1. What is the purpose of this document?
Ledra clinic, the 'prototype' obstetrics and gynecology clinic is committed to protecting the privacy and security of your personal information. This Patient Privacy Notice describes how we collect and use personal information about you during and after your relationship with us, in accordance with the General Data Protection Regulation (GDPR) (EU) 2016/679 and the Law on the Protection of Individuals with regards to the Processing of Personal Data and the Free Movement of such Data Act of 2018 (Law 125(I)/2018) and any other applicable data protection laws and regulations.
The Clinic is a "data controller". This means that we are responsible for deciding how we hold and use personal information about you. We are required under data protection legislation to inform you regarding the information contained in this Privacy Notice.
2. Information we hold about you
Personal Data, or Personal Information, means any information about an individual from which that person can be identified or identifiable natural person; an identifiable natural person is one whose identity can be ascertained, directly or indirectly, in particular by reference to an identifier identity, such as name, ID no, location data and other. It does not include data where the identity has been removed (anonymous data). There are “special categories” of more sensitive personal data which require a higher level of protection, such as political opinions, religious or philosophical beliefs or members of trade unions, genetic data, biometric data for the sole purpose of identifying a natural person, data on health or gender data of a natural person or sexual orientation. We require to have further justification for collecting, storing and using this type of personal information. It does not include information from which the identity of a natural person has been removed, that is, it has become anonymous. We have in place an appropriate policy document and safeguards which we are required by law to maintain when processing such data.
We will collect, store, and use the following categories of your personal information:
We will also collect, store and use the following “special categories” of more sensitive personal information:
3. How we collect your Personal information
We collect and process various kinds of personal data that we receive from you in the following circumstances:
4. How the Clinic will take advantage of the Children's Personal Data.
5. How the Clinic will use your Information.
Your Personal Information will only be used where permitted by law. For the most part, they will be used in the following circumstances:
6. Cases in which your Personal Data will be utilized.
It is necessary that all the categories of information in the above list (see paragraph 2 above) are paramount to the execution of the contract with you, which includes use for providing medical care services and for compliance with legal liabilities.
In some cases, we may use your personal information to pursue legitimate interests of our own or those of third parties, provided your interests and fundamental rights do not override those interests.
The situations in which we will process your personal information are listed below.
The Clinic will not share your personal data with third parties for their own purposes.
7. Automated decision-making.
Automated decision making takes place when an electronic system processes personal data for decision-making without the intervention of human intervention. The Clinic is not currently working on this kind of process. In case this is necessary, you will be informed in writing before any such process takes place.
8. If you fail to provide personal information.
If you do not provide the required information, we may not be able to enter into a contractual relationship with you for the provision of any services, including medical services, as we will not be able to examine whether your request meets the relevant requirements.
9. Change of Purpose.
We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so. Please note that we may process your personal information without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.
10. Data Sharing.
We may have to share your data with third parties, including third-party service providers and other entities in the Clinic. We require third parties to respect the security of your data and to treat it in accordance with the law. We may transfer your personal information outside the EU. If we do, you can expect a similar degree of protection in respect of your personal information.
Why might you share my personal information with third parties?
We will share your personal information with third parties where required by law, where it is necessary to administer the contractual relationship with you, where you have provided your consent to us to do so or where we have another legitimate interest in doing so.
Which third-party service providers process my personal information?
“Third parties” includes third-party service providers (including IT consultants and designated agents). IT services are carried out by third-party service providers.
How secure is my information with third-party service providers and other entities in our group?
All our third-party service providers and other entities in the group are required to take appropriate security measures to protect your personal information in line with our policies. We do not allow our third-party service providers to use your personal data for their own purposes. We only permit them to process your personal data for specified purposes and according to the guidelines they receive from the Clinic. All service providers to the Clinic have entered into a contract with the Clinic for processing as Executives and accept the Clinic 's confidentiality contract as a legal agreement.
When might you share my personal information with other entities in your group?
We will share your personal information with other entities in our group [as part of our regular reporting activities on company performance, in the context of a business reorganization or group restructuring exercise, for system maintenance support and hosting of data.
What about other third parties?
We may share your personal information with other third parties, for example in the context of the possible sale or restructuring of the business. It may also be necessary to exchange your Personal Information with a Regulatory Authority or for law enforcement purposes. In this case, the Clinic will notify you of your consent to further processing your data as long as the original purpose of processing your data changes.
11. Transferring information outside the EU.
We will transfer the personal information we collect about you to non-EU countries where your doctor, health care professional or nominated recipients (for which you have provided your consent for such transfers) reside or where your health insurance is established. Such transfers will be made for the purposes of performance of your contract with the relevant doctor, health care professional or health insurance, or where your nominated recipients request information about you.
Depending on the country to which your personal data is to be transferred, there might or might not be an adequacy decision by the European Commission in respect to that country. This means that the country to which we transfer your data may or may not be deemed to provide an adequate level of protection for your personal information, but we shall transfer such personal data in compliance with the provisions under applicable data protection laws.
12. Data Security.
We have put in place measures to protect the security of your information. Details of these measures will be available upon request. Third parties will only process your personal information upon our instructions and when they have agreed to treat the information confidentially and to keep it secure.
We have applied appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorized way, altered or disclosed. In addition, we limit access to your personal information to those employees, agents, contractors and other third parties who have due to the nature of their business. They will only process your personal information upon our instructions from the Clinic and are subject to a confidentiality obligation.
We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.
13. Data Retention.
Preservation is ensured for healthcare purposes (as long as it is necessary). In the case of the Clinic, personal data is kept for as long as necessary with a minimum retention time of 15 years after the death of the subject and / or 15 years after the patient's last transaction with the Clinic under the Data Protection Commissioner's Dated 03/07/2018, based on Article 23 (1) (j), Law 138 (I) / 2001.
In some circumstances we may anonymize your personal information so that it can no longer be associated with you, in which case we may use such information without further notice to you.
14. Rights of access, correction, erasure, and restriction.
Your duty to inform us of changes.
It is important that your personal information we hold is accurate and current. Please keep us informed of any personal information amendments during your working relationship with us.
Your rights in connection with personal information.
Under certain circumstances, by law you have the right to:
If you want to review, verify, correct, or request erasure of your Personal Information, object to the processing of your Personal Data, or request that we transfer a copy of your personal information to another party, please contact the Data Protection Officer in writing:
SIZERRO MANAGEMENT LTD c/o Christoforos Christoforou
No fee usually required.
You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive.
What we may require from you?
We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is another appropriate security measure to ensure that personal information is not disclosed to any person who has no right to receive it.
Right to withdraw consent.
In the limited circumstances where you may have provided your consent to the collection, processing and transfer of your personal information for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. To withdraw your consent, please contact the Data Protection Officer. Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so in law.
Data Protection Officer.
We have appointed a Data Protection Officer (DPO) Christoforos Christoforou to oversee compliance with this privacy notice. If you have any questions about this privacy notice or how we handle your personal information, please contact the DPO. You have the right to make a complaint at any time to the Data Protection Office, the Cypriot supervisory authority for data protection issues at firstname.lastname@example.org or the phone no 99512278.
Right to lodge a complaint.
If you feel that your concerns and questions have not been fully answered by us regarding the use of your data, you have the right to submit a complaint. You also have every legitimate right to file a complaint with the Office of the Personal Data Protection Commissioner at https://www.dataprotection.gov.cy, which is the supervisory authority for personal data protection issues in Cyprus.
15. Cookies Policy
This page uses session cookies. These are generated when the site is automatically called and deleted. They are used for identification if you revert back to the site in a short period of time, to take account of the defaults already made. Personal data are not stored or processed.
Cookies are intended to make the website user-friendly. Some cookies remain stored on your device until you delete them. They allow the site administrator to identify the browser you are using the next time you visit the site. If you don't want this, you can set your browser to inform you about setting cookies. However, disabling cookies may limit the functionality of the site.
16. Rights of access, correction, erasure, and restriction