This is a translation; the Dutch version prevails.
Boekenbloom helps aesthetic clinics and salons with online appointments, a calendar, an AI booking assistant, reviews and managing and measuring their advertising. We never sell personal data.
This statement explains which data we process and in which role. That differs per situation:
- Part A: you book with a clinic, chat with its assistant or write a review. Then the clinic is responsible for your data (controller). Boekenbloom processes it on the clinic's behalf (processor), under a data processing agreement.
- Part B: you visit our website, have a clinic account or contact us. Then Boekenbloom is responsible.
Who we are
Boeken Bloom B.V., Barajasweg 82, 1043 CP Amsterdam · KvK 42153269 · VAT ID NL869949913B01 · info@boekenbloom.nl. We do not have a data protection officer; you can send questions about privacy to info@boekenbloom.nl.
Part A: appointments, chat and reviews with a clinic
Who is responsible?
The clinic you book with, chat with or write a review about. The clinic's name and contact details are on the booking page. For questions about your data or to exercise your rights, you can contact the clinic, or us; we then pass your request on.
Which data and what for?
| Purpose | Data | Legal basis (determined by the clinic) |
|---|---|---|
| Scheduling, confirming, reminding you of (by email and, if the clinic uses it, SMS), changing or cancelling your appointment | Name, email address, phone number, language, treatment, date/time, staff member, notes | Performance of the contract with you |
| Answering your questions and preparing an appointment through the chat, partly by an AI assistant | Chat messages, name and contact details you provide, chosen appointment; a hashed IP address to prevent abuse | Steps at your request / performance of the contract; abuse prevention: legitimate interest |
| Inviting you to write a review after a completed appointment, and showing your review | Email address (invitation), rating, text, display name (first name + initial), date | Invitation: the clinic's legitimate interest; publication: your consent (checkbox when posting) |
| Measuring which of the clinic's ads lead to appointments | Booking ID, your email address and phone number in encrypted (hashed) form, ad click IDs, IP address, browser type, time | Only with your consent (checkbox when booking) |
| The clinic's advertising cookies or pixels on the booking page | Cookie IDs and click IDs | Only with your consent (cookie banner) |
Health. The name of a treatment can say something about your health. We use it only for your appointment and never send it to advertising platforms. Don't share medical details (such as conditions, allergies or medication) in the notes field, the chat or a review; discuss them directly with the clinic. We do not publish reviews that may contain health data without checking them.
AI assistant. The chat assistant answers general questions and helps you make an appointment. An appointment is only made once you confirm it yourself. The assistant does not take decisions with legal or similarly significant effects for you, does not ask for health data and refers medical questions to the clinic. You can always ask to be put in touch with a staff member. Answers from an AI assistant may contain mistakes; the clinic confirms the final appointment.
Reviews. Only clients with a completed appointment can write a review, one per appointment. We show your first name and the first letter of your last name. Negative reviews are not removed for that reason; we only remove a review if it breaches the review rules or the law, and then tell you the reason. You can have your review removed via info@boekenbloom.nl.
Ad measurement: how does it work?
If you give consent, Boekenbloom sends, on the clinic's behalf, a notification of your booking to the clinic's advertising account at the platforms named in the checkbox (for example Google). Your email address and phone number are encrypted (hashed) beforehand. This lets the platform see whether you clicked on one of the clinic's ads before. The treatment, your notes, chat messages and reviews are never sent. The platform processes this data under its own terms with the clinic; see that platform's privacy statement. You can always withdraw your consent via the link in your confirmation email or via the cookie settings. After that we send nothing more.
Who receives your data?
- The clinic you book with.
- Our service providers (sub-processors): Supabase (database, EU), Vercel (hosting), Resend (email), CM.com (SMS, NL), Anthropic (AI assistant and checking of reviews), Cloudflare (bot protection) and TransIP (domain and email).
- Only with your consent: the clinic's advertising platforms named in the checkbox.
Some of these parties are based in the United States. Transfers only take place with appropriate safeguards: the EU-US Data Privacy Framework or standard contractual clauses of the European Commission.
How long?
- Appointments: as long as the clinic uses Boekenbloom, and no later than 24 months after the appointment date, unless the clinic chooses a shorter period.
- Chat conversations: 12 months after the last message. Hashed IP addresses for abuse prevention: at most 7 days.
- Reviews: the text 24 months after publication; the rating, date and display name as long as the clinic uses Boekenbloom.
- Log of ad measurement notifications sent: 90 days.
- Advertising cookie bb_attr: 90 days; your cookie choice: 1 year.
- If the clinic stops using Boekenbloom, we delete its data within 30 days.
Part B: our website and clinic accounts
| Purpose | Data | Legal basis | Retention period |
|---|---|---|---|
| Clinic account and providing the Service | Name, email and role of the account holder, clinic and company details (incl. KvK), settings | Performance of the contract | Duration of the account + 30 days |
| Recording acceptance of the terms and the data processing agreement | Name, role, date/time, IP address, browser, version | Legal obligation / legitimate interest (demonstrating compliance) | Duration + 5 years |
| Subscriptions and invoices | Company details, invoice details; payment via Mollie | Contract and statutory (tax) retention obligation | Invoices 7 years |
| Connecting the clinic's advertising accounts and managing campaigns | Account IDs, name and email address of the administrator who is invited, campaign data | Performance of the contract | Duration of the account + 30 days |
| Security and bot protection | IP address, browser details, login attempts; Cloudflare Turnstile at registration, login and the web chat | Legitimate interest (secure service) | Logs at most 12 months |
| Fraud prevention: a free trial can be used once per business | Only encrypted fingerprints (SHA-256 with a secret key) of the KvK number, the IBAN or card fingerprint of the verified payment method, the phone number, the address with postcode and the website domain; never the data itself | Legitimate interest (preventing abuse of free trials) | 3 years after the trial started |
| Contact form and pilot conversations | Name, email, phone, clinic, message | Legitimate interest / steps towards a contract | 12 months after last contact |
| Website cookies | See the cookie policy | Necessary; marketing only with consent | See the cookie policy |
Recipients: Supabase, Vercel, Resend, TransIP, Cloudflare (bot protection), Google (connecting clinics' advertising accounts) and Mollie (payments; Mollie is responsible for the payment itself). We have appropriate agreements with these parties.
No automated decision-making: we do not take decisions based solely on automated processing that have legal or similarly significant effects for you (article 22 GDPR).
Your rights
You have the right of access, rectification, erasure, restriction, portability and objection, and you can always withdraw consent you have given, without affecting earlier processing. For Part A you can contact the clinic or us; for Part B, us. We respond within one month.
You can also lodge a complaint with the Dutch Data Protection Authority (autoriteitpersoonsgegevens.nl).
Changes
We may change this statement. The date at the top shows when it was last changed.
Contact
info@boekenbloom.nl