according to the General Data Protection Regulation (GDPR)
The company provides information on the processing of personal data that the data subject provided to the data administrator as part of the initiation of activities in the performance of the contractual relationship:
(1) Administrator of personal data: Ponseti Clinic, Dukelských hrdinů 17, Prague 7 Founder: Ponseti Clinic Praha s.r.o. with registered office at V přístavu 1585/20, Holešovice, 170 00 Prague 7, ID number: 11797487
(2) Personal data protection officer: The personal data protection officer is Ing. Jan Kocis Phone: +420 322 234 177 E-mail: gdpr@ponseticlinic.cz
(3) Purpose of processing: The data administrator will process the personal data of the data subject for the purposes of fulfilling the contractual relationship in the field of health care provision.
(4) Legal basis:
- Consent of the data subject: for the purpose of sending commercial messages
- Performance or conclusion of a contract: especially for the purpose of providing health care
- Legal obligation (in particular Decree No. 98/2012 Coll. on health documentation; Act No. 372/2011 Coll. on health services; Act No. 373/2011 Coll. on specific health services.)
- Legitimate interest: For the purposes of records, traceability or defense of legal claims of the Administrator (records in the administrator's internal systems). For the purposes of property protection, work safety, defense of legal claims and insurance (camera systems). For direct marketing purposes (informing about related services or products)
(5) Categories of personal data: When fulfilling the contractual relationship, the following categories of personal data are processed:
- Address and identification
- ZSpecial category of personal data (health data)
- Other data
(6) Processors of personal data: Personal data may be provided by the data controller for further processing to external providers of accounting services, legal services, cooperating medical facilities, doctors, contractual partners in the field of IT services and technologies, the specific categories of which will be communicated to data subjects upon request.
(7) Other beneficiaries: The data controller may make the provided personal data available to suppliers of consulting services and certification services, the specific categories of which will be communicated to data subjects upon request. For reasons of state supervision, prevention, investigation, detection or prosecution of criminal offenses or execution of sentences, including protection against threats to public security and their prevention, the data controller provides personal data to relevant public authorities or other entities authorized to process personal data. The administrator also provides personal data to Hygiene stations and the Ministry of Health of the Czech Republic.
(8) Period of storage of personal data: The data administrator keeps personal data for the duration of the performance of the contractual relationship, for the period of validity of the granted consent and for the period imposed by law
(9) Automated decision-making, including personal data profiling: The company does not make automated decisions, including personal data profiling.
(10) Rights of the data subject: The right to access personal data – the data subject has the right to access personal data concerning him, the data controller is obliged to provide a copy of the processed personal data after verifying the subject's identity. The right to correct and supplement personal data - the data subject has the right to have the data controller correct or supplement inaccurate personal data concerning him without undue delay. Right to erasure – the data subject has the right to have the data controller erase personal data concerning him without undue delay, if:
- personal data are not needed for the purposes for which they were processed
- the data subject withdraws consent to the processing of personal data
- the data subject objects to the processing
- personal data were processed unlawfully
- the retention of personal data is not prescribed by other relevant legal regulations
- it is not of public interest in the field of public health, archiving, scientific or historical research, statistics
- it is not the exercise or defense of legal claims.
The right to limit processing – the data subject has the right to have the data controller limit the processing of personal data in justified cases. The right to portability of personal data – the data subject has the right to obtain personal data concerning him in a structured, commonly used and machine-readable format, and the right to transfer this data to another controller. Automated individual decision-making – the subject has the right not to be the subject of any decision based solely on automated processing, including profiling, if this is not necessary for the performance of the contract. The right to lodge a complaint with the supervisory authority – the data subject has the right to lodge a complaint with the supervisory authority, i.e. Office for Personal Data Protection. The right to raise an objection - the data subject has the right to raise an objection to the processing of personal data, the data manager may not further process such data in unjustified cases. You can object to processing for direct marketing purposes at any time
(11) Failure to provide personal data: The data subject must provide personal data for legal reasons or include the data in a business contract or order. Otherwise, the fulfillment of the agreed contract would be impossible.
(12) Other provisions: If the data subject does not give the data administrator consent to the handling of personal data or does not enter into a business relationship with the administrator and there are no other reasons for the processing, his personal data will be shredded in written form and deleted in electronic form. Other personal data that the data subject did not provide to the data controller in person may be obtained from publicly accessible sources.