Beware of phishing. CM never sends you e-mails with requests to alter your personal details. How can you spot a fake e-mail?

Privacy statement RMOB CM Brussels

The Regional Mutual Assistance Company CM Brussels (RMOB CM Brussels) respects your privacy in accordance with applicable legislation, regardless of whether you are a member or not, a healthcare provider, interested in working at RMOB CM Brussels or a visitor to the website www.cm .be.

CM - jouw gezondheidsfonds

What is a processing of personal data? Some clarifying concepts

  • Personal data
    Any information about an identified or identifiable natural person ("data subject") (for example not a company); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, psychological, economic, cultural or social identity of that natural person;
  • Processing
    An operation or set of operations performed on personal data or on sets of personal data, whether or not carried out by automated means, such as collecting, recording, organizing, structuring, storing, updating or modifying, retrieving, consulting, using, providing by means to transmit, disseminate or otherwise make available, align or combine, restrict, erase or destroy data;
  • Controller
    A natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data;
  • Processor
    A natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller;

What does RMOB CM Brussels process your data for in general?

Who is responsible for processing your data?

Your personal data is processed by the RMOB CM Brussels, Haachtsesteenweg 579, 1031 Schaarbeek, Belgium with company number 0713.670.669.

Objectives: for what purpose may RMOB CM Brussels process your personal data?

In general, processing your personal data is necessary to:

  • to identify you, contact you and advise you correctly;
  • for the management of your file;
  • for good social security.

As a regional health insurance fund, RMOB CM Brussels aims to promote the physical, psychological and social well-being of Brussels beneficiaries in a spirit of foresight, mutual assistance and solidarity. As such, it participates in the implementation of the Brussels social protection system and carries out all tasks entrusted to it.

RMOB CM Brussels uses your data in the context of Brussels social protection.

In the context of Brussels social protection, RMOB CM Brussels processes all necessary personal data to properly carry out the following main tasks and objectives.

  • For the insurability of members: management of your rights to reimbursement of health care, as a beneficiary or dependent;
  • For the intervention in healthcare costs in Belgium and abroad, as a member or healthcare provider: management of all preventive or healthcare services and supplies, whether or not reimbursable, provided by recognized healthcare providers and care institutions in Belgium or abroad and communicated to RMOB CM Brussels ;
  • For authorizations by the advising physician for certain healthcare or supplies and for functional rehabilitation;
  • For the management of disputes: challenges to the decisions of RMOB CM Brussels, recoveries of undue payments, recoveries of health costs and benefits caused by a liable third party;
  • For the information and guidance, proactively or otherwise, of people, if necessary through the Social Work Department, to allow them to fully exercise their rights and to promote their physical, psychological or social well-being;
  • To manage your contacts with our services through any channel used: face to face, letter, telephone, SMS, email, chat, website, etc.
  • For the proper management and improvement of our services, the social security system and public health and the fight against fraud, through audits, surveys, studies, scientific, statistical or historical studies and through security and protection measures for individuals , goods and data;
  • To comply with our legal obligations, in particular as a Brussels insurance institution towards the Inspection Service of the Health Insurance Funds, Iriscare and the Crossroads Bank for Social Security.

What are the legal provisions for the processing of your data in the context of Brussels social protection?

For the management of the mandatory insurance, RMOB CM Brussels processes the data on the basis of the following articles in the General Data Protection Regulation:

  • Article 6.1. c: comply with the legal obligations imposed on CM
  • Article 6.1 e: task of general interest
  • Article 6.1 f: legitimate interests (safety, protection)
  • Article 6.1 d and article 9.2 c: vital interests of the data subject
  • Article 9.2 b: social security and social protection law
  • Article 9.2. f: the processing is necessary for the establishment, exercise or defense of legal claims
  • Article 9.2 g: reasons of important general interest based on Belgian law
  • Article 9.2 h: assessment of work capacity, health or social care, health care management or social protection services
  • Article 9.2 i: for reasons of general interest in the field of public health
  • Article 9.2 j and article 89: archiving, scientific or historical research or statistics.
  • Article 87: national identification number/national register number.

To this end, we rely, among other things, on the following specific laws and their implementation decrees:

  • Act of 8 August 1983 regulating a National Register of Natural Persons and Royal Decree of 5 December 1986 on its use in health and disability insurance
  • Act of 15 January 1990 on the establishment of the Crossroads Bank for Social Security, Royal Decree of 4 February 1997 and others;
  • Act of 6 August 1990 on health insurance funds and national associations of health insurance funds regarding compulsory insurance and supplementary insurance;
  • Act of 11 April 1995 introducing the Charter of the Socially Insured;
  • Act of 22 August 2002 on patient rights;
  • Act of 13 December 2006 containing various provisions regarding health;
  • Act of 21 August 2008 on the eHealth platform;
  • Decree of 9 February 2018 regarding local social policy;
  • Act of 30 July 2018 on the protection of natural persons with regard to the processing of personal data;
  • Ordinance of 21 December 2018 regarding the Brussels insurance institutions in the field of healthcare and e-assistance to persons.

How long do we keep your data in the context of mandatory insurance?

RMOB CM Brussels will store and use your personal data to the extent necessary for compliance with legal obligations and within the context of our activities. RMOB CM Brussels is bound by legal retention periods for the storage of certain personal data. If the law does not prescribe a period, the personal data may be retained for a period that RMOB CM Brussels itself deems necessary for the efficient implementation of the mandatory regional insurance.

Exchange with other entities or third parties subject to your consent

To the extent that you have given your permission for this, RMOB CM Brussels exchanges data, for example, with CM and MC. This is to ensure that your file is processed more smoothly or for other purposes for which you have given your consent (participation in surveys, etc.).

For what purposes does RMOB CM Brussels process your personal data in the context of recording chat and telephone conversations?

In some cases, RMOB CM Brussels can listen to and record the information via its telephone or chat conversations. This is to improve our services or in the context of providing evidence in the event of a dispute. You will always be informed about this in advance by a recorded message.

Retention period:

  • Telephone: 3 months for training and coaching of employees and improvement of services. 18 months in the context of complaints
  • Chat: 3 months for training and coaching of employees and improvement of services. 24 months in the context of complaints


For what purposes does RMOB CM Brussels process your personal data in the context of camera surveillance?

RMOB CM Brussels can use cameras in and around the offices and buildings where it operates.

Retention period:

  • Image recordings from surveillance cameras in and around the buildings of RMOB CM Brussels (indicated by a sticker) are kept for a maximum of one month. This period can be extended if it appears that the images can be useful and have some evidentiary value for, for example, a crime.

For what purposes does RMOB CM Brussels process your personal data in the context of recruiting new employees?

There is a separate privacy policy for this: www.cm.be/jobs/privacy .

For what purposes does RMOB CM Brussels process your personal data using artificial intelligence?

RMOB CM Brussels uses artificial intelligence to optimize its services and processes. SMR MC BRUXELLES uses it, for example, for:

  • data analysis (e.g. chat);
  • script recognition (certificates, quotations).

Which personal data does RMOB CM Brussels process about you and how?

Categories of personal data

Depending on the data you provide and in function of the different objectives as a national association and health insurance fund, RMOB CM Brussels processes the following categories depending on the type of persons involved:

Ordinary personal data:

  • identification data: name, first name, address, telephone number, e-mail address, ...
  • electronic identification data: IP addresses, cookies, connection times, etc.
  • personal characteristics: age, gender, date of birth, place of birth, marital status, nationality
  • family composition
  • financial details: account number, payments, etc.
  • memberships
  • profession and employment
  • video recordings: camera surveillance, photos, videos
  • sound recording: call centers

Special personal data:

  • Data from the National Register and the national register number of RMOB CM Brussels members; surname, first name, official main residence, date and place of birth, death, gender, marital status, nationality, family composition;
  • Social data: data from the Crossroads Bank for Social Security or that are necessary for the implementation of social security (pension, affiliation, insurability, RIZIV number of healthcare providers, etc.);
  • Personal data relating to health is data that provides information about a person's health status. Medical reports and diagnoses, hospital data, degree of need for care, reimbursement of healthcare services, etc.
  • In the context of disputes, RMOB CM Brussels will also process criminal and administrative convictions and offenses: recoveries of health care and benefits caused by a liable third party, fraud.
  • In the context of scientific research, RMOB CM Brussels can indirectly derive sensitive data from the data it processes, such as race, ethnic origin, political opinions, religious or philosophical beliefs, sexual behavior or sexual orientation.

From whom or from what source does RMOB CM Brussels receive information about you?

This mainly concerns data that comes from:

  • from yourself, your legal representative, or someone who has received a mandate or your approval for this;
  • from the healthcare providers (hospitals, doctors, nurses, etc.) that you have consulted, including via the third-party payment system;
  • of the Crossroads Bank for Social Security of social security institutions and government services (Federal Public Service Finance, etc.);
  • of the actors of integrated comprehensive care (autonomous centers for general social assistance, OCMWs);
  • from SMR MC WALLONIE;
  • of MC, CM and LCM (The members affiliated with the MC or CM are de facto members of the SMR MC WALLONIE, the SMR CM Brussels and the National Association of Christian Mutualities (LCM).);
  • from CM-Zorgkas.

Which employee processes your personal data?

Your personal data is processed carefully and confidentially by the authorized employees to perform their tasks in the context of the described activities.

The employees are bound by professional secrecy and must comply with the duty of discretion. This is imposed legally (Crossroads Bank Act, National Register Act, Article 458 of the Criminal Code, Labor Act) and deontologically.

In addition, RMOB CM Brussels requires its employees to sign a confidentiality agreement.

Automated decision making

Certain data processing is carried out in a fully automated manner without the intervention of an employee, but on the basis of the criteria provided for in the context of the Brussels social protection insurance (e.g. pricing of benefits, payment of the allowance for assistance to the elderly, etc.)

To whom does RMOB CM Brussels pass on your personal data?

Your personal data may be passed on to:

  • You, your legal representative (administrator, mediator, etc.), your representative (professional counselor, lawyer, etc.) or someone who has received a mandate or your agreement for this, directly or through the intervention of the healthcare professional of your choice ;
  • An authorized third party (person, institution, government) solely on the basis of a law, contract, existing authorization from a Sectoral Committee (Social Security, and Health, National Register);
  • Your healthcare providers (hospitals, doctors, nurses, ...): at your request or in the context of our legal assignments (insurability, global medical file, third-party payment system, etc.) via secure channels (eHealth platform, MyCarenet, IrisCarenet, WalCarenet, Refac... );
  • CM and MC, to the extent that the exchange of data is necessary to comply with legal obligations;
  • If applicable, to the CM Care Fund for Flemish Social Protection;
  • If applicable, to the SMR MC WALLONIE, for Walloon Social Protection;
  • To social security institutions via the National Intermutualist College (NIC) and the Crossroads Bank for Social Security:
    • National Social Security Office (RSZ),
    • National Social Insurance Agency for the Self-Employed (RSVZ),
    • National Employment Office (RVA),
    • National Institute for Health and Disability Insurance (RIZIV),
    • National Office for Annual Holidays (RJV),
    • National Pension Service,
    • FEDRIS (Federal Agency for Occupational Risks).
      The National Intermutualistic College works as a filter so that third parties do not know which health insurance fund you are affiliated with. For more information about the operation of the Crossroads Bank for Social Security : what does the CBSS do and how does it do it ?
  • Federal public services, in particular the FPS Finance;
  • Regional agencies designated for specific tasks, for example VAZG, AVIQ, Iriscare, DSL, ... ;
  • Our auditors who are bound by a duty of confidentiality;
  • Opposing parties, their lawyers, bailiffs, experts and to the Ministry of Justice in the event of disputes;
  • All institutions to grant you a benefit based on a privileged status (increased compensation, etc.);
  • Your creditors and their bailiffs in the context of an enforcement procedure (seizure, transfer, etc.);
  • An heir or a notary in the event of death if the personal data are necessary for the settlement and distribution of the estate and insofar as the conditions for this transfer are met;
  • Our processors;
    RMOB CM Brussels mainly uses the following processors:
    • CM, MC and LCM (National Association of Christian Mutualities) in the context of the support provided by their employees;
    • ICT processors;
    • Mailing companies;
    • Our lawyers and bailiffs, experts;
    • Carefully selected suppliers who need to process your personal data in the context and performance of their assigned tasks.

RMOB CM Brussels can also process data from you in the following cases:

Visit CM or MC website:

  • When completing a form on the website, the data communicated will be processed depending on the context-specific purposes for which it was requested (for example, a request for information, registration for an activity, information about volunteer work, etc.).
  • You can log in to My CM (or some other CM applications) with your eID via CSAM or Itsme, in which case personal data (national register number) is also processed to identify you, authenticate you and to retrieve your data from our systems . Your eID may also be requested and read (with your permission) during a visit to one of our offices.
  • What RMOB CM Brussels processes that the user does not see (for example your IP address, browser type, operating system of your computer and the number of visits and pages visited). More information about this can be found in the Cookie Policy .

You want to work for RMOB CM Brussels.

You are a healthcare provider

  • In that case, RMOB CM Brussels only processes personal data relating to your activities as a healthcare provider and this in the context of the objectives described above. We are particularly authorized to publish your name and address that we receive from RIZIV and Iriscare to inform our members about your convention. If you wish to correct this data: www.cm.be/zorgproviders .

Transfer of data outside the European Economic Area

Your data may be transferred outside the European Economic Area (= European Union + Norway, Liechtenstein and Iceland) if:

  • is provided in the context of Brussels social protection;
  • is necessary for the implementation of measures that must be taken before concluding the contract and at your request;
  • and if you have expressly consented.

How is your data secured?

  • We take appropriate measures to ensure the security, integrity and availability of your data, taking into account the state of the art, the scope and context of the processing purposes and the type of personal data.
  • RMOB CM Brussels takes appropriate physical, administrative, organizational and technical security measures to protect your personal data against loss, unauthorized access, unauthorized use and unauthorized disclosure.
  • RMOB CM Brussels contractually imposes the same security measures on its processors.

What are your rights with regard to personal data?

The data subject has certain rights with regard to his personal data insofar as these do not conflict with the legal obligations to which RMOB CM Brussels is subject or the public interest tasks entrusted to RMOB CM Brussels.

  • Right of access
    As a data subject, you have the right to inspect the data relating to you that is processed by RMOB CM Brussels. If you request this, a copy of your personal data can be delivered. You can request a copy of your personal data as long as this does not infringe the rights and freedoms of others.
  • Right to rectification or amendment of your data
    You can request at any time to correct incorrect data or to complete your data. To adjust your data regarding your marital status, please contact the population department of your municipality in the first place. However, RMOB CM Brussels cannot change the data of the national register, which is the authentic source of social security. Please remember to inform us as soon as possible of any change in your situation.
  • Withdraw your consent
    If the processing of your personal data is based on your consent, you have the right to withdraw your consent at any time without providing a reason. Withdrawing your consent does not change the validity of the processing that took place before that withdrawal.
  • Automated individual decision-making (profiling)
    You have the right not to be subject solely to automated decision-making, including profiling. After all, some data processing is completely automated without the intervention of the employee. If you do not agree with the course of a fully automated process, you can contact RMOB CM Brussels. This way you can still request intervention from an employee of RMOB CM Brussels or let us know why you dispute this.
  • Right to object
    Do you disagree with the way in which RMOB CM Brussels processes certain data? Then you can resist it.
    • Without reason, in case of opposition to treatment for direct marketing and prospecting purposes;
    • If your data is processed in the context of a task of general interest, you must justify your specific situation. RMOB CM Brussels may still process this data if there are legitimate and compelling reasons for the processing and the treatment takes precedence over your interests or the exercise of your rights in a lawsuit;
    • If your data is processed for scientific or historical research purposes or for statistical purposes, you can object on grounds relating to your particular situation. Unless the processing is necessary to fulfill a task carried out in the public interest.
  • Right to erasure (right to be forgotten)
    You have the right to delete your personal data if it appears that RMOB CM Brussels is processing this data unlawfully:
    • If the data is no longer necessary for the purposes of the treatment;
    • If you have withdrawn your consent and there is no other legal basis for this treatment;
    • If your objection to the processing is well-founded;
    • If the treatment is illegal;
    • If erasure is required by law;
    • If the data relates to a child under the age of 16 and is collected through an application or website ("Information Society Service").
  • Right to restriction of processing
    You can limit the use of your personal data:
    • Until the time to check the accuracy of the data you dispute;
    • If you object to the illegal deletion of data processed by RMOB CM Brussels;
    • If you object to the deletion of data that RMOB CM Brussels no longer needs, but which are necessary to establish, exercise or defend a right in court;
    • Until the time to check whether the legitimate reasons for RMOB CM Brussels take precedence over yours in case you oppose the treatment of this data by citing your specific situation.

RMOB CM Brussels will then have to limit the processing of such personal data to their storage. Any other processing is permitted with your consent, or for the establishment, exercise or defense of a right in legal proceedings or to protect a third party, or for important reasons of public interest. If this is the case, RMOB CM Brussels will inform you before this restrictive treatment is lifted.

  • Right to data portability
    You have the right to have the personal data that you have provided to RMOB CM Brussels transferred to you or directly to a third party. This is possible insofar as it is not limited by privacy legislation or other legal rules. This right can only be exercised if your data has been processed exclusively on the basis of your consent or a contract and if this processing is done using automated processes. This therefore does not concern compulsory insurance or supplementary insurance. In the event of a change, RMOB CM Brussels will forward the legally required information to the new insurer.

How can you exercise your rights?

If you wish to exercise any of the above privacy rights, you can always contact us.

Always be as specific as possible if you want to exercise your rights. Only in this way can RMOB CM Brussels handle your question specifically and correctly. To ensure that the data subject wishes to exercise his own privacy rights, RMOB CM Brussels may request a copy of the identity card for identification purposes.

How can you contact us or file a complaint?

  • General
    You can always contact us with a question, comment or request to exercise your rights:
  • Data Protection Officer
    If you feel that the above channels cannot help you, you can also contact our Data Protection Officer. This can be either:
    • In writing: by sending a letter to the data protection officer to RMOB CM Brussels, Haachtsesteenweg 579, 1031 Schaarbeek, Belgium.
    • By email: to [email protected] .
  • Data Protection Authority
    You can contact us directly or you can contact the Data Protection Authority.
    Contact details: www.gegevensbeschermingsautoriteit.be/contact , Data Protection Authority Drukpersstraat 35, 1000 Brussels.