Personal Data Processing Statement

Protecting your personal data is one of our highest priorities, which is why we process it responsibly, securely and in accordance with applicable legislation, using appropriate technical and organisational measures to ensure its protection.

We regularly review and update the security measures in place to ensure the highest possible level of protection for the data we process. We place the same emphasis on the responsible conduct of our employees and contractual partners who come into contact with personal data.

We process your personal data solely on lawful legal bases. In cases where your consent is required for processing, you provide it voluntarily and may withdraw it at any time, without this affecting the lawfulness of processing carried out before its withdrawal or the quality of the services provided.

Once the purpose of processing has been fulfilled or the legal basis for processing has ceased to exist, your personal data will be securely erased or destroyed in the manner prescribed by the relevant legislation.

As a data subject you have several rights, about which we inform you in detail in this document. If you have any questions regarding the protection of personal data or the exercise of your rights, you can contact us at any time using the following contact details: [email protected]

This Statement has been drawn up in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) and Act No. 18/2018 Coll. on the Protection of Personal Data, as amended.

Purpose of processing personal data

The controller processes the personal data of data subjects for purposes such as the provision of healthcare, reminding the patient/client of an appointment, and the recording, handling and documentation of complaints, suggestions and claims.

• Provision of healthcare – processing of personal data is necessary to fulfil the controller's legal obligations under the relevant legislation, in particular:
  • Act No. 576/2004 Coll. on Healthcare and Services Related to the Provision of Healthcare, and on amendments to certain acts,
  • Act No. 580/2004 Coll. on Health Insurance, and on the amendment of Act No. 95/2002 Coll. on the Insurance Industry,
  • Act No. 581/2004 Coll. on Health Insurance Companies, Supervision of Healthcare, and on amendments to certain acts,
  • Act No. 578/2004 Coll. on Healthcare Providers, Healthcare Workers, Professional Organisations in Healthcare, and on amendments to certain acts,
  • Act No. 461/2003 Coll. on Social Insurance,
  • Act No. 18/2018 Coll. on the Protection of Personal Data,
  • Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR).
• Reminding the patient/client of an appointment – personal data is processed for the purpose of informing the patient/client about a scheduled examination or treatment appointment by telephone, SMS message or email.
• Recording, handling and documenting complaints and claims – personal data is processed for the purpose of receiving, recording and handling complaints, suggestions and claims from patients/clients.

Recipients of personal data

• Health insurance companies
• Other healthcare providers on the basis of a contractual relationship

Retention period for personal data

The controller is obliged to retain medical records for 20 years from the last provision of healthcare. Documentation from the register of claims and complaints is kept by the provider for 5 years after the claim or complaint has been settled.

Rights of data subjects under Act No. 18/2018 Coll. on the Protection of Personal Data

• The data subject has the right to obtain from the controller confirmation as to whether personal data concerning them is being processed. If so, they have the right of access to this personal data under Section 21(1) of Act No. 18/2018 on the Protection of Personal Data and on amendments to certain acts (hereinafter "Act 18/2018") or Article 15 of Regulation (EU) 2016/679 of the European Parliament and of the Council (hereinafter "Regulation 2016/679").
• The data subject has the right to have the controller correct, without undue delay, inaccurate personal data concerning them. Taking into account the purposes of processing, the data subject has the right to have incomplete personal data completed.
• The data subject has the right to have the controller erase, without undue delay, personal data concerning them where the purpose of its processing has ended or one of the conditions under Section 23(2) of Act 18/2018 is met.
• The data subject has the right to have the controller restrict the processing of personal data in the cases set out in Section 24(1) of Act 18/2018.
• The data subject has the right to object to the processing of their personal data on grounds relating to their particular situation where it is carried out under Section 13(1) (e) or (f) (public interest, official authority, legitimate interest) of Act 18/2018, including profiling based on those provisions.
• The data subject has the right to receive the personal data concerning them which they have provided to the controller, in a structured, commonly used and machine-readable format, and the right to transmit this data to another controller without the controller to which the personal data was provided obstructing it, where: a) the processing is based on consent or on a contract, and b) the processing is carried out by automated means.
• The data subject has the right to object to the processing of personal data concerning them for direct marketing purposes, including profiling to the extent that it is related to such direct marketing.
• The data subject has the right to lodge a complaint with the supervisory authority.