Privacy policy
What our patients say
What do our patients say about their dental treatment, their dentists and assistants, and our practice? There are plenty of informative written and video testimonials to help you make your choice.
We hope that you will soon be one of our satisfied, smiling patients!
Please read this document carefully as by registering and/or using this website you agree to the terms of use and privacy policy set out herein.
1. General provisions
1.1. Purpose and scope of the Rules
The purpose of these Rules is to ensure that Dental For You Dental Centre Limited Liability Company (registered office: 1053 Budapest, Kecskeméti utca 1, 1st floor 2, company registration number: Cg. 01-09-193901, tax number: 25000076-1-41, represented by Dr. Péter Márton Steinhof, Managing Director) as a healthcare service provider (hereinafter referred to as the "Data Controller"), to comply with the legal and professional requirements for the processing of health data, to be in compliance with other legal provisions on data processing, and to protect the data of individuals. Accordingly, the purpose of this Policy is to ensure that the activities of the Data Controller, as a company processing health data, comply with the provisions of Act CXII of 2011 on the Right to Informational Self-Determination and Freedom of Information (hereinafter referred to as "the Infotv.") and the GDPR Regulation (Regulation (EU) No 2016/679 of the European Parliament and of the Council of 25 May 2018 on the protection of personal data and on the protection of individuals with regard to the processing of personal data) applicable from 25 May 2018. Regulation (EC) No 2017/19/EC of the European Parliament and of the Council of 25 May 2017 on the protection of personal data (hereinafter referred to as "GDPR"), Act XLVII of 1997 on the processing and protection of personal data concerning health and related personal data (hereinafter referred to as "Eüak."), and Act CXXXIII of 2005 on the rules of personal and property protection and private investigation.
The scope of the Rules covers:
This Policy does not cover the processing of data relating to the employment relationship with the Data Controller.
1.2. The purpose of health data processing:
Purpose of processing health and personal data (Section 4 (1) of the Health and Social Welfare Act):
Pursuant to Paragraph (2) of Article 4 of the Health and Personal Data Protection Act, in addition to the above-mentioned, health and personal data may be processed - in cases specified by law - for the following purposes:
Health and personal data may also be processed for purposes other than those set out above with the written informed consent of the data subject or his or her legal or authorised representative (hereinafter together referred to as "legal representative"). For the purposes of the processing as set out above, only the amount and type of health and personal data strictly necessary for the purposes of the processing may be processed.
1.3. Principles, legal basis and general conditions for data processing:
The legal basis for the processing is the fulfilment of a legal obligation pursuant to Article 6 (1) (c) of the GDPR Regulation in the case of mandatory data transfers to the competent authority (including mandatory transfers to the ECESTA) as required by the Eüak tv. and the Eü tv. In other cases, the performance of a contract with the Data Controller as a healthcare service provider pursuant to Article 6(1)(b) of the GDPR Regulation. The processing of e-mail addresses processed for the purpose of subscribing to the newsletter is based on the data subject's consent, while the use of cameras installed in the premises of the Controller's clinic as processing is based on the legitimate interest of the Controller in the security of property pursuant to Article 6(1)(f) of the GDPR Regulation. Cameras are installed in the treatment rooms (surgeries) and in the waiting room, the exact location of which and the angle of view of the recording are set out in the Camera Policy of the Data Controller, which is available for inspection at the reception.
Personal data may only be processed for clearly specified, legitimate purposes, for the exercise of rights and the performance of obligations. At all stages of the processing, the purpose of the processing must be fulfilled and the collection and processing of the data must be fair and lawful. Only personal data which is necessary for the purpose of the processing and adequate for the purpose shall be processed. Personal data may only be processed to the extent and for the duration necessary to achieve the purpose. The personal data shall retain this quality during the processing for as long as its relationship with the data subject can be re-established. The link with the data subject may be re-established if the controller has the technical conditions necessary for the re-establishment of the link. The processing must ensure that the data are accurate, complete and, where necessary for the purposes for which they are processed, kept up to date, and that the data subject can be identified only for the time necessary for the purposes for which they are processed.
Adequate security of personal data must be ensured by the application of appropriate technical or organisational measures during processing, in particular measures to protect against unauthorised or unlawful processing, accidental loss, destruction or damage. The processing of personal data shall be regarded as fair and lawful if, in order to ensure the freedom of expression of the data subject, the person who wishes to know the opinion of the data subject visits him or her at the place of residence or stay, provided that the personal data of the data subject are processed in accordance with the provisions of this Act and the personal inquiry is not for commercial purposes. The personal inquiry shall not take place on a public holiday within the meaning of the Labour Code.
Personal data may only be processed if it is required by law or - on the basis of a statutory authorisation, within the scope specified therein, in the case of data that does not constitute special data or personal data for criminal purposes - by a local government decree for a purpose in the public interest, or, failing this, if it is absolutely necessary for the performance of the tasks of the controller as defined by law and the data subject has given his or her explicit consent to the processing of the personal data, or where it is necessary and proportionate for the protection of the vital interests of the data subject or of another person, or for the prevention or elimination of an imminent threat to life, limb or property of a person, or where the personal data have been explicitly disclosed by the data subject and where it is necessary and proportionate for the purpose of the processing.
Unless the duration of the mandatory processing or the periodic review of its necessity is determined by law, local government regulation or a binding legal act of the European Union, the controller shall review, at least every three years from the start of processing, whether the processing of personal data processed by the controller or by a processor acting on its behalf or under its instructions is necessary for the purposes of the processing. The controller shall document the circumstances and the results of that review, keep that documentation for ten years after the review and make it available to the National Authority for Data Protection and Freedom of Information (hereinafter referred to as the Authority) upon request.
Where special categories of data are processed, the controller or the processor, acting on his behalf or at his instructions, shall take appropriate technical and organisational measures to ensure that, when carrying out the processing operations, access to the special categories of data is restricted to those who have an absolute need to know in order to fulfil their task in relation to the processing operation.
1.4. Definitions:
2. Rights of data subjects and their validity
2.1. Rights of the data subject against the Data Controller:
2.2. Right to information:
At the request of the data subject, the Data Controller shall provide information on the data processed by the Data Controller or by a data processor appointed by the Data Controller or under its instructions, on the source of the data, the purpose, legal basis and duration of the processing, and whether the processing is ongoing, the name, address and activities of the data processor in relation to the processing, the circumstances of the personal data breach, its effects and the measures taken to remedy it and, in the case of a transfer of personal data of the data subject, the legal basis and the recipient of the transfer. The controller shall provide the information in writing in an intelligible form within the shortest possible time from the date of the request, but no later than 25 days. The information shall be provided free of charge if the person requesting the information has not yet submitted a request for information to the controller in the current year for the same set of data. In other cases, a fee may be charged. The Data Controller may refuse to provide information only on the basis of the provisions of the legislation on data protection in force at the time.
2.3. Correction and deletion of data:
The data subject shall have the right to obtain, at his or her request and without undue delay, the rectification of inaccurate personal data relating to him or her. Having regard to the purposes of the processing, the data subject shall have the right to obtain the rectification of incomplete personal data, including by means of a supplementary declaration.
The personal data shall be deleted if
is not precluded by law,
Rectification or erasure must be notified to the data subject or to those to whom the data were previously disclosed, unless it is contrary to the legitimate interests of the data subject.
2.4. Right to object:
The data subject may object to the processing of his or her personal data if
the exercise of the right to object is otherwise permitted by law.
The Controller may only continue to process the data
subject's data, despite the data subject's objection, if it is required to do so by law.
2.5. Right to restriction of processing:
The data subject shall have the right to obtain, at his or her request, the restriction of processing by the Controller if one of the following conditions is met:
If the processing is restricted, such personal data may be processed, except for storage, only with the consent of the data subject or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or of an important public interest of the Union or of a Member State.
The controller shall inform the data subject at whose request the processing has been restricted in advance of the lifting of the restriction.
2.6. Right to data portability:
The data subject shall have the right to receive the personal data concerning him or her which he or she has provided to the Controller in a structured, commonly used, machine-readable format and the right to transmit such data to another controller without hindrance from the controller to which he or she has provided the personal data.
2.7. Judicial enforcement:
In the event of a breach of the data subject's rights, the controller may take legal action against the data subject. The court will decide the case out of turn. The controller must prove that the processing is in compliance with the law.
2.8. Compensation, damages:
If the data controller causes damage to another person by unlawful processing of the data subject's data or by breaching the requirements of data security, the data controller must compensate the damage. If the controller infringes the data subject's right to privacy by unlawfully processing his or her data or by breaching data security requirements, the data subject may claim damages from the controller. The controller is liable to the data subject for the damage caused by the processor and the controller is also liable to pay the data subject the damages for the personal data breach caused by the processor. The controller shall be exempted from liability for the damage caused and from the obligation to pay the damage fee if it proves that the damage or the infringement of the data subject's personality rights was caused by an unforeseeable cause outside the scope of the processing. No compensation shall be due and no damages shall be payable where the damage or injury to the personality rights of the data subject was caused by the intentional or grossly negligent conduct of the data subject.
3. Method of data processing
3.1. Data controllers are entitled to:
Within the health care network, data controllers are entitled to process health and personal data:
The processing of health and personal data shall be secure against accidental or intentional destruction or accidental loss, destruction, alteration, damage, disclosure and unauthorised access by unauthorised persons.
3.2. Data recording:
The date of the data recording and the identity of the person recording the data must be recorded in the medical record. All records and entries in the patient's records must be authenticated by signature or handwriting and, if necessary, by date, and in the case of electronic data processing, the clear identification of the person making the entry must be ensured. The Data Controller shall record and store the personal data provided by the data subject (name, date and place of birth, mother's name, address) and the health data recorded before or during the treatment in an electronic database. The processing of personal data in relation to information society services offered directly to children is lawful once the child has reached the age of 16. In the case of children under the age of 16, the processing of personal data of children is lawful only if and to the extent that consent has been given or authorised by the person having parental authority over the child (legal representative).
3.3. Deletion of data:
Data may only be deleted on the basis of this Policy. Deletion must comply with data protection rules, in particular with regard to unauthorised access. In case of deletion, manually processed data must be physically destroyed and, in case of electronically stored data, irreversibly altered. The deletion of data may be carried out with the authorisation of the Data Controller's manager. Data on prescriptions may not be deleted for 5 years, images for 10 years, findings for 30 years and final reports for 50 years.
3.4. Processing for the purpose of dental care:
n the course of dental treatment, the Data Controller records personal data of the person (data subject) who has undergone the treatment and the health data necessary for the professional conduct of the treatment. The data subject or his/her legal representative shall provide the health and personal identification data to the Data Controller for the purposes of the performance of a contract with the Data Controller as a healthcare provider.
The data subject (legal representative) shall provide health and personal identification data at the request of the healthcare provider,
During medical treatment, data in accordance with professional rules must be recorded in the medical records. It is up to the dentist providing the treatment to decide which health data, in addition to the compulsory data, should be recorded in accordance with the professional rules. The recording of data should avoid recording data that are not directly related to the treatment of the patient. The management of medical records during treatment should be organised in such a way that the records and the patient's personal data are accessible to the persons who are responsible for the treatment of the person receiving the treatment. A subcontractor of a dental technician under contract with the controller and his/her employees in such a capacity should have the right to access patient data to the extent necessary for the dental work. The processing of data by dental technicians is otherwise governed by this Policy.
3.5. Protection of medical confidentiality:
The Data Controller, as well as other persons in a legal relationship with the Data Controller, is bound by an obligation of confidentiality without time limitation with regard to data relating to the patient's medical condition and other data that has come to its knowledge in connection with the work. The obligation of confidentiality is independent of the manner in which the data has been disclosed. The duty of confidentiality shall also apply to a carer who has not collaborated in the treatment of the patient, unless the data are necessary for the further treatment of the person treated. The obligation of confidentiality may be waived in writing by the patient or by a statutory obligation to provide information. In order to protect medical confidentiality, it is necessary that all employees of the provider undertake to maintain medical confidentiality. The undertaking must be included in or attached to the employee's job description. The data subject (patient) has the right to declare to whom information about his/her illness, its likely outcome, may be disclosed and to whom partial or total access to his/her medical data is excluded. The health data of the patient concerned shall be disclosed even in the absence of the patient's consent, where
3.6. Persons present during treatment:
The patient has the right to have present during his examination and treatment only those persons whose participation in the treatment is necessary or those to whose presence the patient has consented, unless otherwise provided by law. The person concerned may be present without his/her consent, with respect for his/her human rights and dignity:
In addition to the above, the following may be present,
For the purposes of training of health professionals, a doctor, medical student, health professional, student or pupil of a health college, health professional school or health vocational school may be present during the treatment with the consent of the person concerned (legal representative). Consent may also be given orally by the person receiving treatment to the dentist providing the treatment.
3.7. Right and obligation to information, patient's right to be informed:
The patient shall be informed of the provider's privacy policy before the patient's care is provided. The patient must be informed of the privacy policy before the start of treatment. The patient shall provide proof of this information by signing the service contract. The patient's documentation must be accompanied by any restrictive declaration by the patient. Information on the treatment of the patient shall be provided by the dentist treating the patient. Information on the nursing aspects of the patient's treatment may also be provided by the health care professional attending to the patient. Information on the patient's treatment shall not be provided by a dental nurse or other staff member unless authorised by the dentist treating the patient. The information shall be provided in person.
The treating dentist shall inform the person concerned directly of the medical data concerning him which he has ascertained. In the case of a psychiatric patient, the patient's right of access to the medical records may exceptionally be restricted if there are reasonable grounds to believe that the patient's recovery would be seriously compromised or the privacy of another person would be violated if the medical records were disclosed. Only the dentist is entitled to order the restriction. The patient's legal representative and the patient's legal or authorised representative must be informed of the restriction without delay.
3.8. Informing relatives and other persons:
When registering with the provider or at a later date, the patient may decide to whom partial or full information about his/her illness, its probable outcome, changes in his/her state of health may be disclosed and who may be excluded. The patient shall be informed of the possibility of making such provision.
3.9. Right of access to medical records:
The patient (or his/her legal representative) has the right to be informed of the personal and medical data concerning him/her and has the right to consult the medical records. The health record is held by the health care provider and the patient has the right to access the health record.
The patient has the right to
4. Processing for public health and epidemiological purposes
The healthcare provider shall immediately transmit the health and personal identification data to the public health administration if a communicable disease is detected or suspected. The municipal institute of the National Sanitary and epidemiological Service may request the personal identification data of the person concerned on the grounds of public health or epidemiological public interest.
5. Records of health and identity data
5.1. Obligation to register:
Records must be kept of the health and personal data recorded on the data subject which are necessary for the purposes of treatment and of their transmission. The record of the transfer must include the recipient of the transfer, the method and date of the transfer and the scope of the data transferred. The means of recording may be any data storage device that ensures that the data are protected against intentional destruction, destruction, alteration, damage, disclosure and unauthorised access. The patient provider's own records shall form part of the register.
5.2. Arrangements for the storage and archiving of medical records:
Records relating to the examination and treatment of the patient are contained in the medical records. The medical records shall be kept in such a way that they accurately reflect the process of care.
The medical records shall indicate
the identity of the patient,
the name, address and contact details of the person to be notified in the case of a patient with capacity, and the name, address and contact details of the legal representative in the case of a minor or a person under guardianship,
medical history, medical history,
the results of the first examination,
the results of the tests on which the diagnosis and the plan of care are based, and the date on which the tests were carried out,
the name of the disease justifying the treatment, the underlying disease, concomitant diseases and complications,
any other disease not directly justifying the treatment and the risk factors,
the duration and outcome of the interventions carried out,
data on the patient's hypersensitivity to medication,
the name of the health professional making the entry and the date of entry,
the content of the information provided to the patient or other person entitled to receive the information,
the fact of consent or refusal and the date thereof,
any other data and facts which may influence the patient's recovery.
It must be kept as part of the medical record:
the findings of each examination,
documents generated during treatment and consultation,
records of diagnostic imaging procedures.
In the case of medical records, particular attention should be paid to ensuring that they are detailed, professional, legible and retrievable. Pursuant to Section 30(1) of the Health Care Act, the retention period of medical records is at least 30 years from the date of recording (50 years for final reports and 10 years for diagnostic imaging records). The Data Controller shall establish its own rules for the storage of medical records. During storage, the Data Controller shall ensure that the documentation is protected against unauthorised access, theft, falsification and physical destruction.
6. Implant register
6.1. Information on the legal obligations related to the implant register
If an implant is implanted, removed or replaced in connection with the treatment of the patient concerned, the Data Controller is obliged to comply with the provisions of Act CLIV of 1997 on Health Care No. The Data Controller shall be obliged to transmit the data of the register containing the data pursuant to § 101(1) of the CLIVC Act of 21.12.2003 to the central implant register for the purposes of further treatment of the person undergoing the implantation, removal or replacement of an implant, monitoring of his/her state of health, rapid response to an unexpected event and checking the conformity of implantable medical devices. The health insurance body operating the central register of implants shall establish a contact code for the personal identification data. The health insurance body shall create the link code for all personal data on the basis of the same coding method, in such a way that it does not allow for any reverse engineering of personal data and that all transmissions of data for the same patient, irrespective of the healthcare provider performing the intervention, are linked to the same link code. The contact code as referred to above shall be sent by the health insurance authority to the healthcare provider keeping the register via the IT application it operates. The contact code shall be indicated in the medical documentation, including in the final report given to the patient. The body designated to carry out official tasks in relation to medical devices may, for the purpose of carrying out official tasks in relation to medical devices, obtain access to non-personally identifiable data in the central implant register with a contact code. The health insurance body shall provide the public health administration body and the body responsible for professional quality assessment with information by electronic means on request within 8 days, or without delay if necessary to protect the health of the persons wearing the implants, with information on the non-personally identifiable data stored in the central implant register, with a contact code.
Upon request of the health care provider, including the contact code indicated in the patient documentation, the health care authority shall immediately provide information by electronic means, with a contact code, on the data stored in the central implant register concerning the previous implant procedure performed on the person treated by the health care provider. If it is necessary for the prevention or remedying of an urgent need or a dangerous condition with regard to the person wearing the implant and the last health care provider providing implant-related care has ceased to exist without legal succession or the medical records cannot be obtained or can be obtained with significant delay, the body designated to perform official tasks in relation to medical devices may obtain the data pursuant to Section 101/C (1) a) of the Health Insurance Act in order to contact the person concerned and inform him/her of the actions necessary to protect his/her health.
Data stored in the central implant register shall be deleted 50 years after the last transmission of data relating to the data subject.
7. Electronic health services space (EESZT)
AThe aim of the Hungarian e-health system is to provide the population with faster, more efficient and more service-oriented care. The key to this lies in the continuous connection between care providers, treating physicians and pharmacies, so that information is consistent and accessible. At the same time, the system's services will simplify the administrative and reporting processes in the healthcare sector, speeding up patient care. EESZT is essentially an information flow facilitation system that makes it easier and quicker for data sent to the Space to reach the right person. This data includes personal data and health data, as it is healthcare data. The data is fully secured by a system with the highest level of protection, level 5. The data is handled by the State Health Care Supply Centre (SHSC), which operates the EESZT. Since the introduction of the EESZT, the way in which patients are treated has not changed fundamentally; you have nothing to do other than go to your doctor if you are sick or need a routine check-up, just as you have always done. The purpose of this information note is to familiarise you with the scope of the data that will be entered into the EESZT system by the healthcare institution during the course of your treatment. If you want to take advantage of the opportunities offered by the digital world, this leaflet will also give you the opportunity to find out how to use the latest e-health services. If you would like more information on the operation of the EESZT and the processing of your data than this notice, please visit the information portal https://e-egeszsegugy.gov.hu, where you can read the EESZT Privacy Notice by clicking on the Privacy section and browse the site for more useful information on the operation of the EESZT.
7.1. Scope of personal data processed by the EESZT in the course of healthcare
Data uploading to the EESZT starts from patient admission. Data generated in the course of healthcare are recorded in the EHRC in the following cases and in the following ways:
Event catalogue
The central event catalogue contains up-to-date information about your healthcare. For the central event catalogue, the following event details, the date of the event, the date of recording in the healthcare facility's system and the identifier of the person responsible for recording the event are required. Data retention period: 5 years after your death. You can access the data:
Register of medical documents
The purpose of the registry is to allow treating physicians to access their patients' medical documents, the registry contains these documents (e.g. outpatient chart, findings, final report, etc.). The documents contained here will be kept in accordance with the rules and for the period of time applicable to medical records. Retention period: 5 years after your death. You can access the data:
eProfil
The health profile record contains information describing your general health (current illnesses, general health data). The purpose of the record is to provide the treating physician with up-to-date and comprehensive health information for your care. Retention period: 5 years after your death. You can access the data:
7.2. Where can you view the data about your healthcare that has been entered into EESZT?
AYou can find the EESZT Population Portal at https://www.eeszt.gov.hu. You can access your own personalised EESZT account by clicking on the Login button and entering your client identification and social security number. This will allow you to easily access and download the medical documents and data related to you that will be included in the EESZT at any time.
If you do not have an account, you can create one in the following ways:
1. in person at any document office, government office, tax office or diplomatic mission
2. electronically, if you have a valid identity card issued after 1 January 2016.
You can also use several EESZT services offered by the digital facilities on the Citizen Portal. Some of these are:
ou can keep track of your care events in the Event Catalogue under the ACTIONS tab and find your patient documents generated during your care and uploaded to EESZT in your e-History.
Under the REFERRALS tab, you can retrieve your own electronic referrals filtered by period, view their data content and print them.
Under the RECIPTES tab, you can retrieve your electronic prescriptions, including a list of your prescriptions already filled, going back to a specific period. All prescription information is also available to you, but this does not replace the prescription certificate which can be used by others to fill your prescriptions, so you cannot fill a prescription printed from here. Your traditional paper prescriptions will only appear in your dispensed prescriptions because they are entered into the system by the pharmacy when the prescription is dispensed.
You can request a notification when data or documents relating to you are added to the system under the SUBMIT tab. You can keep track of who has requested to view what data or document in the system, and when. You will also be able to control the availability of your data and documents that will be included in EESZT.
8. Data protection
8.1. Regulation of data protection training:
It is the responsibility of the manager to provide annual training on data management and data protection for the employees of the Data Controller. The training must be documented and provided on a regular basis. Data protection training for new employees shall be provided by the manager and shall be documented. The Data Protection Officer shall be employed by the Data Controller.
Name of the Data Protection Officer: Dr. Róbert Nagy
Contact details of the DPO: dentalforyoufogaszaticentrum@gmail.com
8.2. Data security, data protection:
The Data Controller and the Data Processor shall ensure the security of the data and shall take the technical and organisational measures and establish the procedural rules necessary to enforce the Data Protection Act and other data protection and confidentiality rules. In particular, the data must be protected against unauthorised access, alteration, disclosure, disclosure, deletion or destruction and against accidental destruction or damage. In order to ensure the technical protection of personal data, the controller, the processor or the operator of the communication or information technology equipment should take specific protection measures where personal data are transmitted by network or other information technology equipment. All persons involved in the processing of personal data must exercise the utmost care in their work to ensure the authenticity and integrity of the data and to prevent unauthorised access. When storing and transmitting data, general accident and fire safety regulations must be observed. Within the healthcare provider, the head of the institution handling the data is responsible for the protection of health and personal data and the preservation of records.
In the course of the activities of the Data Controller
8.3. Data recorded on paper or stored electronically:
Data are recorded in a paper document by the Data Controller at the time of recording. The person who records the data is responsible for the legibility of the data. The data recorded shall be recorded by the Data Controller in the electronic database. In the case of electronically stored data, only the registered controller on the access list may process the data. The controller must log in to the system with an individual, secret password. Once the processing is completed, the user must log out of the system. The controller is responsible for password-protected processing in the system. In order to avoid possible misuse, the data controller is obliged to ensure and keep the confidentiality of his/her individual password.
8.4. Procedure in case of data corruption:
In the event of damage or destruction of health and personal data, an attempt shall be made to replace the damaged data as far as possible from other available data sources. The dental care provider shall perform automatic backups of the computer system at specified intervals to ensure continuity of data backup. Data security incidents must be reported to the NAIH.
9. Contact details of the data controller
10. Data processor
10.1. Use of a data processor:
The Data Controller uses a data processor for the processing of data. The Processor shall provide the Controller with the software used for recording patient records in an electronic database. The processor and any person having access to personal data, acting under the control of the controller or the processor, shall process such data only in accordance with the controller's instructions, unless the controller is required by law to derogate from them. In addition to the above, the Data Controller shall employ an additional data processor for the processing of the data for the sole purpose of fulfilling the tax obligations arising from the invoicing of the fee for the health care service, for the performance of accounting tasks. The data processor will only know the personal data of the patients which are indicated on the invoice for the service fee (name, address). The legal basis for the processing of the data in this case is the fulfilment of a legal obligation pursuant to Article 6(1)(c) of the GDPR Regulation. The data storage period for accounting documents is 5, 8 or 10 years as laid down by law. If, in the course of the treatment, the patient decides to require sedation (anaesthesia) for a procedure, the Data Controller will provide this service by using an external service provider, during which a separate medical record and a consent form will be signed by the patient with the doctor providing the anaesthesia care. The sole purpose of this data collection is to obtain information and medical data that may have an impact on the work of the anaesthesiologist. The anaesthesiologist acts as a data processor for the purposes of data processing, the legal basis for which is the performance of a contract with the Data Controller as a healthcare service provider, pursuant to Article 6(1)(b) of the GDPR Regulation. The data processor may not take any substantive decision regarding the processing, may process the personal data coming to its knowledge only in accordance with the provisions of the controller, may not process the data for its own purposes, and shall store and retain the personal data in accordance with the provisions of the controller.
11. Complaints, remedies
The data subject may initiate an investigation against the Data Controller at the National Authority for Data Protection and Freedom of Information in case of a violation of his/her data processing. Contact details of the Authority:
12. Entry into force, other provisions
12.1. This Privacy Policy shall enter into force on 10 October 2018.
12.2. The Data Controller shall make this Policy available to patients on its website, in electronic form if necessary, and on paper in its surgery at all times.
12.3. With regard to the provisions on data protection not specified in this Policy, the legislation referred to in point 1.1 and any applicable and relevant legal provisions in force and replacing such legislation shall apply.
Budapest, 10 October 2018.
………………………………….
Dr. Péter Márton Steinhof
Managing Director
Annexes:
Original source. This document translated by Deepl.com.