Data Protection and Privacy Policy

Regarding the health services and other services of Saint James Hospital Hungary Egészségügyi és Szolgáltató Kft.

1. Controller’s name and information:

Saint James Hospital Hungary Egészségügyi és Szolgáltató Kft. (hereinafter referred to as the Controller, the Establishment)

Mailing address: 1026 Budapest, Hungary, Szilágyi Erzsébet fasor 33-35.

Phone: 06 1 788 2927

E-mail:

Website: www.lassjol.hu

Trade register number: 01 09 876654

Representative(s): Jean Claude Muscat, Zentai Balázs

Data protection officer: Consact Kft., dr. Kőrösi Barbara

Contact details of the data protection officer: , 06 30 2040319

At Saint James Hospital Hungary Kft. it is our priority to strictly adhere to the legal regulations in order to protect health data and personal data of our patients, and to respect the right of the patients to informational self-determination. We process the recorded personal data and health data in a manner that ensures confidentiality, in accordance with the data protection regulations and the professional guidelines; and we take all security, technical and organisational measures that ensure the security of personal data.

The current, valid version of this Privacy Policy is available at the websites www.lassjol.hu and http://stjameseyeclinic.co.uk, at the reception and other places in our establishment. 

2. Legal provisions serving as the basis for processing

The following legal provisions serve as bases for our data processing activities regarding health and personal data:

• Act CXII of 2011 on the right to informational self-determination and on the freedom of information;
• Act CLIV of 1997 on healthcare;
• Act XLVII of 1997 on the processing and protection of health data and related personal data (hereinafter: Health Data Act);
• Government Decree 43/1999. (XII. 3.) on the rules of financing medical services from the Health Insurance Fund;
• Act CL of 2017 on the rules of taxation;
• REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter: General Data Protection Regulation, GDPR).

The Privacy Policy applies to:

• all organisational units of the Establishment that provide health service(s), all organisations carrying out supervision or monitoring related to professional matters, and staff members who process personal data or health data;
• all natural persons using public or private financed healthcare provided by our Establishment, and all natural persons whose personal data is processed by the Controller (hereinafter: data subject);
• all personal identification data and health data processed under the provisions of act XLVII of 1997 on the processing and protection of health data and related personal data (hereinafter: Health Data Act);
• third party service providers who are or will be connected to data processing, that process personal data belonging to the scope of data processing of the Establishment or are involved with the personal data.

3. The purposes of the processing of health data

Personal identification data and health data may be processed for the following purposes:

• promoting, maintaining and improving health;
• facilitating successful medical treatment provided by the medical care body, including supervisory activities;
• tracking the health status of the data subject;
• taking measures concerning public health and epidemics;
• enforcing patient’s rights;
• following individual patient itinerary.

Besides the abovementioned purposes, personal data and health data may be processed only in cases defined by law, for the purposes prescribed therein, for compliance with legal obligation. 

For the purposes mentioned above, health data and identification data may only be processed in the amount and type that are specified by law and professional rules, and that are absolutely necessary.

4. Definitions

GDPR: REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation);

personal data: means any information relating to the data subject; such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person; 

special categories of personal data: personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation;

processing: means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction; preventing consultation and further use of data, taking photos, audio or visual recording, recording physical characteristics suitable for personal identification (e.g. fingerprint, palm print).

Controller: means the natural or legal person, or body without legal personality which, alone or jointly with others, determines the purposes and means of the processing of personal data; makes and executes or has the processor execute decisions pertaining to the data processing.

Processor: means a natural or legal person, or body without legal personality which processes personal data on behalf of the controller;

Data subject: an identified or identifiable natural person who can be identified, directly or indirectly, based on one or more factors, by reference to an identifier; An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or by one or more factors;

Transfers of personal data: disclosing personal data to a specified third party. Transfers to EEA Member States or to bodies of the European Union shall be considered as transfers within the territory of Hungary.

data erasure: making the data unrecognisable by deletion of content or by any other means that enables an equivalent result. 

personal data breach: means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed;

EEA Member State: any Member State of the European Union and any State which is party to the Agreement on the European Economic Area, as well as any State the nationals of which enjoy the same legal status as nationals of States which are parties to the Agreement on the European Economic Area, based on an international treaty concluded between the European Union and its Member States and a State which is not party to the Agreement on the European Economic Area;

third country: any state that is not an EEA state;

NAIH: Hungarian National Authority for Data Protection and Freedom of Information; the supervisory authority of Hungary with regards to GDPR.

5. Principles relating to processing of personal data

Personal data shall be: 

• processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and transparency’); 
• collected for specified, explicit and legitimate purposes only (‘purpose limitation’); 
• adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’); 
• accurate and kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (‘accuracy’);
• kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed (‘storage limitation’); 
• processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’). 
• As Controller, we are responsible for compliance with these principles, and we can prove this compliance when necessary (‘accountability’).

6. Data processed

1. 1. 6.1. Communication

Data subjects: all natural persons who provide their contact data via the website/e-mail/phone/social media platform messages.

The purposes of the processing: Communication

Processing: 

We process the personal data you provide in order to communicate. 

Providing such data is voluntary; however, without it, we will be unable to communicate with you effectively. 

You have the right to withdraw your consent at any time without providing a reason. Please note that such withdrawal will not affect the lawfulness of processing carried out prior to the withdrawal.”.

1. 2. Booking appointment for/registering patients to use private healthcare services (websites, social media platforms, via phone or e-mail, in person)

Data subjects: Persons willing to use private healthcare service(s)

The purposes of the processing: Making an appointment, preparing contract.

Processing: 

When booking an examination via the booking system on our website or any other way (via phone, e-mail or in person), we are going to use your personal data listed above to book your appointment and arrange for the examination. 

We register the data electronically in our medical software.

Providing such data is voluntary, however, you will not be able to book an examination, and we will not be able to start arranging for the examination unless you provide us with the data. You may withdraw your consent at any time without giving reasons, but such withdrawal shall not affect processing based on consent before the withdrawal. 

1. 3. Recorded calls

Data subjects: Persons applying for private health services via phone

The purposes of the processing: Making an appointment, preparing contract.

Processing: 

We do not store such data, but can access them via the host interface. Calls of persons applying for private health services via phone are recorded at the website call centre interface (Comnica).

Providing such data is voluntary, however, you will not be able to book an examination, and we will not be able to start arranging for the examination unless you provide us with the data. If you do not wish to consent to the call being recorded, you may book your examination in person, via our website or via e-mail. You may withdraw your consent at any time without giving reasons, but such withdrawal shall not affect processing based on consent before the withdrawal. 

1. 4. Making a contract

Data subjects: Persons registering for surgery

The purposes of the processing: Entering into and performance of a contract.

Processing: 

We use and process personal data received during the contract procedure, provided by the Data Subject, throughout the duration of the contractual relationship, exclusively for the purposes of fulfilling the contract, and for communicating. 

We store the data in paper form and electronically (using medical software).

We shall use the abovementioned data in order to enter into and perform a contract. Providing such data is optional. However, we will not be able to perform the surgery unless you provide us with the relevant data.

1. 5. Registering medical data – keeping medical files of patients, using medical software, transferring of data to EESZT (National eHealth Infrastructure)

Data subjects: Persons using health services

The purposes of the processing: Examination, treatment, keeping medical records

Processing: 

The provision of such personal data is mandatory pursuant to applicable laws and regulations. Failure to provide the required information may result in the inability to register your data. The data will be recorded in our medical system and transferred to EESZT (National eHealth Infrastructure).

1. 6. Consent form for surgery

Data subjects: Persons applying for surgery

The purposes of the processing: Confirming that the patient received the necessary information on surgery

We use data of persons registering for surgery in order to prepare the consent form for the surgery.

Providing such data is optional, however, we will not be able to give you the necessary information regarding the surgery unless you provide us with the data. You may withdraw your consent at any time without giving reasons, but such withdrawal shall not affect processing based on consent before the withdrawal.

1. 7. Prescriptions

Data subjects: Patients

The purposes of the processing: Making prescriptions

Processing: 

Based on examination, it might be necessary to prescribe medication to the patient. Prescriptions are printed out from the medical system containing the abovementioned data. 

The relevant legal regulations state that it is compulsory to provide such personal data. Should the patient not provide the necessary data, we would not be able to make the prescription.

Data are transferred to the EESZT, and data may be transferred to the competent authorities upon inquiry.

1. 2. Online testing

Data subjects: Persons completing the online test via the website

The purposes of the processing: Assessing eligibility for surgery

Processing: 

We do not store such data, but can access them via the hosting provider’s interface. Data of persons taking the online test are recorded in the hosting provider’s interface (Activecampaigne).

Providing such data is optional, however, we will not be able to assess your eligibility regarding the surgery unless you provide us with the data. You may withdraw your consent at any time without giving reasons, but such withdrawal shall not affect processing based on consent before the withdrawal. 

1. 3. Fulfillment of contractual obligations related to the Controller’s business operations

Data subjects: Contracting party or its representative

The purposes of the processing: Performance of a contract.

Processing: 

We use and process personal data provided by the client, throughout the duration of the contractual relationship, exclusively for the purposes of fulfilling the order, and for communication. 

When we receive the personal data of the partner’s employees, usually to enable communication, we process such data on the basis of legitimate interest. Pursuing the legitimate interest of the parties shall override the employee’s right to have control of his or her personal data, as the restriction is necessary and proportionate for the employee to perform his or her job (NAIH/2018/2570/2/V).

Regarding data processing based on the Controller’s legitimate interest, we have performed a balancing test regarding necessity and proportionality of data processing and the results show that processing is lawful. 

The Data Subject shall have the right to object to the processing of personal data (for details please see section 12.8).

Providing the data is optional; however, it is necessary for us to know your personal data suitable for identification and communication in order to fulfil an order.

Data may be transferred to the accountant and to persons listed in the contract.

1. 4. Invoicing

Data subjects: Patients

The purposes of the processing: Invoicing process

Processing: 

When issued for natural persons, invoices may contain personal data. We retain invoices in accordance with the provisions of the Act on Accounting.

The relevant legal regulations state that it is compulsory to provide the personal data. The invoice cannot be issued otherwise.

The data shall be stored electronically (using számlázz.hu). Invoices are transferred to the accountant.

1. 5. Sending newsletters

Data subjects: Persons subscribing to the newsletter.

The purposes of the processing: Sending newsletters.

Processing: 

Providing such data is optional; however, we will not be able to send you newsletter unless you provide us with the data. The Data Subject may withdraw consent at any time without giving reasons, but such withdrawal shall not affect processing based on consent before the withdrawal. 

For receiving newsletters, data should be registered via Activecampaign online interface, and the data will be stored there.

1. 6. Taking photos or videos of patients for commercial purposes

Data subjects: Patients

The purposes of the processing: Commercial marketing

Processing: 

Providing such data is optional. The Data Subject may withdraw consent at any time without giving reasons, but such withdrawal shall not affect processing based on consent before the withdrawal. 

1. 7. Social media

When the user decides to like or follow any of the Controller’s social media sites, we may also acquire the following data of the user: profile name, profile’s URL, profile identifier, profile picture, address stated, sex/gender, birthday, introduction. In relation to the personal data provided by the visitors on social media sites, we are not acting as Controller. It is the operator of the Social Media site who is considered the Controller, and the operator’s terms on data protection and services shall apply.

1. 8. Cookies

When the User visits our website, we place cookies (small data files) in the User’s web browser and in HTML-based e-mails, in accordance with this Privacy Policy.

Cookies are small data files that are placed on your computer when you visit a website. They are saved and stored by your web browser. Cookies enable us to see the time the User last logged in to our website. The main purpose of cookies is to make personalised offers and advertisements available for the User, to personalise the User experience and meet the User’s personal needs and preferences when using our website.

Cookies are used for a number of useful purposes.

• Safety: to support and ensure safety, and help the Controller to detect illegal activities.
• Preferences, characteristics and services: cookies can show to the Controller the User’s language and communication preferences, and help the User to fill out forms on the website by simplifying the process.
• Advertisements: the Controller may use cookies to show advertisements relevant to the User, on and outside the website. We may use cookies that show whether Users who have seen a certain advertisement on the website visited the advertiser’s website later. 
• Performance, analytics and research: these cookies help the Controller to learn about the website’s performance in different places. The Controller may use cookies that assess, improve and search the website, the product, functions, services, including the User’s visiting the website via other websites, or devices such as the User’s computer or mobile device.

Checking and controlling cookies:

Upon your first visit to our website, we offer you detailed information and configuration options for the cookies we use, in a pop-up window.

Most browsers have the option for the Users to control cookie settings. However, restricting the use of website cookies may lead to poor user experience, as the website would not be personalised any more. 

7. General rules regarding the processing of health data

When collecting data, the time and date of collecting, and the name of the person collecting the data must be recorded in the medical documents.

Every entry in the patient’s medical records must be signed or marked by initials, and dated (if necessary). When processing is carried out electronically, the person making the entry must be clearly identified by the system.

Data related to patient’s examination and treatment are recorded in the medical records. Medical records must be kept in such a way that they always reflect the progress and current state of the patient’s care.

During the treatment process the data prescribed by the relevant professional regulations must be recorded in the medical records. Besides recording the obligatory data, it is the treating physician who decides which medical data should be recorded in accordance with the rules of the profession.

Data that are not directly connected to the patient’s treatment must not be recorded in the medical records, unless such data are relevant to the patient’s care. Medical records and personal data of the patient during treatment may only be accessed by authorised persons.

Without temporal limitations, all employees of our Establishment and all persons under employment-related relationship with us are under the obligation of confidentiality regarding patients’ health data and other data learnt in connection with work. The obligation of confidentiality is irrespective of how the person learnt the data. Consequently, it is not only the treating physician and other professional staff members who are under the obligation of confidentiality, but every staff member of the Establishment.

The patient may release someone from the obligation of confidentiality in writing. When transfer of data is required by legal regulations, the Establishment is obliged to transfer data.

8. Access to data and measures to ensure security of personal data
   1. Access to data

The Establishment records the name, title and department of the employees processing data in the medical data processing register.

Within the medical care network the following persons are eligible to process health data and personal identification data:

• the Director of the Establishment;
• the Medical Director of the Establishment;
• the treating physician;
• nurse specialists and nurses involved in the patient’s treatment;
• the employee responsible for appointments and patient reception; 
• the data protection officer.

When data is processed electronically, signature is replaced by electronic user name together with password. Within the organisational unit/department, the person exercising employer’s rights is responsible for keeping the records and authorising access. The owner of a password shall be held responsible for keeping the password confidential, and for any misuse of password. The Establishment only uses electronic system that can handle passwords confidentially. When data is processed electronically, the system logs entries.

When data is processed manually, the controller or the person modifying data is identified by comparing the person’s signature to the signature sample in the records.

8. 2. Measures to ensure security of personal data

The Controller shall implement appropriate technical and organisational measures to ensure protection against unauthorised or unlawful processing and against accidental loss, destruction or damage and to ensure accuracy, completeness and up-to-date status of data.

Within the scope of its information technology and digital data protection duties, the Controller ensures:

• appropriate measures are taken to prevent unauthorised access to personal data, such as

• • preventing access – computers and computerised databases containing personal information can only be accessed using valid permission that is identifiable (user name and unique password), and passwords for access are changed in every three months;
  • system protection – password-protected Wi-Fi, router with protection to provide firewall between the inner network and the Internet;
  • protection of network and data files against viruses;
  • physical protection of data files and carriers (archiving, fire regulation, closed server).

• In order to ensure safe storage of data, the Controller saves the total of the central server’s data files daily. The data carrier with the saved data is stored safely in the place designed and used for this purpose.

The files containing data are erased permanently when the purpose of processing is fulfilled, or when deadline for processing is reached, legal basis ceased.

In order to ensure proper safety of personal data stored and processed in a paper form, the Controller takes the following measures:

• paper documents are only accessible to employees with a permission to access (filing/archiving rules);
• the employee carrying out data processing during and in connection with medical care must lock up the documents handled as prescribed, then lock the place of data processing, or store the documents in a place where constant supervision is available because of continuous presence of the medical staff. (lockable cabinet, lockable office);
• During transportation to/from, examination of or procedure involving the patient in another Establishment, medical documents must be handed to the person from the medical staff who is responsible for the examination or procedure, or the person who is responsible for the admission. The handing over of the documents must be recorded in the medical records, indicating time/date and signed by the person taking over. Correctness of data must be checked.
• The Controller stores paper documents in a lockable, dry room suitable for storing paper documents, protected against fire and equipped with property protection equipment (filing room/archives).

The documents containing data are shredded in a provable method when the purpose of processing is fulfilled, or when deadline for processing is reached, legal basis ceased (using document shredder, registering in records).

9. Modification and erasure of data

The Data Subject must inform the Controller in writing when there is a change in personal data during the treatment period. The changes must be reported using the form ‘Declaration of changes in personal data’. The Data Subject may request rectification or erasure of the Data Subject’s personal data. For further information please see the chapter ‘Rights of the Data Subject’.

Erasure: the Controller physically destroys data that was processed manually. When data is stored electronically, for erasure the Controller shall alter them in a way that they cannot be restored. Erasure must be carried out with the joint permission of the data protection officer and the director of the establishment. The Controller keeps a record of such erasures. In the event that medical documents are of scientific significance, the Controller shall transfer the documents to the competent archives, after the compulsory retention period.

After having personal data collected, incorrect personal data or incorrect health data shall be corrected or erased by the Controller in such a way, that the originally recorded data would be recognisable. Modifications must be marked with signature/initials. When data is processed electronically, the system identifies the person making the entry and logs the entry unambiguously.

10. Providing health data for the Data Subject or for relatives

The patient (or legal guardian) has the right to request information on the patient’s identification data and health data, view medical records, and request a free copy of the medical records. All further copies are subject to a fee based on the cost items defined in the ministerial decree.

During the patient’s care, the right to request information is due not only for the patient and the legal guardian, but for the person authorised in writing by the patient. After the end of the patient’s care, the right to request information is due not only for the patient and the legal guardian, but for the person authorised in writing by the patient in a private document with full evidential value.

Requests regarding viewing documents or getting copies must be submitted to patient reception.

Requests need to be made in person, with providing personal identification, or in writing, in form of a private document with full evidential value. Eligibility to request information must be proved by the person making the request, by presenting ID card with photograph suitable to provide proof of identity (e.g. ID card, new type of driver’s licence), and presenting proof of eligibility (social security card, birth certificate, marriage certificate, certificate of death, a private document with full evidential value).

Verbal requests must be written down, attached to the patient’s records and stored with them.

In the event a request for data is made not by the data subject, unless the request is based on statutory obligation, the person making the request must provide proof of identity and proof of eligibility by:

• an authorisation handwritten and signed by the data subject; or
• an authorisation written and edited on an electronic device, printed, signed by the data subject, and two witnesses; or
• an authorisation by the data subject in the form of a private document with full evidential value.

In such cases the document proving eligibility must be attached to the request. 

A record of the requests and the actions taken (provision or refusal to provide data) is kept by the Patient Control Officer.

First copies are handed out free of charge. All further copies are subject to a fee based on the cost of the items defined in the ministerial decree. The Establishment shall inform the person requesting data on the amount of payment in writing. Payment should be made by a bank transfer to the Establishment’s account, or by cash payment to the house cashier.

Both sides of every page of the paper copies provided for the person making the request must be stamped with the Establishment’s stamp and dated. Electronic copies made for data carriers are considered to be copies, including taking photographs or scanning.

The Controller shall authenticate and sign the copy, and give it to the data subject, or to the person authorised, provided that the authorisation includes taking copies, in person at the place where the request was filed, or send it via postal service as registered mail, as per the person’s request. The person requesting a copy shall be given the copy in the form defined in the request, if possible. When handing the copies out in person, the person requesting the copies must identify himself/herself, and sign and date to acknowledge the date and fact of receiving the data.

When sending document containing health data for the Data Subject in electronic mail, the document must be protected by password.

Relatives acquiring health data related to the cause of death or about treatment before death of the deceased person

In the event of death of the data subject, upon written request, the data subject’s legal guardian, close relative, and heir are entitled to view, make or receive a copy of:

• the medical records, and data concerning or possibly concerning the cause of death; and
• data concerning treatment before death.

Investigating/disclosing causes influencing the lives of relatives, learning about healthcare related data in the patient’s life and after the patient’s death

When the patient is alive, or after the death of the patient, the spouse, lineal relatives, siblings, heirs and life partner of the patient shall be entitled to exercise right to inquire data, provided that the medical data is necessary

• in order to investigate causes influencing the life and/or health of spouse, lineal relative(s), sibling(s), life partner or descendants, or
• for the medical treatment of the abovementioned persons, and
• the medical data cannot be learnt or concluded from elsewhere,
• the head of the treating unit confirms that the document copies inquired contain medical data only concerning or possibly concerning the cause of death, and medical treatment before death, or
• health data stated in the request, directly concerning causes defined by law.

When the relative only requests viewing of the documents, the head of the treating department shall cater for the relative’s right and inform the relative, under the restrictions mentioned above. The viewing of documents must be registered (by indicating time and date of viewing, the data of the person viewing, and the signature of the person allowing/monitoring the viewing).

11. Transfer of data, data processors

After the examination of the patient, the treating physician records the data as regulated by point F of Section 35 of the Health Data Act in EESZT (National eHealth Infrastructure). Unless explicitly prohibited by the data subject in writing, the general practitioner and the treating physician of the data subject are eligible to learn about the data concerning medical care acquired under the obligatory health insurance in a way that the health insurance body provides the data upon electronic inquiry. The general practitioner may learn the data of the insured person registered in that GP’s practice. The data subject and/or the data subject’s legal guardian may prohibit other joint controller or EESZT user from accessing the data subject’s/the represented minor’s recorded data, by issuing a statement of self-determination. Privacy Policy of the EESZT (National eHealth Infrastructure): https://e-egeszsegugy.gov.hu/adatvedelem. Contact data of the Controller for EESZT:

Állami Egészségügyi Ellátó Központ (National Healthcare Service Providing Center)

Seat: 1125 Budapest, Diós árok 3.

Phone number: 06 1 356 1522

E-mail:

Transfer of data to organisations outside the healthcare service providing network: Upon written request of the following organisations, the treating physician and the healthcare insurance body shall transfer personal data suitable for identification and health data, if the requesting body is entitled by law to process such data. In accordance with Section 4 (4) of the Health Data Act, the requested health data and the identification data must be stated in the request, including data acquired through medical statement made by the healthcare provider. Requests may be made by the following bodies:

1. 1. 1. in criminal cases, the court, the prosecution service, the investigating authority, the body conducting preparatory proceedings, judicial expert, in civil contentious or other proceeding and in administrative cases, the administrative authority, the court, the prosecution service, judicial expert,
      2. in infraction proceedings, the bodies carrying out the proceedings;
      3. for persons liable or potentially liable to military service, metropolitan and county government offices, military directory body and central data processing body of the Hungarian Defence Forces, and the committee assessing military aptitude;
      4. national security services for the purposes of carrying our tasks set in Act CXXV of 1995 on national security services, under the authorisation provided therein;
      5. military directory body and central data processing body of the Hungarian Defence Forces, in order to list trained reserve soldiers for military roster and be able to call in such trained reserve soldiers quickly and in a differentiated manner, under the scope of the Act on Hungarian Defence Forces;
      6. when there is an ongoing ethical proceeding against a healthcare worker, the authorised and competent body of chamber;
      7. the police organ performing internal crime prevention and crime detection tasks, or the counter-terrorism police organ as defined in the Act on Police, for the purposes of carrying out tasks set in the Act, under the authorisation provided therein;
      8. the doctor conducting the inquest of death;
      9. the safety investigation authority in professional accident investigations, as defined in the act on aviation, railway, navigation accidents and other transportation incidents, and in the REGULATION (EU) No 996/2010 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 20 October 2010  on the investigation and prevention of accidents and incidents in civil aviation and repealing Directive 94/56/EC. (Section 23 of the Act XLVII of 1997)

Data processors:

Comnica Kft. (recorded calls)

Seat: 1119 Budapest, Mohai út 38.

Phone: 00 36 1 255 0990

E-mail:

Activecampaign LLC (newsletter, online testing interface)

160 Shelbourne Rd, Dublin, D04 E7K5, Suite 03-101, Dublin, Dublin, 2

https://www.activecampaign.com/contact

KBOSS.hu Kft.  – számlázz.hu (accounting)

Seat: 1031 Budapest [Hungary], Záhony utca 7.

Trade register number: 01-09-303201

Tax number: 13421739-2-41

TRIOX INFORMATIKA Műszaki Kereskedelmi és Szolgáltató Kft. (IT Services)

Seat: 2112 Veresegyház [Hungary], Liszt Ferenc utca 8. a. ép.

Trade register number: 13 09 208718

Tax number: 13316460-2-13

WhatsApp Ireland Limited (instant messaging service via websites)

Merrion Road, Dublin 4, D04 X2K5, Ireland

https://www.whatsapp.com/legal/privacy-policy-eea#ea2SG9qUySboIlMvL

12. The Data Subjects rights related to processing

Upon the patient’s request, the patient representative provides the data subject with information on the data subject’s rights related to managing medical records with regard to the general practice of the Establishment. Name and contact details of the patient representative are displayed at www.lassjol.hu and http://stjameseyeclinic.co.uk, as well as in the waiting room of the Establishment. 

Data protection officer: Consact Kft., dr. Kőrösi Barbara. Contact (during office hours): 06-30 20 40319; e-mail: ; mailing address: Saint James Hospital Hungary Egészségügyi és Szolgáltató Kft., 1026 Budapest, Szilágyi Erzsébet fasor 33-35.

1. 1. 12.1.Right to information

The data subject shall have the right to receive information prior to processing of personal data in a transparent, intelligible, clear and easily accessible form in writing from the Controller. The Controller shall provide the information when personal data are obtained the latest.

Where the Controller intends to process the personal data for a purpose other than that for which they were collected, the Controller should provide the data subject prior to that further processing wit36h information on that other purpose and other necessary information.

12. 2. 12.2.Right of access

The data subject shall have the right to obtain from the Controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and the following information:

a) the purposes of the processing;

b) the categories of personal data concerned;

c) the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations;

d) where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;

e) the existence of the right to request from the Controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing;

f) the right to lodge a complaint with a supervisory authority;

g) where the personal data are not collected from the data subject, any available information as to their source;

h) the existence of automated decision-making, including profiling, and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

The Controller shall provide a copy of the personal data undergoing processing. For any further copies requested by the data subject, the Controller may charge a reasonable fee based on administrative costs. Where the data subject makes the request by electronic means, and unless otherwise requested by the data subject, the information shall be provided in a commonly used electronic form. The right to obtain a copy shall not adversely affect the rights and freedoms of others.

12. 3. 12.3.Right to rectification

The data subject shall have the right to obtain from the Controller without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

12. 4. 12.4.Right to erasure (‘right to be forgotten’)

The data subject shall have the right to obtain from the Controller the erasure of personal data concerning him or her without undue delay and the Controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies:

a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;

b) the data subject withdraws consent on which processing is based, and where there is no other legal ground for the processing;

c) the data subject objects to the processing, and there are no overriding legitimate grounds for the processing;

d) the personal data have been unlawfully processed;

e) the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the Controller is subject;

f) the personal data have been collected in relation to the offer of information society services.

Where the Controller has made the personal data public and is obliged pursuant to the points above to erase the personal data, the Controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform Controllers which are processing the personal data that the data subject has requested the erasure by such Controllers of any links to, or copy or replication of, those personal data.

The points stated above shall not apply to the extent that processing is necessary:

a) for exercising the right of freedom of expression and information;

b) for compliance with a legal obligation which requires processing by Union or Member State law to which the Controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Controller;

c) for reasons of public interest in the area of public health;

d) for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in so far as the right to erasure is likely to render impossible or seriously impair the achievement of the objectives of that processing; or

e) for the establishment, exercise or defence of legal claims.

12. 5. 12.5.Right to restriction of processing

The data subject shall have the right to obtain from the Controller restriction of processing where one of the following applies:

a) the accuracy of the personal data is contested by the data subject, for a period enabling the Controller to verify the accuracy of the personal data;

b) the processing is unlawful and you oppose the erasure of personal data and request the restriction of their use instead;

c) the Controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims; or

d) the data subject has objected to processing pending the verification whether the legitimate grounds of the Controller override those of the data subject.

When processing has been restricted in accordance with the points above, such personal data shall, with the exception of storage, only be processed with the data subject’s consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.

A data subject who has obtained restriction of processing shall be informed by the Controller before the restriction of processing is lifted.

12. 6. 12.6.Right to notification regarding rectification or erasure of personal data or restriction of processing

The data subject has the right to request from the Controller information about the recipients to whom the personal data have been disclosed. The Controller shall be obliged to communicate any rectification or erasure of personal data or restriction of processing to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort.

12. 7. 12.7.Right to data portability

The data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to the Controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller, where:

a) the processing is based on consent or on a contract; and

b) the processing is carried out by automated means.

In exercising his or her right to data portability, the data subject shall have the right to have the personal data transmitted directly from one controller to another, where technically feasible.

Exercising the data subject’s right to data portability shall not adversely affect the rights and freedoms of others. Should that be the case, the Controller shall comply with the right of the data subject to data portability without disclosing the personal data supported by that fact, while informing the subject in details.

12. 8. 12.8.Right to object

The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on the performance of a task carried out in the public interest or in the exercise of official authority vested in the Controller, or for the purposes of the legitimate interest pursued by the Controller or by a third party, including profiling based on those provisions. The Controller shall no longer process the personal data unless the Controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.

Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing, which includes profiling to the extent that it is related to such direct marketing.

Where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes.

12. 9. 12.9.Automated decision-making, profiling

The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her. This shall not apply if the decision:

a) is necessary for entering into, or performance of, a contract between the data subject and a data controller;

b) is authorised by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests; or

c) is based on the data subject’s explicit consent.

In the cases referred to in points a) and c), the data Controller shall implement suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the Controller, to express his or her point of view and to contest the decision.

12. 10. 12.10.Right to communication of a personal data breach to the data subject

When a personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, the Controller shall communicate the personal data breach to the data subject.

12. 11. 12.11.The data subject’s right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, every data subject shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement if the data subject considers that the processing of personal data relating to him or her infringes the Regulation.

The supervisory authority with which the complaint has been lodged shall inform the complainant on the progress and the outcome of the complaint including the possibility of a judicial remedy.

Supervisory authority of Hungary as Member State:

Nemzeti Adatvédelmi és Információszabadság Hatóság [Hungarian National Authority for Data Protection and Freedom of Information] (postal address: 1363 Budapest, Pf. 9., seat: 1055 Budapest, Falk Miksa utca 9-11., website: www.naih.hu, phone number: 06-1-391-1400, e-mail address: ).

12. 12. 12.12.Right to an effective judicial remedy against a supervisory authority

Without prejudice to any other administrative or non-judicial remedy, each natural or legal person shall have the right to an effective judicial remedy against a legally binding decision of a supervisory authority concerning them.

Without prejudice to any other administrative or non-judicial remedy, each data subject shall have the right to an effective judicial remedy where the competent supervisory authority does not handle a complaint or does not inform the data subject within three months on the progress or outcome of the complaint lodged.

Proceedings against a supervisory authority shall be brought before the courts of the Member State where the supervisory authority is established.

Should you have any questions, comments or problems when using the services of Saint James Hospital Hungary Kft., please contact us using the contact details listed in this Privacy Policy. Saint James Hospital Hungary Kft. shall provide information on action taken on a request to the data subject without undue delay and in any event within 30 days of receipt of the request.  That period may be extended by two further months where necessary. We shall inform you of any such extension within one month of receipt of the request, together with the reasons for the delay.

Appendices:

DECLARATION_OF_CHANGES_IN_PERSONAL_DATA

REQUEST_FOR_COPY_OF_MEDICAL_RECORDS