II. What personal data we process about you
We process only the personal data we strictly need for the purposes for which we process them, in particular:
- contact and identification data — first name, surname, date of birth, insurance number, personal identification number, address, e-mail address, telephone number
- payment details and bank account information
- health insurance company number
- medical history relating to the state of health and care of the patient
- diagnosis
We also process contact and identification data of third parties — legal representatives, guardians and, where applicable, other persons with whom we are authorised to deal regarding your state of health or to whom we may pass on information about it.
III. Purposes of processing personal data
We process your personal data for the purpose of:
- providing health services
- reporting health services covered by insurance
- invoicing health services not covered by insurance
- communicating information about your state of health to you and other authorised persons
- organising the provision of health services (patient appointments)
- keeping records of our income and expenditure, payments received and financial management, as required by tax and accounting legislation
- sending marketing communications
IV. Legal basis for processing personal data
The legal basis for processing the personal data listed in point II is:
- compliance with our legal obligations (in particular Act No. 372/2011 Coll., on health services and the conditions of their provision, Act No. 48/1997 Coll., on public health insurance, Act No. 563/1991 Coll., on accounting, Act No. 586/1992 Coll., on income tax, and Act No. 634/1992 Coll., on consumer protection)
- performance of obligations under the health care contract on the basis of which we provide you with health services (this contract need not be concluded in writing)
V. Recipients of personal data
- our employees (as a health service provider) qualified to practise a medical profession, and other professional staff, in direct connection with the provision of health services
- you (as patients), the patient’s legal representatives or guardian, persons designated by the patient, their legal representative or guardian, a foster carer or another caring person
- other health service providers or social service providers, to ensure continuity of further health and social services provided to the patient
- persons entitled to inspect medical records under Sections 31, 32, 33 and 65 of Act No. 372/2011 Coll., in particular the authorised competent administrative authority, the public health protection authority, the State Institute for Drug Control, the Institute of Health Information and Statistics, contracted health insurance companies, the Czech Medical Chamber, the Czech Dental Chamber, the Czech Chamber of Pharmacists, authorised physicians of the assessment service of district social security administrations, employees of district social security administrations, the Public Defender of Rights and authorised employees of the Office of the Public Defender of Rights, for the purpose of obtaining the information needed to fulfil tasks under Act No. 372/2011 Coll. or other legislation governing the activities and tasks of those bodies
- state authorities (in particular bodies involved in criminal proceedings, the Police of the Czech Republic, public prosecutors, courts) and other entities on the basis of other legislation governing their activities and tasks
- entities providing services to the controller with which the controller has concluded the relevant data processing agreement
Your personal data are stored in the Czech Republic or in a Member State of the European Union, and we do not intend to transfer them outside the European Union, to third countries or to international organisations.
VI. Period of processing personal data
Personal data contained in medical records are processed for the period laid down by Decree No. 98/2012 Coll., on medical records. Personal data processed for the other purposes listed in point III are processed for the period laid down by law, or for as long as you remain our patient and for one year after you cease to be our patient.
VII. Rights of the data subject
In relation to the processing of personal data you have the following rights concerning the protection of your personal data:
- the right to request access to your personal data from us;
- the right to rectification of the personal data we process;
- the right to restriction of processing. Restriction means that we must mark the personal data concerned and, for the duration of the restriction, must not process them further except for storage. You have this right where you contest the accuracy of the personal data, for the period needed to verify their accuracy; the processing is unlawful and you object to erasure and request restriction of use instead; we no longer need your personal data for the purposes of processing but you require them for the establishment, exercise or defence of legal claims; or you have objected to the processing as described in point VIII below, pending verification of whether our legitimate grounds for processing override your interests, rights and freedoms;
- the right to erasure of personal data. This right applies only to personal data we process for purposes other than the provision of health services. Data we keep about you for the purpose of providing health services (e.g. in medical records) may not be erased;
- the right to data portability. You may request that we provide your personal data to you for transfer to another controller, or that we transfer them to another controller ourselves. This right applies only to data we process by automated means on the basis of your consent or a contract with you. Data we keep about you for the purpose of providing health services (e.g. in medical records) may be provided only to you and, under statutory conditions, to another health service provider or public authority;
- the right to lodge a complaint with a supervisory authority if you believe that the processing of personal data infringes data protection legislation. You may lodge a complaint with the supervisory authority in the place of your habitual residence, place of work or the place of the alleged infringement. In the Czech Republic the supervisory authority is the Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Prague 7, www.uoou.cz.
VIII. Right to object to processing
Where we process your personal data for the purposes of our legitimate interests or those of another party (the legal bases for processing are set out in point III), you have the right to object to such processing at any time. You may raise an objection at our address given in point I. If you do so, we may continue the processing only if we demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or where the processing is necessary for the establishment, exercise or defence of legal claims.
IX. Mandatory processing and the obligation to provide personal data
Processing your personal data for the purposes of providing health services is a legal requirement. Failure to provide your personal data may mean that we cannot provide you with health services, which may result in harm to your health or a direct threat to your life (Section 41(1)(d) of Act No. 372/2011 Coll., on health services and the conditions of their provision). The obligation to provide the patient’s personal data also applies to their legal representative or guardian (Section 41(2) of Act No. 372/2011 Coll.).
