Privacy Policy

This policy applies to the processing of personal data of visitors to the BiodentClinic.cz website in connection with the website itself (technical operation of the website, contact form, cookies and analytics).

Information on how we process personal data in connection with the provision of healthcare services (medical records, patient appointments, billing, etc.) is provided separately below in the document Information for Patients on the Processing of Personal Data.

Who we are

This website is operated by BIODENT-TUR s.r.o., Company ID No. 28452071, with its registered office at Uruguayská 344/13, Vinohrady, 120 00 Prague 2, registered in the Commercial Register maintained by the Municipal Court in Prague, file No. C 142530. Our website address is: BiodentClinic.cz.

The controller’s contact details are provided in Article I of the Information for Patients on the Processing of Personal Data.

What personal data we collect and why we collect it

Contact form

Our website contains a contact/appointment form through which you can contact us or request an appointment for treatment. Through this form, we collect the information you provide to us, in particular your first and last name, email address, telephone number, and the content of your message or request.

We use this information exclusively to process your enquiry or appointment request and to communicate with you. The legal basis for this processing is our legitimate interest in handling enquiries submitted through the website or, where an appointment for treatment is arranged through the form, the performance of a healthcare agreement (see Article III of the Information for Patients on the Processing of Personal Data).

We retain data submitted through the contact form for as long as necessary to process your request, but no longer than one year from the date the form was submitted. If the communication results in a patient–healthcare provider relationship, the data will subsequently be handled in accordance with the Information for Patients on the Processing of Personal Data.

Media

If images are uploaded as part of the operation of the website (for example through the content management system), we recommend avoiding images containing embedded location data (EXIF GPS), as third parties may be able to extract this information from the images.

Cookies

Our website uses the following cookies:

Essential (technical) cookies – these are required for the basic operation of the website (for example, remembering settings and ensuring the technical functioning of the contact form) and do not require consent.
Analytics cookies (Google Analytics) – we use these to measure website traffic and user behaviour so that we can improve the website.
Marketing cookies (Meta Pixel) – we use these to evaluate advertising effectiveness and, where applicable, to target advertising on social media.

Analytics and marketing cookies are stored only on the basis of your consent given through the cookie banner displayed during your first visit to the website. You may withdraw or change your consent at any time through the cookie banner settings or through your internet browser settings.

In connection with the use of Google Analytics and Meta Pixel, data may be transferred to a third country (the USA) on the basis of an adequacy decision adopted by the European Commission under the EU–U.S. Data Privacy Framework or, where applicable, on the basis of standard contractual clauses pursuant to Article 46 of the GDPR.

Embedded content from other websites

Pages may contain embedded content from other websites (for example, a map or video). Embedded content from other websites behaves in the same way as if the visitor had visited the other website directly. These websites may collect data about you, use cookies and monitor your interaction with the embedded content.

Analytics

See the Cookies section above. We process Google Analytics data in anonymised/aggregated form for website traffic statistics; we do not profile individual visitors.

Who we share your data with

We may share personal data collected through the website with:

providers of technical services responsible for the operation of the website (hosting and website administration);
Google LLC in connection with the use of Google Analytics;
Meta Platforms, Inc. in connection with the use of Meta Pixel;
where an appointment for treatment is arranged, the persons specified in Article IV of the Information for Patients on the Processing of Personal Data.

How long we retain your data

We retain data submitted through the contact form for the period stated in the Contact Form section above. Data collected through analytics and marketing cookies is retained for the period determined by the relevant cookie banner settings, but no longer than 24 months from the date it is stored, or until consent is withdrawn earlier.

Your rights

You have the right to request information about the personal data we process about you in connection with the operation of the website, the right to rectification, restriction of processing or erasure, and the right to withdraw your consent to cookies at any time. A detailed list of your rights, including the right to lodge a complaint with the Office for Personal Data Protection, is provided in Articles VI and VII of the Information for Patients on the Processing of Personal Data, which apply as appropriate to processing carried out in connection with the operation of the website.

Where your data is sent

To the extent described above, data may be transferred to a third country (the USA) in connection with Google Analytics and Meta Pixel, as described in the Cookies section.

Your contact details

To exercise your rights or if you have any questions, you may contact us using the contact details provided in the Who We Are section above.

Additional information

How we protect your personal data

We have adopted appropriate technical and organisational measures to protect personal data collected through the website, in particular a secure (encrypted) connection to the website (HTTPS), restriction of access to contact-form data to authorised persons only, and regular updates of the website software.

Our procedures in the event of a data breach

If we become aware of a security incident resulting in a personal data breach, we proceed in accordance with Articles 33 and 34 of the GDPR. Where required by law, we notify the Office for Personal Data Protection and, where necessary, also inform the affected individuals.

Personal data received from third parties

In connection with the operation of the website itself, we do not obtain personal data about you from any third parties. You provide all such data directly to us, for example through the contact form.

Automated decision-making and/or profiling of user data

In connection with the operation of the website, we do not carry out any automated decision-making or profiling that produces legal effects concerning you or similarly significantly affects you.

Regulated-industry information obligations

As a healthcare provider, we are subject to information obligations under Act No. 372/2011 Coll., on Healthcare Services, and related legislation. These obligations and their relationship to the processing of patients’ personal data are described in detail in the Information for Patients on the Processing of Personal Data.

Information for Patients on the Processing of Personal Data

Pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).

I. Personal data controller

The personal data controller is:

BIODENT-TUR s.r.o.
Registered office: Uruguayská 344/13, Vinohrady, 120 00 Prague 2
Company ID No.: 284 52 071
File No.: C 142530, maintained by the Municipal Court in Prague
Email: biodentclinic.cz@gmail.com
Telephone: +420 776 428 606
Website: BiodentClinic.cz

The controller is a healthcare provider within the meaning of Act No. 372/2011 Coll., on Healthcare Services and the Conditions of Their Provision, as amended.

The controller has not appointed a Data Protection Officer (DPO), as the nature and scope of its processing of personal data do not require it to do so.

II. Purposes of processing personal data

We process your personal data for the following purposes:

providing healthcare services and healthcare;
reporting covered healthcare services to health insurance companies;
billing for healthcare services not covered by health insurance and processing payments;
communicating information about your state of health to you and other authorised persons;
organising the provision of healthcare services (making patient appointments by telephone, email or web forms);
maintaining records of our income and expenditure, payments received and accounting, as required by tax and accounting legislation.

III. Legal basis for processing personal data

The legal basis for processing your personal data for the purposes stated in Article II is:

Compliance with our legal obligations (in particular Act No. 372/2011 Coll., on Healthcare Services and the Conditions of Their Provision; Act No. 48/1997 Coll., on Public Health Insurance; Act No. 563/1991 Coll., on Accounting; Act No. 586/1992 Coll., on Income Taxes; and Act No. 634/1992 Coll., on Consumer Protection).
Performance of obligations under a healthcare agreement on the basis of which we provide healthcare services to you (this agreement does not have to be concluded in writing).
The controller’s legitimate interest in the proper organisation of the clinic’s operations and in handling enquiries and appointment requests submitted through the website.

IV. Recipients of personal data

In accordance with applicable legislation and depending on the circumstances of a particular case, recipients of your personal data may, in addition to you, include other healthcare providers, public authorities, and persons authorised to inspect medical records pursuant to Sections 31, 32, 33 and 65 of Act No. 372/2011 Coll., on Healthcare Services and the Conditions of Their Provision.
For the purposes described above, personal data may also be processed on behalf of the controller by authorised processors (for example, providers of IT services, medical-record software, email and appointment systems, and accounting services) on the basis of data processing agreements concluded in accordance with the GDPR.
For communication with patients and the organisation of the clinic’s operations, the controller also uses tools provided by Google LLC (in particular Google Workspace/Gmail email and office services) and Meta Platforms, Inc. (communication through WhatsApp and, where applicable, Messenger), both based in the USA. This may involve the transfer of personal data to a third country (the USA). Such transfers are safeguarded by an adequacy decision adopted by the European Commission under the EU–U.S. Data Privacy Framework or, where the adequacy decision does not apply to a particular provider, by standard contractual clauses pursuant to Article 46 of the GDPR.

V. Retention period for personal data

Personal data contained in medical records is processed and retained for the period specified by Decree No. 98/2012 Coll., on Medical Records.
Personal data processed for the other purposes stated in Articles II and III (accounting and taxation) is processed for the periods specified by the applicable legislation.
Personal data processed for organisational and appointment purposes is processed for as long as you remain our patient and subsequently for one year after you cease to be our patient, unless the law requires a longer period.

VI. Rights of the data subject

When we process your personal data, you have the following rights under the GDPR:

The right of access to your personal data (Article 15 of the GDPR).
The right to rectification of inaccurate personal data (Article 16 of the GDPR).
The right to restriction of processing (Article 18 of the GDPR). Restriction of processing means that we must mark the personal data subject to the restriction and, for the duration of the restriction, may not process it further other than by storing it. You have the right to restriction of processing where:
- you contest the accuracy of the personal data, for the period necessary for us to verify its accuracy;
- the processing is unlawful and you oppose the erasure of the personal data and request restriction of its use instead;
- we no longer need your personal data for the purposes of processing, but you require it for the establishment, exercise or defence of legal claims;
- you have objected to processing as described in Article VII below, pending verification of whether our legitimate grounds override your interests, rights and freedoms.
The right to erasure of personal data (Article 17 of the GDPR). Please note: the right to erasure does not apply to personal data that we retain for the purpose of providing healthcare services (for example, in medical records), as its retention is strictly required by law.
The right to data portability (Article 20 of the GDPR). This right applies only to data that we process by automated means on the basis of your consent or a contract. Data from medical records may be provided only to you and, subject to the statutory conditions, to another healthcare provider or public authority.
The right to lodge a complaint with a supervisory authority if you believe that data protection legislation has been infringed. You may lodge a complaint with the supervisory authority in the place of your habitual residence, place of work, or the place where the alleged infringement occurred. In the Czech Republic, the supervisory authority is:
Office for Personal Data Protection (Úřad pro ochranu osobních údajů)
Pplk. Sochora 27
170 00 Prague 7
www.uoou.cz

VII. Right to object to processing

Where we process your personal data for the purposes of our legitimate interests or those of a third party (the legal bases for processing are stated in Article III), you have the right to object to such processing at any time by contacting us at the address or email address provided in Article I. If you object, we may continue the processing only if we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or where the processing is necessary for the establishment, exercise or defence of legal claims.

VIII. Mandatory processing and obligation to provide personal data

The processing of your personal data for the provision of healthcare services is a statutory requirement. Failure to provide your personal data may mean that we are unable to provide healthcare services to you, which may result in harm to your health or a direct threat to your life (Section 41(1)(d) of Act No. 372/2011 Coll., on Healthcare Services and the Conditions of Their Provision). The obligation to provide a patient’s personal data also applies to the patient’s legal representative or guardian (Section 41(2) of the same Act).

IX. Cookies and web analytics

Our website uses cookies and similar technologies, including essential (technical) cookies required for the proper functioning of the website, as well as analytics and marketing cookies. Specifically, we use Google Analytics (Google LLC) to measure website traffic and Meta Pixel (Meta Platforms, Inc.) for marketing and advertising-targeting purposes.

Analytics and marketing cookies are stored only on the basis of your consent, which you may give, refuse or withdraw at any time through the cookie banner displayed when you visit the website or through your internet browser settings. The use of these tools may involve the transfer of data obtained through cookies to a third country (the USA) on the basis of an adequacy decision adopted by the European Commission under the EU–U.S. Data Privacy Framework or, where applicable, on the basis of standard contractual clauses pursuant to Article 46 of the GDPR.

Detailed information about the specific cookies we use, their purposes and retention periods is available in our Cookie Policy.