Information for people related or close to patients
Introductory information
Our core business is the provision of health care, whether it is preventive care, diagnostic care, dispensary care, treatment, assessment care, medical rehabilitation care, nursing care or palliative care.
All of these types of healthcare have one thing in common - in order to carry out the healthcare, we need to know a range of your personal data, especially what can be described as sensitive data. This data is mainly data about your health, in some cases also genetic data, data about your sex life and other data that are part of everyone's most sensitive sphere.
In justified cases, we also need to process personal data about you, persons close to our patients. We process data about you that we need to enable you to exercise the rights you are entitled to as a close patient.
We carefully select all persons who may have access to your personal data, whether they are our employees or suppliers. We consider trust and high data security to be one of our top priorities in our business.
What data do we process about you? Why do we process this data about you and what is our legal basis for doing so?
For persons close to patients, the data processed may be mainly identification data, i.e. your name, surname, date of birth, signature. This personal data is processed about you for the purpose of verifying your identity, or also for the purpose of making entries in the medical records when consulting, taking copies and extracts, as well as when giving so-called proxy consent for the provision of a certain health service.
To this extent, the personal data of the patients' legal and other representatives, as well as of any other persons designated by the patient in his or her expression of will as having the right to obtain information on health status, are also processed. The processing of this data is necessary for the fulfilment of the legal obligation of the organisation, and the legal obligation is also the legal basis for the processing.
If the patient wishes to be informed or contacted in the event of any event, we also process your contact details, in particular your telephone number.
In the course of providing healthcare services, it may happen that we learn information other than the above. This information may be provided by a person close to you, such as a family member, if we need to know, for example, their family history. Please pay attention to the patient section of this information regarding the storage and access to this data, as your data will be treated similarly.
In what form is my personal data processed?
We process your data in both electronic and paper form. As your personal data is essentially part of the medical records kept on your loved one, it is kept in a similar form.
To whom can we disclose your personal data?
We manage your personal data within our organisation and we only pass it on to third parties with your consent. However, in some cases we may need to pass your personal data to other recipients without your consent.
In some cases, we are required by law to pass your data on to others. In particular, this will involve disclosure of your data to public authorities (e.g. social security authorities, courts, etc.).
In order to ensure that we provide you with quality care, we also use external suppliers in some cases, in particular for technical support of our information system or management of the medical devices we use in the provision of healthcare. These activities may involve the processing of some of your personal data. External suppliers are in the position of so-called processors and have a written contract with us which obliges them to follow strict principles when handling your data. In this case, your consent is not required for the purpose of carrying out the processing activity, as such processing is directly permitted by law. Please know that we choose our suppliers according to strict criteria, so you do not have to worry about your data. Currently, the following categories of processors process your personal data.
We do not transfer your personal data abroad as a matter of principle. This can only happen exceptionally if you give your consent or if this is required by law.
How long do we keep your personal data?
Your personal data is kept for as long as is strictly necessary. As we overwhelmingly process your data in connection with the provision of healthcare to your loved one, we need to keep it for the period of time that the law requires us to keep their medical records. This period is therefore set by regulation and is between 5 and 100 years, or 10 years after the patient's death, depending on which part of the medical record is involved.
What rights do you have in relation to your personal data?
As a data subject, the law gives you a number of rights. As healthcare cannot be provided without processing the personal data of patients and their relatives, some of your rights are limited by law. However, as a person close to the patient, you have the following rights in relation to your personal data.
Right of access to personal data
You obviously have the right to know what data is being processed about you, for what purpose, for how long, where we obtained the data, whether and to whom we are transferring it. You also have the right to be informed of other rights relating to this data. This document is mainly intended to inform you, however, we are ready to provide you with confirmation or clarification on any point of this information.
If you ask us to do so, we will also provide you with a copy of the personal data processed without undue delay. We are entitled to charge a reasonable fee for this copy, particularly if it is requested repeatedly, in relation to administrative costs. If you make this request in electronic form, we will automatically assume that you are also interested in receiving the information in electronic form. However, you have the option to request it in another way. Please note that the right to obtain a copy of the personal data processed cannot adversely affect the rights of other persons.
Right to rectification of personal data
If you discover that the personal data we process about you is inaccurate or incomplete, you have the right to request that we complete or correct it without undue delay.
Right to restriction of processing of personal data
This right allows you to request, in certain cases, that certain of your personal data be marked and not be further processed for a certain period of time. This is not the same as the right to erasure, as the restriction of processing is not permanent. You have the right to have us restrict the processing of your personal data if:
- you contest the accuracy of the data we process about you for the time necessary to verify its accuracy,
- the processing is without legal basis (e.g. beyond the data we are entitled to process) but you prefer to restrict the processing instead of erasing it, for example because you expect to provide us with the data in the future anyway,
- we no longer need to process your personal data but you require it for the establishment, exercise or defence of legal claims,
- you object to the processing (see the next point in the notice for this right).
If processing is restricted, the data may only be processed with your consent or for the establishment, exercise or defence of legal claims, for the protection of the rights of another person, whether natural or legal, or for reasons of important public interest.
Right to object to the processing of personal data
You may only exercise your right to object to the processing of your personal data where we would process some of your personal data in the public interest or on the basis of our legitimate interest. If this happens, we will only continue to process your personal data if we can demonstrate compelling legitimate grounds for doing so (in particular, if we need it to establish, exercise or defend legal claims).
With regard to the provision of healthcare services, as mentioned above, we process your personal data in the vast majority of cases on the basis of the law. This right is therefore not available to you as a close patient in principle.
Right to complain to a supervisory authority
The exercise of the rights set out so far is without prejudice to your right to lodge a complaint with the Data Protection Authority using the contact details set out at the beginning of this document. You can file a complaint at any time when you have doubts about whether your personal data is being processed as it should be, i.e. unlawfully or in breach of the law.
Right to erasure
In some cases, as a data subject, you also have the right to have your personal data erased. We generally delete your personal data when we no longer need it and have no legal basis for processing it. We will also delete your data if it has been processed on the basis of consent and that consent has been withdrawn.
Please note that even if this is one of the grounds for erasure, it does not mean that we will immediately delete all your personal data. This right does not apply if the processing of the personal data is still necessary for compliance with our legal obligations, for archiving purposes, for scientific or historical research or statistical purposes, or for the establishment, exercise or defence of legal claims.
Right to withdraw consent
Where your personal data is processed on the basis of consent, you also have the right to withdraw consent at any time. However, the withdrawal of consent will not affect any previous processing that we have carried out prior to the withdrawal of consent.
How can I exercise individual rights?
For all matters relating to the processing of your personal data, whether it is an enquiry, exercising a right, making a complaint or otherwise, you can contact our Data Protection Officer in the following ways:
- by post or in person at U Nemocnice 1, 128 00 Prague 2,
- by e-mail at poverenec@uhkt.cz,
We will process your request without undue delay, but within a maximum of one month. In exceptional cases, in particular due to the complexity of your request, we are entitled to extend this period by a further two months. We will, of course, inform you of any such extension and the reasons for it.