Dr. Feldman’s private clinics
Data processing policy
1. The controller and his contact person
1.1. The controller in the processing of personal data is Dr. Feldman’s private clinic Ltd. (hereinafter referred to as “Clinic”), registration number 40003811605, address: Dzīparu iela 8, Dreiliņi, Stopiņi Municipality, LV-2130, telephone: 20004707 , e-mail address: klinika@drfeldmanis.lv
2. General
2.1. The aim of the personal data processing policy (hereinafter referred to as the processing policy) is to provide the natural person with information on the purpose of personal data processing, the legal basis, the scope of the processing, the protection and the time limit for processing, as set out in Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation).
2.2.The processing policy applies to the protection of personal data in relation to patients and visitors of the clinic, as well as to visitors of the website.
2.3.The processing policy applies to the processing of data regardless of the form or environment (pature, website, printed or telephone) The data subject shall provide personal data.
2.4.The provision of personal data is a prerequisite for receiving medical treatment services. In the absence of it, a treatment service may not be provided or it may be provided to a limited extent.
3. Purposes and legal basis of personal data processing
3.1.The purposes of personal data processing are the provision of medical treatment services, including prior registration, making and storing of medical records, consulting doctors, manipulations, carrying out examinations, including transfer to other specialists and laboratory examinations, prescribing of prescriptions, issuing of work incapacity pages and other documents, payment processing and other activities within the scope of the medical treatment service, examination of patients’ applications and control of quality of service, prevention or detection of criminal offences, investigation of personal data processing incidents.
3.2. The list of data processing purposes referred to in Section 3.1 of the processing policy is indicative and personal data of the data subject may be processed for purposes not directly mentioned, which are closely related to the above and necessary to comply with the requirements of the regulatory enactments.
3.3. Legal basis for the processing of personal data: Article 9 (2) (a) of the General Data Protection Regulation: the data subject has given explicit consent to the processing of these personal data for one or more specific purposes, point (b): the processing is necessary for the performance of the duties of the controller and for the exercise of specific rights of employment, social security and social protection rights of the controller or data subject, point (c): the processing is necessary for the protection of the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving his consent; point (f): the processing is necessary for the purpose of establishing, implementing or defending legitimate claims; point (h) the processing is necessary for the purposes of preventive or occupational medicine, the performance of an employee, the assessment of medical diagnosis, health or social care or treatment or the provision of health or the management of services; point (i) the processing is necessary for reasons of public health, point (j) the processing is necessary for reasons of public health, for reasons of public interest, for scientific or historical research, or for statistical purposes, the law of patients’s law and the provisions of these laws and the Cabinet of Ministers, as well
4.Recipients of personal data
4.1.Recipients of personal data may be persons defined in Section 10 of the Patient Rights Law.
4.2.Clinic does not transfer personal data unless it can verify the identity of the recipient and its right to receive the data, as well as if it is suspected that the identity presented by the Data Subject does not correspond to its true identity.
4.3.Clinical personal data processing may involve other persons by signing a written agreement on it and providing sufficient guarantees that appropriate technical and organizational measures will be implemented in such a way that the processing will comply with the requirements of regulatory enactments in data protection.
4.4.Personal data will not be transferred to third countries (countries outside the European Union and the European Economic Area) or international organisations.
5.Conservation and destruction of personal data
5.1.The duration of personal data storage is determined according to the following criteria:
5.1.1. when storing personal data, the deadlines set in regulatory enactments are respected
5.1.2. if the period of storage of personal data is not specified in the regulatory enactments, then the period of storage is determined by the clinic.
5.2. Medical records and documents will be kept within the time limits set by Cabinet of Ministers Regulations of 4 April 2006 No 265.
5.3. Personal data contained in documents of an economic nature, invoices, etc. are stored in accordance with the provisions of the Law on Accounting, which provides for a retention period of not less than 5 years, with the aim to establish the beginning of each economic transaction and to track its progress.
5.4. Personal data (video records) obtained through environmental surveillance shall be stored for a maximum period of 30 days from the date of their performance;
5.5. In any case, personal data shall be stored only for as long as is necessary for the purposes for which they are processed, with a reasonable period of time for the destruction of the data. The data shall be destroyed safely. Printed material containing personal data shall be destroyed by crushing it or other secure means. Electronic data shall be destroyed by permanent deletion.
5.6. Where personal data are fully anonymised, there are no restrictions on their storage from the data protection point of view.
6. Rights of the data subject
6.1. In accordance with the laws and regulations, the data subject has the right to request Clinkai’s access to his personal data, to request their addition, correction or deletion, or restriction of processing in relation to himself, to object to processing, as well as to data portability. This right shall be exercised in so far as the processing of data does not result from the obligations imposed on it by the laws and regulations in force.
6.2. Upon receipt of the Data Subject’s request for the exercise of their rights, the Clinic evaluates the request and executes it in accordance with the laws and regulations, unless the Clinic is unable to identify the data subject.
6.3. The patient has the right to receive one copy per year free of charge with personal data relating to the clinic.
6.4 The reception and/or use of the information referred to in point 6.3 may be limited in order to prevent adverse effects on the rights and freedoms of others (including clinicians).
6.5. The data subject has the right to submit a complaint regarding the unlawful processing of personal data by the supervisory authority.
7. Website visits and cookies processing
7.1.Cookies can be used on the website.
7.2.The website of the clinic may include links to third parties’ websites, which have their own rules on use and protection of personal data, for which Clinic is not responsible.
8.Changes in processing policy
8.1.Clinic reserves the right to make changes to its Processing Policy if certain circumstances change, which affect the regulation of personal data processing.
8.2.Clinic preserves the previous versions of the Processing Policy and is available on the Clinic website.
