Personal Data Management Policy

Welcome to FTPREMIUM CLINIC SA – THERAPIS .We want to provide you with our services with a commitment to protecting and respecting your privacy. For purposes of this update, we will be referred to here as the “Organization”.

With this policy we inform you of the way we collect and use information concerning you, as provided by the current legislation (General Data Protection Regulation 679/2016 as well as the law 4624/19). At the same time, we describe your rights regarding the personal data we process and the measures to protect your privacy. Personal data is the information based on which a person can be identified. Indicatively, the information about your name, the information available to your insurance provider (public or private) to identify you, your e-mail account are mentioned. Sensitive personal data, biometric and genetic, are those data related to your health (article 4, par.13,14,15 GDPR) and identify you.

WHERE THE POTENTIAL RISK TO PERSONAL DATA MAY COME FROM

This Policy helps the Organization to protect itself from risks which, among others, may include:

• Breach of confidentiality. That is, information that can be given to someone without the necessary authorization and competence to process it.
• Lack of choice of the subject of the ways of keeping and processing data concerning him
• Damage to reputation of the Organization in case of illegal access to personal and sensitive personal data.

WHAT THE LAW DEFINES

In order to proceed with the processing of the data concerning you, the existence of a specific legal basis is necessary.

The Organization keeps and processes personal data in the context of the execution of its contractual obligations, as provided by law (Article 6 GDPR par.1) but also to safeguard the vital interests of the subjects of the aforementioned personal data.

In order for the Organization to be in harmony with the law, while keeping and processing personal data (electronic or paper records), certain basic principles need to be followed, which are:

• to do so with a lawful cause,
• for a certain purpose,
• accurately and by observing only the necessary data.
• In addition, personal data must be accurate and up-to-date, in accordance with the rights of the subject,
• kept only for the time necessary and protected by appropriate technical and organizational means.
• In case they are transferred outside the European Union, this must be done legally.      

THE TYPE OF PERSONAL DATA WE PROCESS

The Organization collects:

• Your first name, last name, contact details, sometimes your date and place of birth. Also, details related to the compilation of your medical file, in order to serve your medical practice and your relationship with the Organization. Collection of personal data in the event of the patient’s incapacity during admission can be provided by the attendant, the attending physician or by the EMS in case of patient transfer
• In case of communication with you and vice versa, we will keep a file with details of this communication. Possibly also the content of your own judgments for third parties.
• Internet connection and communication data also related to the media and applications you use. In any case, our telephone communications may also be recorded to serve the purposes of the Organization to provide quality services.
• If you are an employee or customer of the Organization, we may collect data about your gender, nationality and documents capable of identifying you. Also data for payroll purposes, numbers linked to tax and insurance data and everything considered necessary for the termination of a contractual relationship.
• In our facilities there is closed circuit monitoring (CCTV) to record possible malicious activity, as provided by law. In these frames image and movement are recorded and kept for a short time.
• The Organization reserves the right to control, monitor, record, use the content of the data kept in it and processed through the electronic systems it maintains. The same applies to data kept in paper files (folders).
• On our website www.therapy-hospital.gr we use a traffic parameterization application for statistical reasons (cookies) for which we heartily encourage you to find out at https://www.aboutcookies.org/ and the transmission of data from the relevant contact form are subject to the security conditions of the respective applications, including their encryption methods.   

REASON FOR HOLDING AND PROCESSING YOUR PERSONAL DATA

The Organization collects and processes personal data concerning you for the following reasons:

• For our harmonization with the applicable legislation (such as GDPR 679/2016 and law 4624/19)
• To be able to fulfill our obligations arising from your position as a customer For purposes related to the security of persons, facilities, assets and material related to the Organization
• To manage the Agency’s communications and transactions
• For any obligations of the Organization related to obligations and rights defined by the Public Authorities.
• For any case, where an important justifying reason is considered to be your express consent to the keeping and processing of the above data.

DO YOU HAVE AN OBLIGATION TO GIVE US YOUR PERSONAL DATA?

In order to enter into a contract with you and to meet the obligations arising from it as well as to exercise our rights, yes you are obliged to provide us with your personal data. If not, we may not be able to engage with you and provide you with our services (whether as an employer, service provider or supplier).

AUTOMATED DATA PROCESSING

In order to enter into a contract with you and to meet the obligations arising from it as well as to exercise our rights, yes you are obliged to provide us with your personal data. If not, i.e. if we do not have your necessary information and data, we may not be able to contract with you and provide you with our services (either as an employer, as a service provider or as a supplier).

AUTOMATED DATA PROCESSING

For statistical research purposes and for your information, after your consent, the Organization may use automated profiling decision-making. We repeat that such a thing, when done, requires your consent.

RETENTION PERIOD OF YOUR PERSONAL DATA

The Organization may keep your data for some years after the end of the contractual relationship with you. In some cases, it may even be required by law. The financial information concerning you is kept in our file for a decade (10 years). We keep sensitive personal data only for as long as is necessary for the termination of our contractual relationship. Personal data as defined by Law 3418/2005 are kept for 10 years for diagnostic tests and 20 years in case of hospitalization.

TRANSFER OF DATA TO THIRD PARTIES

The Organization does not share files containing sensitive personal data with third parties. In the event that this happens, it will only be done with the express consent of the subject and for reasons that will be explicitly stated. For example, the description of a diagnosis that is transmitted to a healthcare provider or other diagnostic or treatment facility. Also, personal data may be transmitted to an accounting or banking support company, which will be governed by this policy, always within the framework of a contractual relationship. Furthermore, we disclose personal data to the Authorities, as we are under a relevant legal obligation and when this becomes necessary in the context of compliance with the law and for public safety. Your data is not transferred outside the European Union.

(They can be forwarded to the insurance fund or the private insurance company with which the patient is contracted, to collaborating laboratories, to material supplier companies, if this is required for medical procedures, to external partners (e.g. medical technology equipment) that process the personal data on behalf of the Clinic, to auditing or public authorities in the context of its jurisdiction to which the clinic legally notifies, to the employer or the occupational physician, in the context of conducting group diagnostic examinations of employees )

YOUR RIGHTS

At FTPREMIUM CLINIC S.A. – THERAPIS, we attach great importance not only to knowing your rights in relation to your personal data, but also to the way you can exercise them. Therefore, you have:

• Right to know if we hold and/or process your personal data. This right of yours stems from Article 15 GDPR 679/2016. You can also request a copy of your data and how you can access it.
• Right to be able to request the correction of your personal data. As soon as you can prove that the data we hold concerning you needs correction, you can request it from the Organization.
• Right to be “forgotten”, i.e. to delete your data. In any case, you have the right to request from the Organization either the limitation of the personal data concerning you, which we keep and process, or their deletion. Your request can be accepted immediately, as long as it does not contradict the law or an obligation of the Organization arising from it. Right to object to the retention and processing of your data.
• Right to object to the retention and processing of your data.

HOW YOU CAN EXERCISE YOUR RIGHTS

Please contact us in any case of interest in exercising the rights described above. This can be done either by phone or by sending an e-mail to dpo@therapy-hospital.gr In any case, you will be asked for identification information to process your request. You have every right to appeal to the Personal Data Protection Authority, as it is the competent national supervisory body, in case you find a problem with your data and the Organization does not respond.

HOW TO BE INFORMED OF MODIFICATION OF OUR POLICY

You can be informed about any change and modification of this policy from our website www.therapy-hospital.gr

IMPORTANT NOTICE FOR STAKEHOLDERS INCLUDING THE ORGANIZATION’S PARTNERS

This Data Protection Policy of FTPREMIUM CLINIC S.A. – THERAPIS. drawn up and approved by the Administration on 26/05/2020.