Privacy policy

Person concerned

any natural person whose personal data are processed by the Data Controller; this is a person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, an online identifier, or by reference to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

GDPR Regulation

Regulation (EU) No 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation);

Patient

means any natural person who is in a contractual relationship with the Operator, based on the Contract - Health Care Agreement; the Patient is also the Concerned Person;

Operator

the entity which alone or jointly with others determines the purposes and means of processing personal data; in accordance with this document, the Controller shall be understood as the company Institute of Predictive and Personalized Medicine, s. r. o., with its registered office at Nábr. arm. gen. L. Svobodu 32, 811 02 Bratislava, ID No.: 47 217 642, a company registered in the Commercial Register of the Municipal Court of Bratislava III, Section: Sro, Entry No.: 90058/B;

Recipient

the natural or legal person, public authority, agency or other entity to whom the personal data is disclosed, whether or not it is a third party; the specification of the Recipients of the personal data is contained in the relevant provisions of this document;

Agent

a natural or legal person, public authority, agency, or other entity that processes personal data on behalf of the Controller; Processors with whom the Controller has entered into a contract for the processing of personal data are specified in this document;

Customer  

means any natural person or business entity (if personal data protection applies to it) who is in a contractual relationship with the Controller, based on the Contract; the Customer is also the Data Subject;

Contract 

any contract between the Operator and the Customer (e.g. service contract, cooperation contract, healthcare agreement, etc.);

ZOOU

Act No 18/2018 Coll. on the protection of personal data and on amendment and supplementation of certain acts, as amended.

Establishment and existence of a contractual relationship with the Affected Person and performance of obligations under the Contract

The Controller obtains and processes the personal data of the Data Subjects necessary for the conclusion and duration of the contractual relationship, as a rule, with its suppliers, customers, customers or other contracting parties, for the purposes of the implementation and performance of the Contract and related obligations, the exercise of rights or the application of any property sanctions and rights to compensation for damages and other claims arising from the contractual relationship in question. 

Particularly in the case of Customers who are interested in the provision of the services offered by the Operator (e.g. Customers who have purchased services related to the examination of the intestinal microbiome), the Operator processes the personal data of the Data Subjects for the purpose of fulfilling the Contract in question, which are necessary for the proper provision of the services offered. 

Particularly in the case of Customers who are in a contractual relationship with the Controller other than that referred to in the preceding paragraph (e.g. suppliers, customers, etc.) by virtue of the Contract, the Controller processes the personal data of the Data Subjects by virtue of the performance of the Contract in question, which are necessary for its performance. 

Description of the category of persons concerned

Customers

Legal basis for the processing of personal data

In accordance with Article 6 of the GDPR Regulation and Section 13 of the ZOOÚ, the legal basis for the processing of personal data is: 

1. Article 6(1)(b) of the GDPR and Section 13(1)(b) of the GDPR: the processing is necessary for the performance of a contract to which the data subject is a party or to carry out pre-contractual measures at the request of the data subject; for example, in the case of a Service Contract, 
2. Article 9(2)(a) of the GDPR Regulation and Section 16(2)(a) of the OHSA (exception), specifically in the case of a Service Contract for the examination of the intestinal microbiome: The processing of special categories of personal data is prohibited, which include, but are not limited to, data relating to the health of the Data Subject. However, the above shall not apply to the Data Controller under applicable law if the Data Subject has given his or her explicit consent to the processing of sensitive personal data for at least one specific purpose; consent is not valid if the provision of such consent is precluded by a specific regulation.

As a rule, you have given your consent to the Operator directly in the Contract or in the context of the provision of services under the Contract in electronic form. The consent you have provided to the Operator for the aforementioned purposes is voluntary and its provision is not a contractual or legal requirement. If you do not provide your consent, the Operator will not be able to provide the services in sufficient quality.

If you have given your consent to the processing of your personal data, you are giving it to us as express, freely given, specific, informed and unambiguous, and you therefore have the right to withdraw this consent or to restrict the processing of your personal data at any time. For this purpose, please contact us without delay. If you do so, we will no longer process this personal data for the purposes for which consent was given. Please note that the withdrawal of your consent does not affect the lawfulness of any processing carried out on the basis of a consent previously given prior to its withdrawal by you. The withdrawal of consent will not be affected by the Controller.

Scope and categories of personal data processed

The controller will process the following scope/categories of personal data, in particular: 

natural person: name and surname, delivery and billing address, correspondence address, contact details (e-mail, telephone number), date of birth and, separately in the case of Customers under the Contract for the provision of services in connection with the examination of the intestinal microbiome, the medical data required for the proper provision of services;

entrepreneur (if personal data protection applies to him/her): business name, place of business, registered office, VAT number, VAT number, contact details (e-mail, telephone number), name and surname of the statutory body, function, IBAN

Retention period of personal data

Personal data is stored in accordance with the legal requirements for the storage and archiving of personal data. Personal data are processed during the duration of the contractual relationship and subsequently after the termination of the contractual relationship for the periods necessary for the exercise of the legitimate and legally protected interests of the Controller (e.g. in the case of the recovery of incurred claims, litigation, proving compliance with an obligation arising from a specific law and the related retention of contractual documentation, etc.). 

If personal data are processed on the basis of the consent of the Data Subject, the personal data will be processed only during the validity of this consent or until the Data Subject withdraws this consent.

Provision of health care 

For the purposes of providing health care, services related to the provision of health care, including above-standard services in accordance with Act No. 576/2004 Coll., the Act on Health Care, Services Related to the Provision of Health Care and on Amendments and Additions to Certain Acts, as amended, including the identification of the Patient, which are necessary for the proper provision of health care, the Operator obtains and processes a special category of personal data (sensitive data) of the Patients on the basis of agreements on the provision of health care.

The provision of personal data for the purpose of providing health care is not a legal obligation of the Data Subject, however, in the event of failure to provide personal data, the Controller will not be able to properly provide health care.

Description of the category of persons concerned

Patients

Legal basis for the processing of personal data

In accordance with Article 6 of the GDPR Regulation and Section 13 of the ZOOÚ, the legal basis for the processing of personal data is: 

1. Article 6(1)(b) of the GDPR and Article 13(1)(b) of the GDPR: the processing is necessary for the performance of a contract to which the data subject is a party or to carry out pre-contractual measures at the request of the data subject; performance of a contract in relation to general personal data, 
2. Article 6(1)(c) of the GDPR Regulation and Article 13(1)(c) of the GDPR Act: processing is necessary for compliance with a legal obligation of the controller; processing of personal data is necessary pursuant to a special regulation or an international treaty by which the Slovak Republic is bound; in relation to a special category of personal data; and 
3. Article 9(2)(h) of the GDPR and pursuant to Section 16(2)(h) of the GDPR (exception): processing of special categories of personal data, including, but not limited to, data relating to the health of the Data Subject, is prohibited. However, the aforementioned does not apply in the case of the Data Controller under the applicable legislation, as the processing of personal data by the Data Controller is necessary in this case for the purpose of providing healthcare and services related to the provision of healthcare, whereby such data is processed by the Data Controller as a healthcare provider and on its behalf by professionally competent authorised persons who are bound by the obligation of confidentiality of the facts of which they have become aware in the course of their activities and by the obligation to observe the principles of professional ethics.

Scope and categories of personal data processed

The controller will process the following scope/categories of personal data, in particular: 

name and surname, permanent address / temporary address, correspondence address, contact details (e-mail, telephone number), date of birth, medical data necessary for the proper provision of health care (e.g. height, weight, blood pressure, diseases, prescribed medications, allergies, medical history, etc.), personal data of the legal representative in the scope of name and surname, date of birth, contact details (e-mail, telephone number)

Retention period of personal data

Personal data is stored in accordance with the legal requirements for the storage and archiving of personal data. The medical records shall be kept by the Controller for 20 years from the last provision of health care to the person.

Records of Patients and other Customers

The Controller obtains and processes the personal data of Data Subjects in connection with the provision of healthcare to Patients and keeps a Patient record for these purposes. The Controller also keeps a record of its Customers who are not directly provided with health care, but are provided with other services on the basis of a contractual relationship by virtue of a concluded Contract (e.g. services of providing an intestinal microbiome examination and providing professional consultation on the results of the examination, etc.).

Description of the category of persons concerned

Customers, Patients 

Legal basis for the processing of personal data

In accordance with Article 6 of the GDPR Regulation and Section 13 of the ZOOÚ, the legal basis for the processing of personal data is: 

1. Article 6(1)(b) of the GDPR and Article 13(1)(b) of the GDPR: the processing is necessary for the performance of a contract to which the data subject is a party or to carry out pre-contractual measures at the request of the data subject; in particular, in the case of contractual relationships concluded outside the provision of healthcare (e.g. in the case of a contract for the provision of services in connection with the examination of the intestinal microbiome);
2. Article 6(1)(c) of the GDPR Regulation and Section 13(1)(c) of the ZOOÚ: the processing is necessary for the fulfilment of a legal obligation of the controller; the processing of personal data is necessary pursuant to a special regulation or an international treaty to which the Slovak Republic is bound; in particular pursuant to Act No. 576/2004 Coll. on Health Care, Services Related to the Provision of Health Care and on Amendments and Additions to Certain Acts, as amended, Act No. 581/2004 Coll. No. 578/2004 Coll. on health care providers, health care workers, professional organisations in health care and on amendment and supplementation of certain acts, as amended, and other related legislation; in particular in connection with the provision of health care to the Operator's patients

Scope and categories of personal data processed

The controller will process the following scope/categories of personal data, in particular: name and surname, date of birth, permanent address, correspondence address, e-mail, telephone number

Retention period of personal data

Personal data is stored in accordance with the legal requirements for the storage and archiving of personal data. 

Provision of data from medical records

The Controller processes the personal data of the Data Subjects in connection with the fulfilment of the Controller's legal obligations to provide data from the Patients' medical records to third parties who so request, whereby the applicable legislation allows them to provide such personal data and determines the conditions of their provision (scope, manner, etc.).

Description of the category of persons concerned

Patients requesting personal data

Legal basis for the processing of personal data

Pursuant to Article 6 of the GDPR Regulation and Section 13 of the ZOOÚ, the legal basis for the processing of personal data is: Article 6(1)(c) of the GDPR Regulation and Section 13(1)(c) of the ZOOÚ: the processing is necessary for the fulfilment of a legal obligation of the controller; the processing of personal data is necessary pursuant to a special regulation or an international treaty by which the Slovak Republic is bound; in particular, pursuant to Act No. 576/2004 Coll. on health care, services related to the provision of health care and on amendment and supplementation of certain acts, as amended

Scope and categories of personal data processed

The controller will process the following scope/categories of personal data, in particular: name and surname, date of birth, permanent address, correspondence address, e-mail, telephone number, health data (e.g. height, weight, pressure, diseases, prescribed medication, allergies, medical history, etc.) and other data required for the maintenance of medical records by applicable legislation, and, where applicable, the personal data of the applicant for the provision of personal data in the range of name and surname, date of birth, permanent address, correspondence address, e-mail address, telephone number, or business name, registered office / place of business, personal identification number (if personal data protection applies to the legal entity), name and surname of the person taking over the medical records and other necessary personal data necessary to fulfil the purpose of processing.

Retention period of personal data

Personal data is stored in accordance with the legal requirements for the storage and archiving of personal data. The medical records shall be kept by the Controller for 20 years from the last provision of health care to the person.

Accounting and tax rules

The Controller obtains and processes the personal data of the Data Subjects necessary for the purposes of bookkeeping, including invoicing (issuing tax documents), sending invoices, payment of invoices and other obligations arising from the Contracts or applicable law.

Description of the category of persons concerned

Customer, Patient, other Affected persons

Legal basis for the processing of personal data

In accordance with Article 6 of the GDPR Regulation and Section 13 of the ZOOÚ, the legal basis for the processing of personal data is: 

1. Article 6(1)(b) of the GDPR and Article 13(1)(b) of the GDPR: the processing is necessary for the performance of a contract to which the data subject is a party or for the performance of pre-contractual measures at the request of the data subject; in particular, the Contract; and/or
2. Article 6(1)(c) of the GDPR Regulation and Section 13(1)(c) of the GDPR Act: the processing is necessary for the fulfilment of a legal obligation of the controller; the processing of personal data is necessary pursuant to a special regulation or an international treaty to which the Slovak Republic is bound; in particular pursuant to Act No. 431/2002 Coll., the Accounting Act, as amended, Act No. 595/2003 Coll., the Income Tax Act, as amended, Act No. 222/2004 Coll., the Value Added Tax Act, as amended, and other related legislation;

Scope and categories of personal data processed

The Controller will process the following scope/categories of personal data, in particular: personal data of Data Subjects within the scope of the law, in particular within the meaning of Act No. 431/2002 Coll., the Accounting Act, as amended, Act No. 595/2003 Coll., the Income Tax Act, as amended, Act No. 222/2004 Coll., the Value Added Tax Act, as amended, and other related legislation.

For billing purposes: 

natural person: name and surname, billing address, IBAN

entrepreneur (if personal data protection applies): business name, place of business, registered office, VAT number, VAT number, IBAN

Retention period of personal data

The retention period for tax and accounting documents shall be 10 years, unless otherwise provided by applicable law.

Complaints and complaints

The Controller obtains and processes the personal data of the Data Subjects necessary for the conduct of complaint proceedings, as well as proceedings on complaints or complaints, or the registration of these proceedings, whether on account of the provision of health care, or on account of other services provided by the Controller, or on account of the concluded Contracts, or for any other reasons whatsoever.

Description of the category of persons concerned

Customer, Patient, Complainant, Complainant's representative

Legal basis for the processing of personal data

Pursuant to Article 6 of the GDPR Regulation and Section 13 of the ZOOÚ, the legal basis for the processing of personal data is: Article 6(1)(c) of the GDPR Regulation and Section 13(1)(c) of the ZOOÚ: the processing is necessary for the fulfilment of a legal obligation of the controller; the processing of personal data is necessary pursuant to a special regulation or an international treaty by which the Slovak Republic is bound; in particular, Act No. 9/2010 Coll. on Complaints, as amended, Act No. 250/2007 Coll. on Consumer Protection, as amended, Act No. 576/2004 Coll. on Health Care, Services Related to the Provision of Health Care and on Amendments and Additions to Certain Acts, as amended, and other related legislation;

Scope and categories of personal data processed

The controller will process the following scope/categories of personal data, in particular data necessary for the processing of a complaint, complaint or complaint: common personal data such as: 

natural person: name and surname, address, contact details (e-mail, telephone number) 

entrepreneur (if personal data protection applies): business name, place of business, registered office, registration number, contact details (e-mail, telephone number)

Retention period of personal data

The Controller retains personal data for 2 years from the end of the contractual relationship or the duration of the Contract, or the settlement of a complaint, unless otherwise provided for by applicable law. 

Pre-contractual relations, contact form

The Controller collects and processes personal data for the purpose of contacting potential Customers, Patients or other Data Subjects, processing the origin of contact for the purpose of informing about the services provided and for the purpose of concluding a Contract, if you contact us via the contact form published on our website, or by e-mail, telephone or other means.

Description of the category of persons concerned

Affected persons - potential Customers or Patients, other persons contacting the Operator 

Legal basis for the processing of personal data

In accordance with Article 6 of the GDPR Regulation and Section 13 of the ZOOÚ, the legal basis for the processing of personal data is: 

1. Article 6(1)(b) of the GDPR and Article 13(1)(b) of the GDPR: the processing is necessary for the performance of a contract to which the data subject is a party or to carry out pre-contractual measures at the request of the data subject; in particular, pre-contractual relations,
2. Article 6(1)(a) of the GDPR and Section 13(1)(a) of the GDPR: the data subject has consented to the processing of his or her personal data for at least one specific purpose.

You have provided your consent to the Operator either directly in the Agreement, or via the form on the Operator's website "www.ippmclinic.com", by telephone or in another credible way (e.g. by letter or e-mail). Consent provided by you to the Operator, for example, for the purpose of informing yourself about the services provided or for other similar purposes, is voluntary and its provision is not a contractual or legal requirement.

If you have given your consent to the processing of your personal data, you give this consent as a serious and freely given, specific, informed and unambiguous consent, and you therefore have the right to withdraw this consent at any time or to restrict the processing of your personal data. For this purpose, please contact us without delay. If you do so, we will no longer process this personal data for the purposes for which consent was given. Please note that the withdrawal of your consent does not affect the lawfulness of any processing carried out on the basis of a consent previously given prior to its withdrawal by you. The withdrawal of consent will not be affected by the Controller.

Scope and categories of personal data processed

The controller will process the following scope/categories of personal data, in particular: name and surname, e-mail, telephone number, IP address

Retention period of personal data

In the absence of a contractual relationship with the Data Subject, personal data shall be kept only for as long as they are necessary to achieve the purpose for which they were collected. 

If the personal data are processed on the basis of the data subject's consent, the personal data will be processed only for the strictly necessary period of time required to fulfil the purpose of the processing, or until the data subject withdraws this consent.

Competitions 

The Controller is entitled to organise competitions for the purpose of its promotion and advertising of its services, and in this context it collects and processes the personal data of the Data Subjects for the purposes of entering the participants in the competition, evaluating, contacting and announcing the winners of the competition. 

Competitions are in any case governed by the terms and conditions or the competition statutes. 

Description of the category of persons concerned

Affected persons - contest participant and contest winner

Legal basis for the processing of personal data

In accordance with Article 6 of the GDPR Regulation and Section 13 of the ZOOÚ, the legal basis for the processing of personal data is: 

1. Article 6(1)(b) of the GDPR Regulation and § 13(1)(a) of the GDPR Regulation. The processing is necessary for the performance of a contract to which the data subject is a party or to carry out pre-contractual measures at the request of the data subject; the Contest constitutes a contractual relationship between the contest participants and the Operator, and therefore the Operator processes the personal data of the data subjects to the extent necessary for the performance of the obligation arising from the contractual relationship (the Contest), i.e. the evaluation of the Contest and the delivery of the prize, and 
2. Article 6(1)(c) of the GDPR Regulation and Section 13(1)(c) of the OPLA: processing is necessary for the fulfilment of a legal obligation of the controller; processing of personal data is necessary pursuant to a special regulation or an international treaty to which the Slovak Republic is bound; the Controller may also process the personal data of Data Subjects for the purpose of fulfilling legal obligations  arising from tax and accounting legislation.

Scope and categories of personal data processed

The Controller will process the following scope/categories of personal data, in particular: name and surname, correspondence address, e-mail, telephone number, date of birth, or other data strictly necessary for sending and delivering the prize to the winner.

Retention period of personal data

Personal data shall be kept only for as long as is necessary to achieve the purpose for which it was collected. The personal data of the participants of the competition is kept until the end of the respective competition. The personal data of the winners of the competition is kept for as long as necessary for the purpose of providing the prize to the winner.