DentalX Back to home

Belgium Annex

ANX-BE · Draft of October 6, 2026 · revision 1 · version 1.0

Final draft for counsel's review. It is not in effect, and no clinic has accepted it. Items still to be confirmed are highlighted in the text.

This is the controlling text.

SHA-256 of this text: 5ca6bf21d3af620b8ae722c9744cf13d9a211590864cf639abd52c7bf7e25669

Belgium — ANX-BE: Belgium Annex

Document ID: ANX-BE · Version: 1.0 · Effective date: [[TO CONFIRM: publication date]] Language: English, with French and Dutch courtesy copies [[TO CONFIRM: FR and NL translations]]. English controls. Applies to: Clinics established in Belgium, together with the MDPA and the EEA Transfer Module (TM-EEA). Terms defined in the MDPA have the same meaning here.

1. Access list for health data (Law of 30 July 2018, Art. 9)

1.1 The Clinic's list. The Clinic, as controller of health data, keeps a list of the categories of persons who have access to the data. The list describes their capacity in relation to the processing. The Clinic keeps it available to the Data Protection Authority, and ensures that the persons on it are bound by a legal, statutory or contractual obligation of confidentiality.

1.2 What DentalX provides. DentalX provides a role-based access list export: each User, their role and the categories of data that role can reach. The Clinic uses it to keep its list.

1.3 VstreamX's own list. VstreamX keeps the equivalent list for its own personnel with access to the Clinic Data, and gives it to the Clinic on request. Those persons are bound by MDPA clause 5.

2. Retention of the patient file

2.1 The Clinic's duty. Under the Law of 22 April 2019 on the quality of healthcare practice, the patient file must be kept for at least 30 years and at most 50 years from the last contact with the patient.

2.2 What DentalX provides. DentalX provides for Belgian Clinics:

  • a deletion lock that prevents deletion of a patient file within 30 years of the last contact, unless the Clinic confirms that the law allows it in that case; and
  • a deletion prompt at 50 years from the last contact.

[[TO CONFIRM: release date of the 30-year lock and 50-year prompt]]

2.3 At the end of the service. At the end of the service, the export allows the Clinic to keep the files for the remaining period (MDPA clause 14).

3. Security breaches

VstreamX's notice within 24 hours (MDPA clause 9) allows the Clinic to notify the Data Protection Authority within 72 hours.

4. eHealth

DentalX does not connect to the eHealth platform, Recip-e or the Belgian health-data hubs. Where the law requires the Clinic to use them, it does so through other channels.

Items to confirm before publication (Belgium)

  1. Publication date.
  2. The French and Dutch courtesy translations.
  3. Release date of the 30-year deletion lock and 50-year prompt (§2.2).