Privacy Policy

Article I

What personal data is and which personal data are processed

1. The Controller processes only personal data provided to it in connection with the use of its services. These include in particular, but not exclusively, the following data:

   • First and last name of the child (patient) and of their legal guardian
   • Patient’s birth number (rodné číslo)
   • Patient’s sex
   • Telephone number of the patient/legal guardian
   • Email address of the patient/legal guardian
   • Address of the patient/legal guardian
   • Bank details of the patient/legal guardian
   • Patient’s state of health
   • Health insurance or payer details to the extent necessary for reporting and payment for health services.

2. The Controller obtains data mainly directly from the patient, their legal guardian or another authorised person when booking, during examination, treatment, payment and communication. To the extent necessary, data may also be obtained from another health service provider, a health insurance company or an authorised authority where permitted or required by law.

3. Providing data may be mandatory where required by law or where necessary for the provision of a health service, keeping medical records, booking or meeting accounting and tax obligations. Failure to provide mandatory data may mean that the Controller’s practice cannot provide the service, make the booking, issue a document or meet a legal obligation. Providing data for non-mandatory purposes, in particular marketing, is voluntary and refusing to do so has no effect on health care.

Article II

Purpose of processing personal data

The main reason for processing the personal data of patients and their legal guardians is the proper provision of the Controller’s services and ensuring the safety and improving the quality of the Controller’s services.

Personal data are processed in particular for the following purposes:

• Registering the patient with the doctor;
• Providing health care or a health service and other services ordered by the patient/legal guardian, as well as exercising rights and fulfilling obligations arising from the contractual relationship between the patient/legal guardian and the Controller;
• Fulfilling the Controller’s legal obligations under Article 6(1)(c) GDPR;
• The Controller’s legitimate interest (including the future exercise of claims) under Article 6(1)(f) GDPR;
• fulfilling its obligations in accounting and taxation;
• improving the quality of services;
• sending commercial communications;
• answering questions from patients/legal guardians.

Personal data may be used for several purposes at the same time and processed on the basis of several legal grounds. If the purposes of processing cease or all legal grounds for processing lapse, the Controller will stop processing the personal data.

Given the nature of the services the Controller provides to patients, personal data within the meaning of Article 9(1) GDPR may also be processed. Such data are processed for the purposes of providing health care under Article 9(2)(h) GDPR and for the purposes of fulfilling the obligations and exercising the rights of the Controller under Article 9(2)(b) GDPR, for which the data subject additionally gives explicit consent under Article 9(2)(a) GDPR. The Controller may also process this personal data for the purposes of exercising rights and fulfilling obligations arising from the contractual relationship between the data subject and the Controller, including the future exercise of claims. This processing is possible on the basis of the Controller’s legitimate interest under Article 6(1)(f) GDPR.

Article III

Retention period

Personal data of patients processed for the purpose of registering the patient with the Controller and exercising rights and fulfilling obligations related to the concluded contract are processed for the period necessary to exercise those rights and fulfil those obligations and to assert any claims arising from the contractual relationship.

Personal data of patients processed in connection with and for the purpose of providing health care and health services, or other services ordered by the patient (or legal guardian), are processed for the period necessary to exercise the rights and fulfil the obligations arising from the contractual relationship and to assert any claims arising from it, but no longer than the period laid down by law, in particular Act No. 372/2011 Coll., on Health Services, and Ministry of Health Decree No. 98/2012 Coll., on Medical Records.

Personal data of patients processed for the purpose of fulfilling the Controller’s legal obligations are processed for the period required by the relevant legislation.

After the processing period expires or the purpose of processing ceases, the Controller deletes the personal data from the database it uses.

Article IV

Security of personal data

All personal data are protected by standard procedures and technologies. The Controller regularly checks that the system contains no weaknesses and has not been attacked, and uses security measures that, as far as possible, prevent unauthorised access to personal data and that provide sufficient protection given the current state of technology. The security measures adopted are updated regularly.

Article V

Recipients of personal data

1. To ensure the proper provision of services and products and to fulfil its contractual obligations, the Controller uses the professional and specialised services of other entities. Where these entities process personal data provided to them by the Controller, they act as processors, process the data only on the Controller’s instructions and may not use them otherwise.

2. In justified cases, the Controller may also transfer your personal data to other entities, for example:

   • persons involved in providing the service to patients;
   • other health service providers, where the transfer is necessary for the continuity or safety of care and is legally permissible;
   • persons authorised to represent the patient or another person, within the scope of their authority;
   • banks, payment service providers, postal and delivery services, where necessary for payments or communication;
   • persons providing services for the operation of the Controller’s website;
   • public institutions, in particular health insurance companies;
   • state authorities and other institutions in the performance of legal obligations, in particular state administration bodies, supervisory authorities, law enforcement authorities, courts, bailiffs, notaries, insolvency administrators and other entities;
   • where required by law;
   • the Controller’s business partners: if a business partner is entrusted with an activity that forms part of the Controller’s services, it may be necessary to transfer personal data;
   • processors providing services to the Controller in connection with fulfilling legal and contractual rights and obligations;
   • other entities where necessary to protect the Controller’s rights and interests, to the extent necessary to successfully assert a claim or defend rights.

3. With your consent or on your instruction, your personal data may also be provided to other entities.

Article VI

Cookies

1. Cookies are small text files stored on a website visitor’s device that allow the website to function properly and remember certain settings. The Controller may use only technically necessary cookies to ensure the secure and proper operation of the website. These cookies do not require the visitor’s prior consent.

2. The Controller does not use analytical, preference or marketing cookies on its website.

3. In the Contact section, a map from the Google Maps service, operated by Google Ireland Limited, can be displayed. The map loads only after the visitor clicks the “Show map” button. By clicking it, the visitor agrees that Google may store cookies on their device and process their IP address and device information (Section 89(3) of Act No. 127/2005 Coll., on Electronic Communications). Until the visitor clicks the button, the map does not load and no data are passed to Google.

4. Consent can be withdrawn at any time by deleting cookies in the web browser settings. On the next visit, the map loads again only after a new click. Google’s processing of data is governed by its privacy policy: https://policies.google.com/privacy.

Article VII

Rights of the data subject

Patients/legal guardians have the following rights regarding the protection of their personal data:

1. Right of access to their personal data;

2. Right to rectification of personal data;

3. Right to erasure of personal data (where there is no other legal ground for processing);

4. Right to restriction of processing of personal data;

5. Right to data portability: the data subject is entitled to receive the personal data concerning them that they have provided to the Controller and to transmit those data to another controller;

6. Right to object to the processing of personal data: if you no longer wish to receive commercial communications or other news from the Controller from time to time, you may object to further processing of your personal data for direct marketing. If you do so, your data will no longer be processed for this purpose;

7. Right to withdraw consent: withdrawal of consent does not affect the lawfulness of processing based on that consent before its withdrawal. Consent may be withdrawn in writing at any time. Withdrawal of consent does not, however, mean that the Controller must delete personal data it processes for the performance of a contract concluded with the data subject;

8. Right to be informed of a personal data breach in certain cases;

9. Right to lodge a complaint with the supervisory authority, i.e. the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Company ID: 708 37 627, registered office Pplk. Sochora 727/27, Holešovice, 170 00 Prague 7, email: posta@uoou.gov.cz, data box ID: qkbaa2n;

10. other rights laid down in the Act on the Processing of Personal Data and in the General Data Protection Regulation No. 2016/679.

Requests to exercise the above rights are submitted to the Controller using its contact details given in Article VIII, preferably by email or via data box. The Controller may, to a reasonable extent, request additional information or verification of identity where necessary to protect personal data and to prevent their disclosure to an unauthorised person.

The Controller will handle the request without undue delay, usually within one month of receiving it. For complex or numerous requests, this period may be extended by a further two months; the applicant will be informed of the extension and the reasons for it no later than one month after receipt of the request. If the Controller does not comply with the request, it will state the reasons and inform the applicant of the possibility of lodging a complaint with the Office for Personal Data Protection and seeking judicial remedy.

Article VIII

Controller’s contact details

If you have any questions about the protection of personal data or wish to withdraw consent to further processing of your personal data, you can contact the Controller:

• by telephone: +420 608 407 199
• by email: pedopsyche@protonmail.com
• in writing: Pedopsyche s.r.o., Na Pankráci 1683/127, 140 00 Prague 4
• via data box ID: nn7hapz
• via the website: www.pedopsyche.cz