Privacy statement

Information about our data protection and data processing policies and practices.

Name and details of the controller

Controller 1 Name: Saint James Eye Clinic Hungary Kft.

Postal address: 1034 Budapest, Bécsi út 68-84.

Telephone: 06 1 788 2927

Email: balazs.zentai@stjameshospital.hu

Website: www.lassjol.hu, https://saintjameshungary.hu/

Company registration number: 01 09 439235

Controller 2 Name: Saint James Aesthetic Hungary Kft.

Postal address: 1034 Budapest, Bécsi út 68-84.

Telephone: 06 1 788 2927

Email: balazs.zentai@stjameshospital.hu

Website: https://saintjameshungary.hu/

Company registration number: 01 09 434063

Controller 1 and Controller 2 together: the Controller

Representatives of the Controller: Jean Claude Muscat, Balázs Zentai

Data Protection Officer: Consact Kft., Dr Barbara Kőrösi

Data Protection Officer contact: korosib@consact.hu, +36 30 204 0319

Controller 1 and Controller 2 belong to the same group of companies and in practice operate as a single healthcare centre. With regard to the processing of personal data, they are joint controllers.

In order to protect patients' health and personal data, Saint James Vision&Aesthetics Center and its staff consider it particularly important to comply strictly with the law and to respect patients' right to informational self-determination. Recorded health and personal data are handled confidentially, in accordance with data protection legislation, professional regulations and this privacy notice, and every security, technical and organisational measure is taken to guarantee the security of the data.

The current version of this Notice is always available on the www.lassjol.hu, and the https://saintjameshungary.hu/ websites, at reception and at several locations within our facility.

2. Legislation on which the processing is based

Our processing of health and personal data is governed primarily by the following legislation:

Hungarian Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information
Hungarian Act CLIV of 1997 on Health;
Hungarian Act XLVII of 1997 on the Processing and Protection of Health and Related Personal Data (hereinafter: Eüak)
Government Decree 43/1999 (XII. 3.) on the detailed rules for financing healthcare services from the Health Insurance Fund.
Hungarian Act CL of 2017 on the Rules of Taxation;
REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter: “GDPR”)

This notice applies to:

all organisational units of the Institution that provide healthcare, and any organisation or staff member carrying out professional supervision or inspection who processes health and personal data;
all natural persons using the Institution's healthcare services, and all other natural persons whose personal data is processed by the Controller (hereinafter: data subject);
all health and personal identification data relating to the data subject that is processed in accordance with Act XLVII of 1997 on the Processing and Protection of Health and Related Personal Data (hereinafter: Eüak);
any external service provider involved or to be involved in the processing that processes, or comes into contact with, personal data falling within the Institution's remit.

3. Purpose of processing health data

Health and personal identification data may be processed for the following purposes:

promoting the preservation, improvement and maintenance of health;
supporting effective medical treatment by the healthcare provider, including professional supervision;
monitoring the data subject's state of health;
taking measures necessary in the interest of public health and epidemiology;
enforcing patients' rights;
tracking the individual patient pathway.

Apart from the above, health and personal data may only be processed in cases specified by law, for the purpose specified therein, in order to fulfil a legal obligation.

For the purposes described above, only such health and personal identification data may be processed, and only to the extent, as is required by law and professional rules and is strictly necessary to achieve the purpose of the processing.

4. Definitions

GDPR: REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)

Personal data: any information relating to the data subject, such as an identifier, name, identification number, location data, online identifier, or data relating to the physical, physiological, genetic, mental, economic, cultural or social identity of the natural person.

Special categories of data: personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, as well as genetic and biometric data for the purpose of uniquely identifying a natural person, health data, and data concerning a natural person's sex life or sexual orientation.

Processing: any operation or set of operations performed on personal data or sets of personal data, regardless of the method used, in particular collection, recording, organisation, structuring, storage, alteration, adaptation, use, retrieval, transmission, disclosure, alignment or combination, restriction, erasure and destruction, consultation of the data, prevention of further use of the data, taking photographs, sound or video recordings, and recording physical characteristics suitable for identifying a person (e.g. fingerprints or palm prints).

Controller: the natural or legal person, or organisation without legal personality, which, alone or jointly with others, determines the purposes and means of the processing of personal data, and makes and implements decisions regarding the processing or has them implemented by a processor.

Processor: the natural or legal person, or organisation without legal personality, which processes personal data on behalf of the controller.

Data subject: a natural person who is identified, or who can be identified directly or indirectly on the basis of one or more factors, by reference to specific personal data. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or one or more other factors.

Transfer of data: making personal data available to a specified third party. Transfers to EEA Member States or to bodies of the European Union are to be treated as if they took place within the territory of Hungary.

Erasure: making data unrecognisable by deleting its content or by any other means producing an equivalent result.

Personal data breach: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed.

EEA Member State: a Member State of the European Union, another state party to the Agreement on the European Economic Area, and any state whose nationals enjoy the same legal status as nationals of a state party to the EEA Agreement under an international treaty concluded between the European Union and its Member States and a state not party to the EEA Agreement.

Third country: any state that is not an EEA Member State.

NAIH: The Hungarian National Authority for Data Protection and Freedom of Information, the supervisory authority under the GDPR for Hungary.

5. Basic principles of data processing

Personal data shall be:

processed lawfully, fairly and in a transparent manner in relation to the data subject (“lawfulness, fairness and transparency”);
collected only for specified, explicit and legitimate purposes (“purpose limitation”);
adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (“data minimisation”);
processed with every reasonable step taken to ensure that the data is accurate and up to date; personal data that is inaccurate for the purposes of the processing is erased or rectified without delay (“accuracy”);
stored in a form that permits identification of data subjects for no longer than is necessary for the purposes of the processing (“storage limitation”);
processed in a manner that ensures appropriate security of the personal data, using appropriate technical or organisational measures, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage (“integrity and confidentiality”).

As controller, we are responsible for compliance with the above and will demonstrate compliance where necessary (“accountability”).

6. Data processed

6.1 Contacting us

Data subjects: any natural person who provides the details needed to contact them via the website, email, telephone or a social media message.

Purpose of processing: Establishing and maintaining contact

Categories of data	Legal basis	Retention period
name, telephone number, email address.	GDPR Article 6(1)(a) – Consent	Until consent is withdrawn

The processing:

We process the personal data provided in order to respond to enquiries.

Providing this data is not mandatory; however, without it we are unable to contact you or respond.

The data subject may withdraw their consent at any time without giving reasons; however, this does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.

6.2 Appointment booking and registration for private healthcare services (website, social media pages, telephone, email, in person)

Data subjects: Persons applying for private healthcare services

Purpose of processing: Appointment booking and preparation of the contract.

Categories of data

Legal basis

Retention period

name, telephone number, place of residence, email address, date of birth, eye conditions, dioptres, address (postcode), Hungarian social security (TAJ) number (or passport number), previous illnesses, treatments, operations, medication, health fund ID, name of relative or authorised representative, appointment time

GDPR Article 6(1)(a) – Consent

+ with regard to health data, explicit consent under Article 9(2)(a)

5 years after the end of the contractual relationship; erasure at the data subject's request

The processing:

If you book an appointment with us using the booking system on our website or by other means (telephone, in person, email), we use the above personal data to book your appointment and organise your examination.

The data is recorded electronically in our medical software.

Providing the above data is not mandatory; however, without it you cannot book an appointment and we cannot begin organising your examination. You may withdraw your consent at any time without giving reasons; however, this does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.

6.3 Authorisation or prohibition of informing relatives

Data subjects: Relatives of patients

Purpose of processing: Informing relatives, or excluding them from being informed.

Categories of data	Legal basis	Retention period
name, telephone number	Legitimate interest under GDPR Article 6(1)(f)	The Controller retains medical records for at least 30 years from the date the data was recorded.

The processing:

The patient may state which of their relatives the Controller may inform about their state of health or, conversely, which relatives are to be excluded from being informed.

The relative's details are provided by the patient.

For processing based on the Controller's legitimate interest, we have carried out a balancing test to assess the necessity and proportionality of the processing, and have concluded that the processing is lawful.

The data subject has the right to object to the processing (for details, see section 12.8).

6.4 Recorded calls

Data subjects: Persons applying for private healthcare services by telephone

Purpose of processing: Appointment booking and preparation of the contract.

Categories of data

Legal basis

Retention period

name, telephone number, email address, date of birth, basic eye data: dioptres, eye conditions, contact lens wear, address (postcode)

GDPR Article 6(1)(a) – Consent

+ with regard to health data, explicit consent under Article 9(2)(a)

The Controller does not store the data; it can only be accessed on the service provider's platform.

The processing:

We do not store the data; we can only access it on the service provider's platform. Calls from persons applying for private healthcare services by telephone are recorded on a web-based call centre platform (Comnica).

Providing the above data is not mandatory; however, without it you cannot book an appointment and we cannot begin organising your examination. If you do not wish to consent to the call being recorded, you can book in person, on our website or by email. You may withdraw your consent at any time without giving reasons; however, this does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.

6.5 Conclusion of contract

Data subjects: Persons applying for surgery.

Purpose of processing: Conclusion and performance of the contract.

Categories of data	Legal basis	Retention period
Name, identification number, date of suitability assessment, date of surgery, signature	GDPR Article 6(1)(b) (performance of a contract)	5 years after the end of the contractual relationship
bank statement (for instalment payments)	GDPR Article 6(1)(b) (performance of a contract)	1 month after the conclusion of the contract

The processing:

When concluding a contract, we use the data provided by the individual and process it for the duration of the contractual relationship, solely for the purpose of performing the contract and maintaining contact. For instalment payments, we also ask the data subject for a bank statement to verify their ability to pay, which we erase by destroying it after the contract has been concluded – within 1 month at the latest.

The data is stored both on paper and electronically (medical software).

We use the above data to conclude and perform the contract. Providing the data is not mandatory, but without it we cannot perform the surgery.

6.6 Recording health data – keeping patient records, using medical software, transferring data to the EESZT

Data subjects: Persons using healthcare services

Purpose of processing: Examination, medical treatment, keeping medical records.

Categories of data

Legal basis

Retention period

name, date of birth, place of birth, TAJ number, mother's name, home address, correspondence address, medical history related to the examination, examination results, medical report

GDPR Article 6(1)(c)

(legal obligation) under Section 28(1) of the Eüak, and, with regard to health data, GDPR Article 9(2)(h).

The Controller retains medical records for at least 30 years from the date the data was recorded.

The processing:

Providing the data is mandatory under the applicable legislation. If it is not provided, we cannot record your data. The data is also recorded in our medical system and transferred to the EESZT (Hungarian Electronic Health Service Space).

6.7 Surgical consent form

Data subjects: Persons applying for surgery

Purpose of processing: Proof that information about the surgery has been provided.

Categories of data	Legal basis	Retention period
name, date and place of birth, TAJ number or, failing that, mother's name and place of residence, medical history, signature	GDPR Article 6(1)(a) – consent	The Controller retains medical records for at least 30 years from the date the data was recorded.

We use the data of persons applying for surgery to issue the surgical consent form

Providing the above data is not mandatory; however, without it we cannot inform you about the surgery. You may withdraw your consent at any time without giving reasons; however, this does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.

6.8 Issuing prescriptions

Data subjects: Patient

Purpose of processing: Issuing prescriptions.

Categories of data	Legal basis	Retention period
Patient data: name, social security (TAJ) number – for prescriptions with national health insurance subsidy, address, date of birth, public healthcare card number for patients entitled to public healthcare, the data subject's sex for prescriptions issued via the EESZT, as well as the data subject's TAJ number or, failing that, the number of another document suitable for identifying the data subject, ICD (BNO) code – for prescriptions with national health insurance subsidy, date	GDPR Article 6(c) (compliance with a legal obligation): Act XLVII of 1997 on the processing and protection of health and related personal data, Section 14/A(1)	The Controller retains medical records for at least 30 years from the date the data was recorded.

The processing:

Based on the examinations, it may be necessary to issue a prescription for the patient. Prescriptions are printed from the medical system with the content described above.

Providing the data is mandatory under the applicable legislation. If it is not provided, we cannot issue the prescription.

The data is transferred to the EESZT and, in the event of an official investigation, may also be transferred to the competent authority.

6.9 Online test

Data subjects: Persons completing the online test on the website

Purpose of processing: Assessing suitability for surgery.

Categories of data	Legal basis	Retention period
age, pregnancy or breastfeeding, amblyopia, previous eye conditions, treatments, email address, name	GDPR Article 6(1)(a) – consent, and explicit consent under Article 9(2)(a)	Not retained or stored by the Controller; stored by the service provider.

The processing:

We do not store the data; we can only access it on the service provider's platform. The data of persons completing the online test is recorded on the service provider's platform (ActiveCampaign).

Providing the above data is not mandatory; however, without it we cannot assess your suitability for surgery. You may withdraw your consent at any time without giving reasons; however, this does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.

6.10 Performance of contracts relating to the Controller's operations and business activities

Data subjects: Contracting partner or their contact person.

Purpose of processing: Performance of the contract.

Categories of data	Legal basis	Retention period
name, telephone number and email address of the contracting partner's employee	GDPR Article 6(1)(f) – legitimate interest	5 years after the end of the legal relationship, plus 1 year (the audit period prescribed by the Act on the Rules of Taxation)

The processing:

In performing the contract, we use the personal data provided by the partner and process it for the duration of the contractual relationship, solely for the purpose of fulfilling the order and maintaining contact.

Where we also receive personal data of the partner company's employees, typically for contact purposes, we process this data on the basis of legitimate interest. In this case, the legitimate interest of the contracting parties takes precedence over the employee's right to control their personal data, as the restriction is necessary and proportionate for the employee to perform their job (NAIH/2018/2570/2/V).

The data subject has the right to object to the processing (for details, see section 12.8).

Providing the data is not mandatory; however, knowing the personal data needed for identification and contact is an essential condition for fulfilling the order.

The data may be transferred to our accountant and to the parties specified in the contract.

6.11 Invoicing

Data subjects: Patients.

Purpose of processing: Managing invoices.

Categories of data

Legal basis

Retention period

Name, address and health fund ID of the patient or the patient's legal representative

GDPR Article 6(1)(c) – compliance with a legal obligation

– Act C of 2000 on Accounting, Section 169(1)–(2)

8 years

The processing:

For individuals, invoices contain (or may contain) personal data. We retain invoices in accordance with the Accounting Act.

Providing the data is mandatory under the applicable legislation. If it is not provided, the invoice cannot be issued.

The data is stored electronically (számlázz.hu). Invoices are passed on to our accountant.

6.12 Marketing newsletters

Data subjects: Persons subscribing to the newsletter.

Purpose of processing: Sending newsletters and information about news, discounts and special offers.

Categories of data	Legal basis	Retention period
name, email address	GDPR Article 6(1)(a) – consent	Until consent is withdrawn

The processing:

Providing the above data is not mandatory; however, without it we cannot send you our newsletter. The data subject may withdraw their consent at any time without giving reasons; however, this does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.

Newsletter subscription data is recorded and stored on the ActiveCampaign online platform.

6.13 Taking photographs or video recordings of patients for marketing purposes

Data subjects: Patients.

Purpose of processing: Marketing.

Categories of data	Legal basis	Retention period
Video, photograph	GDPR Article 6(1)(a) – consent	Until consent is withdrawn

The processing:

Providing the above data is not mandatory. The data subject may withdraw their consent at any time without giving reasons; however, this does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.

6.14 Social media presence

If a user chooses to like or follow one of our social media pages, we may also see the following data: profile name, profile URL, profile ID, profile picture, stated place of residence, gender, birthday and bio. We are not the controller of personal data published by visitors on social media pages. The operator of the social media platform is the controller, and its Privacy Policy and Terms of Service govern the processing.

6.15 Cookies

When you visit our website, we place small data files called cookies in the User's browser and in HTML-based emails, in accordance with this privacy notice.

Cookies are small data files that are placed on your computer when you use the website, and are saved and stored by your web browser. A cookie makes it possible to recognise when the User last logged in to the website. The main purpose of cookies is to provide the User with personalised offers and advertisements that tailor the user experience on the website and reflect the User's personal needs and preferences.

Cookies can be used for many useful purposes.

Security: supporting and enabling security, and helping the Controller detect unlawful behaviour.
Preferences, features and services: cookies can tell the Controller which language the User prefers and what the User's communication preferences are, and make it easier for the User to fill in forms on the website.
Advertising: the Controller may use cookies to show the User relevant advertisements both on and off the website. Cookies may also be used to show whether Users who saw an advertisement on the website later visit the advertiser's website.
Performance, analytics and research: these cookies help the Controller understand how the website performs in different locations. The Controller may also use cookies to evaluate, improve and research the website, products, features and services, including when the User accesses the website from other websites or devices, such as the User's computer or mobile device.

Controlling and managing cookies:

We provide detailed information about the cookies we use, and settings to manage them, in the pop-up window that appears when you first visit the website.

Most browsers allow Users to control the use of cookies through their settings. However, if the User restricts the website's use of cookies, this may worsen the user experience, as the website will no longer be personalised for the User.

7. General rules for processing health data

When data is recorded, the date of recording and the person recording it must be entered in the medical records.

Every note or entry in the patient's records must be authenticated with a signature or initials and, where necessary, a date; in the case of electronic processing, the system must ensure that the person making the entry can be clearly identified.

Data relating to the patient's examination and treatment is contained in the medical records. Medical records must be kept in such a way that they accurately reflect the course of care.

During treatment, the data required by professional rules must be recorded in the medical records. The treating doctor decides which health data – beyond the data that must be recorded by law – needs to be recorded in accordance with professional rules.

Data not directly related to the patient's treatment may only be included in the medical records if it is relevant to the patient's care. During treatment, only persons with access rights may access the records and the patient's personal data.

Everyone employed by the Institution, or working for it under any other legal relationship, is bound by an obligation of confidentiality, without time limit, regarding data on the patient's state of health and any other data they learn in the course of their work. The obligation of confidentiality applies regardless of how the data came to their knowledge. It therefore binds not only the treating doctor and healthcare professionals, but every member of the Institution's staff.

The patient may release staff from the obligation of confidentiality in writing. The Institution must comply with its obligation to provide data where transferring the data is required by law.

8. Access to data and data security measures

8.1 Access to data

The Institution records the names and positions of staff involved in data processing in each organisational unit, together with the unit concerned, in its register of health data processing.

Within the healthcare network, the following are authorised to process health and personal identification data:

the Director of the Institution;
the Medical Director of the Institution;
the treating doctor;
the specialist nurse or nurse involved in the treatment;
the staff member responsible for patient scheduling and patient management;
the Data Protection Officer.

In the case of electronic processing, the signature is replaced by the electronic username and password. The person exercising employer's rights over the organisational unit is responsible for keeping the register and authorising access. The password holder is responsible for keeping the password confidential and for any misuse of it. The Institution only uses electronic systems capable of keeping passwords confidential. In the case of electronic processing, the system logs each login.

In the case of manual processing, the person processing or amending the data is identified by comparing their signature with the specimen signature held in the register.

8.2 Data security measures

Through technical and organisational measures for data protection and information security, the Controller ensures that personal data is protected against unauthorised and unlawful processing, accidental loss, destruction or damage, and that the data is accurate, complete and up to date.

As part of its responsibilities for IT security and digital data protection , the Controller ensures:

measures to protect against unauthorised access, such as

access protection – the computer and the databases containing personal information accessible on it can only be accessed with valid, identifiable authorisation (a username and unique password); access passwords are changed every three months;
network protection – password-protected Wi-Fi and a secured router provide a firewall between the internal network and the internet;
protection of the network and data files against viruses;
physical protection of data files and the devices that hold them (archiving, fire safety rules, locked server).

To store data securely, the Controller makes a daily backup of all data on the central server. The backup media is stored securely in the place and manner designated for this purpose.

Files containing data are irreversibly deleted once the purpose of the processing has been fulfilled, or when the processing period has expired or its legal basis has ceased.

A To ensure appropriate security of personal data stored and processed on paper, the Controller takes the following measures:

documents can only be accessed by staff with access rights (records management policy);
after documenting care, or during it, the staff member processing the data locks away the documents as required, locks the room where the data is processed, or stores the documents where supervision is ensured by the continuous presence of healthcare staff (lockable filing cabinet, lockable office);
When a patient is transported or examined at another institution, the medical records must be handed over in person to the healthcare worker responsible for the examination or procedure, or to the one handling the transfer. The handover, with its date and time and signed by the recipient, must be noted in the patient's records, and the accuracy of the data must be verified.
the Controller stores paper documents in a dry, securely lockable room suitable for storing paper documents and equipped with fire protection and security equipment (records room).

Once the purpose of the processing has been fulfilled, or when the processing period has expired or its legal basis has ceased, documents containing data are destroyed in a verifiable manner (using a shredder, with a written record).

9. Amending and erasing data

The data subject must inform the Controller in writing of any changes that occur during the period of treatment, by completing the “Declaration of change of personal data” form. The data subject may request the rectification and erasure of their data; for details, see the section “Rights of the data subject in relation to processing”.

When erasing data, the Controller physically destroys manually processed data and irreversibly alters electronically stored data. Erasure may only be carried out with the joint approval of the Data Protection Officer and the Director of the Institution, and the Controller keeps a record of it. If the medical records are of scientific significance, the Controller transfers them to the competent archive after the mandatory retention period.

After recording, the Controller corrects or deletes incorrect health or personal data in the medical records in such a way that the originally recorded data remains identifiable. The amendment must be initialled; in the case of electronic processing, the system ensures that the person making the entry is clearly identified and that the entry is logged.

10. Providing information on the data subject's own health data or that of a relative

The patient (or their legal representative) is entitled to receive information about their personal identification and health data, to inspect their medical records and to request a copy of them free of charge. A fee is payable for each further copy, based on the cost items set out in a ministerial decree.

During the data subject's period of care, the right to request data may be exercised, in addition to the data subject and their legal representative, by a person authorised by the data subject in writing. After the data subject's care has ended, the right to request data may be exercised, in addition to the data subject and their legal representative, by a person authorised by the data subject in a private document with full probative value.

Requests to inspect records or obtain copies should be addressed to the staff member responsible for patient management.

The request may be submitted in person, with proof of identity, or in writing, in the form of a private document with full probative value. The applicant must prove their entitlement with photographic identification (e.g. identity card, new-style driving licence) and a document proving their entitlement (TAJ card, birth certificate, marriage certificate, death certificate, or a private document with full probative value).

Verbal requests must be put in writing, attached to the patient's records and kept there.

If the request for data is not made by the data subject, the requester – except for data requests based on law – must prove their identity and entitlement:

an authorisation handwritten and signed by the data subject; or
an authorisation written, edited and printed on an electronic device, signed by hand and witnessed by two witnesses; or
an authorisation by the data subject in a private document with full probative value.

In these cases, the document proving entitlement must be attached to the request.

The staff member responsible for patient management keeps a record of requests and of the action taken (provision or refusal of data).

The first copies are provided free of charge; thereafter, a fee is payable for further copies based on the cost categories set out in a ministerial decree. The Institution will inform the applicant of this in writing. Payment can be made by bank transfer to the Institution's account or in cash at the Institution's cash desk.

Every page of a paper copy issued to the applicant must bear the Institution's stamp and the date. Copies made electronically or onto a data storage device (including photographs or scans) also count as copies.

After certification and signature, the Controller sends the copy to the data subject – or, if their authorisation extends to receiving the records, to the authorised person – as they request, either by registered post or in person at the place where the request was submitted. Where possible, the copy must be delivered to the applicant in the manner specified in their request. In the case of personal collection, the applicant must prove their identity and confirm receipt of the copies, and the time of receipt, with their signature.

Documents containing health data sent to the data subject by email must be password-protected.

Access by relatives to health data relating to the cause of death of a deceased person or to treatment preceding the death

In the event of the data subject's death, their legal representative, close relative or heir is entitled, on written request:

to access health data related or possibly related to the cause of death, and
health data related to treatment preceding the death; to inspect the medical records; and to make or receive copies of them.

Identifying causes affecting the lives of relatives and accessing data related to their healthcare, during the patient's lifetime or after their death

During the patient's lifetime or after their death, the data subject's spouse, direct relative, sibling, heir or partner may also exercise the right to request data, on written request, if the health data is needed

to identify causes affecting the life or health of the spouse, direct relative, sibling, partner or their descendants, or
for the healthcare of the persons listed above, and
it is not possible to obtain or infer the health data in any other way,
the head of the patient care unit certifies that the requested copies of the records contain only health data related or possibly related to the cause of death, or to treatment preceding the death, or
health data directly related to the legally specified reason stated in the request.

If the relative only requests to inspect the records, this right is granted by the head of the patient care department subject to the above restrictions, who also provides the necessary information. Inspection of the records must be documented (stating the date of inspection, the details of the person inspecting them and the signature of the manager authorising or supervising the inspection).

11. Data transfers and processors

After treatment, the attending doctor records the data concerning the data subject specified in Section 35/F of the Eüaktv. in the Electronic Health Service Space (EESZT). Unless the data subject has prohibited this in writing, the data subject's GP and treating doctor are entitled to access data on healthcare the data subject has received under compulsory health insurance, with the health insurance body providing the data via electronic query. A GP may only access the data of insured persons registered with them. The data subject or their legal representative may, in a self-determination statement, prohibit other connected data controllers or EESZT users from accessing their recorded data or the data of a minor they represent. The EESZT Privacy Notice is available at the following link: https://e-egeszsegugy.gov.hu/adatvedelem. Details of the EESZT controller:

National Healthcare Service Centre (Állami Egészségügyi Ellátó Központ)

Registered office: Diós árok 3, 1125 Budapest

Telephone: 06 1 356 1522

Email: helpdesk.eeszt@aeek.hu

In addition to doctors employed by it, Saint James Vision&Aesthetics Center also works with partner doctors who contribute in person. Such colleagues are independent data controllers, but Saint James Vision&Aesthetics Center's data protection rules apply to them in the same way.

Transfer of data at the request of bodies outside the healthcare network: At the request or written enquiry of the following bodies, the treating doctor and the health insurance body will provide the requesting body with the data subject's health data and the personal identification data necessary for identification that the requesting body may lawfully process. In accordance with Section 4(4) of the Eavt., the request must specify the health and personal identification data sought, including data available from a medical injury report prepared by the healthcare provider. The requesting bodies may be:

in criminal cases: the court, the prosecution service, the investigating authority, the body conducting preparatory proceedings and the forensic expert; in civil litigation, non-contentious proceedings and administrative cases: the administrative authority, the prosecution service, the court and the forensic expert;
in minor offence proceedings: the bodies conducting the proceedings;
for persons potentially or actually liable for military service: the district office of the Budapest or county government office, the military administration and central data processing body of the Hungarian Defence Forces, and the committee determining medical fitness for military service;
the national security services, in performing the tasks set out in Act CXXV of 1995 on the National Security Services and within the scope of the authority granted therein;
the military administration and central data processing body of the Hungarian Defence Forces, for assigning trained reservists to wartime positions in peacetime and for the rapid and differentiated call-up of trained reservists, within the scope set out in the Act on National Defence and the Hungarian Defence Forces;
in ethics proceedings against a healthcare worker: the professional chamber body with competence and jurisdiction to conduct the proceedings;
the bodies performing internal crime prevention and detection tasks, and the counter-terrorism bodies, as defined in the Police Act, in performing their statutory tasks and within the scope of the authority granted therein;
in a post-mortem examination: the doctor performing the examination;
the transport safety body, during technical investigations under the Act on the Technical Investigation of Air, Rail and Water Transport Accidents and Other Transport Incidents, and under Regulation (EU) No 996/2010 of the European Parliament and of the Council of 20 October 2010 on the investigation and prevention of accidents and incidents in civil aviation and repealing Directive 94/56/EC. (Section 23 of Act XLVII of 1997)

Processors:

Kardisoft Kft. (medical software)

Registered office: Csokonai u. 29, 9024 Győr

Company registration number: 08 09 012232

Tax number: 13293369-2-08

Comnica Kft. (recorded telephone calls)

Registered office: Mohai út 38, 1119 Budapest

Telephone: 36 1 255 0990

Email: info@comnica.com

ActiveCampaign LLC (newsletters, online test platform)

160 Shelbourne Rd, Dublin, D04 E7K5, Suite 03-101, Dublin, Dublin, 2

https://www.activecampaign.com/contact

KBOSS.hu Kft. – számlázz.hu (accounting)

Registered office: 1031 Budapest, Záhony utca 7.

Company registration number: 01-09-303201

Tax number: 13421739-2-41

Docca Zrt. (IT services)

Registered office: 1123 Budapest, Győri út 2/C, 2nd floor, door 6

Company registration number: 01 10 141530

Tax number: 27428014-2-43

WhatsApp Ireland Limited (instant messaging service on the websites)

Merrion Road, Dublin 4, D04 X2K5, Ireland

https://www.whatsapp.com/legal/privacy-policy-eea#ea2SG9qUySboIlMvL

12. Rights of the data subject in relation to processing

At the data subject's request, the patients' rights representative will inform them of their rights regarding the handling of medical records, taking into account the Institution's practice. The name and contact details of the patients' rights representative are published on the www.lassjol.hu and https://saintjameshungary.hu/ websites and in the Institution's waiting room.

Data Protection Officer: Consact Kft., Dr Barbara Kőrösi; contact during working hours: +36 30 204 0319; email: korosib@consact.hu.

12.1 Right to prior information

Before the processing of personal data begins, the data subject is entitled to receive written information from the Controller in a transparent, intelligible, clear and easily accessible form. The Controller must provide this information at the latest at the time the personal data is obtained.

Where the controller intends to further process the personal data for a purpose other than that for which it was collected, it must inform the data subject of that other purpose, and of any relevant further information, before the further processing.

12.2 Right of access

The data subject has the right to obtain confirmation from the Controller as to whether or not their personal data is being processed and, where that is the case, access to the personal data and the following information:

a) the purposes of the processing;
b) the categories of personal data concerned;
c) the recipients or categories of recipient to whom the personal data has been or will be disclosed, in particular recipients in third countries or international organisations;
d) where possible, the envisaged period for which the personal data will be stored or, if not possible, the criteria used to determine that period;
e) the existence of the right to request from the Controller rectification or erasure of personal data or restriction of processing, or to object to such processing;
f) the right to lodge a complaint with a supervisory authority;
g) where the personal data is not collected from the data subject, any available information as to its source;
h) the existence of automated decision-making, including profiling, and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

The Controller provides the data subject with a copy of the personal data undergoing processing. For any further copies requested by the data subject, the Controller may charge a reasonable fee based on administrative costs. Where the data subject makes the request by electronic means, the information is provided in a commonly used electronic form, unless otherwise requested by the data subject. The right to obtain a copy must not adversely affect the rights and freedoms of others.

12.3 Right to rectification

The data subject has the right to obtain from the Controller, without undue delay, the rectification of inaccurate personal data concerning them. Taking into account the purposes of the processing, the data subject has the right to have incomplete personal data completed, including by means of providing a supplementary statement.

12.4 Right to erasure (“right to be forgotten”)

The data subject has the right to obtain from the Controller the erasure of personal data concerning them without undue delay, and the Controller is obliged to erase that personal data without undue delay where one of the following grounds applies:

a) the personal data is no longer necessary in relation to the purposes for which it was collected or otherwise processed;
b) the data subject withdraws the consent on which the processing is based, and there is no other legal ground for the processing;
c) the data subject objects to the processing and there are no overriding legitimate grounds for the processing;
d) the personal data has been unlawfully processed;
e) the personal data has to be erased for compliance with a legal obligation in Union or Member State law to which the Controller is subject;
f) the personal data has been collected in relation to the offer of information society services.

Where the Controller has made the personal data public and is obliged to erase it under the above, the Controller, taking account of available technology and the cost of implementation, takes reasonable steps, including technical measures, to inform controllers processing the data that the data subject has requested the erasure of any links to, or copies or replications of, that personal data.

The above does not apply to the extent that processing is necessary:

a) for exercising the right of freedom of expression and information;
b) for compliance with a legal obligation which requires processing under Union or Member State law to which the Controller is subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Controller;
c) for reasons of public interest in the area of public health;
d) for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, insofar as the right to erasure is likely to render impossible or seriously impair the achievement of the objectives of that processing; or
e) for the establishment, exercise or defence of legal claims.

12.5 Right to restriction of processing

The data subject has the right to obtain from the Controller restriction of processing where one of the following applies:

a) the accuracy of the personal data is contested by the data subject, for a period enabling the Controller to verify the accuracy of the personal data;
b) the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of its use instead;
c) the Controller no longer needs the personal data for the purposes of the processing, but the data subject requires it for the establishment, exercise or defence of legal claims; or
d) the data subject has objected to processing, pending verification of whether the legitimate grounds of the Controller override those of the data subject.

Where processing has been restricted under the above, such personal data may, with the exception of storage, only be processed with the data subject's consent, for the establishment, exercise or defence of legal claims, for the protection of the rights of another natural or legal person, or for reasons of important public interest of the Union or of a Member State.

The Controller informs a data subject who has obtained restriction of processing before the restriction is lifted.

12.6 Notification obligation regarding rectification or erasure of personal data or restriction of processing

The data subject has the right to request from the Controller information about the recipients to whom their personal data has been disclosed. The Controller must communicate any rectification or erasure of personal data or restriction of processing to each recipient to whom the personal data has been disclosed, unless this proves impossible or involves disproportionate effort.

12.7 Right to data portability

The data subject has the right to receive the personal data concerning them, which they have provided to the Controller, in a structured, commonly used and machine-readable format, and has the right to transmit that data to another controller, where

a) the processing is based on consent or on a contract, and
b) the processing is carried out by automated means.

In exercising the right to data portability, the data subject has the right to have the personal data transmitted directly from one controller to another, where technically feasible.

The exercise of the right to data portability must not adversely affect the rights and freedoms of others. Where this would be the case, the Controller fulfils the data subject's request without disclosing the personal data concerned and sends the data subject a reasoned explanation.

12.8 Right to object

The data subject has the right to object at any time, on grounds relating to their particular situation, to processing of their personal data that is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Controller, or for the purposes of the legitimate interests pursued by the Controller or a third party, including profiling based on those provisions. In this case, the Controller may no longer process the personal data unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or for the establishment, exercise or defence of legal claims.

Where personal data is processed for direct marketing purposes, the data subject has the right to object at any time to the processing of their personal data for such marketing, including profiling to the extent that it is related to direct marketing.

Where the data subject objects to processing for direct marketing purposes, the personal data may no longer be processed for such purposes.

12.9 Automated decision-making and profiling

The data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them. This does not apply if the decision

a) is necessary for entering into, or performance of, a contract between the data subject and the controller;
b) is authorised by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard the data subject's rights, freedoms and legitimate interests; or
c) is based on the data subject's explicit consent.

In the cases referred to in points (a) and (c), the Controller must implement suitable measures to safeguard the data subject's rights, freedoms and legitimate interests, at least the right to obtain human intervention on the part of the Controller, to express their point of view and to contest the decision.

12.10 Right of the data subject to be informed of a personal data breach

The data subject has the right to be informed of a personal data breach at the Controller affecting them, where the breach is likely to result in a high risk to the rights and freedoms of natural persons.

12.11 Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, every data subject has the right to lodge a complaint with a supervisory authority – in particular in the Member State of their habitual residence, place of work or place of the alleged infringement – if they consider that the processing of their personal data infringes the Regulation.

The supervisory authority with which the complaint has been lodged must inform the complainant of the progress and outcome of the complaint, including the possibility of a judicial remedy.

Hungarian supervisory authority:

Hungarian National Authority for Data Protection and Freedom of Information (NAIH) (postal address: 1363 Budapest, Pf. 9.; registered office: 1055 Budapest, Falk Miksa utca 9-11.; website: www.naih.hu; telephone: +36 1 391 1400; email: ugyfelszolgalat@naih.hu).

12.12 Right to an effective judicial remedy against a supervisory authority

Without prejudice to any other administrative or non-judicial remedy, every natural or legal person has the right to an effective judicial remedy against a legally binding decision of a supervisory authority concerning them.

Without prejudice to any other administrative or non-judicial remedy, every data subject has the right to an effective judicial remedy where the competent supervisory authority does not handle a complaint or does not inform the data subject within three months of the progress or outcome of the complaint.

Proceedings against a supervisory authority must be brought before the courts of the Member State where the supervisory authority is established.

If you have any questions, comments or problems while using the services of Saint James Vision&Aesthetics Center, you can contact us using the details given in this notice. Saint James Vision&Aesthetics Center will inform you in writing of the action taken on your request without undue delay and at the latest within 30 days of receiving it. If necessary, this deadline may be extended by 2 months, stating the reasons for the delay; we will inform you of this within 1 month of receiving your request.

The data subject may withdraw their consent at any time without giving reasons; however, this does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.

Download here: Saint James Eye Centre – Privacy Notice

Annexes included in the downloadable version:

Declaration of change of personal data

Request form for copies of medical records