Privacy statement

Information about our data protection and data management policies and practices.

Name and details of the data controller

Data Controller 1 Name: Saint James Eye Clinic Hungary Kft.

Postal address: 1034 Budapest, Vienna Road 68-84.

Phone number: 06 1 788 2927

Email address: balazs.zentai@stjameshospital.hu

Website: www.lassjol.hu, https://saintjameshungary.hu/

Company registration number: 01 09 439235

Data Controller 2 Name: Saint James Aesthetic Hungary Kft.

Postal address: 1034 Budapest, Vienna Road 68-84.

Phone number: 06 1 788 2927

Email address: balazs.zentai@stjameshospital.hu

Website: https://saintjameshungary.hu/

Company registration number: 01 09 434063

Data Controller 1 and Data Controller 2 together: Data Controller

Data Controller Representative: Jean Claude Muscat, Balázs Zentai

Data Protection Officer: Consact Kft., Dr. Kőrösi Barbara

Data protection officer contact details: korosib@consact.hu, 06 30 2040319

Data Controller 1 and Data Controller 2 belong to a group of companies and in practice operate as a healthcare center. They are considered joint data controllers with respect to the processing of personal data.

Saint James Vision&Aesthetics Center and its staff consider it of utmost importance to protect the health and personal data of patients, and to respect the patients’ right to informational self-determination. The recorded health and personal data are handled confidentially in accordance with data protection laws and professional standards, and all security, technical, and organizational measures are taken to guarantee the safety of the data.

The current version of this Notice is always available at www.lassjol.hu, and the https://saintjameshungary.hu/ on websites, at the reception, and in several places within our institution.

2. The legislation that serves as the basis for data processing

Our activities related to the processing of health and personal data are primarily determined by the following laws:

Act CXII of 2011 on the right of informational self-determination and freedom of information
Law CLIV of 1997 on health care;
Law XLVII of 1997 on the processing and protection of health and related personal data (hereinafter: Eüak)
Decree No. 43/1999 (XII. 3.) of the Government on the detailed rules for financing health services from the Health Insurance Fund.
the CL. Law of 2017 on the administration of taxation;
REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL (27 April 2016) on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter: „GDPR”)

The scope of this information is as follows:

to all organizational units of the Institution providing healthcare services, to the organization performing professional supervision and control, to any employee who, or which, processes health and personal data,
to any natural person who uses the healthcare services of the Institution, as well as to any other natural person whose personal data are processed by the Data Controller (hereinafter: the "Data Subject"),
health and personal identification data concerning the data subject, processed in accordance with the provisions of Act XLVII of 1997 on the processing and protection of health and related personal data (hereinafter Eüak.),
the external service provider with whom the personal data related to the institution’s duties is handled or will be handled.

3. The purpose of health data management

Health and identity data can be processed for the following purposes:

promoting the preservation, improvement and maintenance of health,
promoting the effective curative treatment activities of the healthcare provider, including the professional supervision activities,
monitoring the health status of the person concerned,
taking measures that become necessary for public health, public hygiene and epidemiological interests,
Enforcement of patient rights
tracking the individual patient journey.

In addition to the listed data, health and personal data may be processed for the purposes specified therein only in cases determined by law in order to fulfill the obligation prescribed by law.

For the data management purposes described above, only the necessary and strictly necessary health-related or personally identifying data may be processed, as required by laws and professional regulations, and which are indispensable for achieving the data management purpose.

4. Concepts

GDPRREGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL (27 April 2016) on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)

Personal data: any information about the data subject, such as an identifier, name, number, location data, online identifier, or data regarding the natural person’s physical, physiological, genetic, mental, economic, cultural or social identity.

Special data: personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, as well as genetic and biometric data intended to identify natural persons, health data and personal data concerning the sexual life of natural persons or sexual orientation of natural persons.

Data management: regardless of the method used, any operation or set of operations performed with personal data or data sets, including in particular collection, recording, storage, organization, structuring, adaptation or alteration, use, disclosure by transmission, dissemination, or any other form of public communication, comparison with data held by other organizations or public authorities, and the processing of data for the purpose of identifying the data subject, as well as the recording of photographs, audio or video recordings and the physical characteristics that could be used to identify the data subject (e.g., fingerprints or palm prints).

Data Controller: the natural or legal person, or legal entity without legal personality, who, alone or jointly with others, determines the purposes and means of the processing of personal data, makes and implements decisions regarding data processing, or carries them out with the data processor.

Data processor: the natural or legal person, or the legal entity that is not a legal person, who, or which, processes personal data on behalf of the data controller.

Affected: any natural person identified on the basis of specific personal data or – directly or indirectly, based on one or more factors – identifiable as such; an identifiable natural person is a natural person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

Data transfer: the disclosure of personal data to a specific third party. Data transfers to EEA member states or to the institutions of the European Union shall be considered as if they were being made within the territory of Hungary.

Deletion/deletion: the anonymization of data by content deletion or in a manner equivalent to this.

Data protection incident: Security is the protection against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or unauthorized access to personal data that is transmitted, stored, or otherwise handled.

Member State of the EEA: the Member State of the European Union and the other State party to the Agreement on the European Economic Area, as well as the State whose citizens are nationals of the European Union and its Member States, shall enjoy the same legal status as the nationals of the State party to the Agreement on the European Economic Area under an international treaty concluded between the European Union and its Member States and the State not party to the Agreement on the European Economic Area.

Third country: any state that is not a member state of the EEA.

NAIH: National Data Protection and Freedom of Information Authority, in the case of Hungary, the supervisory authority under the GDPR.

5. Fundamental principles of data processing

Personal data:

the treatment is carried out lawfully and fairly, and in a transparent manner for the affected person („legality, fair procedure and transparency”);
collection may only be carried out for a specific, clear and legitimate purpose („purpose limitation”);
they must be appropriate and relevant to the purposes of data processing, and they must be limited to what is necessary („data economy”);
During its processing, we take all reasonable measures to ensure that the data is accurate and up-to-date; for the purposes of data processing, inaccurate personal data shall be deleted or corrected immediately („accuracy”);
we store it in a form that allows the data subjects to be identified only for the period necessary to achieve the purposes for which the personal data is processed („limited storage”);
We manage the processing in such a way that appropriate technical or organizational measures are applied to ensure the appropriate security of personal data, including protection against unauthorized or unlawful processing, accidental loss, destruction or damage („integrity and confidentiality”).

As data controllers, we are responsible for compliance with the above, and we will verify compliance if necessary („accountability”).

6. Managed data

6.1 Contact

Affected parties: any natural person who provides the contact details necessary for the contact on the website/by email/by phone/in a message on a social media platform.

Purpose of data processingContacting and maintaining relationships

Data type	Legal basis	Guard time
name, phone number, email address.	Article 6(1)(a) of the GDPR – Consent	Until withdrawal of consent

The data management process:

In order to respond to requests, we process the personal data provided.

Providing this information is not mandatory, but in the absence of it, we will not be able to respond to your contact request.

The Data Subject may withdraw their consent at any time without justification, however this does not affect any processing of data that took place previously based on the consent.

6.2 Booking and admission of individuals seeking private healthcare services (website, social media pages, by phone, email, in person)

Affected partiesThose seeking private healthcare services

Purpose of data processing: Booking an appointment, preparing a contract.

Data type

Legal basis

Guard time

name, phone number, place of residence, e-mail address, date of birth, eye disease, dioptres, address (zip code), TAJ (passport number), previous illnesses, treatments, surgeries, medication usage, health fund identification number, spouse, or authorized representative name, date

Article 6(1)(a) of the GDPR – Consent

+ express consent in accordance with Article 9(2)(a) regarding health data

5 years after the termination of the contractual relationship, deletion upon request of the affected person

The data management process:

If you book an appointment with us using the online booking system on our website or by other means (by phone, in person, by email), we will use the above personal data to book the appointment and to organize the examination.

The data are kept electronically in the medical software.

Providing the above data is not mandatory; however, in the absence of such information, you will not be able to schedule an appointment and we will not be able to begin organizing the examination. You may withdraw your consent at any time without giving any reason; however, this will not affect any data processing that took place previously based on the consent.

6.3 Authorization or prohibition to inform relatives

Affected parties: Relatives of patients

Purpose of data processingInformation to relatives, or exclusion from the information.

Data type	Legal basis	Guard time
name, phone number	Legitimate interest pursuant to Article 6(1)(f) of the GDPR	The Healthcare Documentation shall be kept by the Data Controller for at least 30 years from the date of data collection.

The data management process:

The patient may declare which of their relatives they wish to be informed by the Data Controller about their health status, or conversely, which of their relatives they wish to be excluded from the information.

The patient enters the relevant data.

Regarding the data processing based on the Data Controller’s legitimate interest, we conducted an interest test to assess the necessity and proportionality of the processing, as a result of which we determined that the data processing is lawful.

The Data Subject has the possibility to object to the data processing (see in detail point 12.8).

6.4 Fixed calls

Affected partiesIndividuals who call for private healthcare services by phone

Purpose of data processing: Booking an appointment, preparing a contract.

Data type

Legal basis

Guard time

name, phone number, e-mail address, date of birth, basic eye measurements: dioptre, eye diseases, wearing contact lenses address (zip code)

Article 6(1)(a) of the GDPR – Consent

+ express consent in accordance with Article 9(2)(a) regarding health data

The data controller does not store the data; access to it is provided exclusively through the provider’s interface.

The data management process:

The data is not stored; access to it is provided exclusively through the provider’s interface. Calls made by individuals seeking private healthcare services by phone are recorded on the web-based call center interface (Comnica).

Providing the above data is not mandatory; however, in the absence of such information, you will not be able to schedule an appointment and we will not be able to begin organizing the examination. If you do not wish to consent to the recording of the call, you may schedule an appointment in person, on our website, or by sending an email. You may withdraw your consent at any time without giving any reason; however, this will not affect any data processing that took place previously based on your consent.

6.5 Contractual obligations

Affected parties: People who are going to undergo surgery.

Purpose of data processing: Signing and fulfilling a contract.

Data type	Legal basis	Guard time
Name, ID number, date of aptitude test, date of surgery, signature	GDPR Article 6(b) (Performance of a contract)	5 years after the termination of the contractual relationship
Bank account statement (in case of partial payment)	GDPR Article 6(b) (Performance of a contract)	1 month after the contract is concluded

The data management process:

During contract conclusion, the data provided by the individual is used; it is managed during the duration of the contractual relationship solely for the purpose of fulfilling the contract and maintaining contact. In the case of partial payment, in order to verify the payer’s solvency, we also request a bank account statement from the Data Subject, which will be deleted after the conclusion of the contract – no later than within 1 month.

The data is also stored on paper and electronically (medical software).

We use the above data to conclude and fulfill the contract. Providing the data is not mandatory, but without them we cannot perform the surgery.

6.6 Health data recording – record-keeping, use of medical software, data transfer to EESST

Affected partiesPeople who use health services

Purpose of data processingExamination, treatment, management of health documentation.

Data type

Legal basis

Guard time

name, date of birth, place of birth, TAJ, mother's name, address, postal address, data related to the examination history, examination results, medical findings

Article 6(1)(c) of the GDPR

(Legal obligation) pursuant to § 28 (1) of the Eüak, and in relation to health data, Article 9 (2) h) of the GDPR.

The Healthcare Documentation shall be kept by the Data Controller for at least 30 years from the date of data collection.

The data management process:

In accordance with the relevant legislation, providing the data is mandatory. Failure to do so will prevent us from keeping your data on record. The data is also recorded in our medical system and transmitted to the EESST.

6.7 Surgical consent declaration

Affected parties: Persons requiring surgery

Purpose of data processing: Proof of giving consent for surgical treatment.

Data type	Legal basis	Guard time
name, date and place of birth, TAJ, or in absence thereof mother's name and place of residence, medical history, signature	Article 6(1)(a) of the GDPR - contribution	The Healthcare Documentation shall be kept by the Data Controller for at least 30 years from the date of data collection.

The data of the persons who are undergoing surgery are used to issue the surgical consent declaration.

Providing the above data is not mandatory; however, in the absence of such information, we will not be able to inform you about the surgery. You may withdraw your consent at any time without giving any reason; however, this will not affect any data processing that took place previously based on the consent.

6.8 Recipe writing

Affected partiesPatient

Purpose of data processing: Recipe writing.

Data type	Legal basis	Guard time
Patient data: name, TAJ – in the case of an order with social security support, address, date of birth, in the case of a public health care patient, the number of the public health care card, in the case of a prescription ordered via the EESST, the affected person’s gender, in addition to this, the affected TAJ number, or in its absence, another identification document used to identify the affected person, BNO code – in the case of an order with social security support, date	Article 6, paragraph c) of the GDPR (Legal obligation to fulfill): XLVII Law of 1997 – on the processing and protection of health and related personal data, Article 14/A, paragraph 1	The Healthcare Documentation shall be kept by the Data Controller for at least 30 years from the date of data collection.

The data management process:

Based on the examinations, it may be necessary to write a prescription for the patient. The prescriptions are printed from the medical system with the above content.

Providing the data is mandatory under the relevant legislation. Failure to do so will result in the prescription not being issued.

The data is transmitted to the EESST, and in the event of an official investigation, the data may also be transmitted to the competent authority.

6.9 Online test

Affected partiesThe people who complete the online test on the website

Purpose of data processingAssessment of suitability for surgery.

Data type	Legal basis	Guard time
age, pregnancy or breastfeeding, history of stroke, previous eye diseases, treatments, email address, name	Article 6(1)(a) of the GDPR – consent, as well as the express consent pursuant to Article 9(2)(a)	There is no storage/backup at the data controller; the service provider does the storage.

The data management process:

The data is not stored; we only have access to it through the provider’s interface. The data of the individuals who complete the online test are recorded in the provider’s interface (Activecampaign).

Providing the above data is not mandatory; however, in the absence of such data, we cannot assess your suitability for the surgery. You may withdraw your consent at any time without giving any reason; however, this does not affect data processing that took place previously based on your consent.

6. 10 Performance of contracts related to the operation and business activities of the data controller

Affected parties: Contractual partner or contact person.

Purpose of data processing: Performance of the contract.

Data type	Legal basis	Guard time
Name, phone number, and email address of the partner’s employee	Article 6 (1) f) GDPR – legitimate interest	5 years after the termination of the employment relationship, + 1 year as the deadline for verification required by the Tax Administration Act

The data management process:

During the performance of the contract, we use the personal data provided by the partner; we process them during the duration of the contractual relationship, solely for the purpose of fulfilling the order and for communication purposes.

If we also receive the personal data of the employees of the partner company, typically for the purpose of contact, we process these data on the basis of a legitimate interest. The enforcement of the legitimate interest of the contracting parties benefits in this case compared to the employee’s right of disposition over their personal data, as the employee’s work is necessary for the performance of their job and the restriction is proportionate (NAIH/2018/2570/2/V).

The Data Subject has the possibility to object to the data processing (see in detail point 12.8).

Providing the data is not mandatory, however, the knowledge of personal data suitable for identification and contact is an essential prerequisite for fulfilling the order.

The data may be forwarded to the accountant and to those specified in the contract.

6.11 Billing

Affected partiesPatients.

Purpose of data processingManaging accounts.

Data type

Legal basis

Guard time

Name, address and health insurance identification number of the patient/patient's legal representative

Article 6(1)(c) of the GDPR – Fulfillment of a legal obligation

– Article 169(1)-(2) of Act C of 2000 on the Accounting Act

8 years

The data management process:

For private individuals, the invoices contain personal data. We keep the invoices in accordance with the requirements of the Accounting Act.

Providing the data is mandatory under the relevant legislation. Failure to do so will result in the invoice not being issued.

The data are stored electronically (számlázz.hu). The invoices are submitted to the accountant.

6.12 Sending newsletters for marketing purposes

Affected parties: Persons who subscribe to the newsletter.

Purpose of data processingSending newsletters, informing about new products, special offers and discounts.

Data type	Legal basis	Guard time
name, email address	Article 6(1)(a) of the GDPR – consent	Until withdrawal of consent

The data management process:

Providing the above data is not mandatory; however, in the absence of such information, we are unable to send the newsletter. The Data Subject may withdraw their consent at any time without giving any reason; however, this does not affect any processing of data that has taken place previously based on the consent.

The data can be recorded in the newsletters on the Activecampaign online platform, where they are stored.

6.13. Taking photos or videos of a patient for marketing purposes

Affected partiesPatients.

Purpose of data processingMarketing.

Data type	Legal basis	Guard time
Video, photo	Article 6(1)(a) of the GDPR – consent	Until withdrawal of consent

The data management process:

The provision of the above data is not mandatory. The Data Subject may withdraw their consent at any time without giving any reason, however this does not affect any data processing that has already taken place based on the consent.

6.14 Social media presence

If the user, on their own initiative, likes or follows one of our social media pages, we may also learn their following data: profile name, profile URL, profile identifier, profile picture, given address, gender, birthday, introduction. I am not the data controller of the personal data published by visitors on the social media page. The operator of the social media page is the data controller; the operator’s Data Protection and Service Terms govern data processing.

6.15 Cookies (cookiek)

When you visit our website, we place small data files, so-called cookies or cookies, in the user’s browser and in HTML-based emails in accordance with this data protection notice.

Cookies are small data files that are sent to your computer via the website when you use it, and are saved by the internet browser. A cookie allows the website to recognize when a user has logged in to the site for the first time. The main purpose of a cookie is to allow the user to receive personalized offers and advertisements that customize the user experience during the use of the website and express the user’s personal needs and preferences.

Cookies can be used for many useful purposes.

Security: supporting and enabling security, and assisting the Data Controller in detecting illegal behavior.
Preferences, features, and services: cookies are able to tell the Data Controller which language the User prefers, what the User’s communication preferences are, and help the User fill out forms on the website, making them easier to fill out.
Advertising: The Data Controller may use cookies to show the User relevant advertisements on and off the website. It may also use cookies that show whether Users who have seen an advertisement on the website will later visit the advertiser’s website.
Performance, analytics and research: such cookies help the Data Controller to understand how the website performs in different locations. The Data Controller may also use cookies that evaluate, improve, and research the website, products, features, and services, including when the User enters the website from other websites or devices, such as the User's computer or mobile device.

Checking and managing cookies:

We provide detailed information and configuration options regarding the cookies we use in the pop-up window when you first visit the website.

Most browsers allow Users to control the use of cookies through the settings. However, if the User restricts the use of cookies on the website, this may compromise the user experience, as it will no longer be possible to personalize the experience for the user.

7. General rules for the handling of health data

During data collection, the date of the data collection and the person who collected the data must be recorded in the health documentation.

All entries in the patient’s documentation must be authenticated with a signature or hand-written note and, if necessary, with a date; in the case of electronic data management, the system must ensure that the person who made the entry is clearly identified.

Data related to the examination and treatment of the patient are included in the medical documentation. The medical documentation must be maintained in a way that it reflects the reality of the treatment process.

During the medical treatment, data in accordance with professional regulations must be recorded in the medical documentation. The physician performing the treatment decides which health data must be recorded in accordance with professional regulations, in addition to the data that must be recorded by law.

The inclusion of data in health documents that are not directly related to the patient’s medical treatment may only take place if they are relevant to the patient’s care. During the medical treatment, only those with access rights may access the documentation and the patient’s personal data.

All persons employed at the Institute and in other employment relationships related to work are subject to a duty of confidentiality regarding data related to the patient’s health status and other data that have come to their knowledge in connection with work. The duty of confidentiality applies without time limitation to all employees of the Institute, regardless of how the data were obtained. The duty of confidentiality therefore applies not only to the treating physician and the professional staff, but also to all employees of the Institute.

The patient may be granted a written exemption from the confidentiality obligation. The Institution is obliged to comply with the data reporting obligation if the transmission of the data is mandatory under the statutory regulations.

8. Access to data and data security measures

8.1 Access to data

The Institution records the names, positions and the designation of the data management employees in the organizational units, along with the indication of the organizational unit in the health data management register.

Within the healthcare network, the healthcare and identity data processing rights are held by:

the Director of the Institution,
the Director of the Institute
the treating physician,
the healthcare professional involved in the treatment, the nurse,
the staff member responsible for patient registration and referral management
the data protection officer.

In the case of electronic data management, the signature is replaced by the electronic user name-password pair. For the management of the records and the authorization of access, the person exercising the employer’s rights regarding the organizational unit is responsible. For the secret handling of the password and any misuse thereof, the owner of the password is responsible. The institution only uses an electronic system that is capable of ensuring the secret handling of passwords. In the case of electronic data management, the system logs the fact of the entry.

In the case of manual data management, the identification of the data controller or the person making the modification is done by comparing the signature with the signature recorded in the registry.

8.2 Data security measures

The Data Controller guarantees the prevention of unauthorized and unlawful processing of personal data, accidental loss, destruction, or damage thereof, as well as the accuracy, completeness, and up-to-dateness of the data, through technical and organizational measures for data protection and information security.

The Data Controller is with information technology protection and digital data protection Among his duties related to this matter, he is responsible for:

measures to protect against unauthorized access, such as

access protection – only with valid identifiable credentials (username and unique password) can access to the computer and databases containing personal information available on it be granted; the access passwords are changed every three months;
Network protection – password-protected WiFi, a protected router provides a firewall between the internal network and the internet;
the protection of the network and data repositories against viruses;
of the physical protection of data repositories and the devices that store them (archiving, fire safety regulations, locked server)

In order to ensure the secure storage of the data, the Data Controller performs daily backups of the entire data volume of the central server. The saved data medium is securely stored in a designated and regulated location and in a manner that is consistent with the requirements.

The files containing the data are deleted irreversibly after the purpose of data processing has been fulfilled or when the deadline for data processing has expired, the legal basis for which has been terminated.

A stored and managed on paper In order to ensure the appropriate security of personal data, the Data Controller implements the following measures:

only employees with access rights to the documents can access them (records management policy);
After the documentation related to the provision of care or related to it is completed by the data management staff, the managed documents are sealed in a prescribed manner, the data management room is locked, or stored in a place where the presence of healthcare workers is ensured through continuous supervision (lockable filing cabinet, lockable office);
During the transportation of the patient and examination in another institution, the medical documentation must be handed over personally to the healthcare worker responsible for the examination or intervention or the healthcare worker who is responsible for the transfer. The fact of the transfer must be recorded in the patient’s documentation by the recipient by indicating the date and the data must be verified for accuracy.
The Data Controller stores the paper-based documents in a dry room equipped with well-sealed, fire-resistant and asset-protection equipment suitable for storing paper-based documents (document storage room).

The documents containing the data shall be destroyed in a manner that proves the purpose of the data processing has been fulfilled or the legal basis for data processing has expired (using a shredder or a notary).

9. Modifying and deleting data

The affected person is required to inform the Data Controller in writing about any changes that occur during the treatment period; to do so, the Personal Data Change Declaration form must be filled out. The affected person may request the rectification and deletion of their data; details regarding this can be found in the chapter entitled “The rights of the data subject regarding data processing”.

During the deletion process, the controller physically destroys the manually processed data, and in the case of electronically stored data, irreversibly alters them. The deletion can be performed with the joint permission of the data protection officer and the Director of the Institution, and this is recorded in the Controller’s records. If the health documentation has scientific significance, the Controller will transfer it to the competent Records Department after the mandatory registration period has expired.

The Data Controller shall correct or delete any erroneous health or personal data contained in the health documentation – after the data entry – in such a way that the originally recorded data can be identified. The modification shall be accompanied by a signature, and in the case of electronic data processing, the clear identification of the person who entered the data and the recording of the entry shall be ensured by the system.

10. Data reporting regarding the health data of the affected person or their close relatives

The patient (their legal representative) is entitled to receive information about their personal identification and health data, to access the medical documentation, and to request a free copy thereof. Any additional copies must be paid for according to the cost elements specified in a ministerial regulation.

The person concerned during the period of its provision The right to request data is exercised by the data subject and their legal representative, as well as by the person authorized by them in writing. The data subject after the completion of the supply The right to request data is exercised by the data subject and their legal representative, as well as by the person authorized by the person in a legally valid private document.

Requests for document retrieval or copy issuance should be addressed to the colleague responsible for document management.

The application in person, in addition to proof of identity, or in writing, The application may be submitted in a fully probative private form. Proof of eligibility must be provided by the applicant with a photo ID (e.g., ID card, new type of driver's license) and documentation proving their eligibility (TAJ card, birth certificate, marriage certificate, death certificate, fully probative private document).

The oral request must be written down and attached to the patient's documentation and kept there.

If the The data is not requested by the person concerned, Thus, except for a legal request for data, the applicant is required to prove their identity and eligibility:

by the person concerned, in his/her own hand, with a power of attorney signed by him/her, or
written, edited, printed and signed with one's own hand in an electronic instrument, which has been authenticated by two witnesses, or
with the authorization contained in the full authentic private document concerned.

In these cases, the document proving entitlement must be attached to the application.

The staff responsible for data management keeps a record of applications and the measures (disclosure or refusal thereof).

For the first time, the issuance of copies will be carried out without cost, after which a fee must be paid based on the cost scales specified in the ministerial decree for the issuance of further copies. The institution will inform the applicant in writing about this matter. The method of payment is a transfer to the institution’s bank account or cash payment to the cash desk.

All pages of the paper copy issued to the applicant must be stamped and dated by the Institution. Photocopying is considered electronic, including making a copy on a data carrier (including taking a photo or scanning).

After authentication and signature, the Data Controller must, upon request, send the copy to the affected person or, if their authorization extends to receiving the documentation, to the authorized person by postal mail as a registered delivery or hand it over in person at the place where the request was submitted. In the case of personal delivery, the applicant must, if there are no obstacles to this, verify their identity and sign the receipt of the copies and the time of their receipt.

The document containing health data sent via electronic mail must be sent to the Data Subject using a password.

Knowing health data related to the cause of death of a deceased relative or to medical treatment before the death occurred

In the event of the death of the person concerned, their legal representative, close relatives and heirs – upon written request – are entitled to:

related to or attributable to the cause of death, and furthermore
to obtain health information related to curative treatment before death occurs, to access the health documentation, and to obtain a copy thereof or to receive a copy.

Identifying the causes influencing the lives of relatives, gaining knowledge about data related to their healthcare during the patient's life and after their death

In the patient's life or after their death, the spouse concerned, a relative in the direct line, a sibling, an heir, and a partner – on the basis of a written request – are also entitled to exercise the right to request data even if the health data is

the identification of the causes affecting the life and health of the spouse, the relative living in the same household, the brother or sister, the partner, as well as their descendants; and
medical care for the persons listed above is necessary, and
the knowledge of the health data in another way, or the conclusion based on it, is not possible,
the head of the medical care organization unit certifies that the copies of the requested documentation relate exclusively to the cause of death or are related to the medical treatment prior to the death, or
the application includes health data that are directly related to the legal reason specified therein.

If the relative only requests access to the documentation, the head of the patient care department will ensure this right in accordance with the above restrictions, who will also provide the necessary information to the relative. Access to the documentation must be documented (with the date of the access, the details of the person accessing the documentation and the signature of the head of the department who granted the access).

11. Data transfer, data processors

After the treatment, the treating physician records the data regarding the affected person specified in point F of Eüaktv.35/§. The affected person’s family doctor and the physician who provided the treatment are entitled to know the details of the health care provided by the affected person at the expense of the mandatory health insurance, provided that the data are provided to them in electronic form by the health insurance institution. The family doctor can access the data of the insured person who has registered with him/her. The affected person/or his/her legal representative is entitled to prohibit, in a declaration of self-determination, the other data processor or the user of the EESZT from knowing the recorded data/the data of the minor represented by him/her. The EESZT Data Protection Information can be accessed at the following link: https://e-egeszsegugy.gov.hu/adatvedelem. The Data Controller’s details are:

State Health Care Provider Center

Headquarters: 1125 Budapest, Diós árok 3.

Phone number: 06 1 356 1522

Email address: helpdesk.eeszt@aeek.hu

In addition to the doctors employed as employees of Saint James Vision&Aesthetics Center, the personal contribution partners doctors also work together with. Such colleagues are considered independent data controllers, but the Saint James Vision&Aesthetics Center’s data protection regulations also apply to them.

Data transfer for seeking or requesting data from a body outside the healthcare network: For data requests or written requests from the following bodies, the treating physician and the health insurance institution shall, in accordance with the law, provide the personal identification data necessary for identification to the requesting or requesting data provider body. In the request or data request, the health and personal identification data to be known shall be indicated in accordance with Paragraph 4 of Article 4 of the Eavt. The requesting or requesting data provider bodies may be:

in criminal matters, the court, the public prosecutor, the investigating authority, the body conducting the preliminary proceedings, the judicial expert, civil and non-judicial, as well as administrative authorities in civil and administrative matters, the public prosecutor, the court, the judicial expert,
during a regulatory procedure, the bodies conducting the procedure,
in the case of potential military personnel and military personnel, the county (capital district) office of the capital city and county government, the military administration and central data processing organ of the Hungarian Armed Forces, and the committee determining military fitness,
in order to carry out the tasks defined in Act CXXV of 1995 on National Security Services, within the scope of the authority granted therein,
the military administrative and central data processing organ of the Hungarian Defence Forces, for the purpose of calling trained reservists for military deployment during peacetime and for the rapid and differentiated recruitment of trained reservists, within the scope defined in the Act on Defence and the Hungarian Defence Forces,
during an ongoing ethical procedure against a healthcare professional, the conduct of the procedure by a chamber body with the authority and competence to do so,
the bodies responsible for internal crime prevention and investigation as defined in the Police Act, as well as the bodies combating terrorism, in order to carry out the tasks defined in the Act, within the scope of the authority granted therein,
During the autopsy, the physician conducting the autopsy,
During the professional investigation in the Act on the professional investigation of air, rail and water transport accidents and other transport incidents, as well as in the European Parliament and Council Regulation 996/2010/EU of 20 October 2010 on the investigation and prevention of civil aviation accidents and incidents and repealing Directive 94/56/EC, the transport safety authority. (Article 23 of Act XLVII of 1997)

Data processors:

Kardisoft Ltd. (medical software)

Headquarters: 9024 Győr, Csokonai u. 29

Company registration number: 08 09 012232

Tax number: 13293369-2-08

Comnica Kft. (recorded phone calls)

Headquarters: 1119 Budapest, Mohai út 38.

Phone number: 36 1 255 0990

Email address: info@comnica.com

Activecampaign LLC (newsletters, online test platform)

160 Shelbourne Rd, Dublin, D04 E7K5, Suite 03-101, Dublin, Dublin, 2

https://www.activecampaign.com/contact

KBOSS.hu Ltd. – számlázz.hu (accounting)

Head office: 1031 Budapest, Záhony utca 7.

Company registration number: 01-09-303201

Tax number: 13421739-2-41

Docca Ltd. (IT service)

Headquarters: 1123 Budapest, Győri út 2/C 2nd floor, door 6

Company registration number: 01 10 141530

Tax number: 27428014-2-43

WhatsApp Ireland Limited (Instant messaging service on websites)

Merrion Road, Dublin 4, D04 X2K5, Ireland

https://www.whatsapp.com/legal/privacy-policy-eea#ea2SG9qUySboIlMvL

12. The rights of the data subject regarding the processing

At the request of the affected person, the patient rights representative will provide information about their rights related to the handling of health documentation, subject to the practice applied at the Institution. The patient rights representative’s name and contact information are: www.lassjol.hu and https://saintjameshungary.hu/ It is published on websites and in the Institute’s waiting room.

Data Protection Officer: Consact Kft., Dr. Kőrösi Barbara; contactable during working hours: 06-30 20 40319; email: korosib@consact.hu.

12.1 Right to prior information

The data subject has the right to receive information in writing from the Data Controller before the start of the processing of personal data regarding the data subject. The information must be provided to the Data Controller no later than at the time of the acquisition of the personal data.

If the data controller intends to further process the personal data for a purpose other than the purpose for which it was collected, it must inform the data subject about this different purpose and all relevant additional information prior to the further processing.

12. 2 The right of access

The data subject has the right to receive a response from the Data Controller regarding whether the processing of their personal data is ongoing and, if such processing is ongoing, the right to access the personal data and the following information:

a) the purposes of data processing;
b) the categories of personal data concerned;
c) the recipients or categories of recipients with whom the personal data have been or will be disclosed, including in particular third-country recipients or international organizations;
d) where applicable, the planned duration of the storage of personal data, or, if this is not possible, the criteria for determining this duration;
e) the right of the data subject to request from the Data Controller the rectification, deletion or restriction of the processing of personal data concerning him/her, and to object to the processing of such personal data;
f) the right to submit a complaint to a supervisory authority;
g) if the data were not collected from the data subject, all available information regarding their source;
h) the fact of automated decision-making, including profiling, and, in at least these cases, the applied logic and the understandable information about the significance of such data processing and the expected consequences for the data subject.

The Data Controller shall provide a copy of the personal data subject to the processing to the data subject. For further copies requested by the data subject, the Data Controller may charge a reasonable fee based on administrative costs. If the data subject submitted the request electronically, the information shall be provided in a widely used electronic format, unless the data subject requests otherwise. The right to request a copy shall not adversely affect the rights and freedoms of others.

12.3 Right to rectification

The data subject has the right, at their request, to have inaccurate personal data concerning them corrected without undue delay by the Data Controller. Taking into account the purpose of the processing, the data subject has the right to request the addition of incomplete personal data – including through an additional declaration.

12.4 The right to be forgotten („the right to be forgotten”)

The data subject has the right, at their request, to have the personal data concerning them deleted without undue delay by the Data Controller, and the Data Controller is obliged to delete the personal data concerning the data subject without undue delay if one of the following reasons applies:

a) the personal data are no longer necessary for the purpose for which they were collected or otherwise processed;
b) the data subject withdraws the consent that forms the basis for the data processing and there is no other legal basis for the data processing;
c) the data subject objects to the processing of the data and there is no overriding legitimate reason for the processing;
d) the personal data were processed unlawfully;
e) the personal data must be deleted in order to comply with a legal obligation prescribed by Union or Member State law applicable to the Data Controller;
f) the personal data were collected in connection with the provision of information society services.

If the Data Controller has disclosed the personal data and is required to delete it in accordance with the previous provisions, it shall, taking into account the available technology and the costs of implementation, take reasonable steps – including technical measures – to inform the data controllers who process the data that the data subject has requested the deletion of the links to the personal data in question or of any other copy or duplicate of these personal data.

The above provisions do not apply if data processing is necessary:

a) for the exercise of the freedom of expression and the right to information;
b) to fulfill an obligation under Union or national law applicable to the Data Controller that requires the processing of personal data, or to carry out a task carried out in the public interest or in the exercise of a public authority conferred on the Data Controller;
c) on grounds of public interest in the field of public health;
d) for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, where the right to erasure is likely to render impossible or seriously impair the achievement of those purposes; or
e) for the purpose of presenting, asserting or defending legal claims.

12.5 The right to restrict data processing

The data subject has the right, at their request, to have the data controller restrict the processing of their data if one of the following conditions is met:

a) the data subject disputes the accuracy of the personal data; in this case, the restriction applies to the period of time necessary to allow the Data Controller to verify the accuracy of the personal data;
b) the data processing is unlawful, and the data subject objects to the deletion of the data and instead requests the restriction of its use;
c) the Data Controller no longer needs the personal data for the purposes of processing, but the data subject requires them to assert, exercise or defend legal claims; or
d) the data subject has objected to the processing; in this case, the restriction applies for the period until it is determined whether the legitimate reasons of the Data Controller take precedence over the legitimate reasons of the data subject.

If data processing is restricted on the basis of the above, such personal data may be processed only with the consent of the data subject, or to establish, exercise or defend legal claims, or for the protection of the rights of other natural or legal persons, or for important public interest reasons of the Union or of a Member State.

The Data Controller shall inform the data subject, whose request has restricted the data processing, in advance of the lifting of the restriction of the data processing.

12.6 Right to rectification or erasure of personal data or restriction of data processing

The data subject has the right to request the Controller to provide the recipients with whom their personal data have been disclosed. The Controller is obliged to inform all recipients with whom the personal data have been disclosed of the rectification, deletion or restriction of the processing of their personal data, unless this is impossible or requires disproportionately great effort.

12.7 Right to data portability

The data subject has the right to receive the personal data concerning him or her that he or she has provided to the Data Controller in a structured, commonly used and machine-readable format, and the right to transmit those data to another data controller if:

a) the data processing is based on consent or a contract, and
b) the data processing is carried out in an automated manner.

In exercising the right to data portability, the data subject is entitled to request the direct transfer of personal data between data controllers, if this is technically feasible.

The exercise of the data subject’s right to data portability shall not adversely affect the rights and freedoms of others, provided that the Data Controller complies with this fact by not disclosing personal data supported by this fact, and it is appropriate to inform the data subject thereof.

12.8 The right to object

The data subject has the right to object at any time, for reasons related to their particular situation, to the processing of personal data that is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Data Controller, including profiling based on those provisions. In this case, the Data Controller may not further process the personal data, unless the Data Controller demonstrates that the processing is justified by compelling legitimate grounds that override the interests, rights and freedoms of the data subject, or that are related to the exercise of legal claims, their enforcement or defense.

If personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to the processing of personal data concerning them for this purpose, including profiling, insofar as it relates to direct marketing.

If the data subject objects to the processing of personal data for direct marketing purposes, the personal data shall no longer be processed for such purposes.

12.9 Automated decision-making, profiling

The data subject has the right not to be subject to a decision based solely on automated processing of data, including profiling, which would have a legal effect on him or her or similarly significantly affect him or her. This does not apply in cases where the decision

a) necessary for the conclusion or performance of the contract between the data subject and the data controller,
b) the adoption of such measures by the data controller is permitted by Union or Member State law applicable to the data controller, which also establishes appropriate measures to protect the data subject’s rights and freedoms and their legitimate interests; or
c) based on the expressed consent of the person concerned.

In the cases referred to in points a) and c), the Data Controller is obliged to take appropriate measures to protect the rights, freedoms and legitimate interests of the data subject, including at least the right of the data subject to request human intervention on the part of the Data Controller, to express his or her point of view and to submit an objection to the decision.

12.10 The affected person's right to information regarding the data protection incident

The data subject has the right to receive information about the data protection incident that affects him or her at the Data Controller, if the data protection incident is likely to involve a high risk to the rights and freedoms of natural persons.

12.11 The affected person’s right to file a complaint with the supervisory authority

Without prejudice to other administrative or judicial remedies, all affected persons are entitled to lodge a complaint with a supervisory authority – in particular in the Member State where their habitual residence, place of work or the place of the alleged infringement is located – if, in the affected person’s view, the processing of their personal data infringes the Regulation.

The supervisory authority to which the complaint was submitted is obliged to inform the customer about the procedural developments related to the complaint and its outcome, including the fact that the customer is entitled to seek judicial remedy.

Hungarian state supervisory authority:

National Authority for Data Protection and Freedom of Information (postal address: 1363 Budapest, Pf. 9., head office: 1055 Budapest, Falk Miksa utca 9-11., website: www.naih.hu, phone: 06-1-391-1400, e-mail address: ugyfelszolgalat@naih.hu).

12.12 Right to effective judicial remedy against the supervisory authority

Without prejudice to other administrative or non-judicial remedies, every natural and legal person is entitled to an effective judicial remedy against a decision of the supervisory authority concerning them that has legal force.

Without prejudice to other administrative or non-judicial remedies, all concerned are entitled to an effective judicial remedy if the competent supervisory authority does not address the complaint or fails to inform the concerned person within three months about the procedural developments or the outcome of the complaint.

Proceedings against the supervisory authority must be initiated before the courts of the Member State where the supervisory authority is based.

If you have any questions, comments or concerns regarding the services provided by Saint James Vision&Aesthetics Center, you can contact us using the contact details provided in the information notice. Saint James Vision&Aesthetics Center will provide you with information regarding the measures taken in response to your request without undue delay, but no later than 30 days from the date of receipt of the request. If necessary, the deadline may be extended by 2 months, with notification of the reasons for the delay within 1 month of the receipt of the request.

The Data Subject may withdraw their consent at any time without justification, however this does not affect any processing of data that took place previously based on the consent.

It can be downloaded here: Saint James Eye Center – Data Protection Information

The attachments included in the downloadable version are:

Declares for personal data exchange

Page requesting a copy of health documentation