Information on Personal Data Processing

Personal data controller (PDC):
FertiCare SE

Business ID No.: 01386620

With its registered seat at:
Radlická 3185/1c, 150 00 Praha 5

Place of business:
Bělehradská 1042/14, 360 01 Karlovy Vary

Website: www.ivf-kv.cz

PDC contact: gdpr@ivf-kv.cz

(hereinafter the “Institution”)

What information will you learn from this document?

  • Definitions
  • Why do we process your personal data and on what legal basis?
  • What data categories do we process and from what sources?
  • To whom can we transfer the data and where can they get?
  • How do we handle the data and for how long?
  • What are your rights?

1. Definitions

Personal data:
Information concerning an identified or identifiable natural person
Data subject:
Identified or identifiable natural person
Personal data controller:
Natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data
Personal data processor:
Natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller

2. Why do we process your personal data and on what legal basis?

We are a private institution specialised in providing general as well as specific health care services (planned health care, diagnostic health care).

Personal data protection is of utmost importance to us, which is why we always proceed in accordance with legal regulations and the best practice of international standards. You will learn from the following paragraphs about our purposes and legal bases for processing your personal data.

Processing of personal data on the basis of legal obligations

In some cases, legal regulations stipulate our obligation to process your personal data. It concerns data processing namely for the following purposes:

  1. Provision of general health care services, provision of specific health care services (Health Services Act, Specific Health Services Act, Protection of Public Health Act, Pharmaceuticals Act, etc.);
  2. Ensuring the quality and safety of human tissues and cells intended for human application (Human Tissues and Cells Act, Decree on detailed requirements for the safeguarding of the quality and safety of human tissues and cells intended for human application, Directives of the European Parliament, etc.);
  3. Provision and payment of health care services reimbursed from public health insurance (Public Health Insurance Act, Civil Code, etc.);
  4. Accounting, tax consulting, and payroll management (Accounting Act, Tax Consulting Act, Civil Code, Labour Code, etc.);
  5. Handling of records and documents, record-keeping, classification, distribution, storage, shredding and archiving thereof (Medical Documentation Decree, Act on Archiving and Documentary Services, Cybersecurity Act, etc.).

In this case, your consent to the processing of personal data is not required in order to process your data.

Processing of personal data under a contract

Processing associated with our activities:

  • Health care services in the scope of registration pursuant to Act No. 372/2011 Coll., on health services and the terms and conditions for providing such services, as amended, and Act No. 373/2011 Coll., on specific health care services, as amended;
  • Lease of properties, apartments and non-residential premises without rendering other than basic services ensuring due operation of the properties, apartments and non-residential premises;
  • Manufacture, sale and services not included in Annexes 1 through 3 of the Trade Licensing Act.

We process your personal data and, if necessary, also the personal data of other persons concerned on the above basis.

We are unable to offer or provide our services to you without processing such data. In this case, your consent to the processing of personal data is not required in order to process your data.

Processing of personal data on the basis of legitimate interests

Another reason for the processing of personal data is the protection of your and our rights and interests as well as the interests of other persons. This reason includes the following operations:

  • Processing of personal data strictly necessary for the purposes of fraud prevention;
  • Direct marketing within the limits of legitimate expectations;
  • Reporting of any criminal offences or threats to public safety by the controller, and transmission of affected personal data pertaining to a criminal offence or threats to public safety to the competent authority;
  • Internal functions necessary for our activities (audit, controlling, IT operations, accounting and tax records, administration, etc.).

It is possible to raise an objection against the processing based on legitimate interests. The objection shall be reviewed and the facts proving whether the given processing complies with the requirements of the regulations assessed. For more information about your rights, see the information provided below.

In this case, your consent to the processing of personal data is not required in order to process your data.

Processing of personal data is necessary for the performance of tasks of the controller carried out in the public interest or in the exercise of an official authority or in any vital interest

Processing of personal data in this case is stipulated by the Czech or EU legislation, has a specific legal basis and pursues a legitimate aim. It concerns the following activities:

  • Scientific research;

We adhere to the principle of data minimisation and personal data pseudonymisation; we apply the principle of proportionality and necessity.

  • Statistical purposes;

We adhere to the principle of data minimisation and personal data pseudonymisation; we apply the principle of proportionality and necessity.

  • Protection of vital interests of the data subject or of another natural person;
  • Monitoring of epidemics and the spread thereof;
  • Natural and man-made disasters;
  • Employment law;
  • Social security, including pensions;
  • Purposes of health, health security, including public health;
  • Health care services management;
  • Settling reimbursement claims and services in the health insurance system;
  • Determination, performance or protection of legal claims (in judicial, administrative, or non-judicial proceedings).

In this case, your consent to the processing of personal data is not required in order to process your data.

Processing of personal data with the consent of the data subject

If we have no legal basis for the processing of personal data (see above), we process your personal data with your consent.

With your consent, we may process your personal data for the following purposes:

  • Providing services;
  • Transfer of data to other personal data controllers for separate processing except for the purposes of providing planned health care and diagnostic health care;

The data subject’s consent shall be given by an unambiguous confirmation; consent shall mean any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her whether as a written, including electronic format, or oral declaration.

Provision of such consent shall be voluntary. The consent to the processing of personal data may be withdrawn at any time. Withdrawal of consent shall be without prejudice to the previous processing of personal data.

3. What personal data categories do we process and from what sources?

We process personal data that we need to perform our activities. This means all the data necessary for the provision of health care. Where necessary, we process personal data of other persons (family members, relatives, etc.).

When providing health care services and performing related activities we process the following categories of personal data:

  • Identification data (name, surname, title, date of birth, birth identification number, social security number, health insurance company, ID card number, address of permanent residence);
  • Contact information (mailing address, telephone number, e-mail address, and other similar information);
  • Descriptive and socio-demographic data (gender, status, nationality, profession, education, employer, referring physician, private gynaecologist, etc.);
  • Special category data – sensitive data (genetic, biometric data, health condition, sex life and sexual orientation, family history, etc.);
  • Information on transactions (all payments and reimbursements, including the relevant payment information);
  • Written and electronic communication, including telephone communication;
  • Camera records (obtained in order to protect property and persons);

Where do we collect your personal data from?

We collect personal data:

  • From patients to whom we provide general and specific health care services in our Institution;
  • During performance of our own activities (especially information gathered during the provision of general and specific health care services);
  • From other personal data controllers if it is necessary for the provision of general and specific health care services;
  • From other persons (job seekers, employees, close persons, etc.);
  • Operational data (data of contractual partners, data from attendance lists, etc.).

4. To whom can we transfer personal data and where can they get?

Personal data may be processed not only by the controller, its employees and its staff but also by contractual processors or other controllers involved in providing our services. These are namely the following categories of processors/controllers:

Category 1 Diagnostic laboratories

Category 2 Health insurance companies

Category 3 Private physicians (applicants for the provision of health care services)

Category 4 IT system administrators

Category 5 Processors of financial, payroll and tax operations

Category 6 State administration authorities – State Institute for Drug Control, Tax Office, Regional Social Security Administration, National Health Information System, Regional Hygiene Station, Police of the Czech Republic, etc.

Category 7 Commercial insurance companies

Category 8 Law offices

Category 9 Auditors, accreditation companies

Category 10 Other assisted reproduction centres

Category 11 Documentation processors

Category 12 Others

Other categories of entities to whom data may be transferred

Other third parties (such as the Police and other public authorities) may gain access to personal data if they have a statutory reason to have access to such data.

Confidentiality

All persons cooperating with us and handling personal data when performing their labour or contractual obligations are bound by confidentiality and comply with sufficient standards safeguarding the security of your personal data.

When can we transfer data abroad?

Your personal data may be transferred to be processed within the EU and the EEA (e.g., other assisted reproduction centres, IT technology providers, or other recipients listed above). In accordance with the legal regulations, we are allowed to transfer personal data also to countries outside the EU/EEA but only in such cases when assurance of the relevant security measures and evidence of safeguards of the handling of such data in accordance with the relevant legal regulations are provided.

5. How do we handle the data and for how long?

The processing shall be done in manual as well as automated regimes employing various applications and software.

For how long do we keep the data?

The personal data record-keeping and archiving period depends on several factors regarded the given specific situations in which the personal data are to be processed. Our Institution follows the guidelines from the Filing and Shredding Rules. After termination of the provision of care, the personal data are still processed

in order to protect our or your rights and interests, for the minimum necessary time period for their securing or execution. The time periods may vary on the basis of the type of personal data processing, or of the right the given data are relevant to. In case of some documents, we are obliged to retain the data contained therein for the time period stipulated by generally binding legal regulations (namely in the areas of accounting, tax and revenue, labour-law-related issues, archiving and filing services, in accordance with the regulation on health care documentation).

In case of the provision of consent, the data processing shall continue until the consent is revoked, unless otherwise directly stated in the consent. You may withdraw your consent at any time and thus terminate the processing of your data.

6. What are your rights?

In regard to your personal data processing, you are entitled to exercise the following rights:

Right to information:
You have the right to obtain at your request information prior to and during the processing. At your request, we shall inform you whether your personal data are being processed and further, if you so request, we shall also notify you of the purposes, data categories, recipients (their categories), time period of retention (criteria), your rights including the option of turning to the supervisory authority, the data sources (if not provided by you), automated individual decision-making and transferral to third countries, or international organisations (appropriate safeguards).

Right of access:
Besides the information regarding processing, you are entitled to a copy of all the data concerning your person being processed.

Right to rectification:
The controller should be processing data which are accurate; when an inaccurate piece of information is discovered, you have the right to that part of data to be corrected.

Right to erasure (Right to be forgotten):
You have the right to have your data erased but only when there are no other existing legal reasons for their processing which the controller can apply (including protection of their legitimate interests and rights).

Right to data portability:
You have the right to obtain the processed data, which are processed on the basis of consent or on the basis of entering into or performing a contract and which you have yourself provided or which directly arise from your activities, in machine-readable format. The above stated applies to automated data processing only.

Right to object to processing:
Applies to cases of data processing performed due to the general public interest adhered to by the controller, or due to the controller’s own legitimate interest, including direct marketing. You have the right to object to such processing, and the controller shall be obliged to consider and assess such processing as far as it is complying with all the rules required by the regulations. In case of direct marketing, such processing shall always be suspended when an objection is raised.

Right to withdrawal of consent:
In case of data processing based on your consent, you are entitled to withdraw such consent at any time in writing via e-mail to the e-mail address gdpr@ivf-kv.cz, in which you shall describe the manner of withdrawal of your consent.

Right to restriction of processing:

You are entitled to require restriction of processing of your data if any of the following applies:

- You contest the accuracy of the data for a period enabling the controller to verify the accuracy of the personal data;

- The data are not necessary for the purposes of the processing but you require their processing for the establishment, exercise or defence of legal claims;

- You have objected to the processing pending verification of whether the legitimate grounds of the controller override your legitimate grounds;

- The data processing was unlawful and you oppose the erasure of the personal data and request the restriction of their use instead.

Automated individual decision-making:
In cases where automated individual decision-making takes place and has substantial consequences for you (for instance, it would lead to a contract not being concluded, rejection of a payment, alterations in contracted services, etc.), you have the right to have such decision reviewed, to express an opinion on the same, and as the case may be, to contest the same.

The right to bring proceedings before a supervisor, a court:
You are entitled to bring proceedings before the supervisory body – The Office for Personal Data Protection (Úřad na ochranu osobních údajů – www.uoou.cz), or a court.

How can you exercise your rights?

  • in electronic form to: gdpr@ivf-kv.cz
  • personally, at the following venue: FertiCare SE, Bělehradská 1042/14, 360 01 Karlovy Vary

Visiting the website – cookies

When you visit our website, cookie files are processed. Some of these files enable us to make the website function properly and to link your activities whilst browsing the web.

The collection of cookie files for such purpose may be considered as personal data processing. Such processing is possible on legal grounds – the legitimate interest of controllers as stipulated by Art. 6(1)(f) of Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (formerly and hereinafter the “Regulation”).

The website may be used also in a mode disabling the collection of data of website visitors – you can choose such mode of operation either in the settings of your web browser, or you may raise an objection to such data collection based on the legitimate interest of the controllers in accordance with Art. 21 of the Regulation via e-mail to ​gdpr@ivf-kv.cz. Your objection shall then be assessed immediately, at the latest within 30 (thirty) days of receipt thereof. Cookies necessary for the functioning of the website shall be stored only for the time period strictly necessary for the functioning of the website.

Should you object to the processing of technical cookies necessary for the operation of websites, the full functionality and compatibility of such websites cannot be guaranteed.

Cookies collected for the purpose of counting website visits and creating statistics related to the traffic and behaviour of website visitors are evaluated in aggregate and pseudonymised form.

For the purpose of targeting promotional offers on other websites and social networks, we submit the data about your website behaviour also to those websites and networks.

Cookies for targeting advertisements are processed on the basis of your consent derived from your browser settings. You provide your consent for the time period stated hereinbelow for different marketing cookies. The consent to collect cookie files data for marketing purposes can be withdrawn at any time by changing the settings in the relevant web browser, or as the case may be via the above-stated contact address ​gdpr@ivf-kv.cz.

Use of the cookies of some providers can be deactivated directly at:

Cookies are stored for the time period stated hereinbelow for individual types of cookie files, to a maximum of 24 (twenty-four) months from their last usage.

The collected cookie files are processed by other processors:

  • Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland, IČ 368047), VAT IE6388047V
  • Seznam.cz, a.s. (Radlická 3294/10, Prague 5, 150 00), Business ID No. 26168685
  • Adform A/S (Wildersgade 10B, Copenhagen DK-1408, Denmark), VAT DK34194661
  • Facebook Ireland Limited (4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland), VAT IE9692928F

The processors subsequently process the cookie files in accordance with their terms and conditions, which you can find at the following links:

You may withdraw your consent to the usage of cookie files by third parties at any time by switching off this function in your browser or mobile device settings. 

On their websites, the controllers collect the following cookie files:

Service/Type

Cookie name

Purpose

Expiration

facebook.com

fr

Cookies are used in order to identify the Facebook user and the browser for the advertisement system of Facebook.

3 months

ivf-kv.cz

referer_log

Cookies serve for the recording of internal data of the editing system.

10 years

ivf-kv.cz

cookies-allowed

Cookies serve for the recording of information on whether or not the user has consented to the notification cookie banner.

10 years

ivf-kv.cz

ci_session_ivf-kv_cz

Cookies serve for necessary operation of the website and the editing system.

Session

ivf-kv.cz

_gid

Cookies are used by Google Analytics to distinguish users.

2 years

ivf-kv.cz

_ga

Cookies are used by Google Analytics to distinguish users.

1 day

ivf-kv.cz

NID

The NID cookie file contains a unique ID by which Google retains in memory your settings and other information, for example, your preferred language (e.g., Czech), the number of search results you wish to display on one page (e.g., 10 or 20), and whether you would like to have the Safe Google search option on

6 months

Google

GAPS

Cookie file serving for the operation of Google services, such as the selection of relevant advertisements, enhancing campaign performance reviews, and blocking advertisements the user has already seen from displaying again.

2 years

YouTube

YSC,

Cookies help track the number of video views and user preferences based on which other videos are recommended once the video ends.

8 months

YouTube

VISITOR_INFO1_LIVE,

Cookies help track the number of video views and user preferences based on which other videos are recommended once the video ends.

6 months

YouTube

PREF

Cookies help track the number of video views and user preferences based on which other videos are recommended once the video ends.

8 months

YouTube

GPS

Cookies help track the number of video views and user preferences based on which other videos are recommended once the video ends.

1 day

YouTube

IDE

Cookies serve for displaying relevant advertisements of the DoubleClick system.

1 year

Contact us

FertiCare SE
Radlická 3185/1c , Praha 5, 150 00

Our clinics:
FertiCare Karlsbad Fertility:
Bělehradská 1042/14, Karlovy Vary
FertiCare Prague:
Radlická 3185/1c, Praha 5

© 2014 - 2019