Rules on personal data protection of the Specialty Hospital Medico

1. Contact information (telephone or e-mail address) are collected for the purpose of contacting service users regarding the dates of examinations and sending promotional materials if there is consent from the respondent.
2. Identification data (name, surname, address, PIN, gender, date of birth, insurance provider) are collected for the purpose of creating medical findings and issuing an invoice for the services provided. PIN enables a faster and simpler search of databases and prevents mistaking patients with the same first and last names.
3. Medical findings are collected and created for the purpose of performing services and are stored in order to comply with legal obligations.
4. Recording via a surveillance camera on the Specialty Hospital Medico premises is done for security reasons. Only part of the corridor, the reception area (cash register) and the entrance door are under video surveillance.

The legal basis for the collection of the above-mentioned personal data, in addition to the personal data collected by video surveillance and contact information, is the fulfilment of our legal obligations (the Medical Practitioners Act, the Records Act) in the field of health and other regulations governing our activity, which regulate the manner and period of storage of medical findings as well as the mandatory content thereof. Part of the identification data is collected on the basis of accounting regulations governing the mandatory content of the invoice. Contact information is collected when it is necessary for the performance of the contract or in order to act at the request of the data subject before the conclusion of the contract. Recording via a surveillance camera is carried out on the basis of the legitimate interest of the Controller, and it consists in protecting the safety of users of services, employees and property of the institution. Contact information for sending promotional materials (e-mail only) is collected on the basis of the consent of the data subject.

1. Medical findings or personal data contained therein shall be stored as data of permanent value in accordance with Article 23 of the Records Act in the field of health. Data on outpatient treatment shall be kept pursuant to Article 23 of the Medical Practitioners Act for 10 years after the end of treatment.
2. Personal data contained in the invoice for services rendered shall be kept in accordance with the Accounting Act for 11 years from the date of its creation.
3. We keep contact information for as long as necessary for the purpose of performing the contract or acting before concluding the contract. Furthermore, the contact information collected through the consent for the purpose of sending promotional materials is kept until the withdrawal of the consent in question, and for a maximum of ten years from the date of its creation.
4. We store personal data collected through video surveillance for six days from the date of their creation, after which they are permanently deleted.

a) Right to access: You have the right to obtain confirmation whether we process personal data relating to you and, if such personal data are processed, access to personal data and the following information – the purpose of the processing, the categories of personal data in question, the recipients to whom the personal data have been disclosed and the retention period.

b) Right to rectification: You have the right to obtain without undue delay the rectification of inaccurate personal data that concerns you.

c) Right to delete: You have the right to request the deletion of personal data relating to you, which will be erased if the legal requirements are met, or if the conditions are not met, you will be informed why the data cannot be deleted.

d) Right to restriction of processing: You have the right to obtain restriction of processing if the prerequisites defined by the General Data Protection Regulation in Article 18 are met.

e) Right to transfer data: You have the right to receive the personal data concerning you, in a structured, commonly used and machine-readable format, and you have the right to transfer this data to another controller if the processing is based on consent or on a contract and if the processing is carried out by automated means.

f) Right to object: You have the right to object at any time to the processing of personal data concerning you. The complaint is submitted by e-mail to gdpr@medico.hr with the indication Objection to the processing of personal data or by filling out a written form located at the reception.

g) You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or significantly affect you in a similar way.

f) If the processing of your personal data is based on consent, you have the right to withdraw this consent at any time by sending an e-mail to gdpr@medico.hr.

g) Right to file a complaint with a supervisory authority.