INFORMATION FOR PATIENTS
REGARDING THE PROCESSING OF THEIR PERSONAL DATA

pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council of the European Union from the 27th of April 2016 on the protection of natural persons with regard to the processing of personal data and to the free movement of such data and the revocation of Directive 95/46/EC (General Data Protection Regulation)

I. Personal data administrator

Name: DentAlo Slovanský dům, s.r.o.
Company Registration Number: 045 94 126
Registered office: Na příkopě 859/22
Nové Město, 110 00 Prague 1
Contact: gdpr@alo.cz


The administrator is the provider of health services pursuant to Art No. 372/2011 Coll. with regard to health services and the conditions in which they are provided, as amended.


II. Objective/s for processing personal data
We process your personal data with the objective of
− providing health services
− allocating reimbursed health services
− settling non-reimbursed health services
− communicating data regarding your health condition to you and other authorized persons
− organizing the provision of health services (patient commissioning)
− administering evidence regarding our intake and expenses, accepted payments and the managing of how they arise from the regulations for adjusted taxes and accounting


III. Legal basis for processing personal data
The legal basis for processing your personal data stated in point II is as follows:
− the fulfilment of our legal obligation (especially in regard to Act No. 372/2011 Coll. with regard to health services and the conditions in which they are provided, Act No. 48/1997 Coll. with regard to the verification of health insurance, Act No. 563/1991 Coll. with regard to accounting, Act No. 586/1992 Coll. with regard to income tax and Act No. 643/1992 with regard to consumer protection)
− the fulfilment of commitments pursuant to the health care contract under which we provide you with health services (this contract is not obligated to be concluded in written form)

IV. Recipients of personal data
The recipients of your personal data, in accordance with legal regulations in specific cases besides you, may be as follows: the health services provider, public authorities and persons authorized to consult medical documentation in accordance with § 31, § 32, § 33 and § 65 of Act No. 372/2011 Coll., with regard to health services and the conditions in which they are provided. To insure the above-described objectives, your personal data may be processed by the processor (in addition to the administrator), based on the contracts for the processing of personal data concluded in accordance with the general Regulation for the protection of personal data.
We do not pass your personal data on to foreign countries.


V. Period of processing personal data
Personal data contained in medical records are processed for the period stipulated by the Decree No. 98/2012 Coll., with regard to medical documentation. The personal data process to fulfil other objectives stated in point III is processed during the period stated by law or during the period in which you will be our patient, and then, during one year after the day when you will stop being our patient.


VI. Rights of the data subject
During the processing of personal data you have the following rights with regard to the protection of your personal data:
− the right to request access to your personal data;
− the right to adjust your personal data which we are processing;
− the right to limit processing. To ‘limit processing’ means that we must mark your personal data, which has had its processing limited, and, after a period where processing has remained limited, we are not permitted to further process this data, with the exception of storing this data. You have the right to limit the processing of your personal data if:
− you deny the exactness of your personal data, and that being during the period when it is necessary for us to verify the exactness of your personal data;
− the processing of your personal data is against the law and you decline the erasure of your personal data and rather request the usage of your personal data to be limited;
− we do not require your personal data to fulfil the objective of processing, but rather you request for the determination, procedure or defence of legal claims;
− you have objected to the processing referred to in point VII below until it has been verified whether our legitimate reasons for processing outweigh your interests or your rights and freedoms;
− you desire to exercise your right to have your personal data erased. The right to have your personal data erased is only in relation to the personal data, which we process in order to fulfil other objectives than providing health services. We are not permitted to erase the data which we manage in order to fulfil the objective of providing health services (ex. in health documentation);
− you exercise the right to data portability. You may request that we provide you with your personal data, so that you may hand it over to another personal data administrator, or so that we ourselves hand over the data to another personal data administrator.
However, you only have this right in regard to the data which we process automatically based on your given consent or the contract which we have concluded with you. And we are only permitted to provide the data about you which we manage in order to fulfil the objective of providing health services (ex. in health documentation) to you or, due to legal regulations, to another health services provider or public authority.
− you exercise the right to submit a formal complaint to a supervisory authority, and so doing in the event that you believe that the processing of your personal data has breached the legal regulations with regard to protecting personal data in some way. You may submit your formal complaint to the supervisory authority located in the place where your permanently reside, the place where you are legally employed or in the place where the data breach occurred. In the Czech Republic, your supervisory authority for the protection of personal data is located at Pplk. Sochora 27, 170 00 Prague 7, www.uoou.cz.


VII. The right to protest the processing of personal data
In the event that we are processing your personal data to fulfil our authorized interest objectives or those of another party (the legal basis for data processing are stated in point III), you have the right at any time to protest the processing of your personal data. You may raise your objection by writing to the address stated in point I. Should you raise such an objection, we are only authorized to continue in this processing if we are able to prove our seriously authorized reasons for processing your personal data that predominate over your interests or rights and freedoms, and furthermore, we are authorized to continue processing should the procession be found to be necessary for the determination, procedure or defence of legal claims.


VIII. Mandatory processing and the obligation to provide personal data
The processing of your personal data in order to fulfil the objective of providing health services is a legal requirement. By not processing your personal data, it is possible that we will not be able to provide you with health services, which could result in harm to your health or an immediate threat to one’s life (§ 41 Para.1 let. d. of Art No. 372/2011 Coll., with regard to health services and the conditions in which they are provided). The obligation to provide the patient’s personal data also concerns that patient’s legal representation or caretaker (§ 41 Para. 2 of Art No. 372/2011 Coll., with regard to health services and the conditions in which they are provided).