The purpose of this information is to provide you as a data subject with information about what personal data the hospital collects, for what purposes it is used, and where you can obtain information about your personal data that the hospital processes.
1. WHAT PERSONAL DATA DO WE PROCESS AND FOR HOW LONG?
NH Hospital a.s. (hereinafter referred to as NH) processes personal data and sensitive data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, as well as in accordance with national data protection legislation.
We maintain a database of personal and sensitive data of our patients and are the data controller of this data:
- Personal data and sensitive data obtained and processed by NH in connection with the provision of healthcare services (medical records),
- personal data for unambiguous and unmistakable identification,
- personal data enabling the NH to contact you,
- personal data relating to the relationship between the NH and the patient.
The NH processes personal data in the case of compliance with legal obligations for the period of time specified by law; in the case of processing necessary for the performance of a contract, for the period of time necessary to ensure mutual rights and obligations under the contract, i.e. always for at least the duration of the contract; in the case of processing based on the consent of the data subject for the period of time specified in the consent or until its revocation. After the end of the period of legitimate processing, NH will cease to process your personal data and will ensure its destruction in accordance with the relevant legislation.
2. FOR WHAT PURPOSES AND ON THE BASIS OF WHICH LEGAL TITLES DO WE PROCESS YOUR PERSONAL DATA?
For the purposes of maintaining medical records and other purposes related to the provision of health care, health protection and related activities based on the fulfilment of the legal obligations of the administrator as a health care facility pursuant to Act No. 372/2011 Coll., on health services and conditions of their provision, as amended, Act No. 373/2011 Coll., on specific health services, as amended, and other applicable health care legislation.
For the purposes of the implementation of the contractual relationship with the data subject in the provision of health services, i.e. negotiations on the conclusion of the contract or its amendment, the mutual performance of rights and obligations under the contract, as well as the protection of the rights and legally protected interests of the controller (in particular, securing and asserting legal claims under the contract).
For its internal use, primarily to protect our rights and legitimate interests, in particular to evaluate potential risks, to monitor the quality of services and to optimise the services provided.
For commercial and marketing purposes, i.e. in particular to offer additional services unrelated to the service provided, including the dissemination of commercial communications, pursuant to Act No. 480/2004 Coll., on certain information society services, as amended, on the basis of the voluntary consent to the processing of personal data.
In the case of voluntary consent, it is up to your free decision whether you provide your consent to the extent proposed by us. NH is bound by the extent of the consent provided. You may withdraw your consent at any time. In the event that you withdraw your consent, NH is obliged to stop processing your personal data processed on the basis of the consent provided within a reasonable period of time that corresponds to the technical and administrative possibilities of NH. You may re-grant your consent to NH for the processing of your personal data.
3. TO WHOM CAN OR MUST WE PROVIDE YOUR PERSONAL DATA?
- To health care institutions, registries, state organizations that enter into the process of registration, treatment, control and contact with the patient;
- To our processors who carry out partial or full processing of personal data for NH under a relevant contract;
- State authorities or public authorities in cases where the NH is required by law to provide personal data - in particular, state administration authorities, courts, law enforcement authorities, supervisory authorities, bailiffs, notaries, insolvency administrators, etc;
- To other entities where necessary to protect our rights, e.g. insurance companies, courts, bailiffs, auctioneers; the scope of personal data provided is limited to the data necessary for the successful assertion of a claim;
- To other entities, with your consent.
4. WHAT RIGHTS DO YOU HAVE IN RELATION TO THE PROCESSING OF PERSONAL DATA?
You can request information about what personal data NH processes about you, as well as exercise the other rights listed below, by contacting us at:
NH Hospital a.s.
K Nemocnici 1106
268 31 Hořovice
or at the following e-mail address: dpo@akesoholding.cz
Contact details of the Data Protection Officer:
Bc. Michal Voborník
Data Protection Officer (DPO)
dpo@akesoholding.cz
As a data subject, you have the right to request information as to whether or not personal data concerning you are processed by NH and, if so, to obtain access to such personal data and information about:
- the purpose of the processing of the personal data,
- the category of personal data concerned,
- the recipient or category of recipients of the personal data,
- the period for which the personal data will be kept,
- the sources of the personal data,
- whether automated decision-making, including profiling, is involved
NH will provide you with an initial copy of the personal data processed free of charge. For further copies, or if the request is manifestly unfounded or unreasonable, NH may require payment of the costs associated with providing the information, such as postage costs.
If you have provided personal data to NH on the basis of consent, you have the right to:
- obtain the personal data you have provided in a structured, commonly used and machine-readable format and the right to transfer that data to another controller,
- to have the personal data transferred directly from one controller to another, where technically feasible.
- If you discover or believe that the processing of your personal data by the NH has violated your rights or breached the obligations set out in the Regulation or in national data protection legislation, you may seek redress using all the means available to the data subject under applicable law, in particular by asking the NH to:
- rectification or erasure (destruction) of the personal data (except where the processing is necessary for compliance with a legal obligation), or
- restriction (blocking) of processing.
- The NH will always inform you without undue delay, in any case within one month of receipt of the request, about the processing of your request.
GDPR application in English - NH.pdf
You can send your request to: dpo@akesoholding.cz
You can also contact the Data Protection Authority directly with your suggestions:
Data Protection Authority
Address: Pplk. Sochor 27, 170 00 Prague 7
Tel: 234 665 111, website: www.uoou.cz
5. CHANGES TO YOUR PERSONAL DATA
For proper and correct processing, you must notify the NH of any changes to your personal data that occur.
