e.g., Play Store), and which version of Firebase is used. This information cannot be traced back to the user.

We use your data to:

1. Provide our prevention, care, and acceleration services to you.
2. Deliver the preventive health check.
3. Communicate with you or your employer.
4. Improve our services.
5. For the billing of business care (in case a business care trajectory is started).

Delivering prevention, care, and acceleration services

We use your personal and health data to provide our prevention, care, and acceleration services. We use your data for the medical prevention, investigation, and treatment of diseases, injuries, and other problems you may have.

If Business Care is used, this data is stored in a patient file within Oscar and is also used for the realization of a treatment plan and other documents.

If we are required to share certain information due to legal obligations, we will do so. Of course, only the information that is strictly necessary for this purpose.

Delivering the preventive health check

We collect your personal data to be able to create a personal advice report after completing the preventive health check. In addition, your data, of course anonymized and not traceable to you, is used for a macro-report for your employer, benchmarking, and possibly future scientific research.

Communicating with you or your employer

We send information and notifications to you in various ways. This can be, for example, as part of a treatment (such as a reminder for a task or appointment) or an activation campaign for the use of prevention content.

Prevention services (use of the platform, helpdesk, chat, workshops)
Within the prevention services, we will never share your name or medical data with your employer.
At the employer level, the use of the platform and the mental helpdesk (anonymized and aggregated) will be reported back to measure impact.

Business care
In the case of a business care trajectory, we mention your name on the invoice. We will never share your medical data with your employer. Only when you explicitly give permission can we share information with your employer about the process and progress of a business care trajectory.

Improving our services

When you have complaints about our services, we use your data to improve our services. For this purpose, we may use your personal data, but also statistical data regarding the use of the online platform. In doing so, we ensure that this cannot be traced back to you.

We do not keep your data longer than necessary for providing the prevention platform, healthcare services, and preventive health check. Below, you can read how long we keep your data in various cases.

Online workshops, Mental Lifestyle Helpdesk, business care, anonymous chat
Within the online workshops, our Mental Lifestyle Helpdesk, and business care services, we do not keep your data longer than necessary.

In some cases, our services involve a treatment agreement as defined in the Medical Treatment Agreement Act (WGBO). If this is the case, we will inform you before the start of the care.
If this is the case, we will keep your medical data for twenty years from the last modification in the file. This is stipulated in the WGBO.

If there is no treatment agreement, your data will be deleted after the treatment. If the prevention platform is used as part of the service, the above information about the prevention platform also applies.

For the anonymous chat, the chat messages are kept for 5 hours, after which they are automatically deleted. The chat can be used completely anonymously.

Preventive health check
When completing your preventive health check, your data is automatically processed into a personal advice report immediately after submission (within 10-15 minutes). When completing the preventive health check, a TLS 1.2 secured connection is used. During this process, your personally identifiable information such as email address is stored encrypted. After sending your personal report, the entered data is anonymized and stored in our system in a way that cannot be traced back to you, for the purpose of a macro report for your employer (only with more than 20 submissions), benchmarking, and potential future scientific research.

The entered email address and phone number are only stored for securely sending the personal report and sending an evaluation questionnaire after 14 days. The secured email is kept for 30 days.

We only share your data with others when strictly necessary. In doing so, we will always limit ourselves to the minimum set of information necessary for that party.

We share the information with, among others:

People who work for The Mental Move or are hired by The Mental Move.

Only employees or hired healthcare professionals involved in your support may view your data. All these people have signed for confidentiality in their (employment/hiring) contract and in some cases also have a professional duty of confidentiality.

Suppliers and subcontractors.

• When using the Mental Lifestyle Helpdesk and the workshops, a limited set of your data is stored in Dynamics 365. WhereBy is used for video calling during the session and workshop.
• When using Business Care, your data is stored within Oscar.
• For the anonymous chat, Zaurus is used (provider of, among others, Zorgmail).
• For the preventive health check, your completed (medical) data is stored anonymously within Dynamics 365. Your personal report is securely sent once (according to NTA7516 standards) to your email address with a 2FA code to your mobile number. For this, the services of Bastion365 are used. These 3^rd parties adhere to the same privacy rules as The Mental Move.
• For webinars, Sli.do (ISO27001 and ISO9001) may be used to facilitate polls. Participation in these polls is anonymous, and no personal data needs to be shared.
• When using the prevention platform, Google Analytics is used (to record visitor numbers) and Google Firebase (in case of use via the iOS or Android app). In both cases, this information cannot be traced back to the user.
• For video calling for a Mental Lifestyle Helpdesk or a Business Care session, the Juvoly API is used to summarize the conversation. Juvoly is ISO27001 and NEN7510 certified.

Your employer and/or referrer.

Your employer pays for the services of The Mental Move. To do this, we only share procedural information about the treatment with your employer, which is limited to notifying the start of a care trajectory. We will never share your medical data with your employer or referrer (company doctor), unless you explicitly give permission for this. In the case of the preventive health check, your employer can obtain a macro report. This report will only be provided for more than 20 participants.

The authorities

The Mental Move sometimes has to share data with authorities such as the Dutch Healthcare Authority, RIVM, police, or others. We will only do this when it is necessary due to legislation.

For providing our services, the following systems are primarily used:

• Microsoft Office 365, Microsoft Teams, Dynamics and Azure (including ISO27001, ISO27017, ISO27018, SOC)
  Data is stored within Microsoft’s data center in Western Europe (Netherlands).
• WhereBy (ISO27001 certified)
• Bastion365 (ISO27001 and NEN7510 certified)
  For mailing reports according to NTA7516 standards. Data is stored within the EU.
• Zaurus (ISO27001 and NEN7510 certified)
• Juvoly (ISO27001 and NEN7510 certified)
• Oscar (ISO27001 and NEN7510 certified)
  If there is a treatment that falls under the WGBO, a file will be created in the Oscar ECD system.
• Mailjet (ISO27001)
  Limited set of data is stored within the EU (Germany Belgium).
• SignRequest (ISO27001)
  Used to digitally sign contracts for business care between employer and The Mental Move.

The Mental Move considers the protection of your personal data very important. The management of The Mental Move directs the established information security policy. As part of this policy, risks are continuously assessed, improvements implemented, and progress reported.

We therefore process your data carefully and have taken many measures to protect your personal data. These measures include:

• The connections with our systems are always secured with SSL.
• Your data is stored encrypted.
• Where possible, your data is stored anonymously.
• All our systems are secured with usernames and strong passwords. The applications in which your special personal data is processed are also secured with Two Factor Authentication.
• The prevention platform is protected with a Web Application Firewall and periodically scanned for vulnerabilities.
• Our employees’ laptops are centrally managed, ensuring they are always provided with the latest updates, up-to-date virus malware detection, and local encryption.
• All our psychologists are bound by strict professional confidentiality. Furthermore, all our employees have a contractual obligation of confidentiality.
• The Mental Move has taken appropriate technical and organizational measures (including requiring all employees to adhere to a strict code of conduct for information security, mandatory annual information security awareness training for all employees) to protect your personal data against unlawful processing.

We process your personal data based on the following legal grounds:

• The consent given by you. You can always withdraw this consent. If consent is withdrawn, we may not be able to provide the requested services properly.
• To comply with our legal obligations.
• For our legitimate (business) interests, which are pursued in the context of our preventive and (occupational) medical services.
• An agreement. In some cases, there may be a treatment agreement between you and The Mental Move according to the Medical Treatment Agreement Act (WGBO).

We use your data. Because this is your data, you have several rights. These include:

• Right to Access and Copy.
  This is your right to receive a copy of the personal data that The Mental Move processes.
• Right to Be Forgotten.
  You have the right to be “forgotten”.
• Right to Rectification and Completion.
  The right to have your personal data modified.
• Right to Data Portability.
  You may transfer your data to another healthcare provider.
• Right to Restriction of Processing.
  The right to have less data processed.
• The Right to Object to Data Processing.

If you have a complaint about the processing of your personal data, we ask you to contact us. Should that not lead to the desired result, you have the option to file a complaint with the Dutch Data Protection Authority, the supervisory authority in the field of privacy.

If you wish to exercise one of your rights, we ask you to make a request in writing (by phone, mail, or email). We strive to process your request as quickly as possible, but in any case within 4 weeks (while observing the law and regulations). If we need more time, we will communicate this to you within a month. As part of processing the request, we need to verify your identity.

Your request can be sent to privacy@thementalmove.nl or to The Mental Move B.V., Korte Schaft 23a, 3991 AT Houten.

Regular visit
For the purpose of monitoring the security of the website, only if the monitoring software detects threatening activities, the IP address will be stored. This information will be stored for a maximum of 1 month for the purpose of website security.

We further use the services of Leadinfo B.V., Rotterdam, The Netherlands, which recognizes visits from companies to our website based on IP addresses and shows us related publicly available information, such as company names or addresses. Additionally, Leadinfo places two first-party cookies to provide transparency on how our visitors use our website, and the tool processes domains of provided form inputs (e.g. “leadinfo.com”) to correlate IP addresses with companies and to improve its services. For more information, visit www.leadinfo.com. On this page: www.leadinfo.com/en/opt-out you have an opt-out option. In case of an opt-out, your data will no longer be used by Leadinfo.

Request for a demo or whitepaper

When requesting a demo or a whitepaper, The Mental Move collects the following information:

• First name last name
• Email address
• Phone number (optional)
• Company Name
• Role/function (optional)

We use this information to contact you. This data is necessary to provide the demo or send the whitepaper.
When sending the whitepaper via email or sending newsletters (when you as a user have given permission for this), it is tracked whether the email has been opened and which links in the newsletter have been clicked.

Contact request

When asking a question through a contact form, The Mental Move collects the following information:

• First name last name
• Email address
• Phone number (optional)
• Company Name
• Role/function (optional)
• Your question

We use this information to contact you and it is necessary to answer your question.

We retain the data you enter for a contact, demo, or whitepaper request for 1 year, unless permission is given again in the meantime.
If you also subscribe to the newsletter, your data will be stored for a longer period. When you unsubscribe from the newsletter, we will delete your data after one year.

If you want your data to be deleted sooner, please contact us via privacy@thementalmove.nl.

Until you accept the use of cookies and other tracking systems on the website, we do not place non-anonymized analytical cookies and/or tracking cookies on your computer, mobile phone, or tablet.

Click here for our full cookie policy.

Based on Article 6 paragraph 1 sub b GDPR, The Mental Move collects the following data because they are relevant for the recruitment and selection of candidates and entering into employment.

• Motivation letter- Name and address details, including phone number and email address;
• Information about your current job and previous jobs;
• Information about completed education, courses, and internships;
• References, testimonials
• In the 2nd stage of the application process: Assessment report / competency test;
• After completion of the selection and signing of contract: Certificate of good conduct, copy of ID, bank account number;
• Other information provided by the applicant, whether or not included in a CV. By voluntarily providing data that does not fall under Article 6 paragraph 1 sub b GDPR, the applicant gives permission to process this based on Article 6 paragraph 1 sub a GDPR.

The Mental Move, of course, does not collect or process sensitive information about applicants, such as ethnic background, political or religious beliefs, or sexual orientation.

We retain the data you share with us during the application for a maximum of 6 months after completing the application process, unless permission is given again in the meantime.

If you want your data to be deleted sooner, please contact us via privacy@thementalmove.nl.

For applications, we use the following systems:

• Microsoft Office 365, Microsoft Teams and Azure (including ISO27001, ISO27017, ISO27018, SOC)
  Data is stored within Microsoft’s data center in Western Europe (Netherlands).
• Bastion365 (ISO27001 and NEN7510 certified)
  For exchanging confidential data (such as ID) Data is stored within the EU.
• SelectionLab
  For the purpose of online assessment. In this case, SelectionLab is the data controller. When participating in an assessment, you will be asked to agree to the privacy terms of The Selection Lab.

See “Our Information Security Measures” under the heading “Privacy During/After Using the Prevention Platform, Treatment, or Preventive Health Check”.

We use your data. Because this is your data, you have several rights. These include:

• Right to Access and Copy.
  This is your right to receive a copy of the personal data that The Mental Move processes.
• Right to Be Forgotten.
  You have the right to be “forgotten”.
• Right to Rectification and Completion.
  The right to have your personal data modified.
• Right to Data Portability.
  You may transfer your data to another healthcare provider.
• Right to Restriction of Processing.
  The right to have less data processed.
• The Right to Object to Data Processing.

If you have a complaint about the processing of your personal data, we ask you to contact us. Should that not lead to the desired result, you have the option to file a complaint with the Dutch Data Protection Authority, the supervisory authority in the field of privacy.

If you wish to exercise one of your rights, we ask you to make a request in writing (by phone, mail, or email). We strive to process your request as quickly as possible, but in any case within 4 weeks (while observing the law and regulations). If we need more time, we will communicate this to you within a month. As part of processing the request, we need to verify your identity.

Your request can be sent to privacy@thementalmove.nl or to The Mental Move B.V., Korte Schaft 23a, 3991 AT Houten.