{"id":4514,"date":"2025-09-29T22:14:52","date_gmt":"2025-09-29T22:14:52","guid":{"rendered":"https:\/\/saintjameshungary.hu\/?page_id=4514"},"modified":"2026-04-15T15:31:25","modified_gmt":"2026-04-15T15:31:25","slug":"data-protection-declaration","status":"publish","type":"page","link":"https:\/\/saintjameshungary.hu\/en\/adatvedelmi-nyilatkozat\/","title":{"rendered":"Privacy statement"},"content":{"rendered":"<div data-elementor-type=\"wp-page\" data-elementor-id=\"4514\" class=\"elementor elementor-4514\" data-elementor-post-type=\"page\">\n\t\t\t\t<div class=\"elementor-element elementor-element-69ed91dc e-flex e-con-boxed e-con e-parent\" data-id=\"69ed91dc\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-b025de2 elementor-widget elementor-widget-heading\" data-id=\"b025de2\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t\t<h1 class=\"elementor-heading-title elementor-size-default\">Privacy statement<\/h1>\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-48582765 elementor-widget elementor-widget-text-editor\" data-id=\"48582765\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<p>Information about our data protection and data management policies and practices.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-61a805a6 elementor-widget elementor-widget-button\" data-id=\"61a805a6\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"button.default\">\n\t\t\t\t\t\t\t\t\t\t<a class=\"elementor-button elementor-button-link elementor-size-sm\" href=\"#adatvedelem\">\n\t\t\t\t\t\t<span class=\"elementor-button-content-wrapper\">\n\t\t\t\t\t\t\t\t\t<span class=\"elementor-button-text\">I will read it<\/span>\n\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-45206c1 e-flex e-con-boxed e-con e-parent\" data-id=\"45206c1\" data-element_type=\"container\" data-e-type=\"container\" id=\"adatvedelem\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-760ce1f elementor-widget elementor-widget-text-editor\" data-id=\"760ce1f\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<h3><b>Name and details of the data controller<\/b><\/h3><p>\u00a0<\/p><p><b>Data Controller 1<\/b><span style=\"font-weight: 400;\"> Name: <\/span><b>Saint James Eye Clinic Hungary Kft.<\/b><\/p><p><span style=\"font-weight: 400;\">Postal address: <\/span> <span style=\"font-weight: 400;\">1034 Budapest, <\/span><a href=\"https:\/\/www.google.com\/maps\/place\/data=!4m2!3m1!1s0x4741d9290721921f:0x99b6ea9808ea8a55?sa=X&amp;ved=1t:8290&amp;ictx=111\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">Vienna Road 68-84<\/span><\/a><span style=\"font-weight: 400;\">.<\/span><\/p><p><span style=\"font-weight: 400;\">Phone number: <\/span> <span style=\"font-weight: 400;\">06 1 788 2927<\/span><\/p><p><span style=\"font-weight: 400;\">Email address:<\/span> <span style=\"font-weight: 400;\">balazs.zentai@stjameshospital.hu<\/span><\/p><p><span style=\"font-weight: 400;\">Website: <\/span> <a href=\"http:\/\/www.lassjol.hu\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">www.lassjol.hu<\/span><\/a><span style=\"font-weight: 400;\">, <\/span><a href=\"https:\/\/saintjameshungary.hu\/en\/\"><span style=\"font-weight: 400;\">https:\/\/saintjameshungary.hu\/<\/span><\/a><span style=\"font-weight: 400;\">\u00a0<\/span><\/p><p><span style=\"font-weight: 400;\">Company registration number: <\/span> <span style=\"font-weight: 400;\">01 09 439235<\/span><\/p><p>\u00a0<\/p><p><b>Data Controller 2<\/b><span style=\"font-weight: 400;\"> Name: <\/span><b>Saint James Aesthetic Hungary Kft.<\/b><\/p><p><span style=\"font-weight: 400;\">Postal address: <\/span> <span style=\"font-weight: 400;\">1034 Budapest, <\/span><a href=\"https:\/\/www.google.com\/maps\/place\/data=!4m2!3m1!1s0x4741d9290721921f:0x99b6ea9808ea8a55?sa=X&amp;ved=1t:8290&amp;ictx=111\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">Vienna Road 68-84<\/span><\/a><span style=\"font-weight: 400;\">.<\/span><\/p><p><span style=\"font-weight: 400;\">Phone number: <\/span> <span style=\"font-weight: 400;\">06 1 788 2927<\/span><\/p><p><span style=\"font-weight: 400;\">Email address:<\/span> <span style=\"font-weight: 400;\">balazs.zentai@stjameshospital.hu<\/span><\/p><p><span style=\"font-weight: 400;\">Website: <\/span> <a href=\"https:\/\/saintjameshungary.hu\/en\/\"><span style=\"font-weight: 400;\">https:\/\/saintjameshungary.hu\/<\/span><\/a><\/p><p><span style=\"font-weight: 400;\">Company registration number: <\/span> <span style=\"font-weight: 400;\">01 09 434063<\/span><\/p><p>\u00a0<\/p><p><span style=\"font-weight: 400;\">Data Controller 1 and Data Controller 2 together: Data Controller<\/span><\/p><h5>\u00a0<\/h5><p><span style=\"font-weight: 400;\">Data Controller Representative: Jean Claude Muscat, Bal\u00e1zs Zentai<\/span><\/p><p><span style=\"font-weight: 400;\">Data Protection Officer: Consact Kft., Dr. K\u0151r\u00f6si Barbara<\/span><\/p><p><span style=\"font-weight: 400;\">Data protection officer contact details: korosib@consact.hu, 06 30 2040319<\/span><\/p><p><span style=\"font-weight: 400;\">Data Controller 1 and Data Controller 2 belong to a group of companies and in practice operate as a healthcare center. They are considered joint data controllers with respect to the processing of personal data.<\/span><\/p><p><span style=\"font-weight: 400;\">Saint James Vision&amp;Aesthetics Center and its staff consider it of utmost importance to protect the health and personal data of patients, and to respect the patients\u2019 right to informational self-determination. The recorded health and personal data are handled confidentially in accordance with data protection laws and professional standards, and all security, technical, and organizational measures are taken to guarantee the safety of the data.<\/span><\/p><p><span style=\"font-weight: 400;\">The current version of this Notice is always available at <\/span><a href=\"http:\/\/www.lassjol.hu\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">www.lassjol.hu<\/span><\/a><span style=\"font-weight: 400;\">, and the <\/span><a href=\"https:\/\/saintjameshungary.hu\/en\/\"><span style=\"font-weight: 400;\">https:\/\/saintjameshungary.hu\/<\/span><\/a><span style=\"font-weight: 400;\"> on websites, at the reception, and in several places within our institution.\u00a0<\/span><\/p><p>\u00a0<\/p><h5><a name=\"_Toc119591121\"><\/a>2.\u00a0 \u00a0 \u00a0<strong>The legislation that serves as the basis for data processing<\/strong><\/h5><p><span style=\"font-weight: 400;\">Our activities related to the processing of health and personal data are primarily determined by the following laws:<\/span><\/p><ul><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Act CXII of 2011 on the right of informational self-determination and freedom of information<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Law CLIV of 1997 on health care;<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Law XLVII of 1997 on the processing and protection of health and related personal data (hereinafter: E\u00fcak)<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Decree No. 43\/1999 (XII. 3.) of the Government on the detailed rules for financing health services from the Health Insurance Fund.<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">the CL. Law of 2017 on the administration of taxation;<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">REGULATION (EU) 2016\/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL (27 April 2016) on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95\/46\/EC (hereinafter: \u201eGDPR\u201d)<\/span><\/li><\/ul><p><span style=\"font-weight: 400;\">The scope of this information is as follows:<\/span><\/p><ul><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">to all organizational units of the Institution providing healthcare services, to the organization performing professional supervision and control, to any employee who, or which, processes health and personal data,<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">to any natural person who uses the healthcare services of the Institution, as well as to any other natural person whose personal data are processed by the Data Controller (hereinafter: the \"Data Subject\"),<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">health and personal identification data concerning the data subject, processed in accordance with the provisions of Act XLVII of 1997 on the processing and protection of health and related personal data (hereinafter E\u00fcak.),<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">the external service provider with whom the personal data related to the institution\u2019s duties is handled or will be handled.<\/span><\/li><\/ul><p><a style=\"font-size: 1.2em; font-weight: bold;\" name=\"_Toc35703841\"><\/a><a style=\"font-size: 1.2em; font-weight: bold;\" name=\"_Toc119591122\"><\/a><span style=\"font-size: 1.2em; font-weight: bold;\">3. The purpose of health data management<\/span><\/p><p><a name=\"_Toc35703842\"><\/a><\/p><p><span style=\"font-weight: 400;\">Health and identity data can be processed for the following purposes:<\/span><\/p><ul><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">promoting the preservation, improvement and maintenance of health,<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">promoting the effective curative treatment activities of the healthcare provider, including the professional supervision activities,<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">monitoring the health status of the person concerned,<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">taking measures that become necessary for public health, public hygiene and epidemiological interests,<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Enforcement of patient rights<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">tracking the individual patient journey.<\/span><\/li><\/ul><p><span style=\"font-weight: 400;\">In addition to the listed data, health and personal data may be processed for the purposes specified therein only in cases determined by law in order to fulfill the obligation prescribed by law.\u00a0<\/span><\/p><p><span style=\"font-weight: 400;\">For the data management purposes described above, only the necessary and strictly necessary health-related or personally identifying data may be processed, as required by laws and professional regulations, and which are indispensable for achieving the data management purpose.<\/span><\/p><h5><a name=\"_Toc509407972\"><\/a><a name=\"_Toc514063301\"><\/a><a name=\"_Toc64921680\"><\/a><a name=\"_Toc109241623\"><\/a><a name=\"_Toc119591123\"><\/a>4. Concepts<\/h5><p><b>GDPR<\/b><span style=\"font-weight: 400;\">REGULATION (EU) 2016\/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL (27 April 2016) on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95\/46\/EC (General Data Protection Regulation)<\/span><\/p><p><b>Personal data:<\/b> <span style=\"font-weight: 400;\">any information about the data subject, such as an identifier, name, number, location data, online identifier, or data regarding the natural person\u2019s physical, physiological, genetic, mental, economic, cultural or social identity.\u00a0<\/span><\/p><p><b>Special data:<\/b> <span style=\"font-weight: 400;\">personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, as well as genetic and biometric data intended to identify natural persons, health data and personal data concerning the sexual life of natural persons or sexual orientation of natural persons.<\/span><\/p><p><b>Data management<\/b><span style=\"font-weight: 400;\">: <\/span> <span style=\"font-weight: 400;\">regardless of the method used, any operation or set of operations performed with personal data or data sets, including in particular collection, recording, storage, organization, structuring, adaptation or alteration, use, disclosure by transmission, dissemination, or any other form of public communication, comparison with data held by other organizations or public authorities, and the processing of data for the purpose of identifying the data subject, as well as the recording of photographs, audio or video recordings and the physical characteristics that could be used to identify the data subject (e.g., fingerprints or palm prints).<\/span><\/p><p><b>Data Controller<\/b><span style=\"font-weight: 400;\">: <\/span> <span style=\"font-weight: 400;\">the natural or legal person, or legal entity without legal personality, who, alone or jointly with others, determines the purposes and means of the processing of personal data, makes and implements decisions regarding data processing, or carries them out with the data processor.<\/span><\/p><p><b>Data processor<\/b><span style=\"font-weight: 400;\">: <\/span> <span style=\"font-weight: 400;\">the natural or legal person, or the legal entity that is not a legal person, who, or which, processes personal data on behalf of the data controller.<\/span><\/p><p><b>Affected<\/b><span style=\"font-weight: 400;\">: <\/span> <span style=\"font-weight: 400;\">any natural person identified on the basis of specific personal data or \u2013 directly or indirectly, based on one or more factors \u2013 identifiable as such; an identifiable natural person is a natural person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.<\/span><\/p><p><b>Data transfer<\/b><span style=\"font-weight: 400;\">: <\/span> <span style=\"font-weight: 400;\">the disclosure of personal data to a specific third party. Data transfers to EEA member states or to the institutions of the European Union shall be considered as if they were being made within the territory of Hungary.<\/span><\/p><p><b>Deletion\/deletion:<\/b> <span style=\"font-weight: 400;\">the anonymization of data by content deletion or in a manner equivalent to this.\u00a0<\/span><\/p><p><b>Data protection incident<\/b><span style=\"font-weight: 400;\">: <\/span> <span style=\"font-weight: 400;\">Security is the protection against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or unauthorized access to personal data that is transmitted, stored, or otherwise handled.<\/span><\/p><p><b>Member State of the EEA<\/b><span style=\"font-weight: 400;\">: <\/span> <span style=\"font-weight: 400;\">the Member State of the European Union and the other State party to the Agreement on the European Economic Area, as well as the State whose citizens are nationals of the European Union and its Member States, shall enjoy the same legal status as the nationals of the State party to the Agreement on the European Economic Area under an international treaty concluded between the European Union and its Member States and the State not party to the Agreement on the European Economic Area.<\/span><\/p><p><b>Third country<\/b><span style=\"font-weight: 400;\">: <\/span> <span style=\"font-weight: 400;\">any state that is not a member state of the EEA.<\/span><\/p><p><b>NAIH<\/b><span style=\"font-weight: 400;\">:<\/span> <span style=\"font-weight: 400;\">National Data Protection and Freedom of Information Authority, in the case of Hungary, the supervisory authority under the GDPR.<\/span><\/p><h5><a name=\"_Toc509407973\"><\/a><a name=\"_Toc514063302\"><\/a><a name=\"_Toc64921681\"><\/a><a name=\"_Toc109241624\"><\/a><a name=\"_Toc119591124\"><\/a>5. Fundamental principles of data processing<\/h5><p><span style=\"font-weight: 400;\">Personal data:\u00a0<\/span><\/p><ul><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">the treatment is carried out lawfully and fairly, and in a transparent manner for the affected person (\u201elegality, fair procedure and transparency\u201d);\u00a0<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">collection may only be carried out for a specific, clear and legitimate purpose (\u201epurpose limitation\u201d);\u00a0<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">they must be appropriate and relevant to the purposes of data processing, and they must be limited to what is necessary (\u201edata economy\u201d);\u00a0<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">During its processing, we take all reasonable measures to ensure that the data is accurate and up-to-date; for the purposes of data processing, inaccurate personal data shall be deleted or corrected immediately (\u201eaccuracy\u201d);<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">we store it in a form that allows the data subjects to be identified only for the period necessary to achieve the purposes for which the personal data is processed (\u201elimited storage\u201d);\u00a0<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">We manage the processing in such a way that appropriate technical or organizational measures are applied to ensure the appropriate security of personal data, including protection against unauthorized or unlawful processing, accidental loss, destruction or damage (\u201eintegrity and confidentiality\u201d).\u00a0<\/span><\/li><\/ul><p><strong>As data controllers, we are responsible for compliance with the above, and we will verify compliance if necessary (\u201eaccountability\u201d).<\/strong><\/p><h5><a name=\"_Toc119591125\"><\/a>6. Managed data<\/h5><h5><strong>6.1 Contact<\/strong><\/h5><p><b>Affected parties<\/b><span style=\"font-weight: 400;\">: any natural person who provides the contact details necessary for the contact on the website\/by email\/by phone\/in a message on a social media platform.<\/span><\/p><p><b>Purpose of data processing<\/b><span style=\"font-weight: 400;\">Contacting and maintaining relationships<\/span><\/p><table width=\"600\"><tbody><tr><td width=\"200\">Data type<\/td><td width=\"200\">Legal basis<\/td><td width=\"200\">Guard time<\/td><\/tr><tr><td width=\"200\">name, phone number, email address.<\/td><td width=\"200\">Article 6(1)(a) of the GDPR \u2013 Consent<\/td><td width=\"200\">Until withdrawal of consent<\/td><\/tr><\/tbody><\/table><p><strong>The data management process:<\/strong><\/p><p><span style=\"font-weight: 400;\">In order to respond to requests, we process the personal data provided.\u00a0<\/span><\/p><p><span style=\"font-weight: 400;\">Providing this information is not mandatory, but in the absence of it, we will not be able to respond to your contact request. <\/span><\/p><p><span style=\"font-weight: 400;\">The Data Subject may withdraw their consent at any time without justification, however this does not affect any processing of data that took place previously based on the consent.<\/span><a name=\"_Toc119591127\"><\/a><\/p><h5><strong>6.2 Booking and admission of individuals seeking private healthcare services (website, social media pages, by phone, email, in person)<\/strong><\/h5><p><b>Affected parties<\/b><span style=\"font-weight: 400;\">Those seeking private healthcare services<\/span><\/p><p><b>Purpose of data processing<\/b><span style=\"font-weight: 400;\">: Booking an appointment, preparing a contract.<\/span><\/p><table><tbody><tr><td><span style=\"font-weight: 400;\">Data type<\/span><\/td><td><span style=\"font-weight: 400;\">Legal basis<\/span><\/td><td><span style=\"font-weight: 400;\">Guard time<\/span><\/td><\/tr><tr><td><span style=\"font-weight: 400;\">name, phone number, place of residence, e-mail address, date of birth, eye disease, dioptres, address (zip code), TAJ (passport number), previous illnesses, treatments, surgeries, medication usage, health fund identification number, spouse, or authorized representative name, date<\/span><\/td><td><p><span style=\"font-weight: 400;\">Article 6(1)(a) of the GDPR \u2013 Consent<\/span><\/p><p><span style=\"font-weight: 400;\">+ express consent in accordance with Article 9(2)(a) regarding health data<\/span><\/p><\/td><td><span style=\"font-weight: 400;\">5 years after the termination of the contractual relationship, deletion upon request of the affected person<\/span><\/td><\/tr><\/tbody><\/table><p><b>The data management process:\u00a0<\/b><\/p><p><span style=\"font-weight: 400;\">If you book an appointment with us using the online booking system on our website or by other means (by phone, in person, by email), we will use the above personal data to book the appointment and to organize the examination.\u00a0<\/span><\/p><p><span style=\"font-weight: 400;\">The data are kept electronically in the medical software.<\/span><\/p><p><span style=\"font-weight: 400;\">Providing the above data is not mandatory; however, in the absence of such information, you will not be able to schedule an appointment and we will not be able to begin organizing the examination. You may withdraw your consent at any time without giving any reason; however, this will not affect any data processing that took place previously based on the consent.\u00a0<\/span><\/p><h5><strong>6.3 Authorization or prohibition to inform relatives<\/strong><\/h5><p><b>Affected parties<\/b><span style=\"font-weight: 400;\">: Relatives of patients<\/span><\/p><p><b>Purpose of data processing<\/b><span style=\"font-weight: 400;\">Information to relatives, or exclusion from the information.<\/span><\/p><table><tbody><tr><td><span style=\"font-weight: 400;\">Data type<\/span><\/td><td><span style=\"font-weight: 400;\">Legal basis<\/span><\/td><td><span style=\"font-weight: 400;\">Guard time<\/span><\/td><\/tr><tr><td><span style=\"font-weight: 400;\">name, phone number<\/span><\/td><td><span style=\"font-weight: 400;\">Legitimate interest pursuant to Article 6(1)(f) of the GDPR<\/span><\/td><td><span style=\"font-weight: 400;\">The Healthcare Documentation shall be kept by the Data Controller for at least 30 years from the date of data collection.<\/span><\/td><\/tr><\/tbody><\/table><p><b>The data management process:\u00a0<\/b><\/p><p><span style=\"font-weight: 400;\">The patient may declare which of their relatives they wish to be informed by the Data Controller about their health status, or conversely, which of their relatives they wish to be excluded from the information.<\/span><\/p><p><span style=\"font-weight: 400;\">The patient enters the relevant data.<\/span><\/p><p><span style=\"font-weight: 400;\">Regarding the data processing based on the Data Controller\u2019s legitimate interest, we conducted an interest test to assess the necessity and proportionality of the processing, as a result of which we determined that the data processing is lawful.\u00a0<\/span><\/p><p><span style=\"font-weight: 400;\">The Data Subject has the possibility to object to the data processing (see in detail point 12.8).<\/span><\/p><h5><strong>6.4 Fixed calls<\/strong><\/h5><p><b>Affected parties<\/b><span style=\"font-weight: 400;\">Individuals who call for private healthcare services by phone<\/span><\/p><p><b>Purpose of data processing<\/b><span style=\"font-weight: 400;\">: Booking an appointment, preparing a contract.<\/span><\/p><table><tbody><tr><td><span style=\"font-weight: 400;\">Data type<\/span><\/td><td><span style=\"font-weight: 400;\">Legal basis<\/span><\/td><td><span style=\"font-weight: 400;\">Guard time<\/span><\/td><\/tr><tr><td><span style=\"font-weight: 400;\">name, phone number, e-mail address, date of birth, basic eye measurements: dioptre, eye diseases, wearing contact lenses address (zip code)<\/span><\/td><td><p><span style=\"font-weight: 400;\">Article 6(1)(a) of the GDPR \u2013 Consent<\/span><\/p><p><span style=\"font-weight: 400;\">+ express consent in accordance with Article 9(2)(a) regarding health data<\/span><\/p><\/td><td><span style=\"font-weight: 400;\">The data controller does not store the data; access to it is provided exclusively through the provider\u2019s interface.<\/span><\/td><\/tr><\/tbody><\/table><p><b>The data management process:\u00a0<\/b><\/p><p><span style=\"font-weight: 400;\">The data is not stored; access to it is provided exclusively through the provider\u2019s interface. Calls made by individuals seeking private healthcare services by phone are recorded on the web-based call center interface (Comnica).<\/span><\/p><p><span style=\"font-weight: 400;\">Providing the above data is not mandatory; however, in the absence of such information, you will not be able to schedule an appointment and we will not be able to begin organizing the examination. If you do not wish to consent to the recording of the call, you may schedule an appointment in person, on our website, or by sending an email. You may withdraw your consent at any time without giving any reason; however, this will not affect any data processing that took place previously based on your consent.\u00a0<\/span><\/p><h5><strong>6.5 Contractual obligations<\/strong><\/h5><p><b>Affected parties: <\/b><span style=\"font-weight: 400;\">People who are going to undergo surgery.<\/span><\/p><p><b>Purpose of data processing: <\/b><span style=\"font-weight: 400;\">Signing and fulfilling a contract.<\/span><\/p><table><tbody><tr><td><span style=\"font-weight: 400;\">Data type<\/span><\/td><td><span style=\"font-weight: 400;\">Legal basis<\/span><\/td><td><span style=\"font-weight: 400;\">Guard time<\/span><\/td><\/tr><tr><td><span style=\"font-weight: 400;\">Name, ID number, date of aptitude test, date of surgery, signature<\/span><\/td><td rowspan=\"2\"><span style=\"font-weight: 400;\">GDPR Article 6(b) (Performance of a contract)<\/span><\/td><td><span style=\"font-weight: 400;\">5 years after the termination of the contractual relationship<\/span><\/td><\/tr><tr><td><span style=\"font-weight: 400;\">Bank account statement (in case of partial payment)<\/span><\/td><td><span style=\"font-weight: 400;\">1 month after the contract is concluded<\/span><\/td><\/tr><\/tbody><\/table><p><b>The data management process<\/b><span style=\"font-weight: 400;\">:\u00a0<\/span><\/p><p><span style=\"font-weight: 400;\">During contract conclusion, the data provided by the individual is used; it is managed during the duration of the contractual relationship solely for the purpose of fulfilling the contract and maintaining contact. In the case of partial payment, in order to verify the payer\u2019s solvency, we also request a bank account statement from the Data Subject, which will be deleted after the conclusion of the contract \u2013 no later than within 1 month.<\/span><\/p><p><span style=\"font-weight: 400;\">The data is also stored on paper and electronically (medical software).<\/span><\/p><p><span style=\"font-weight: 400;\">We use the above data to conclude and fulfill the contract. Providing the data is not mandatory, but without them we cannot perform the surgery.<\/span><\/p><h5><strong>6.6 Health data recording \u2013 record-keeping, use of medical software, data transfer to EESST<\/strong><\/h5><p><b>Affected parties<\/b><span style=\"font-weight: 400;\">People who use health services<\/span><\/p><p><b>Purpose of data processing<\/b><span style=\"font-weight: 400;\">Examination, treatment, management of health documentation.<\/span><\/p><table><tbody><tr><td><span style=\"font-weight: 400;\">Data type<\/span><\/td><td><span style=\"font-weight: 400;\">Legal basis<\/span><\/td><td><span style=\"font-weight: 400;\">Guard time<\/span><\/td><\/tr><tr><td><span style=\"font-weight: 400;\">name, date of birth, place of birth, TAJ, mother's name, address, postal address, data related to the examination history, examination results, medical findings<\/span><\/td><td><p><span style=\"font-weight: 400;\">Article 6(1)(c) of the GDPR\u00a0<\/span><\/p><p><span style=\"font-weight: 400;\">(Legal obligation) pursuant to \u00a7 28 (1) of the E\u00fcak, and in relation to health data, Article 9 (2) h) of the GDPR.<\/span><\/p><\/td><td><span style=\"font-weight: 400;\">The Healthcare Documentation shall be kept by the Data Controller for at least 30 years from the date of data collection.<\/span><\/td><\/tr><\/tbody><\/table><p><b>The data management process:\u00a0<\/b><\/p><p><span style=\"font-weight: 400;\">In accordance with the relevant legislation, providing the data is mandatory. Failure to do so will prevent us from keeping your data on record. The data is also recorded in our medical system and transmitted to the EESST.<\/span><\/p><h5><strong>6.7 Surgical consent declaration<\/strong><\/h5><p><b>Affected parties<\/b><span style=\"font-weight: 400;\">: Persons requiring surgery<\/span><\/p><p><b>Purpose of data processing:<\/b><span style=\"font-weight: 400;\"> Proof of giving consent for surgical treatment.<\/span><\/p><table><tbody><tr><td><span style=\"font-weight: 400;\">Data type<\/span><\/td><td><span style=\"font-weight: 400;\">Legal basis<\/span><\/td><td><span style=\"font-weight: 400;\">Guard time<\/span><\/td><\/tr><tr><td><span style=\"font-weight: 400;\">name, date and place of birth, TAJ, or in absence thereof mother's name and place of residence, medical history, signature<\/span><\/td><td><span style=\"font-weight: 400;\">Article 6(1)(a) of the GDPR - contribution<\/span><\/td><td><span style=\"font-weight: 400;\">The Healthcare Documentation shall be kept by the Data Controller for at least 30 years from the date of data collection.<\/span><\/td><\/tr><\/tbody><\/table><p><span style=\"font-weight: 400;\">The data of the persons who are undergoing surgery are used to issue the surgical consent declaration.<\/span><\/p><p><span style=\"font-weight: 400;\">Providing the above data is not mandatory; however, in the absence of such information, we will not be able to inform you about the surgery. You may withdraw your consent at any time without giving any reason; however, this will not affect any data processing that took place previously based on the consent.<\/span><\/p><h5><strong>6.8 Recipe writing<\/strong><\/h5><p><b>Affected parties<\/b><span style=\"font-weight: 400;\">Patient<\/span><\/p><p><b>Purpose of data processing:<\/b><span style=\"font-weight: 400;\"> Recipe writing.<\/span><\/p><table><tbody><tr><td><span style=\"font-weight: 400;\">Data type<\/span><\/td><td><span style=\"font-weight: 400;\">Legal basis<\/span><\/td><td><span style=\"font-weight: 400;\">Guard time<\/span><\/td><\/tr><tr><td><span style=\"font-weight: 400;\">Patient data: name, TAJ \u2013 in the case of an order with social security support, address, date of birth, in the case of a public health care patient, the number of the public health care card, in the case of a prescription ordered via the EESST, the affected person\u2019s gender, in addition to this, the affected TAJ number, or in its absence, another identification document used to identify the affected person, BNO code \u2013 in the case of an order with social security support, date<\/span><\/td><td><span style=\"font-weight: 400;\">Article 6, paragraph c) of the GDPR (Legal obligation to fulfill): XLVII Law of 1997 \u2013 on the processing and protection of health and related personal data, Article 14\/A, paragraph 1<\/span><\/td><td><span style=\"font-weight: 400;\">The Healthcare Documentation shall be kept by the Data Controller for at least 30 years from the date of data collection.<\/span><\/td><\/tr><\/tbody><\/table><p><b>The data management process:\u00a0<\/b><\/p><p><span style=\"font-weight: 400;\">Based on the examinations, it may be necessary to write a prescription for the patient. The prescriptions are printed from the medical system with the above content.\u00a0<\/span><\/p><p><span style=\"font-weight: 400;\">Providing the data is mandatory under the relevant legislation. Failure to do so will result in the prescription not being issued.<\/span><\/p><p><span style=\"font-weight: 400;\">The data is transmitted to the EESST, and in the event of an official investigation, the data may also be transmitted to the competent authority.<\/span><\/p><h5><strong>6.9 Online test<\/strong><\/h5><p><b>Affected parties<\/b><span style=\"font-weight: 400;\">The people who complete the online test on the website<\/span><\/p><p><b>Purpose of data processing<\/b><span style=\"font-weight: 400;\">Assessment of suitability for surgery.<\/span><\/p><table><tbody><tr><td><span style=\"font-weight: 400;\">Data type<\/span><\/td><td><span style=\"font-weight: 400;\">Legal basis<\/span><\/td><td><span style=\"font-weight: 400;\">Guard time<\/span><\/td><\/tr><tr><td><span style=\"font-weight: 400;\">age, pregnancy or breastfeeding, history of stroke, previous eye diseases, treatments, email address, name<\/span><\/td><td><span style=\"font-weight: 400;\">Article 6(1)(a) of the GDPR \u2013 consent, as well as the express consent pursuant to Article 9(2)(a)<\/span><\/td><td><span style=\"font-weight: 400;\">There is no storage\/backup at the data controller; the service provider does the storage.<\/span><\/td><\/tr><\/tbody><\/table><p><b>The data management process:\u00a0<\/b><\/p><p><span style=\"font-weight: 400;\">The data is not stored; we only have access to it through the provider\u2019s interface. The data of the individuals who complete the online test are recorded in the provider\u2019s interface (Activecampaign).<\/span><\/p><p><span style=\"font-weight: 400;\">Providing the above data is not mandatory; however, in the absence of such data, we cannot assess your suitability for the surgery. You may withdraw your consent at any time without giving any reason; however, this does not affect data processing that took place previously based on your consent.\u00a0<\/span><\/p><h5><strong>6. 10 Performance of contracts related to the operation and business activities of the data controller<\/strong><\/h5><p><b>Affected parties: <\/b><span style=\"font-weight: 400;\">Contractual partner or contact person.<\/span><\/p><p><b>Purpose of data processing: <\/b><span style=\"font-weight: 400;\">Performance of the contract.<\/span><\/p><table><tbody><tr><td><span style=\"font-weight: 400;\">Data type<\/span><\/td><td><span style=\"font-weight: 400;\">Legal basis<\/span><\/td><td><span style=\"font-weight: 400;\">Guard time<\/span><\/td><\/tr><tr><td><span style=\"font-weight: 400;\">Name, phone number, and email address of the partner\u2019s employee<\/span><\/td><td><span style=\"font-weight: 400;\">Article 6 (1) f) GDPR \u2013 legitimate interest<\/span><\/td><td><span style=\"font-weight: 400;\">5 years after the termination of the employment relationship, + 1 year as the deadline for verification required by the Tax Administration Act<\/span><\/td><\/tr><\/tbody><\/table><p><b>The data management process<\/b><span style=\"font-weight: 400;\">:\u00a0<\/span><\/p><p><span style=\"font-weight: 400;\">During the performance of the contract, we use the personal data provided by the partner; we process them during the duration of the contractual relationship, solely for the purpose of fulfilling the order and for communication purposes.\u00a0<\/span><\/p><p><span style=\"font-weight: 400;\">If we also receive the personal data of the employees of the partner company, typically for the purpose of contact, we process these data on the basis of a legitimate interest. The enforcement of the legitimate interest of the contracting parties benefits in this case compared to the employee\u2019s right of disposition over their personal data, as the employee\u2019s work is necessary for the performance of their job and the restriction is proportionate (NAIH\/2018\/2570\/2\/V).<\/span><\/p><p><span style=\"font-weight: 400;\">Regarding the data processing based on the Data Controller\u2019s legitimate interest, we conducted an interest test to assess the necessity and proportionality of the processing, as a result of which we determined that the data processing is lawful.\u00a0<\/span><\/p><p><span style=\"font-weight: 400;\">The Data Subject has the possibility to object to the data processing (see in detail point 12.8).<\/span><\/p><p><span style=\"font-weight: 400;\">Providing the data is not mandatory, however, the knowledge of personal data suitable for identification and contact is an essential prerequisite for fulfilling the order.<\/span><\/p><p><span style=\"font-weight: 400;\">The data may be forwarded to the accountant and to those specified in the contract.<\/span><\/p><h5><strong>6.11 Billing<\/strong><\/h5><p><b>Affected parties<\/b><span style=\"font-weight: 400;\">Patients.<\/span><\/p><p><b>Purpose of data processing<\/b><span style=\"font-weight: 400;\">Managing accounts.<\/span><\/p><table><tbody><tr><td><span style=\"font-weight: 400;\">Data type<\/span><\/td><td><span style=\"font-weight: 400;\">Legal basis<\/span><\/td><td><span style=\"font-weight: 400;\">Guard time<\/span><\/td><\/tr><tr><td><span style=\"font-weight: 400;\">Name, address and health insurance identification number of the patient\/patient's legal representative<\/span><\/td><td><p><span style=\"font-weight: 400;\">Article 6(1)(c) of the GDPR \u2013 Fulfillment of a legal obligation<\/span><\/p><p><span style=\"font-weight: 400;\">\u2013 Article 169(1)-(2) of Act C of 2000 on the Accounting Act<\/span><\/p><\/td><td><span style=\"font-weight: 400;\">8 years<\/span><\/td><\/tr><\/tbody><\/table><p><b>The data management process<\/b><span style=\"font-weight: 400;\">:\u00a0<\/span><\/p><p><span style=\"font-weight: 400;\">For private individuals, the invoices contain personal data. We keep the invoices in accordance with the requirements of the Accounting Act.<\/span><\/p><p><span style=\"font-weight: 400;\">Providing the data is mandatory under the relevant legislation. Failure to do so will result in the invoice not being issued.<\/span><\/p><p><span style=\"font-weight: 400;\">The data are stored electronically (sz\u00e1ml\u00e1zz.hu). The invoices are submitted to the accountant.<\/span><\/p><h5><strong>6.12 Sending newsletters for marketing purposes<\/strong><\/h5><p><b>Affected parties<\/b><span style=\"font-weight: 400;\">: Persons who subscribe to the newsletter.<\/span><\/p><p><b>Purpose of data processing<\/b><span style=\"font-weight: 400;\">Sending newsletters, informing about new products, special offers and discounts.<\/span><\/p><table><tbody><tr><td><span style=\"font-weight: 400;\">Data type<\/span><\/td><td><span style=\"font-weight: 400;\">Legal basis<\/span><\/td><td><span style=\"font-weight: 400;\">Guard time<\/span><\/td><\/tr><tr><td><span style=\"font-weight: 400;\">name, email address<\/span><\/td><td><span style=\"font-weight: 400;\">Article 6(1)(a) of the GDPR \u2013 consent<\/span><\/td><td><span style=\"font-weight: 400;\">Until withdrawal of consent<\/span><\/td><\/tr><\/tbody><\/table><h5>\u00a0<\/h5><p><b>The data management process<\/b><span style=\"font-weight: 400;\">:\u00a0<\/span><\/p><p><span style=\"font-weight: 400;\">Providing the above data is not mandatory; however, in the absence of such information, we are unable to send the newsletter. The Data Subject may withdraw their consent at any time without giving any reason; however, this does not affect any processing of data that has taken place previously based on the consent.\u00a0<\/span><\/p><p><span style=\"font-weight: 400;\">The data can be recorded in the newsletters on the Activecampaign online platform, where they are stored.<\/span><\/p><h5><strong>6.13. Taking photos or videos of a patient for marketing purposes<\/strong><\/h5><p><b>Affected parties<\/b><span style=\"font-weight: 400;\">Patients.<\/span><\/p><p><b>Purpose of data processing<\/b><span style=\"font-weight: 400;\">Marketing.<\/span><\/p><table><tbody><tr><td><span style=\"font-weight: 400;\">Data type<\/span><\/td><td><span style=\"font-weight: 400;\">Legal basis<\/span><\/td><td><span style=\"font-weight: 400;\">Guard time<\/span><\/td><\/tr><tr><td><span style=\"font-weight: 400;\">Video, photo<\/span><\/td><td><span style=\"font-weight: 400;\">Article 6(1)(a) of the GDPR \u2013 consent<\/span><\/td><td><span style=\"font-weight: 400;\">Until withdrawal of consent<\/span><\/td><\/tr><\/tbody><\/table><h5>\u00a0<\/h5><p><b>The data management process<\/b><span style=\"font-weight: 400;\">:\u00a0<\/span><\/p><p><span style=\"font-weight: 400;\">The provision of the above data is not mandatory. The Data Subject may withdraw their consent at any time without giving any reason, however this does not affect any data processing that has already taken place based on the consent.\u00a0<\/span><\/p><h5><strong>6.14 Social media presence<\/strong><\/h5><p><span style=\"font-weight: 400;\">If the user, on their own initiative, likes or follows one of our social media pages, we may also learn their following data: profile name, profile URL, profile identifier, profile picture, given address, gender, birthday, introduction. I am not the data controller of the personal data published by visitors on the social media page. The operator of the social media page is the data controller; the operator\u2019s Data Protection and Service Terms govern data processing.<\/span><\/p><h5><strong>6.15 Cookies (cookiek)<\/strong><\/h5><p><span style=\"font-weight: 400;\">When you visit our website, we place small data files, so-called cookies or cookies, in the user\u2019s browser and in HTML-based emails in accordance with this data protection notice.<\/span><\/p><p><span style=\"font-weight: 400;\">Cookies are small data files that are sent to your computer via the website when you use it, and are saved by the internet browser. A cookie allows the website to recognize when a user has logged in to the site for the first time. The main purpose of a cookie is to allow the user to receive personalized offers and advertisements that customize the user experience during the use of the website and express the user\u2019s personal needs and preferences.<\/span><\/p><p><span style=\"font-weight: 400;\">Cookies can be used for many useful purposes.<\/span><\/p><ul><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Security: supporting and enabling security, and assisting the Data Controller in detecting illegal behavior.<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Preferences, features, and services: cookies are able to tell the Data Controller which language the User prefers, what the User\u2019s communication preferences are, and help the User fill out forms on the website, making them easier to fill out.<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Advertising: The Data Controller may use cookies to show the User relevant advertisements on and off the website. It may also use cookies that show whether Users who have seen an advertisement on the website will later visit the advertiser\u2019s website.\u00a0<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Performance, analytics and research: such cookies help the Data Controller to understand how the website performs in different locations. The Data Controller may also use cookies that evaluate, improve, and research the website, products, features, and services, including when the User enters the website from other websites or devices, such as the User's computer or mobile device.<\/span><\/li><\/ul><p><b>Checking and managing cookies:<\/b><\/p><p><span style=\"font-weight: 400;\">We provide detailed information and configuration options regarding the cookies we use in the pop-up window when you first visit the website.<\/span><\/p><p><span style=\"font-weight: 400;\">Most browsers allow Users to control the use of cookies through the settings. However, if the User restricts the use of cookies on the website, this may compromise the user experience, as it will no longer be possible to personalize the experience for the user.\u00a0<\/span><\/p><h5><strong>7. General rules for the handling of health data<\/strong><\/h5><p><span style=\"font-weight: 400;\">During data collection, the date of the data collection and the person who collected the data must be recorded in the health documentation.<\/span><\/p><p><span style=\"font-weight: 400;\">All entries in the patient\u2019s documentation must be authenticated with a signature or hand-written note and, if necessary, with a date; in the case of electronic data management, the system must ensure that the person who made the entry is clearly identified.<\/span><\/p><p><span style=\"font-weight: 400;\">Data related to the examination and treatment of the patient are included in the medical documentation. The medical documentation must be maintained in a way that it reflects the reality of the treatment process.<\/span><\/p><p><span style=\"font-weight: 400;\">During the medical treatment, data in accordance with professional regulations must be recorded in the medical documentation. The physician performing the treatment decides which health data must be recorded in accordance with professional regulations, in addition to the data that must be recorded by law.<\/span><\/p><p><span style=\"font-weight: 400;\">The inclusion of data in health documents that are not directly related to the patient\u2019s medical treatment may only take place if they are relevant to the patient\u2019s care. During the medical treatment, only those with access rights may access the documentation and the patient\u2019s personal data.<\/span><\/p><p><span style=\"font-weight: 400;\">All persons employed at the Institute and in other employment relationships related to work are subject to a duty of confidentiality regarding data related to the patient\u2019s health status and other data that have come to their knowledge in connection with work. The duty of confidentiality applies without time limitation to all employees of the Institute, regardless of how the data were obtained. The duty of confidentiality therefore applies not only to the treating physician and the professional staff, but also to all employees of the Institute.<\/span><\/p><p><span style=\"font-weight: 400;\">The patient may be granted a written exemption from the confidentiality obligation. The Institution is obliged to comply with the data reporting obligation if the transmission of the data is mandatory under the statutory regulations.<\/span><\/p><h5><b>8. Access to data and data security measures<\/b><\/h5><h5><strong>8.1 Access to data<\/strong><\/h5><p><span style=\"font-weight: 400;\">The Institution records the names, positions and the designation of the data management employees in the organizational units, along with the indication of the organizational unit in the health data management register.<\/span><\/p><p><span style=\"font-weight: 400;\">Within the healthcare network, the healthcare and identity data processing rights are held by:<\/span><\/p><ul><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">the Director of the Institution,<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">the Director of the Institute<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">the treating physician,<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">the healthcare professional involved in the treatment, the nurse,<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">the staff member responsible for patient registration and referral management\u00a0<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">the data protection officer.<\/span><\/li><\/ul><p><span style=\"font-weight: 400;\">In the case of electronic data management, the signature is replaced by the electronic user name-password pair. For the management of the records and the authorization of access, the person exercising the employer\u2019s rights regarding the organizational unit is responsible. For the secret handling of the password and any misuse thereof, the owner of the password is responsible. The institution only uses an electronic system that is capable of ensuring the secret handling of passwords. In the case of electronic data management, the system logs the fact of the entry.<\/span><\/p><p><span style=\"font-weight: 400;\">In the case of manual data management, the identification of the data controller or the person making the modification is done by comparing the signature with the signature recorded in the registry.<\/span><\/p><h5><strong>8.2 Data security measures<\/strong><\/h5><p><span style=\"font-weight: 400;\">The Data Controller guarantees the prevention of unauthorized and unlawful processing of personal data, accidental loss, destruction, or damage thereof, as well as the accuracy, completeness, and up-to-dateness of the data, through technical and organizational measures for data protection and information security.<\/span><\/p><p><span style=\"font-weight: 400;\">The Data Controller is <\/span><span style=\"font-weight: 400;\">with information technology protection and digital data protection<\/span><span style=\"font-weight: 400;\"> Among his duties related to this matter, he is responsible for:<\/span><\/p><ul><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">measures to protect against unauthorized access, such as<\/span><\/li><\/ul><ul><li style=\"font-weight: 400;\" aria-level=\"2\"><span style=\"font-weight: 400;\">access protection \u2013 only with valid identifiable credentials (username and unique password) can access to the computer and databases containing personal information available on it be granted; the access passwords are changed every three months;<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"2\"><span style=\"font-weight: 400;\">Network protection \u2013 password-protected WiFi, a protected router provides a firewall between the internal network and the internet;<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"2\"><span style=\"font-weight: 400;\">the protection of the network and data repositories against viruses;<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"2\"><span style=\"font-weight: 400;\">of the physical protection of data repositories and the devices that store them (archiving, fire safety regulations, locked server)<\/span><\/li><\/ul><ul><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">In order to ensure the secure storage of the data, the Data Controller performs daily backups of the entire data volume of the central server. The saved data medium is securely stored in a designated and regulated location and in a manner that is consistent with the requirements.<\/span><\/li><\/ul><p><span style=\"font-weight: 400;\">The files containing the data are deleted irreversibly after the purpose of data processing has been fulfilled or when the deadline for data processing has expired, the legal basis for which has been terminated.<\/span><\/p><p><span style=\"font-weight: 400;\">A <\/span><span style=\"font-weight: 400;\">stored and managed on paper <\/span><span style=\"font-weight: 400;\">In order to ensure the appropriate security of personal data, the Data Controller implements the following measures:<\/span><\/p><ul><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">only employees with access rights to the documents can access them (records management policy);<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">After the documentation related to the provision of care or related to it is completed by the data management staff, the managed documents are sealed in a prescribed manner, the data management room is locked, or stored in a place where the presence of healthcare workers is ensured through continuous supervision (lockable filing cabinet, lockable office);<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">During the transportation of the patient and examination in another institution, the medical documentation must be handed over personally to the healthcare worker responsible for the examination or intervention or the healthcare worker who is responsible for the transfer. The fact of the transfer must be recorded in the patient\u2019s documentation by the recipient by indicating the date and the data must be verified for accuracy.<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">The Data Controller stores the paper-based documents in a dry room equipped with well-sealed, fire-resistant and asset-protection equipment suitable for storing paper-based documents (document storage room).<\/span><\/li><\/ul><p><span style=\"font-weight: 400;\">The documents containing the data shall be destroyed in a manner that proves the purpose of the data processing has been fulfilled or the legal basis for data processing has expired (using a shredder or a notary).<\/span><\/p><h5><b>9. Modifying and deleting data<\/b><\/h5><p><span style=\"font-weight: 400;\">The affected person is required to inform the Data Controller in writing about any changes that occur during the treatment period; to do so, the Personal Data Change Declaration form must be filled out. The affected person may request the rectification and deletion of their data; details regarding this can be found in the chapter entitled \u201cThe rights of the data subject regarding data processing\u201d.<\/span><\/p><p><span style=\"font-weight: 400;\">During the deletion process, the controller physically destroys the manually processed data, and in the case of electronically stored data, irreversibly alters them. The deletion can be performed with the joint permission of the data protection officer and the Director of the Institution, and this is recorded in the Controller\u2019s records. If the health documentation has scientific significance, the Controller will transfer it to the competent Records Department after the mandatory registration period has expired.<\/span><\/p><p><span style=\"font-weight: 400;\">The Data Controller shall correct or delete any erroneous health or personal data contained in the health documentation \u2013 after the data entry \u2013 in such a way that the originally recorded data can be identified. The modification shall be accompanied by a signature, and in the case of electronic data processing, the clear identification of the person who entered the data and the recording of the entry shall be ensured by the system.<\/span><\/p><h5><strong>10. Data reporting regarding the health data of the affected person or their close relatives<\/strong><\/h5><p><span style=\"font-weight: 400;\">The patient (their legal representative) is entitled to receive information about their personal identification and health data, to access the medical documentation, and to request a free copy thereof. Any additional copies must be paid for according to the cost elements specified in a ministerial regulation.<\/span><\/p><p><span style=\"font-weight: 400;\">The person concerned <\/span><span style=\"font-weight: 400;\">during the period of its provision<\/span><span style=\"font-weight: 400;\"> The right to request data is exercised by the data subject and their legal representative, as well as by the person authorized by them in writing. The data subject <\/span><span style=\"font-weight: 400;\">after the completion of the supply<\/span><span style=\"font-weight: 400;\"> The right to request data is exercised by the data subject and their legal representative, as well as by the person authorized by the person in a legally valid private document.<\/span><\/p><p><span style=\"font-weight: 400;\">Requests for document retrieval or copy issuance should be addressed to the colleague responsible for document management.<\/span><\/p><p><span style=\"font-weight: 400;\">The application <\/span><i><span style=\"font-weight: 400;\">in person<\/span><\/i><span style=\"font-weight: 400;\">, in addition to proof of identity, or <\/span><i><span style=\"font-weight: 400;\">in writing<\/span><\/i><span style=\"font-weight: 400;\">, The application may be submitted in a fully probative private form. Proof of eligibility must be provided by the applicant with a photo ID (e.g., ID card, new type of driver's license) and documentation proving their eligibility (TAJ card, birth certificate, marriage certificate, death certificate, fully probative private document).<\/span><\/p><p><span style=\"font-weight: 400;\">The oral request must be written down and attached to the patient's documentation and kept there.<\/span><\/p><p><span style=\"font-weight: 400;\">If the <\/span><span style=\"font-weight: 400;\">The data is not requested by the person concerned<\/span><span style=\"font-weight: 400;\">, Thus, except for a legal request for data, the applicant is required to prove their identity and eligibility:<\/span><\/p><ul><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">by the person concerned, in his\/her own hand, with a power of attorney signed by him\/her, or<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">written, edited, printed and signed with one's own hand in an electronic instrument, which has been authenticated by two witnesses, or<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">with the authorization contained in the full authentic private document concerned.<\/span><\/li><\/ul><p><span style=\"font-weight: 400;\">In these cases, the document proving entitlement must be attached to the application.\u00a0<\/span><\/p><p><span style=\"font-weight: 400;\">The staff responsible for data management keeps a record of applications and the measures (disclosure or refusal thereof).\u00a0<\/span><\/p><p><span style=\"font-weight: 400;\">For the first time, the issuance of copies will be carried out without cost, after which a fee must be paid based on the cost scales specified in the ministerial decree for the issuance of further copies. The institution will inform the applicant in writing about this matter. The method of payment is a transfer to the institution\u2019s bank account or cash payment to the cash desk.<\/span><\/p><p><span style=\"font-weight: 400;\">All pages of the paper copy issued to the applicant must be stamped and dated by the Institution. Photocopying is considered electronic, including making a copy on a data carrier (including taking a photo or scanning).<\/span><\/p><p><span style=\"font-weight: 400;\">After authentication and signature, the Data Controller must, upon request, send the copy to the affected person or, if their authorization extends to receiving the documentation, to the authorized person by postal mail as a registered delivery or hand it over in person at the place where the request was submitted. In the case of personal delivery, the applicant must, if there are no obstacles to this, verify their identity and sign the receipt of the copies and the time of their receipt.<\/span><\/p><p><span style=\"font-weight: 400;\">The document containing health data sent via electronic mail must be sent to the Data Subject using a password.<\/span><\/p><p><i><span style=\"font-weight: 400;\">Knowing health data related to the cause of death of a deceased relative or to medical treatment before the death occurred<\/span><\/i><\/p><p><span style=\"font-weight: 400;\">In the event of the death of the person concerned, their legal representative, close relatives and heirs \u2013 upon written request \u2013 are entitled to:<\/span><\/p><ul><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">related to or attributable to the cause of death, and furthermore<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">to obtain health information related to curative treatment before death occurs, to access the health documentation, and to obtain a copy thereof or to receive a copy.<\/span><\/li><\/ul><p><i><span style=\"font-weight: 400;\">Identifying the causes influencing the lives of relatives, gaining knowledge about data related to their healthcare during the patient's life and after their death<\/span><\/i><\/p><p><span style=\"font-weight: 400;\">In the patient's life or after their death, the spouse concerned, a relative in the direct line, a sibling, an heir, and a partner \u2013 on the basis of a written request \u2013 are also entitled to exercise the right to request data even if the health data is<\/span><\/p><ul><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">the identification of the causes affecting the life and health of the spouse, the relative living in the same household, the brother or sister, the partner, as well as their descendants; and<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">medical care for the persons listed above is necessary, and<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">the knowledge of the health data in another way, or the conclusion based on it, is not possible,<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">the head of the medical care organization unit certifies that the copies of the requested documentation relate exclusively to the cause of death or are related to the medical treatment prior to the death, or<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">the application includes health data that are directly related to the legal reason specified therein.<\/span><\/li><\/ul><p><span style=\"font-weight: 400;\">If the relative only requests access to the documentation, the head of the patient care department will ensure this right in accordance with the above restrictions, who will also provide the necessary information to the relative. Access to the documentation must be documented (with the date of the access, the details of the person accessing the documentation and the signature of the head of the department who granted the access).<\/span><\/p><h5><b>11. Data transfer, data processors<\/b><\/h5><p><span style=\"font-weight: 400;\">After the treatment, the treating physician records the data regarding the affected person specified in point F of E\u00fcaktv.35\/\u00a7. The affected person\u2019s family doctor and the physician who provided the treatment are entitled to know the details of the health care provided by the affected person at the expense of the mandatory health insurance, provided that the data are provided to them in electronic form by the health insurance institution. The family doctor can access the data of the insured person who has registered with him\/her. The affected person\/or his\/her legal representative is entitled to prohibit, in a declaration of self-determination, the other data processor or the user of the EESZT from knowing the recorded data\/the data of the minor represented by him\/her. The EESZT Data Protection Information can be accessed at the following link: <\/span><a href=\"https:\/\/e-egeszsegugy.gov.hu\/adatvedelem\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">https:\/\/e-egeszsegugy.gov.hu\/adatvedelem<\/span><\/a><span style=\"font-weight: 400;\">. The Data Controller\u2019s details are:<\/span><\/p><p><b>State Health Care Provider Center<\/b><\/p><p><span style=\"font-weight: 400;\">Headquarters: <\/span> <span style=\"font-weight: 400;\">1125 Budapest, Di\u00f3s \u00e1rok 3.<\/span><\/p><p><span style=\"font-weight: 400;\">Phone number:<\/span> <span style=\"font-weight: 400;\">06 1\u00a0356 1522<\/span><\/p><p><span style=\"font-weight: 400;\">Email address:<\/span> <a href=\"mailto:helpdesk.eeszt@aeek.hu\"><span style=\"font-weight: 400;\">helpdesk.eeszt@aeek.hu<\/span><\/a><\/p><p><span style=\"font-weight: 400;\">In addition to the doctors employed as employees of Saint James Vision&amp;Aesthetics Center, the personal contribution partners doctors also work together with. Such colleagues are considered independent data controllers, but the Saint James Vision&amp;Aesthetics Center\u2019s data protection regulations also apply to them.<\/span><\/p><p><b>Data transfer for seeking or requesting data from a body outside the healthcare network:<\/b><span style=\"font-weight: 400;\"> For data requests or written requests from the following bodies, the treating physician and the health insurance institution shall, in accordance with the law, provide the personal identification data necessary for identification to the requesting or requesting data provider body. In the request or data request, the health and personal identification data to be known shall be indicated in accordance with Paragraph 4 of Article 4 of the Eavt. The requesting or requesting data provider bodies may be:<\/span><\/p><ol><li style=\"font-weight: 400;\" aria-level=\"3\"><span style=\"font-weight: 400;\">in criminal matters, the court, the public prosecutor, the investigating authority, the body conducting the preliminary proceedings, the judicial expert, civil and non-judicial, as well as administrative authorities in civil and administrative matters, the public prosecutor, the court, the judicial expert,<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"3\"><span style=\"font-weight: 400;\">during a regulatory procedure, the bodies conducting the procedure,<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"3\"><span style=\"font-weight: 400;\">in the case of potential military personnel and military personnel, the county (capital district) office of the capital city and county government, the military administration and central data processing organ of the Hungarian Armed Forces, and the committee determining military fitness,<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"3\"><span style=\"font-weight: 400;\">in order to carry out the tasks defined in Act CXXV of 1995 on National Security Services, within the scope of the authority granted therein,<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"3\"><span style=\"font-weight: 400;\">the military administrative and central data processing organ of the Hungarian Defence Forces, for the purpose of calling trained reservists for military deployment during peacetime and for the rapid and differentiated recruitment of trained reservists, within the scope defined in the Act on Defence and the Hungarian Defence Forces,<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"3\"><span style=\"font-weight: 400;\">during an ongoing ethical procedure against a healthcare professional, the conduct of the procedure by a chamber body with the authority and competence to do so,<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"3\"><span style=\"font-weight: 400;\">the bodies responsible for internal crime prevention and investigation as defined in the Police Act, as well as the bodies combating terrorism, in order to carry out the tasks defined in the Act, within the scope of the authority granted therein,<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"3\"><span style=\"font-weight: 400;\">During the autopsy, the physician conducting the autopsy,<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"3\"><span style=\"font-weight: 400;\">During the professional investigation in the Act on the professional investigation of air, rail and water transport accidents and other transport incidents, as well as in the European Parliament and Council Regulation 996\/2010\/EU of 20 October 2010 on the investigation and prevention of civil aviation accidents and incidents and repealing Directive 94\/56\/EC, the transport safety authority. (Article 23 of Act XLVII of 1997)<\/span><\/li><\/ol><p><i><span style=\"font-weight: 400;\">Data processors:<\/span><\/i><\/p><p><b>Kardisoft Ltd. <\/b><span style=\"font-weight: 400;\">(medical software)<\/span><\/p><p><span style=\"font-weight: 400;\">Headquarters:<\/span> <span style=\"font-weight: 400;\">9024 Gy\u0151r, Csokonai u. 29<\/span><\/p><p><span style=\"font-weight: 400;\">Company registration number: <\/span> <span style=\"font-weight: 400;\">08 09 012232<\/span><\/p><p><span style=\"font-weight: 400;\">Tax number: <\/span> <span style=\"font-weight: 400;\">13293369-2-08<\/span><\/p><p><b>Comnica Kft.<\/b><span style=\"font-weight: 400;\"> (recorded phone calls)<\/span><\/p><p><span style=\"font-weight: 400;\">Headquarters:<\/span> <span style=\"font-weight: 400;\">1119 Budapest, Mohai \u00fat 38.<\/span><\/p><p><span style=\"font-weight: 400;\">Phone number: <\/span> <span style=\"font-weight: 400;\">36 1 255 0990<\/span><\/p><p><span style=\"font-weight: 400;\">Email address: <\/span> <span style=\"font-weight: 400;\">info@comnica.com<\/span><\/p><p><b>Activecampaign LLC <\/b><span style=\"font-weight: 400;\">(newsletters, online test platform)<\/span><\/p><p><span style=\"font-weight: 400;\">160 Shelbourne Rd, Dublin, D04 E7K5, Suite 03-101, Dublin, Dublin, 2<\/span><\/p><p><span style=\"font-weight: 400;\">https:\/\/www.activecampaign.com\/contact<\/span><\/p><p><b>KBOSS.hu Ltd.<\/b><span style=\"font-weight: 400;\">\u00a0 \u2013 sz\u00e1ml\u00e1zz.hu (accounting)<\/span><\/p><p><span style=\"font-weight: 400;\">Head office: 1031 Budapest, Z\u00e1hony utca 7.<\/span><\/p><p><span style=\"font-weight: 400;\">Company registration number: 01-09-303201<\/span><\/p><p><span style=\"font-weight: 400;\">Tax number: 13421739-2-41<\/span><\/p><p><b>Docca Ltd. <\/b><span style=\"font-weight: 400;\">(IT service)<\/span><\/p><p><span style=\"font-weight: 400;\">Headquarters: 1123 Budapest, Gy\u0151ri \u00fat 2\/C 2nd floor, door 6<\/span><\/p><p><span style=\"font-weight: 400;\">Company registration number: 01 10 141530<\/span><\/p><p><span style=\"font-weight: 400;\">Tax number: 27428014-2-43<\/span><\/p><p><b>WhatsApp Ireland Limited <\/b><span style=\"font-weight: 400;\">(Instant messaging service on websites)<\/span><\/p><p><span style=\"font-weight: 400;\">Merrion Road, Dublin 4, D04 X2K5, Ireland<\/span><\/p><p><a href=\"https:\/\/www.whatsapp.com\/legal\/privacy-policy-eea#ea2SG9qUySboIlMvL\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">https:\/\/www.whatsapp.com\/legal\/privacy-policy-eea#ea2SG9qUySboIlMvL<\/span><\/a><span style=\"font-weight: 400;\">\u00a0<\/span><\/p><h5><b>12. The rights of the data subject regarding the processing<\/b><\/h5><p><span style=\"font-weight: 400;\">At the request of the affected person, the patient rights representative will provide information about their rights related to the handling of health documentation, subject to the practice applied at the Institution. The patient rights representative\u2019s name and contact information are: <\/span><a href=\"http:\/\/www.lassjol.hu\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">www.lassjol.hu<\/span><\/a> <span style=\"font-weight: 400;\">and<\/span> <a href=\"https:\/\/saintjameshungary.hu\/en\/\"><span style=\"font-weight: 400;\">https:\/\/saintjameshungary.hu\/<\/span><\/a><span style=\"font-weight: 400;\"> It is published on websites and in the Institute\u2019s waiting room.\u00a0<\/span><\/p><p><span style=\"font-weight: 400;\">Data Protection Officer<\/span><b>:<\/b><span style=\"font-weight: 400;\">\u00a0Consact Kft., Dr. K\u0151r\u00f6si Barbara; contactable during working hours: 06-30 20 40319; email: korosib@consact.hu.<\/span><\/p><h5><strong>12.1 Right to prior information<\/strong><\/h5><p><span style=\"font-weight: 400;\">The data subject has the right to receive information in writing from the Data Controller before the start of the processing of personal data regarding the data subject. The information must be provided to the Data Controller no later than at the time of the acquisition of the personal data.<\/span><\/p><p><span style=\"font-weight: 400;\">If the data controller intends to further process the personal data for a purpose other than the purpose for which it was collected, it must inform the data subject about this different purpose and all relevant additional information prior to the further processing.<\/span><\/p><h5><strong>12. 2 The right of access<\/strong><\/h5><p><span style=\"font-weight: 400;\">The data subject has the right to receive a response from the Data Controller regarding whether the processing of their personal data is ongoing and, if such processing is ongoing, the right to access the personal data and the following information:<\/span><\/p><ol><li><span style=\"font-weight: 400;\">a) the purposes of data processing;<\/span><\/li><li><span style=\"font-weight: 400;\">b) the categories of personal data concerned;<\/span><\/li><li><span style=\"font-weight: 400;\">c) the recipients or categories of recipients with whom the personal data have been or will be disclosed, including in particular third-country recipients or international organizations;<\/span><\/li><li><span style=\"font-weight: 400;\">d) where applicable, the planned duration of the storage of personal data, or, if this is not possible, the criteria for determining this duration;<\/span><\/li><li><span style=\"font-weight: 400;\">e) the right of the data subject to request from the Data Controller the rectification, deletion or restriction of the processing of personal data concerning him\/her, and to object to the processing of such personal data;<\/span><\/li><li><span style=\"font-weight: 400;\">f) the right to submit a complaint to a supervisory authority;<\/span><\/li><li><span style=\"font-weight: 400;\">g) if the data were not collected from the data subject, all available information regarding their source;<\/span><\/li><li><span style=\"font-weight: 400;\">h) the fact of automated decision-making, including profiling, and, in at least these cases, the applied logic and the understandable information about the significance of such data processing and the expected consequences for the data subject.<\/span><\/li><\/ol><p><span style=\"font-weight: 400;\">The Data Controller shall provide a copy of the personal data subject to the processing to the data subject. For further copies requested by the data subject, the Data Controller may charge a reasonable fee based on administrative costs. If the data subject submitted the request electronically, the information shall be provided in a widely used electronic format, unless the data subject requests otherwise. The right to request a copy shall not adversely affect the rights and freedoms of others.<\/span><\/p><h5><strong>12.3 Right to rectification<\/strong><\/h5><p><span style=\"font-weight: 400;\">The data subject has the right, at their request, to have inaccurate personal data concerning them corrected without undue delay by the Data Controller. Taking into account the purpose of the processing, the data subject has the right to request the addition of incomplete personal data \u2013 including through an additional declaration.<\/span><\/p><h5><strong>12.4 The right to be forgotten (\u201ethe right to be forgotten\u201d)<\/strong><\/h5><p><span style=\"font-weight: 400;\">The data subject has the right, at their request, to have the personal data concerning them deleted without undue delay by the Data Controller, and the Data Controller is obliged to delete the personal data concerning the data subject without undue delay if one of the following reasons applies:<\/span><\/p><ol><li><span style=\"font-weight: 400;\">a) the personal data are no longer necessary for the purpose for which they were collected or otherwise processed;<\/span><\/li><li><span style=\"font-weight: 400;\">b) the data subject withdraws the consent that forms the basis for the data processing and there is no other legal basis for the data processing;<\/span><\/li><li><span style=\"font-weight: 400;\">c) the data subject objects to the processing of the data and there is no overriding legitimate reason for the processing;<\/span><\/li><li><span style=\"font-weight: 400;\">d) the personal data were processed unlawfully;<\/span><\/li><li><span style=\"font-weight: 400;\">e) the personal data must be deleted in order to comply with a legal obligation prescribed by Union or Member State law applicable to the Data Controller;<\/span><\/li><li><span style=\"font-weight: 400;\">f) the personal data were collected in connection with the provision of information society services.<\/span><\/li><\/ol><p><span style=\"font-weight: 400;\">If the Data Controller has disclosed the personal data and is required to delete it in accordance with the previous provisions, it shall, taking into account the available technology and the costs of implementation, take reasonable steps \u2013 including technical measures \u2013 to inform the data controllers who process the data that the data subject has requested the deletion of the links to the personal data in question or of any other copy or duplicate of these personal data.<\/span><\/p><p><span style=\"font-weight: 400;\">The above provisions do not apply if data processing is necessary:<\/span><\/p><ol><li><span style=\"font-weight: 400;\">a) for the exercise of the freedom of expression and the right to information;<\/span><\/li><li><span style=\"font-weight: 400;\">b) to fulfill an obligation under Union or national law applicable to the Data Controller that requires the processing of personal data, or to carry out a task carried out in the public interest or in the exercise of a public authority conferred on the Data Controller;<\/span><\/li><li><span style=\"font-weight: 400;\">c) on grounds of public interest in the field of public health;<\/span><\/li><li><span style=\"font-weight: 400;\">d) for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, where the right to erasure is likely to render impossible or seriously impair the achievement of those purposes; or<\/span><\/li><li><span style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">e) for the purpose of presenting, asserting or defending legal claims.<\/span><\/span><p>\u00a0<\/p><strong>12.5 The right to restrict data processing<\/strong><\/li><\/ol><p><span style=\"font-weight: 400;\">The data subject has the right, at their request, to have the data controller restrict the processing of their data if one of the following conditions is met:<\/span><\/p><ol><li><span style=\"font-weight: 400;\">a) the data subject disputes the accuracy of the personal data; in this case, the restriction applies to the period of time necessary to allow the Data Controller to verify the accuracy of the personal data;<\/span><\/li><li><span style=\"font-weight: 400;\">b) the data processing is unlawful, and the data subject objects to the deletion of the data and instead requests the restriction of its use;<\/span><\/li><li><span style=\"font-weight: 400;\">c) the Data Controller no longer needs the personal data for the purposes of processing, but the data subject requires them to assert, exercise or defend legal claims; or<\/span><\/li><li><span style=\"font-weight: 400;\">d) the data subject has objected to the processing; in this case, the restriction applies for the period until it is determined whether the legitimate reasons of the Data Controller take precedence over the legitimate reasons of the data subject.<\/span><\/li><\/ol><p><span style=\"font-weight: 400;\">If data processing is restricted on the basis of the above, such personal data may be processed only with the consent of the data subject, or to establish, exercise or defend legal claims, or for the protection of the rights of other natural or legal persons, or for important public interest reasons of the Union or of a Member State.<\/span><\/p><p><span style=\"font-weight: 400;\">The Data Controller shall inform the data subject, whose request has restricted the data processing, in advance of the lifting of the restriction of the data processing.<\/span><\/p><h5><strong>12.6 Right to rectification or erasure of personal data or restriction of data processing<\/strong><\/h5><p><span style=\"font-weight: 400;\">The data subject has the right to request the Controller to provide the recipients with whom their personal data have been disclosed. The Controller is obliged to inform all recipients with whom the personal data have been disclosed of the rectification, deletion or restriction of the processing of their personal data, unless this is impossible or requires disproportionately great effort.<\/span><\/p><h5><strong>12.7 Right to data portability<\/strong><\/h5><p><span style=\"font-weight: 400;\">The data subject has the right to receive the personal data concerning him or her that he or she has provided to the Data Controller in a structured, commonly used and machine-readable format, and the right to transmit those data to another data controller if:<\/span><\/p><ol><li><span style=\"font-weight: 400;\">a)<\/span> <span style=\"font-weight: 400;\">the data processing is based on consent or a contract, and<\/span><\/li><li><span style=\"font-weight: 400;\">b)<\/span> <span style=\"font-weight: 400;\">the data processing is carried out in an automated manner.<\/span><\/li><\/ol><p><span style=\"font-weight: 400;\">In exercising the right to data portability, the data subject is entitled to request the direct transfer of personal data between data controllers, if this is technically feasible.<\/span><\/p><p><span style=\"font-weight: 400;\">The exercise of the data subject\u2019s right to data portability shall not adversely affect the rights and freedoms of others, provided that the Data Controller complies with this fact by not disclosing personal data supported by this fact, and it is appropriate to inform the data subject thereof.<\/span><\/p><h5><strong>12.8 The right to object<\/strong><\/h5><p><span style=\"font-weight: 400;\">The data subject has the right to object at any time, for reasons related to their particular situation, to the processing of personal data that is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Data Controller, including profiling based on those provisions. In this case, the Data Controller may not further process the personal data, unless the Data Controller demonstrates that the processing is justified by compelling legitimate grounds that override the interests, rights and freedoms of the data subject, or that are related to the exercise of legal claims, their enforcement or defense.<\/span><\/p><p><span style=\"font-weight: 400;\">If personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to the processing of personal data concerning them for this purpose, including profiling, insofar as it relates to direct marketing.<\/span><\/p><p><span style=\"font-weight: 400;\">If the data subject objects to the processing of personal data for direct marketing purposes, the personal data shall no longer be processed for such purposes.<\/span><\/p><h5><strong>12.9 Automated decision-making, profiling<\/strong><\/h5><p><span style=\"font-weight: 400;\">The data subject has the right not to be subject to a decision based solely on automated processing of data, including profiling, which would have a legal effect on him or her or similarly significantly affect him or her. This does not apply in cases where the decision<\/span><\/p><ol><li><span style=\"font-weight: 400;\">a)<\/span> <span style=\"font-weight: 400;\">necessary for the conclusion or performance of the contract between the data subject and the data controller,<\/span><\/li><li><span style=\"font-weight: 400;\">b)<\/span> <span style=\"font-weight: 400;\">the adoption of such measures by the data controller is permitted by Union or Member State law applicable to the data controller, which also establishes appropriate measures to protect the data subject\u2019s rights and freedoms and their legitimate interests; or<\/span><\/li><li><span style=\"font-weight: 400;\">c)<\/span> <span style=\"font-weight: 400;\">based on the expressed consent of the person concerned.<\/span><\/li><\/ol><p><span style=\"font-weight: 400;\">In the cases referred to in points a) and c), the Data Controller is obliged to take appropriate measures to protect the rights, freedoms and legitimate interests of the data subject, including at least the right of the data subject to request human intervention on the part of the Data Controller, to express his or her point of view and to submit an objection to the decision.<\/span><\/p><h5><strong>12.10 The affected person's right to information regarding the data protection incident<\/strong><\/h5><p><span style=\"font-weight: 400;\">The data subject has the right to receive information about the data protection incident that affects him or her at the Data Controller, if the data protection incident is likely to involve a high risk to the rights and freedoms of natural persons.<\/span><\/p><h5><strong>12.11 The affected person\u2019s right to file a complaint with the supervisory authority<\/strong><\/h5><p><span style=\"font-weight: 400;\">Without prejudice to other administrative or judicial remedies, all affected persons are entitled to lodge a complaint with a supervisory authority \u2013 in particular in the Member State where their habitual residence, place of work or the place of the alleged infringement is located \u2013 if, in the affected person\u2019s view, the processing of their personal data infringes the Regulation.<\/span><\/p><p><span style=\"font-weight: 400;\">The supervisory authority to which the complaint was submitted is obliged to inform the customer about the procedural developments related to the complaint and its outcome, including the fact that the customer is entitled to seek judicial remedy.<\/span><\/p><p><span style=\"font-weight: 400;\">Hungarian state supervisory authority:<\/span><\/p><p><span style=\"font-weight: 400;\">National Authority for Data Protection and Freedom of Information (postal address: 1363 Budapest, Pf. 9., head office: 1055 Budapest, Falk Miksa utca 9-11., website: <\/span><a href=\"http:\/\/www.naih.hu\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">www.naih.hu<\/span><\/a><span style=\"font-weight: 400;\">, phone: 06-1-391-1400, e-mail address: ugyfelszolgalat@naih.hu).<\/span><\/p><h5><strong>12.12 Right to effective judicial remedy against the supervisory authority<\/strong><\/h5><p><span style=\"font-weight: 400;\">Without prejudice to other administrative or non-judicial remedies, every natural and legal person is entitled to an effective judicial remedy against a decision of the supervisory authority concerning them that has legal force.<\/span><\/p><p><span style=\"font-weight: 400;\">Without prejudice to other administrative or non-judicial remedies, all concerned are entitled to an effective judicial remedy if the competent supervisory authority does not address the complaint or fails to inform the concerned person within three months about the procedural developments or the outcome of the complaint.<\/span><\/p><p><span style=\"font-weight: 400;\">Proceedings against the supervisory authority must be initiated before the courts of the Member State where the supervisory authority is based.<\/span><\/p><p><span style=\"font-weight: 400;\">If you have any questions, comments or concerns regarding the services provided by Saint James Vision&amp;Aesthetics Center, you can contact us using the contact details provided in the information notice. Saint James Vision&amp;Aesthetics Center will provide you with information regarding the measures taken in response to your request without undue delay, but no later than 30 days from the date of receipt of the request. If necessary, the deadline may be extended by 2 months, with notification of the reasons for the delay within 1 month of the receipt of the request.<\/span><\/p><p><span style=\"font-weight: 400;\">The Data Subject may withdraw their consent at any time without justification, however this does not affect any processing of data that took place previously based on the consent.<\/span><\/p><p>It can be downloaded here:\u00a0<span style=\"text-decoration: underline;\"><strong><a title=\"\" href=\"https:\/\/saintjameshungary.hu\/wp-content\/uploads\/2026\/04\/Adatvedelmi-Nyilatkozat-Saint-James-Hungary-20260415.pdf\">Saint James Eye Center \u2013 Data Protection Information<\/a><\/strong><\/span><\/p><p><strong>The attachments included in the downloadable version are:<\/strong><\/p><p>Declares for personal data exchange<\/p><p>Page requesting a copy of health documentation<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>","protected":false},"excerpt":{"rendered":"<p>Adatv\u00e9delmi nyilatkozat T\u00e1j\u00e9koztat\u00f3 az adatv\u00e9delmi \u00e9s adatkezel\u00e9si ir\u00e1nyelveinkr\u0151l \u00e9s gyakorlatunkr\u00f3l. Elolvasom Az adatkezel\u0151 megnevez\u00e9se \u00e9s adatai \u00a0 Adatkezel\u0151 1 megnevez\u00e9se: [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"site-sidebar-layout":"no-sidebar","site-content-layout":"","ast-site-content-layout":"full-width-container","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"disabled","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"class_list":["post-4514","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/saintjameshungary.hu\/en\/wp-json\/wp\/v2\/pages\/4514","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/saintjameshungary.hu\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/saintjameshungary.hu\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/saintjameshungary.hu\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/saintjameshungary.hu\/en\/wp-json\/wp\/v2\/comments?post=4514"}],"version-history":[{"count":25,"href":"https:\/\/saintjameshungary.hu\/en\/wp-json\/wp\/v2\/pages\/4514\/revisions"}],"predecessor-version":[{"id":10327,"href":"https:\/\/saintjameshungary.hu\/en\/wp-json\/wp\/v2\/pages\/4514\/revisions\/10327"}],"wp:attachment":[{"href":"https:\/\/saintjameshungary.hu\/en\/wp-json\/wp\/v2\/media?parent=4514"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}