Information clause on the processing of personal data of the GDPR
In connection with the requirements of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46 / EC, hereinafter referred to as ” Regulation “, we would like to inform you that the administrator of your personal data is Klinika Okulistyczna VITA-MED Sp. z o. o. with its seat in Głogów (ul. Legnicka 5, 67-200 Głogów).
CONTACT DETAILS OF THE DATA ADMINISTRATOR
Contact with the Administrator is possible at the telephone number: 76 831 37 48, at the e-mail address: clinika@vita-med.glogow.pl and by correspondence at: Klinika Okulistyczna VITA-MED, ul. Legnicka 5, 67-200 Głogów.
CONTACT DETAILS OF THE DATA PROTECTION OFFICER
The administrator has appointed a Personal Data Protection Inspector, who can be contacted by calling: 76 831 37 48, at the following e-mail address: iod@vita-med.glogow.pl and by correspondence at: IOD Klinika Okulistyczna VITA-MED, ul. Legnicka 5, 67-200 Głogów.
PURPOSE AND LEGAL BASIS FOR THE PROCESSING OF PERSONAL DATA
Your personal data may be processed by the administrator for the purpose of:
- health prophylaxis, medical diagnosis, treatment and provision of health care;
- keeping medical records;
- ensuring the continuity of healthcare services;
- performance of the contract for the provision of services;
- resulting from legitimate interests pursued by the administrator, e.g. for contact regarding confirmation, change or cancellation of a visit / treatment date;
- promotional and marketing activities, if you give your separate consent.
LEGAL BASIS FOR THE PROCESSING OF PERSONAL DATA
The legal basis for processing is Art. 9 sec. 2 lit. h) of the Regulation in conjunction with Art. 3 sec. 1 of the act on medical activity and art. 24 of the Act on Patients’ Rights and the Patient’s Rights Ombudsman – ie “processing is necessary for the purposes of preventive health care or occupational medicine, (…) medical diagnosis, provision of health care (…) under the law of a Member State (EU)” in connection with Art. 6 sec. 1 lit. c) of the Regulation “processing is necessary to fulfill the legal obligation incumbent on the controller”. In certain cases, the processing may be carried out on the basis of art. 6 sec. 1 lit. a) of the Regulation “the data subject has consented to the processing of his personal data for one or more specific purposes”, Art. 6 sec. 1 lit. b) of the Regulation “processing is necessary for the performance of a contract to which the data subject is party, or to take action at the request of the data subject prior to entering into a contract” and art. 6 sec. 1 lit. f) of the Regulation “processing is necessary for purposes arising from legitimate interests pursued by the administrator or a third party”, eg direct marketing or pursuing claims; and art. 6 sec. 1 lit. d) of the Regulation and in connection with Art. 9 (2) (a) c) of the Regulation “processing is necessary to protect the vital interests of the data subject or another natural person, and the data subject is physically or legally incapable of giving consent”. before concluding the contract “and art. 6 sec. 1 lit. f) of the Regulation “processing is necessary for purposes arising from legitimate interests pursued by the administrator or a third party”, eg direct marketing or pursuing claims; and art. 6 sec. 1 lit. d) of the Regulation and in connection with Art. 9 (2) (a) c) of the Regulation “processing is necessary to protect the vital interests of the data subject or another natural person, and the data subject is physically or legally incapable of giving consent”. before concluding the contract “and art. 6 sec. 1 lit. f) of the Regulation “processing is necessary for purposes arising from legitimate interests pursued by the administrator or a third party”, eg direct marketing or pursuing claims; and art. 6 sec. 1 lit. d) of the Regulation and in connection with Art. 9 (2) (a) c) of the Regulation “processing is necessary to protect the vital interests of the data subject or another natural person, and the data subject is physically or legally incapable of giving consent”. d) of the Regulation and in connection with Art. 9 (2) (a) c) of the Regulation “processing is necessary to protect the vital interests of the data subject or another natural person, and the data subject is physically or legally incapable of giving consent”. d) of the Regulation and in connection with Art. 9 (2) (a) c) of the Regulation “processing is necessary to protect the vital interests of the data subject or another natural person, and the data subject is physically or legally incapable of giving consent”.
DATA RECIPIENTS
Your personal data may be transferred to the following categories of recipients: public authorities operating on the basis of applicable law, entities performing medical activities in connection with providing them with medical documentation, entities performing activities in the field of medical diagnostics, persons authorized in writing by you to receive information about you health condition and access to your medical records. In certain cases, data recipients are also persons authorized by the Administrator to process personal data, insurance companies, the Administrator’s contractors, entities providing the administrator with technical support, advisory services, IT services, legal assistance, tax, accounting and HR services.
TRANSFER OF PERSONAL DATA OUTSIDE THE EEA
Personal data will not be transferred outside the EEA or made available to international organizations. Your personal data will be processed only for the period necessary and specified by law.
DATA STORAGE PERIOD
Your personal data contained in medical records will be stored for 20 years from the end of the calendar year in which the last entry was made, with the exceptions specified in art. 29 sec. 1 of the Act of November 6, 2008 on patient’s rights and the Patient’s Rights Ombudsman (consolidated text, Journal of Laws 2017, item 1318, i.e.
- ‘Medical records in the event of the death of a patient as a result of bodily injury or poisoning, which are kept for 30 years from the end of the calendar year in which the death occurred;
- medical records containing the data necessary to monitor the fate of blood and its components, which are kept for 30 years from the end of the calendar year in which the last entry was made;
- X-ray photos stored outside the patient’s medical records, which are kept for a period of 10 years from the end of the calendar year in which the photo was taken;
- referrals for examinations or doctor’s orders, which are stored for the period of:
- a) 5 years, counting from the end of the calendar year in which the medical services that are the subject of the referral or the doctor’s order were provided,
- b) 2 years from the end of the calendar year in which the referral was issued – if the health service was not provided due to the patient’s failure to report within the prescribed period, unless the patient received the referral;
- medical records for children up to the age of 2, which are kept for 22 years. “
Pursuant to Art. 29 Par. 2 of the Act of November 6, 2008 on patient’s rights and the Patient’s Rights Ombudsman: “After the expiry of the periods specified in sec. 1 the entity providing health services destroys medical documentation in a way that prevents identification of the patient it concerned. Medical documentation intended for destruction may be issued to the patient, his legal representative or a person authorized by the patient ”.
THE RIGHTS OF THE PERSON WHO THE DATA CONCERNS
You have the right to request the Administrator in writing to access information about your personal data in the Administrator’s data files; the right to rectify data; deletion of data or restriction of processing; object to the processing of data or to the transfer of personal data to another administrator, as well as the right to transfer data. The Data Administrator is obliged to provide relevant information in writing within 30 days. The provisions on the protection of personal data show to what extent each of the above-mentioned rights can be exercised. It will depend, in particular, on the legal basis and the purpose of processing personal data by the Administrator and this.
BASIS FOR PROVIDING PERSONAL DATA
Providing personal data in the scope resulting from the legal obligations imposed on the Administrator, e.g. the obligation to keep medical records, is mandatory. Failure to provide the data will result in the inability to provide medical services. In addition, failure to provide certain data may make it difficult for the Administrator to contact for information purposes related to the provision of medical services.
PROCESSING OF DATA BASED ON CONSENT
In the case of data processed solely on the basis of your consent, providing this data and expressing your consent in writing is voluntary. Please be advised that such consent may be withdrawn at any time without affecting the lawfulness of the processing which was carried out on the basis of consent before its withdrawal.
RIGHT TO LODGE A COMPLAINT WITH THE SUPERVISORY AUTHORITY
You have the right to lodge a complaint with the supervisory body, i.e. the President of the Personal Data Protection Office, when, in your opinion, the processing of personal data by the Data Administrator violates the law.
INFORMATION ON AUTOMATED DECISION-MAKING
Personal data will not be used for automated decision making that produces legal effects on you, including profiling.
See also: Privacy Policy