General data protection regulation
Dear Patients,
We would like to inform you that my DENT cz, s.r.o., Company ID No. 241 80 335, with its dental practice located at Bělohorská 257/45, 169 00 Prague 6, handles personal data responsibly and in accordance with the requirements of Act No. 101/2000 Coll., on the Protection of Personal Data, and Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of personal data.
In this regard, we would like to inform you that we use your personal data solely for treatment and diagnostic purposes and for activities strictly necessary for the operation of our dental practice.
All data is stored on secure storage devices, protected by passwords, and accessible only to authorised persons. Information stored in paper form is kept securely locked.
We process the following personal data: first name, surname, address, telephone number, email address, health insurance information and information concerning your health.
We use personal data solely for the purposes of your treatment and the operation of our dental practice. Personal data may be accessed only by a dentist, dental hygienist or other healthcare professional employed by my DENT cz, s.r.o., as well as by our accountant, the provider of our dental software and the dental laboratories with which we cooperate.
Information for Patients on the Processing of Personal Data
Pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC (General Data Protection Regulation).
1. Data Controller
my DENT cz, s.r.o.
Company ID No.: 241 80 335
Bělohorská 257/45, 169 00 Prague 6
office@mydent.cz
The Controller is a healthcare service provider within the meaning of Act No. 372/2011 Coll., on Healthcare Services and the Conditions of Their Provision, as amended.
2. Purposes of Personal Data Processing
We process your personal data for the following purposes:
- providing healthcare services;
- billing for healthcare services;
- communicating information about your health to you and other authorised persons;
- organising the provision of healthcare services, including scheduling patient appointments;
- maintaining records of our income, expenditure, payments received and financial management, as required under tax and accounting legislation.
3. Legal Basis for the Processing of Personal Data
The legal basis for processing your personal data for the purposes specified in Section 2 is:
- compliance with our legal obligations, particularly under Act No. 372/2011 Coll., on Healthcare Services and the Conditions of Their Provision; Act No. 48/1997 Coll., on Public Health Insurance; Act No. 563/1991 Coll., on Accounting; Act No. 586/1992 Coll., on Income Taxes; and Act No. 634/1992 Coll., on Consumer Protection;
- performance of our obligations arising from the healthcare agreement under which we provide healthcare services to you. This agreement does not have to be concluded in writing.
4. Recipients of Personal Data
In accordance with applicable legislation and depending on the circumstances of a particular case, recipients of your personal data may include, in addition to you, healthcare service providers, public authorities and persons authorised to access medical records pursuant to Sections 31, 32, 33 and 65 of Act No. 372/2011 Coll., on Healthcare Services and the Conditions of Their Provision.
For the purposes described above, personal data may also be processed on behalf of the Controller by data processors under data processing agreements concluded in accordance with the General Data Protection Regulation.
We do not transfer your personal data abroad.
5. Personal Data Retention Period
Personal data contained in medical records is processed for the period specified by Decree No. 98/2012 Coll., on Medical Records.
Personal data processed for the other purposes specified in Section 3 is retained for the period required by law or for as long as you remain our patient, and subsequently for one year after you cease to be our patient.
6. Rights of the Data Subject
When we process your personal data, you have the following rights relating to the protection of your personal data:
- the right to request access to your personal data;
- the right to rectification of the personal data we process about you;
- the right to restriction of processing.
Restriction of processing means that we must identify the personal data subject to the restriction and, for the duration of the restriction, may not process it further except for storing it.
You have the right to restriction of processing where:
- you dispute the accuracy of the personal data, for the period necessary for us to verify its accuracy;
- the processing is unlawful and you oppose the erasure of the personal data and request that its use be restricted instead;
- we no longer require your personal data for the purposes of processing, but you require it for the establishment, exercise or defence of legal claims;
- you have objected to processing as described in Section 7 below, pending verification of whether our legitimate grounds for processing override your interests, rights and freedoms.
You also have:
- the right to erasure of personal data. This right applies only to personal data that we process for purposes other than the provision of healthcare services. We are not permitted to erase data that we retain for the purpose of providing healthcare services, including data contained in medical records;
- the right to data portability. You may request that we provide your personal data to you for the purpose of transferring it to another data controller, or that we transfer it directly to another controller. However, this right applies only to data processed by automated means on the basis of your consent or a contract with you. Data retained for the purpose of providing healthcare services, including data contained in medical records, may be disclosed only to you or, under the conditions specified by law, to another healthcare service provider or public authority;
- the right to lodge a complaint with a supervisory authority if you believe that the processing of your personal data violates data protection legislation. You may lodge a complaint with the supervisory authority in the place of your habitual residence, place of employment or place of the alleged infringement. In the Czech Republic, the supervisory authority is the Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Prague 7, www.uoou.cz.
7. Right to Object to Processing
Where we process your personal data for the purposes of our legitimate interests or the legitimate interests of another party, you have the right to object to such processing at any time. The legal bases for processing are specified in Section 3.
You may submit your objection using the contact details provided in Section 1. If you object, we may continue processing your personal data only if we demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or where the processing is necessary for the establishment, exercise or defence of legal claims.
8. Mandatory Processing and the Obligation to Provide Personal Data
The processing of your personal data for the purpose of providing healthcare services is a legal requirement.
Failure to provide your personal data may mean that we are unable to provide you with healthcare services, which could result in harm to your health or a direct threat to your life, pursuant to Section 41(1)(d) of Act No. 372/2011 Coll., on Healthcare Services and the Conditions of Their Provision.
The obligation to provide a patient’s personal data also applies to the patient’s legal representative or guardian pursuant to Section 41(2) of Act No. 372/2011 Coll.