Privacy and Data Security Policy
Prepared by: Data Protection Auditor Bt. based on data processing practices identified by Nádor Dent Kft. during the data protection audit.
Approved by: Dr. Orsolya Szűcs, Managing Director;
Date of approval: March 1, 2018.
Introduction
- Nádor Dent Kft., as data controller, hereby informs its customers and visitors to its website and social media pages (hereinafter collectively referred to as: data subjects or users) that it respects the personal rights of data subjects and therefore acts in accordance with the following data processing policy (hereinafter: Policy) when processing data. Nádor Dent Kft. reserves the right to amend the Policy in order to bring it into line with any changes in the legal framework and other internal regulations. The current version of the Policy is available in electronic form on the website https://ujbuda.dental/hu and in paper form at the reception of the clinic. Based on the above, Nádor Dent Kft. considers the provisions of the Policy to be binding on itself and acts in accordance with them in its operations. With reference to point 1, this Policy regulates the data processing activities provided to data subjects by Nádor Dent Kft. through the means and methods provided by it.
- Nádor Dent Kft. strives to comply as closely as possible with the recommendations of the National Authority for Data Protection and Freedom of Information, in particular its recommendation of September 29, 2015, on the data protection requirements for prior information, and therefore expresses the data protection rules as clearly as possible, explaining them with examples where necessary, and presenting each data processing activity in detail so that the data subject can decide whether or not to give their voluntary consent to them. Although Nádor Dent Kft. fulfills its obligation to provide prior information with this Policy, for the sake of easier readability and transparency, it also publishes a Data Protection Notice, which is separate from these Regulations in form, and which is to be considered an annex to the Regulations, and which the Regulations explain and fill with detailed content.
1. Definition of terms
The Data Controller uses the following terms in this Policy and its annexes, therefore we recommend that you review them in detail.
- Data Subject or User: any natural person identified or identifiable, directly or indirectly, on the basis of specific personal data, including, for example, natural persons using the Data Controller’s services, etc.;
- Personal data: data that can be linked to the data subject, in particular the data subject’s image, voice, name, identification number, and one or more factors specific to their physical, physiological, mental, economic, cultural, or social identity, as well as conclusions about the data subject that can be drawn from the data;
- The concept of personal data following the application of the GDPR: any information relating to an identified or identifiable natural person (i.e., the data subject); a natural person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
- Consent: a freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her, whether in whole or in part; thus, consent has three basic elements: voluntariness, certainty, and adequate information;
- Data controller: the natural or legal person or organization without legal personality who, alone or jointly with others, determines the purposes of data processing, makes and implements decisions regarding data processing (including the means used) or has them implemented by a data processor commissioned by it; thus, for the purposes of this Policy, the Data Controller is the person specified in Chapter 2;
- Data processing: any operation or set of operations performed on data, regardless of the procedure used, in particular collection, recording, organization, storage, alteration, use, retrieval, transfer, disclosure, alignment or combination, blocking, erasure and destruction, as well as the prevention of further use of the data, the taking of photographs, sound or image recordings, and the recording of physical characteristics suitable for identifying a person, including, but not limited to: requesting information, making appointments, etc.;
- Restriction of processing: marking stored personal data for the purpose of restricting their future processing;
- Profiling: any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyze the performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements;
- Pseudonymization: processing personal data in such a way that it can no longer be attributed to a specific natural person without the use of additional information, provided that such additional information is kept separately and is subject to technical and organizational measures to ensure that the personal data are not attributed to an identified or identifiable natural person;
- Data transfer: making data available to a specific third party;
- Data processing: the performance of technical tasks related to data management operations, regardless of the method and means used to perform the operations and the location of the application, provided that the technical task is performed on the data; for ease of understanding, using an illustrative list, data processing includes performing accounting tasks;
- Data erasure: rendering data unrecognizable in such a way that it can no longer be restored;
- Data blocking: marking data with an identifier for the purpose of restricting its further processing for a definite or indefinite period of time;
- Data destruction: the complete physical destruction of the data medium containing the data, for example by shredding the document containing the data;
- Data file: the totality of data processed in a single register;
- Registration system: a structured set of personal data organized in any way—centralized, decentralized, or according to functional or geographical criteria—which is accessible on the basis of specific criteria;
- Third party: a natural or legal person or an organization without legal personality who or which is not the data subject, the data controller or the data processor, or persons who, under the direct authority of the data controller or data processor, are authorized to process personal data;
- Data breach: unlawful processing or processing of personal data, in particular unauthorized access, alteration, transmission, disclosure, erasure or destruction, as well as accidental destruction or damage;
- The concept of data breach following the application of the GDPR: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored or otherwise processed;
- Health data: pursuant to Section 3(a) of Act XLVII of 1997, data relating to the physical, mental and spiritual condition of the data subject, his or her pathological addictions, as well as the circumstances of illness or death, the cause of death, communicated by the data subject or by another person, or detected, examined, measured, imaged or derived by the healthcare network; furthermore, any data that can be linked to or influence the above (e.g., behavior, environment, occupation),
- Health data following the application of the GDPR: personal data relating to the physical or mental health of a natural person, including data relating to health services provided to a natural person that contain information about the health status of that natural person;
- Partner: legal entities that use the Data Controller’s services on a contractual basis and/or facilitate the performance of the Data Controller’s services (performance assistants), business associations without legal personality to which the Data Controller transfers or may transfer personal data with the consent of the data subject, or which perform or may perform data storage, processing, related IT and other activities facilitating secure data management for the Data Controller;
- Dental office: the dental office located at 1117 Budapest, Szerémi út 7/A. 1/101.
- Employee: a natural person in a contractual, employment or other legal relationship with the Data Controller who is entrusted with the performance of the Data Controller’s services and who comes into contact with personal data in the course of their data management or data processing tasks, and for whose activities the Data Controller assumes full responsibility towards the data subjects and third parties;
- Data controller: the Employee who generated the data and/or who has access to the data and/or to whom the data was transferred by another data controller or third party and/or who came into possession of the data in any other way;
- Healthcare network: an organization or natural person providing healthcare and performing professional supervision and control;
- Medical treatment: any activity aimed at maintaining health, preventing, early detection, diagnosis, and treatment of diseases, maintaining or improving the condition resulting from the disease, and for this purpose, the direct examination, treatment, care, medical rehabilitation, and the processing of the data subject’s test materials for these purposes, including the provision of medicines, medical aids, spa treatments, rescue and patient transport, and obstetric care;
- Medical confidentiality: health and personal identification data that comes to the knowledge of the data controller during medical treatment, as well as other data relating to necessary or ongoing or completed medical treatment and other data learned in connection with medical treatment;
- Close relative: spouse, direct relative, adopted child, stepchild, foster child, adoptive parent, step-parent, foster parent, sibling, and partner;
- Urgent need: a sudden change in health that would put the person at immediate risk of death or cause serious or permanent damage to their health if they didn’t get medical care right away;
- Healthcare professional: a dentist, other person with a higher education qualification in healthcare, a person with a healthcare qualification, or a person without a healthcare qualification who is involved in healthcare activities;
- Patient care provider: the doctor providing treatment, healthcare professionals, other persons involved in the medical treatment of the person concerned, pharmacists; for the purposes of these Rules, the Data Controller is the patient care provider.
