Privacy policy.

MEDCOR BV, Hooiwegel 14, 9070 Heusden-Destelbergen, Belgium, enterprise number 0712.550.815, is the controller of the personal data described in this policy.

For any question or request about your data, contact Hendrik Staels, managing director, at staelshendrik@medcor.be or +32 478 60 23 54. MEDCOR is a small company and has not appointed a data protection officer; every privacy question is handled personally.

This policy applies to visitors of medcor.be, to people who contact MEDCOR, and to contact persons at clients, prospective clients, suppliers, specialists in the MEDCOR network, authorities and other business partners.

When MEDCOR handles personal data on behalf of a client as part of an assignment, for example in a quality system, a complaint file or a vigilance case, the client is the controller and MEDCOR acts as processor. The client’s instructions then apply, together with a data processing agreement where needed, as set out in article 10 of the General Terms and Conditions.

• —Contact form and intro call requests. Your name, work email, company and the message or preferred times you send. Used to reply and to arrange the call. Legal basis: steps taken at your request before a contract, and MEDCOR’s legitimate interest in answering enquiries.
• —Clients and their contact persons. Names, job titles, business contact details, correspondence, quotes, agreements and invoices. Used to carry out the assignment, invoice it and keep the accounts. Legal basis: performance of the contract and legal obligations under accounting and tax law.
• —Statutory roles. Where MEDCOR acts as Responsible Person, Qualified Person, Responsible Person for Information and Publicity or PRRC, the details needed to notify and register that role with the competent authorities, such as the FAMHP. Legal basis: legal obligation.
• —Adverse event reports and product complaints. A report about a client’s product can contain health data about a patient or the contact details of the person reporting it. It is forwarded to the marketing authorisation holder or manufacturer within 24 hours and used for nothing else. Legal basis: legal obligations under medicines and medical device law and, for health data, reasons of public interest in public health (article 9(2)(i) GDPR).
• —Business relations. Business contact details of prospective clients, suppliers and specialists in the MEDCOR network. Legal basis: MEDCOR’s legitimate interest in running and developing its business. You can object at any time.
• —Website use. Technical data needed to deliver the site and, only if you agree, analytics data. See “Website and cookies” below.

MEDCOR does not sell personal data, does not send newsletters and does not use personal data for automated decisions or profiling.

The website is hosted by Netlify. To deliver and secure the site, Netlify processes technical data such as your IP address, browser type and the pages requested. Messages sent through the forms on this site are stored by Netlify and forwarded to MEDCOR by email.

With your consent, MEDCOR uses Google Analytics (Google Ireland Limited) and Microsoft Clarity (Microsoft Ireland Operations Limited) to see which pages are useful and where the site can be clearer. Clarity records how pages are used, such as clicks and scrolling, and masks what you type into form fields. These tools only load after you choose “Accept” in the cookie bar. If you decline or make no choice, no analytics cookies are set. You can change your choice at any time with “Cookie settings” in the footer or the button below.

Change cookie settings

• —Hendrik Staels and, for a specific assignment, specialists from the MEDCOR network. They work under a written agreement that covers confidentiality and data protection.
• —Service providers that work for MEDCOR as processors: Microsoft (Microsoft 365 email and file storage), Netlify (website hosting and forms) and MEDCOR’s accountant. With your consent, Google and Microsoft for website analytics.
• —Competent authorities, notified bodies, and marketing authorisation holders or manufacturers, when the law or an assignment requires it.
• —Lawyers, courts or collection agencies, only where needed to establish, exercise or defend a legal claim.

Client documents and email in the MEDCOR Microsoft 365 environment are stored in Microsoft data centres in the European Union. Netlify, Google and Microsoft are linked to the United States, so some data, such as website or analytics data, may be processed there. Such transfers rely on the EU–US Data Privacy Framework, under which these companies are certified, or on the standard contractual clauses approved by the European Commission.

• —Enquiries that do not lead to an assignment: up to 2 years after the last contact.
• —Client files: as long as the assignment requires. At the end of an assignment, client data is returned or deleted within 30 days unless agreed or required otherwise.
• —Agreements, invoices and accounting records: for the statutory retention period, currently 10 years.
• —Records linked to statutory roles and vigilance: for as long as the applicable medicines or medical device legislation requires.
• —Analytics data: kept by Google and Microsoft for a limited period, at most 14 months.

Personal data is protected under MEDCOR’s Information Security Policy: personal accounts with multi-factor authentication, encrypted devices, storage in the European Union and sharing only with named persons on a need-to-know basis.

If an incident affects client data, the clients concerned are informed within 24 hours of discovery. Where a personal data breach is likely to put people’s rights at risk, it is reported to the Belgian Data Protection Authority within 72 hours, as the GDPR requires.

You can ask to access your personal data, to correct or delete it, to restrict its use or to receive it in a portable format. You can object at any time to processing based on legitimate interest, and withdraw your consent at any time without affecting processing that took place before.

Send your request to staelshendrik@medcor.be. You will receive an answer within one month. To protect your data, MEDCOR may ask you to confirm your identity.

If you are not satisfied with the answer, you can lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données), Rue de la Presse 35, 1000 Brussels, www.dataprotectionauthority.be.

This policy is updated when MEDCOR’s practices or the law change. The version date at the top of this page shows when it last changed. This version dates from November 2026.