Protection of personal data

INFORMATION FOR PATIENTS ON THE PROCESSING OF PERSONAL DATA

pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, “GDPR”)

I. Data Controller

The controller of your personal data is:

BIODENT-TUR s.r.o. Registered office: Uruguayská 344/13, Vinohrady, 120 00 Praha 2, Czech Republic Company ID (IČO): 284 52 071 Registered with the Municipal Court in Prague, Section C, File No. 142530 E-mail: biodentclinic.cz@gmail.com Phone: +420 776 428 606 Website: www.dental-prag.eu

The Controller is a healthcare service provider within the meaning of Act No. 372/2011 Coll., on Health Services and the Conditions for their Provision, as amended.

The Controller has not appointed a Data Protection Officer (DPO), as the nature and scope of its data processing do not require one under GDPR.

II. Purposes of Processing

We process your personal data for the purposes of:

providing healthcare services and health care;
reporting health services covered by public health insurance to health insurance companies;
billing for services not covered by public health insurance and processing payments;
communicating information about your health condition to you and to other authorised persons;
organising the provision of healthcare services (booking patients by phone, e-mail or web forms);
maintaining records of our income and expenses, payments received, and accounting, as required by tax and accounting regulations.

III. Legal Basis for Processing

The legal basis for processing your personal data referred to in Section II is:

Compliance with our legal obligations (in particular Act No. 372/2011 Coll., on Health Services and the Conditions for their Provision; Act No. 48/1997 Coll., on Public Health Insurance; Act No. 563/1991 Coll., on Accounting; Act No. 586/1992 Coll., on Income Tax; and Act No. 634/1992 Coll., on Consumer Protection).
Performance of the healthcare agreement under which we provide you with healthcare services (this agreement does not need to be concluded in writing).
The Controller’s legitimate interest in the proper organisation of the practice’s operations and in handling enquiries and bookings made through the website.

IV. Recipients of Personal Data

In accordance with applicable law, recipients of your personal data may, in specific cases, in addition to you, include: other healthcare service providers, public authorities, and persons authorised to access medical records under Sections 31, 32, 33 and 65 of Act No. 372/2011 Coll., on Health Services and the Conditions for their Provision.
To ensure the purposes described above, personal data may also be processed, in addition to the Controller, by authorised processors (e.g. providers of IT services, software for maintaining medical records, e-mail and booking systems, and accounting), on the basis of data processing agreements concluded in accordance with the GDPR.
For the purposes of communicating with patients and organising the practice’s operations, the Controller also uses tools provided by Google LLC (in particular the e-mail and office services Google Workspace/Gmail) and Meta Platforms, Inc. (communication via WhatsApp and/or Messenger), both headquartered in the USA. This involves the transfer of personal data to a third country (USA). Such transfer is safeguarded on the basis of the European Commission’s adequacy decision issued under the EU–U.S. Data Privacy Framework, or, where the adequacy decision does not apply to a particular provider, on the basis of standard contractual clauses pursuant to Art. 46 GDPR.

V. Data Retention Period

Personal data contained in medical records is processed and retained for the period specified by Decree No. 98/2012 Coll., on Medical Records.
Personal data processed for the other purposes referred to in Sections II and III (accounting, taxes) is processed for the period specified by the relevant legal regulations.
Personal data processed for the purposes of organisation and booking is processed for as long as you remain our patient, and subsequently for a period of one year after you cease to be our patient, unless legal regulations provide for a longer period.

VI. Rights of the Data Subject

When processing your personal data, you have the following rights under the GDPR:

The right of access to your personal data (Art. 15 GDPR).
The right to rectification of inaccurate personal data (Art. 16 GDPR).
The right to restriction of processing (Art. 18 GDPR). Restriction of processing means that we must mark the personal data for which processing has been restricted and, for the duration of the restriction, may not process it further except for storage. You have the right to restriction of processing if:
- you contest the accuracy of the personal data, for the period necessary to enable us to verify its accuracy;
- the processing is unlawful and you oppose the erasure of the personal data and request the restriction of its use instead;
- we no longer need your personal data for the purposes of processing, but you require it for the establishment, exercise or defence of legal claims;
- you have objected to processing as described in Section VII below, pending verification of whether our legitimate grounds for processing override your interests or rights and freedoms.
The right to erasure of personal data (Art. 17 GDPR). Please note: The right to erasure does not apply to personal data that we maintain for the purpose of providing healthcare services (e.g. in medical records), as its retention is strictly required by law.
The right to data portability (Art. 20 GDPR). This right applies only to data that we process automatically on the basis of your consent or a contract. Data from medical records may only be provided to you, and, under statutory conditions, also to another healthcare service provider or public authority.
The right to lodge a complaint with the supervisory authority if you believe that data protection legislation has been infringed. You may lodge a complaint with the supervisory authority of the place of your habitual residence, place of work, or the place of the alleged infringement. In the Czech Republic, the supervisory authority is:

Office for Personal Data Protection (Úřad pro ochranu osobních údajů) Pplk. Sochora 27, 170 00 Praha 7, Czech Republic www.uoou.cz

VII. Right to Object to Processing

Where we process your personal data for the purposes of our legitimate interests or those of a third party (the legal bases for processing are set out in Section III), you have the right to object to such processing at any time at our address or e-mail address given in Section I. If you raise such an objection, we will be entitled to continue such processing only if we demonstrate compelling legitimate grounds for the processing which override your interests or rights and freedoms, or for the establishment, exercise or defence of legal claims.

VIII. Mandatory Processing and the Obligation to Provide Personal Data

The processing of your personal data for the purposes of providing healthcare services is a statutory requirement. Failure to provide your personal data may mean that we are unable to provide you with healthcare services, which may result in harm to your health or a direct threat to your life (Section 41(1)(d) of Act No. 372/2011 Coll., on Health Services and the Conditions for their Provision). The obligation to provide the patient’s personal data also applies to their legal representative or guardian (Section 41(2) of the same Act).

IX. Cookies and Website Analytics

Our website uses cookies and similar technologies, including both necessary (technical) cookies to ensure the proper functioning of the website, and analytics and marketing cookies, specifically Google Analytics (Google LLC) for measuring visitor traffic, and Meta Pixel (Meta Platforms, Inc.) for marketing and advertising targeting purposes.

Analytics and marketing cookies are stored only on the basis of your consent, which you may grant, refuse or withdraw at any time via the cookie banner displayed when visiting the website, or via your web browser settings. In connection with the use of these tools, data obtained through cookies may be transferred to a third country (USA), on the basis of the European Commission’s adequacy decision (EU–U.S. Data Privacy Framework), or, where applicable, on the basis of standard contractual clauses pursuant to Art. 46 GDPR.

Detailed information on which specific cookies we use, for what purpose, and for how long, can be found in the Cookie Policy available on our website.

Note: This document is an English translation of the official Czech-language document “Ochrana osobních údajů“. In the event of any discrepancy, ambiguity, or conflict between the Czech original and this English translation, the Czech version shall prevail and be legally operative under Czech law. Statutory references (Act numbers, Sections) have been kept in their original Czech identification format.