Information for patients on the processing of personal data 

according to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons concerning the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation). 

I.Personal data controller 

Company: Dental Smile Time s.r.o. 

ID No.: 27074544 

Registered office: Jablonecká 712, 190 00 Prague 9 – Prosek 

Email: smiletime.cz@gmail.com 

The controller is a healthcare provider following Act No. 372/2011 Coll., on healthcare services and conditions for their provision, as amended.

II.Purpose(s) of personal data processing 

: We process your data for 

* providing healthcare services 

* reporting reimbursed healthcare services 

* billing for non-reimbursed healthcare services 

* communicating health information to you and other authorized persons * organizing the provision of healthcare services (patient appointments) 

* keeping records of our income and expenses, payments received, and financial management, as required by tax and accounting regulations 

III. Legal basis for the processing of personal data 

The legal basis for the processing of your data referred to in point II. is 

* the fulfillment of our legal obligations (in particular Act No. 372/2011 Coll., on health services and conditions for their provision, Act No. 48/1997 Coll., on public health insurance, Act No. 563/1991 Coll., on accounting, Act No. 586/1992 Coll., on income taxes, Act No. 634/1992 Coll., on consumer protection) 

* fulfillment of obligations under the health care contract based on which we provide you with health services (this contract does not have to be concluded in writing)

IV.Recipients of personal data 

Following the provisions of legal regulations, in specific cases, recipients of your data may include, in addition to you: healthcare providers, public authorities, and persons authorized to inspect medical records according to Sections 31, 32, § 33 and § 65 of Act No. 372/2011

Coll., on healthcare services and conditions for their provision. In order to ensure the above-described purposes, personal data may be processed not only by the controller but also by processors on the basis of personal data processing agreements concluded in accordance with the General Data Protection Regulation. We do not transfer your personal data abroad.

V.Period of personal data processing 

Personal data contained in medical records are processed for the period specified in Decree No. 98/2012 Coll., on medical records. Personal data processed for other purposes specified in point III is processed for the period specified by law or for as long as you are our patient, and subsequently for one year after you cease to be our patient.

VI.Rights of the data subject 

When processing personal data, you have the following rights regarding the protection of your personal data: 

* the right to request access to your personal data from us; 

* the right to correct your personal data that we process; 

* the right to restrict processing. Restriction of processing means that we must mark your personal data for which processing has been restricted and may not further process it for the duration of the restriction, except for storage. You have the right to restrict processing if 

* you contest the accuracy of the personal data, for a period enabling us to verify the accuracy of the personal data; 

* the processing is unlawful and you oppose the erasure of the personal data and request the restriction of its use instead; 

* we no longer need your personal data for the purposes of the processing, but you require it for the establishment, exercise, or defense of legal claims; 

* if you have objected to the processing referred to in point VII below, until it has been verified whether our legitimate reasons for processing outweigh your interests or rights and freedoms; 

* the right to erasure of personal data. The right to erasure of personal data applies only to personal data that we process for purposes other than the provision of health services. We are not allowed to erase data that we keep about you to provide healthcare services (e.g., in medical records); 

* the right to data portability. You may request that we provide you with your personal data to transfer it to another personal data controller, or that we transfer it ourselves to another personal data controller. However, you only have this right concerning data that we process automatically based on your consent or a contract with you. However, we may only provide data that we hold about you to provide healthcare services (e.g., in medical records) to you and, under certain legal conditions, to another healthcare provider or public authority.

* the right to complain to a supervisory authority if you believe that the processing of personal data violates data protection legislation. You can complain to the supervisory authority in your place of habitual residence, place of work, or place where the alleged infringement occurred. In the Czech Republic, the supervisory authority is the Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Prague 7, www.uoou.cz. 

VII. Right to object to processing.

If we process your personal data for the purposes of our legitimate interests or those of another party (the legal basis for processing is set out in point III), you have the right to object to such processing at any time. You can raise an objection at our address listed in point I. If you raise such an objection, we will only be entitled to continue such processing if we demonstrate serious legitimate reasons for the processing that outweigh your interests or rights and freedoms, and furthermore, if the processing is necessary for the establishment, exercise, or defense of legal claims. 

VIII. Mandatory processing and obligation to provide personal data.

The processing of your personal data to provide healthcare services is a legal requirement. Failure to provide your personal data may mean that we will not be able to provide you with healthcare services, which may result in damage to your health or a direct threat to your life (Section 41(1)(d) of Act No. 372/2011 Coll., on healthcare services and conditions for their provision). The obligation to provide the patient’s personal data also applies to their legal representative or guardian (Section 41(2) of Act No. 372/2011 Coll., on healthcare services and the conditions for their provision).