Privacy Policy & Information on Personal Data Processing

1. Data Controller and DPO Information

The data controller is Care&Cure Clinic (the “Clinic”). In accordance with Article 37 of the GDPR, the Clinic has not appointed a Data Protection Officer (DPO), as its core activities do not involve large-scale, systematic monitoring of data subjects. All inquiries regarding personal data should be directed to [director@care-cure.cz].

2. Scope of Processed Data

The Clinic processes personal data provided directly by you or collected during the provision of healthcare services, including:

• Identification and Contact Data: Name, date of birth, ID/passport number, address, and contact information.
• Special Categories of Data (Health Data): Medical history, diagnoses, lab results, and therapeutic protocols.
• Financial and Insurance Data: Health insurance details, billing records, and payment history.

3. Legal Grounds for Processing

• Legal Obligation (Art. 6(1)(c) & Art. 9(2)(h) GDPR): Processing required under Act No. 372/2011 Coll. (Health Services Act) for maintaining medical documentation and reporting to health insurance providers.
• Performance of Contract (Art. 6(1)(b) GDPR): Necessary for the provision of medical and administrative services requested by the patient.
• Legitimate Interests (Art. 6(1)(f) GDPR): Protection of Clinic rights, enforcement of unpaid claims, and organizational security (e.g., appointment reminders).
• Consent (Art. 6(1)(a) GDPR): Only applicable for purposes outside of medical care (e.g., marketing) where express consent is given.

4. Necessity of Data Provision

Providing your personal and health data is a statutory and contractual requirement. Without this information, the Clinic cannot establish a patient relationship or legally provide healthcare services under Czech law.

5. Data Recipients and Transfer

Your data may be disclosed to ensure continuity of care and legal compliance:

• Public Authorities: Health insurance companies and state health registries.
• Specialized Processors: IT providers (medical software), accounting firms, legal and tax advisors.
• Continuity of Care: Other healthcare providers if necessary for treatment.
• External Premium Coordination: If you request the Clinic to arrange a priority or VIP appointment with an external specialist, you explicitly acknowledge and agree that your identification and basic health data (relevant to the referral) may be shared with specialized third-party coordinators or medical brokers. These entities act as independent controllers or processors and are engaged solely to facilitate your access to external healthcare services.

Note on Security: All processors are bound by confidentiality agreements and must implement technical and organizational security measures. The Clinic does not transfer data outside the EU/EEA.

6. Data Retention Periods

• Medical Documentation: Retained as mandated by Decree No. 98/2012 Coll. (typically 10 years after the last visit, varying by case type).
• Contractual Data: Processed during the agreement and for 4 years after termination to protect Clinic’s legitimate interests.
• Legal Disputes: Data may be kept longer if required for ongoing litigation or administrative inspections.

7. Your Rights as a Data Subject

• Access (Art. 15 GDPR): Obtain a copy of processed data and information about processing methods.
• Rectification (Art. 16 GDPR): Correct inaccurate or incomplete data.
• Erasure (“Right to be Forgotten”) (Art. 17 GDPR): Limited; medical records required by law cannot be erased.
• Restriction of Processing (Art. 18 GDPR): Limit processing during disputes over data accuracy.
• Data Portability (Art. 20 GDPR): Receive your data in a structured, machine-readable format.
• Right to Object (Art. 21 GDPR): Object to processing based on legitimate interests.
• Withdrawal of Consent: If processing is based on consent, it may be withdrawn at any time without affecting prior lawful processing.

8. Right to Lodge a Complaint

If you believe your data is being handled unlawfully, you have the right to lodge a complaint with the Office for Personal Data Protection (Úřad pro ochranu osobních údajů) at www.uoou.cz.

Patient Rights & Responsibilities

1. Right to Professional Care and Human Dignity

In accordance with Section 28 of Act No. 372/2011 Coll., every patient has the right to receive health services at an appropriate professional level (náležitá odborná úroveň). Services are provided with full respect for the patient’s dignity, privacy, and physical integrity, without discrimination based on gender, religion, or nationality.

2. Right to Informed Consent and Information

• Information Access: Patients have the right to be informed about their health status and the proposed treatment plan.
• Pre-Treatment Disclosure: Prior to any intervention, physicians will explain the purpose, nature, expected benefits, and potential risks of the procedure.
• Right to Refusal: Patients may refuse a health service (Informed Disagreement/Negative Reverse), unless Czech law requires treatment without consent (e.g., life-threatening situations).
• Language Access: As a facility specialized for international patients, we provide information in a language the patient understands to ensure valid consent.

3. Protection of Privacy and Confidentiality (GDPR)

The Clinic strictly adheres to the General Data Protection Regulation (EU) 2016/679 and the Czech Personal Data Processing Act. Medical staff are bound by professional secrecy (mlčenlivost).

• Personal and health data will not be shared with third parties without explicit written consent, except when legally required (e.g., reporting infectious diseases).

4. Access to Medical Documentation

Under Section 65 of Act No. 372/2011 Coll., patients (or authorized representatives) have the right to:

• View their medical records in the presence of a designated staff member.
• Request a copy or extract of the records (an administrative fee may apply).
• Request correction of inaccurate factual data. Requests should be sent to HR@care-cure.cz.

5. Right to Feedback and Formal Complaint

• Submission: Complaints can be sent to director@care-cure.cz.
• Procedure: The Clinic will review complaints and provide a written response within the statutory period (usually 30 days). Filing a complaint does not affect the right to seek further review through the Czech Trade Inspection (ČOI) for consumer matters.

6. Patient Obligations (Clinic Safety Clause)

To ensure the safety of our staff and the continuity of care, patients are required to:

• Provide Truthful Information: Disclose accurate health history and infectious disease status.
• Follow the Treatment Plan: Cooperate with medical staff as directed.
• Respectful Conduct: Avoid aggressive, abusive, or discriminatory behavior toward staff.
• Financial Responsibility: Settle all “self-paid” fees (non-insured services) immediately upon completion of the service.

Legal Note: Under Section 48(2)(d) of the Health Services Act, the Clinic reserves the right to terminate the healthcare relationship if a patient grossly violates their obligations or the Clinic’s Operating Rules.