Last updated August 2026
This page covers how Fyda Studio (KVK 97438162) handles data received from clinics as part of a Clinic Health Audit engagement, and general data collected through this website. It does not cover how your own clinic handles patient data internally, which remains entirely your responsibility as the data controller for your full patient records.
For every Clinic Health Audit, you provide a single CSV or spreadsheet export from your own booking or practice-management system. Before sending it, you replace any patient name, email address, phone number, or date of birth with an anonymous Patient ID that only you can match back to a real person.
The file I receive typically contains: an anonymous Patient ID, treatment type and area, treatment date, practitioner, revenue or price, and referral source, where available. I never request, and will never knowingly accept, a file containing real patient names or contact details.
Data that cannot reasonably be traced back to a specific person generally falls outside what GDPR and the Dutch AVG define as personal data. Structuring the entire audit process around anonymized exports isn't just a courtesy, it's the design choice that keeps this engagement straightforward from a data-protection standpoint for both of us.
Your anonymized export is analyzed using Anthropic's Claude API, operating under Anthropic's Commercial Terms of Service, which automatically include a Data Processing Addendum with Standard Contractual Clauses for any data transferred outside the EU. Your content is not used to train any AI model. Processing currently takes place on infrastructure outside the EU, which is why the anonymization step matters as much as it does.
Your export file, and any analysis derived from it, is retained only for as long as needed to deliver your report, and is permanently deleted within 30 days of the final report being sent to you. If you're on a quarterly retainer, each quarter's file follows the same 30-day deletion timeline independently.
For your patients' underlying records, your clinic remains the data controller at all times. I do not hold, request, or have any way to access your full patient database. For the anonymized operational data you choose to share for an audit, I act as a data processor, governed by the written engagement letter signed before any work begins.
Ready-to-send outreach messages reference a Patient ID only, never a real name. Your own staff match each ID back to the correct patient and send the message from your side. I never send a message directly to a patient, and never see the real identity behind an ID.
This site does not use tracking cookies or third-party advertising scripts. If you submit a form to book a call, the information you provide (name, email, and anything you write) is used only to respond to your enquiry, and is not added to any marketing list without your separate, explicit consent.
As the data controller for your own patients, your obligations to them are separate from this policy. As a clinic engaging Fyda Studio, you have the right to request a copy of what data has been processed on your behalf, request early deletion of your file, and end an engagement at any time per the terms in your engagement letter.
If anything here is unclear, or you'd like more detail on a specific point before sending an export, get in touch before starting an engagement, not after.
Have a question before sending an export?
Free 20-min call