1. Specijalna bolnica MEDICO (Medico Specialty Hospital), with its registered office in Rijeka, Agati\u0107eva 8, Personal Identification Number (OIB):57951842896 (hereinafter: Medico and\/or the Data Controller), collects and processes certain personal data about you in accordance with this Privacy Statement.<\/p>\n\n\n\n
2. This Privacy Statement applies to all patients, users of medical services, and visitors of the Medico Specialty Hospital.<\/p>\n\n\n\n
3. Through this Privacy Statement, the Data Controller, with the aim of ensuring fair and transparent processing, wishes to provide the users of its services with clear information on the processing and protection of their personal data, and to enable them to easily monitor and manage their personal data and consents.<\/p>\n\n\n\n
4. Medico is committed to protecting privacy and personal data.<\/p>\n\n\n\n
5. If you have any questions regarding the protection of personal data, please feel free to contact us by e-mail at gdpr@medico.hr<\/a> or in writing at the address of the Data Controller’s registered office (as stated in point 1 of this Statement).<\/p>\n\n\n\n 6. The Medico Specialty Hospital has appointed a Data Protection Officer. You may contact the Data Protection Officer directly with inquiries relating to the processing of your personal data and the exercise of your rights by e-mail at dpo@medico.hr or in writing at the address of the Data Controller’s registered office, marked “for the attention of the Data Protection Officer.”<\/p>\n\n\n\n 7. We reserve the right to amend this Privacy Statement at any time, for any reason. Users will be notified of any change to this Privacy Statement on the website www.medico.hr (hereinafter: the Website).<\/p>\n\n\n\n 8. We may occasionally remind you of this Privacy Statement, while the version in force is always available on the Website.<\/p>\n\n\n\n The legal basis for collecting the aforementioned personal data, other than personal data collected through video surveillance and contact data, is the performance of our statutory obligations (the Medical Practice Act, the Healthcare Records Act) in the field of healthcare, i.e. the performance of the service agreement, and other regulations governing our activity, which regulate the manner and retention period of medical findings as well as their mandatory content. Part of the identification data is collected on the basis of accounting regulations governing the mandatory content of invoices. Contact data is collected when necessary for the performance of a contract, or in order to take steps at the request of the data subject prior to entering into a contract. Recording by surveillance camera is carried out on the basis of the Data Controller’s legitimate interest, which consists in protecting the safety of service users, staff, and the institution’s property. The video surveillance covers exclusively: corridors, the waiting room, staircases, the entrance door, and the external perimeter.<\/p>\n\n\n\n Only incoming telephone calls from patients\/users to the telephone number 072 100 700 \u2013 the Data Controller’s call centre \u2013 are recorded. Recorded telephone conversations relate to incoming calls concerning appointments (scheduling, checking, cancelling, or complaints), and the sole purpose of this processing is to improve service quality, while the legal basis is the Data Controller’s legitimate interest. In addition, for the sake of transparency, the data subject (patient\/user) calling the aforementioned telephone number is informed immediately upon connection that the call is being recorded. Contact data for sending findings and promotional materials (by e-mail only) is collected on the basis of the data subject’s consent.<\/p>\n\n\n\n Data relating to the use of the website (point 7 above) is processed on the basis of the Data Controller’s legitimate interest and the data subject’s consent, where such consent is required (analytics technologies, marketing technologies, promotional communications, and other purposes for which consent is required under applicable regulations).<\/p>\n\n\n\n The following categories of data may be processed when visiting or using the website:<\/p>\n\n\n\n (i)) Technical and device data<\/strong> (device and operating system type, browser type and version, IP address or data derived from the IP address, technical device or browser identifiers, browser language, date and time of access, data necessary for the security and technical functioning of the Website). Such data may be processed to ensure the secure and proper functioning of the Website, to detect technical issues, and to protect information systems.<\/p>\n\n\n\n (ii)) Data on website usage<\/strong> \u2013 where appropriate consent has been given for such processing, where required, data on the manner of using the Website may be processed, for example: pages and content visited, duration of visits, order in which pages are viewed, interactions with content, source of arrival at the Website, data on the campaign through which the user arrived at the Website, and data on the technical performance and use of individual Website functionalities. Such data is used to analyse Website usage, improve user experience, measure the effectiveness of digital content, and, subject to appropriate consent, measure the effectiveness of marketing activities.<\/p>\n\n\n\n (iii)) Online forms, contact, and appointment booking<\/strong> \u2013 when a user voluntarily completes a contact form, an inquiry form, an appointment-booking form, or another available functionality via the Website, Medico may process data that the user has provided themselves, for example: first and last name, telephone number, e-mail address, content of the inquiry, selected service or reason for contact, and other data the user voluntarily provides through the form. Such data is processed in order to respond to the inquiry, contact the user, arrange an appointment, take steps at the request of the data subject prior to entering into a contract, or perform the contract, i.e. provide the healthcare service. If a user voluntarily submits data relating to their health condition via an online form, such data is processed in accordance with the rules applicable to special categories of personal data, and solely to the extent necessary for the relevant purpose of providing the healthcare service or communicating with the patient.<\/p>\n\n\n\n (iv)) Cookies and similar technologies<\/strong> \u2013 The Website uses cookies and similar technologies to enable technical functioning, improve functionality, analyse Website usage, and, subject to appropriate consent, measure the effectiveness of marketing activities. For details, please visit the Cookie Policy<\/a> (www.medico.hr).<\/p>\n\n\n\n Necessity of providing personal data: given the statutory obligation to maintain medical records and issue invoices, most of the personal data we collect from you is necessary for us to be able to perform our service. Furthermore, you are not able to decline the collection of personal data through video surveillance\/audio recording of telephone conversations, given that such data is collected on the basis of the institution’s legitimate interest. You are not obliged to provide contact data, and if you have provided it, you may request its deletion at any time. Any consent given for the processing of personal data may be withdrawn at any time.<\/p>\n\n\n\n Medico retains your personal data for the period necessary to achieve the processing purposes described above, within the time limits prescribed by law and other regulations, and, in certain cases, for as long as is reasonable and advisable with regard to statute-of-limitations periods.<\/p>\n\n\n\n Medical findings and imaging diagnostics, i.e. the personal data contained therein, are retained as data of permanent value pursuant to Article 23 of the Healthcare Records Act. Data on outpatient treatment is retained pursuant to Article 23 of the Medical Practice Act for 10 years from the completion of treatment.<\/p>\n\n\n\n Personal data appearing on invoices for services rendered is retained pursuant to the Accounting Act for 11 years from the date it arose.<\/p>\n\n\n\n We retain contact data for as long as necessary for the performance of the contract, or for taking steps prior to entering into a contract. Furthermore, contact data collected on the basis of consent for the purpose of sending findings and promotional materials is retained until such consent is withdrawn, and for a maximum of ten years from the date it arose.<\/p>\n\n\n\n We retain personal data collected via video surveillance for six days from the date it arose, after which it is permanently deleted. We retain personal data collected via telephone call recordings for 90 days, after which it is permanently deleted, except in the exceptional case where recordings have been retained for the purposes of judicial or administrative proceedings, in which case they are retained until such proceedings are concluded.<\/p>\n\n\n\n Personal data collected via the Website is retained only for as long as necessary to achieve the purpose for which it was collected, i.e. in accordance with applicable statutory time limits.<\/p>\n\n\n\n Data submitted via online contact or appointment-booking forms is retained in accordance with the purpose of the communication, the provision of the service, and the applicable rules relating to medical records, once it becomes part of the medical records.<\/p>\n\n\n\n Data related to analytics and marketing technologies is retained in accordance with the settings of the particular systems used, the selected data retention periods, applicable consents, and the rules of the relevant service providers.<\/p>\n\n\n\n More detailed information on the retention periods of individual cookies is available through the Cookie Policy<\/a> or the cookie settings on the Website (www.medico.hr).<\/p>\n\n\n\n Depending on the type of examination or test, the Data Controller may use the services of authorised external associates, including for laboratory tests, reading of findings, and the installation and maintenance of medical devices, and may share your personal data, with your consent or at your request, with selected healthcare institutions and\/or laboratories and\/or other clinics and\/or health insurance providers. Such transfers may relate, for example, to certain types of tests, examinations, or radiological imaging diagnostics (X-ray, MRI, CT, mammography, etc.). At your request, we will gladly share with you the data of external associates depending on the type of test or examination performed.<\/p>\n\n\n\n Medico may share your personal data with third parties in accordance with its contractual obligations to them. This constitutes the Data Controller’s legitimate interest. Such third parties include professional advisers and auditors, suppliers engaged by the Company to provide services on the Company’s behalf and for its account, including IT service providers and event organisers, and other persons engaged by the Company to provide you with services, including courier services, lawyers, experts, and translators.<\/p>\n\n\n\n For the purposes of operating the Website, analytics, IT system maintenance, hosting, security, digital advertising, and other related services, Medico may use external service providers. Depending on their role and the specific service, such providers may act as processors on Medico’s behalf, independent controllers, or joint controllers, in accordance with applicable regulations and the terms of the particular service.<\/p>\n\n\n\n Depending on the technologies actually used, the aforementioned providers may include providers of: web hosting, website maintenance and development, consent management systems, web analytics, digital advertising, cloud and IT infrastructure, and security and technical services.<\/p>\n\n\n\n Where applicable, Medico governs its relationship with processors through appropriate contractual provisions pursuant to Article 28 of the GDPR.<\/p>\n\n\n\n If Medico uses services of companies within the Google group, including Google Analytics and Google Ads, certain data may be processed in accordance with the privacy policies, contractual terms, and settings of the relevant Google services. The scope of processing depends on: the specific services used, the technical configuration, the user’s choice of consent, and applicable data protection rules.<\/p>\n\n\n\n More detailed information on individual cookies, providers, and retention periods is available through the Cookie Policy<\/a> or the cookie management system on the Website (www.medico.hr).<\/p>\n\n\n\n The Data Controller may share personal data with public authorities, e.g. the Croatian Health Insurance Fund, the Croatian Institute of Public Health, the ministry responsible for health, courts, or state agencies, where such sharing of data is necessary, including for the purpose of complying with all legal requirements. Unless prohibited by law, we will make all reasonable efforts to inform you in advance of any such disclosure of your personal data.<\/p>\n\n\n\n The Company does not permit your personal data to be made available to third parties for the purpose of offering third-party products and services, unless you have given your explicit consent for that purpose.<\/p>\n\n\n\n Certain providers of digital, analytics, cloud, or technology services used by Medico may process data outside the European Economic Area. If personal data is transferred to third countries, Medico ensures that an appropriate legal mechanism exists for such transfer in accordance with applicable personal data protection regulations, which may include a European Commission adequacy decision, the European Commission’s standard contractual clauses, or other applicable safeguards.<\/p>\n\n\n\n Medico does not make decisions that produce legal effects concerning a patient or similarly significantly affect them based solely on automated processing of data collected through marketing or analytics technologies.<\/p>\n\n\n\n Certain analytics or advertising platforms may use automated algorithms for measurement, statistical modelling, campaign optimisation, or the selection of advertisement display methods, in accordance with the terms and rules of the relevant service provider.<\/p>\n\n\n\n Such processing does not, in itself, constitute automated medical decision-making by Medico.<\/p>\n\n\n\n In order to protect your health and personal data, Medico applies state-of-the-art technical and organisational protection measures (including data encryption, access control, regular backups, and staff training) in accordance with applicable regulations and information security standards in healthcare.<\/p>\n\n\n\n Medico also applies appropriate technical and organisational measures in relation to the website and related digital systems, including, depending on the system and risk assessment:<\/p>\n\n\n\n a)) Right of access: <\/strong>you have the right to obtain confirmation as to whether or not we are processing personal data concerning you, and, where such personal data is being processed, access to the personal data and the following information: the purpose of the processing, the categories of personal data concerned, the recipients to whom the personal data has been disclosed, and the retention period.<\/p>\n\n\n\n b)) Right to rectification: <\/strong>you have the right to obtain, without undue delay, the rectification of inaccurate personal data concerning you.<\/p>\n\n\n\n c)) Right to erasure: <\/strong>you have the right to request the erasure of personal data concerning you, and such data will be erased if the legal conditions for doing so are met; if the conditions are not met, you will receive a notice explaining why the data cannot be erased.<\/p>\n\n\n\n d)) Right to restriction of processing: <\/strong>you have the right to obtain restriction of processing where the preconditions set out in Article 18 of the General Data Protection Regulation are met.<\/p>\n\n\n\n e)) Right to data portability: <\/strong>you have the right to receive the personal data concerning you in a structured, commonly used, and machine-readable format, and you have the right to transmit that data to another controller where the processing is based on consent or on a contract and is carried out by automated means.<\/p>\n\n\n\n f)) Right to object: <\/strong>you have the right to object, at any time, to the processing of personal data concerning you.<\/p>\n\n\n\n g)) You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.<\/p>\n\n\n\n h)) Withdrawal of consent: <\/strong>if the processing of your personal data is based on consent, you have the right to withdraw that consent at any time by sending an e-mail to gdpr@medico.hr.<\/p>\n\n\n\n i)) Right to lodge a complaint with the supervisory authority: <\/strong>Croatian Personal Data Protection Agency (Agencija za za\u0161titu osobnih podataka), Zagreb, Ulica Metela O\u017eegovi\u0107a 16, e-mail: azop@azop.hr<\/a>.<\/p>\n\n\n\n If you wish to exercise any of your rights guaranteed by the General Data Protection Regulation, please follow the steps below:<\/p>\n\n\n\n You may submit a request to exercise your rights to Medico in the following ways:<\/p>\n\n\n\n Please provide us with a request that is as complete and comprehensible as possible so that we can respond to you and identify you (necessary for the security and technical protection of your data). If you do not provide us with identification data, we will not be able to process your request due to insufficient identification.<\/p>\n\n\n\n We will respond to a submitted request without undue delay, and no later than within one month of the date of receipt of the request, in accordance with the General Data Protection Regulation. The Medico Specialty Hospital will endeavour to respond to simpler requests within a shorter period, generally within eight (8) days of receipt of the request.<\/p>\n\n\n\nTypes of Personal Data Collected, Purpose, and Legal Basis of Processing<\/h2>\n\n\n\n
\n
Personal Data Retention Period<\/h2>\n\n\n\n
With Whom We Share Your Personal Data<\/h2>\n\n\n\n
Automated Data Processing<\/h2>\n\n\n\n
Safeguards<\/h2>\n\n\n\n
\n
Data Subject Rights Relating to the Processing of Personal Data<\/h2>\n\n\n\n
How to Exercise Your Rights<\/h2>\n\n\n\n
\n
Cookie Policy<\/h2>\n\n\n\n