PATIENTS PRIVACY POLICY

Purpose and Legitimation for Treatment

1. Provision of ophthalmological medical care: performance of an agreement to which the data subject is party, data subject’s consent, and processing is necessary for the purpose of preventative medicine, medical diagnoses, care provision and healthcare treatment, as well as the management of systems and healthcare services.

2. Administrative procedures related to the provision of healthcare services, managing the contractual relationship with the patient and invoicing: performance of an agreement to which the data subject is party

3. Compliance with legal obligations: compliance with a legal obligation applicable to the joint data controllers.

4. CCTV for security purposes: in accordance with public interest stipulated in the Private Security Act 5/2014.

5. Sending commercial communications (Newsletter): if express consent is granted for such purpose by checking the corresponding box on the informed consent form for registering as a patient and the joint controllers’ legitimate interest in accordance with Article 21.2 of Act 34/2002.

6. Conducting quality surveys: the joint controllers’ legitimate interest.

7. Website management (https://www.icoftalmologia.com/en): the data subject granted their consent for their data to be processed for one or more specific purposes and the joint controllers’ legitimate interest.

8. Social media management: the data subject granted their consent for their data to be processed for one or more specific purposes and in the joint controllers’ legitimate interest.

9. Digital communications: express consent granted by checking the box on the forms on our website and the joint controllers’ legitimate interest.

10. Responding to information requests, complaints, suggestions, claims and incidents: compliance with a legal obligation applicable to the joint data controllers, the joint controllers’ legitimate interest and the express consent granted when the data subject fill out the incident form.

11. Clinical trials: the data subject granted express consent to take part in a clinical trial conducted in our centres, when a clinical trial is conducted in the public interest and in the joint controllers’ legitimate interest.

12. Managing a request to execute the rights of the data subject: the processing necessary to fulfil a legal obligation.

13. Managing data breaches: processing is necessary to comply with a legal obligation and the joint controllers’ legitimate interest.

14. CV management: processing is necessary to comply with pre-contractual measures or the intention to hire and the data subject’s express consent.

Source

• The patient or their legal representative or guardian.
• The user.
• The healthcare professional.
• Research centres.
• The patient’s insurance company, where applicable.
• The company that manages online appointments on the website.
• If there is a foreign patient, there may be institutions or embassies that provide us with their contact details to provide them with our services.
• A candidate in a hiring process or who is interested in a position.

Recipients

• Supplier firms that act as data processors located within the European Economic Area with which there is an agreement, that support us in providing our services as providers of medical services, clinical analyses or trials, security firms and document destruction services.
• IT service providers.
• Financial institutions for managing collections and payments if the service requested by the patient is subject to payment.
• Insurance and mutual insurance firms, to manage and control payments within the framework of the healthcare provision agreement, based on the legitimate interest of managing healthcare services and the Insurance Agreements Act 50/1980.
• Suppliers of medical devices, prostheses and implants, in order correctly manage the contractual and/or care relationship with the patient based on the data subject’s vital interest.
• Healthcare centres for leasing operating theatres, in order correctly manage the contractual and/or care relationship with the patient based on the data subject’s vital interest.
• Businesses that form part of clinical trials.
• Institutions that put patients in contact with healthcare centres and/or embassies that provide us with the contact details of international patients for the proper performance of the contractual and/or care relationship with the patient.
• Public Authorities, Judges, Courts and Law Enforcement Bodies if there is a legal obligation.

International Transfers

We hereby inform you that, in order to provide some services, we work with service providers that may conduct international data transfers to third countries outside of the European Economic Area with the right level of security recognised by the European Commission or that have standard clauses. However, express consent will be necessary if the patient in question lives outside the EEA or if they hold an insurance policy with an insurance firm located outside the EEA, their data may be transferred and processed in regions outside of the EEA that the European Commission has deemed not to be suitable, not to have suitable guarantees or not to have a similar data protection of data protection to that of the European Union in its legislation. For example, if you wish to contract our services, there may be dedicated institutions for putting you in contact with healthcare centres and/or embassies in the country where you reside that provide us with your personal data, as well as insurance firm for managing the payment for the services provided if you hold an insurance company located outside the EEA. In any case, we hereby inform you that such disclosure will only take place in order to manage the contractual relationship with the patient and facilitate payment for the care services provided; as such, if you object to this disclosure, the agreement will not be valid and the insurance firms will not be able to process the payment for the services received since they will not be able to validate the provision of the service by the health care centre.

Storage

In general, your data will only be stored for as long as strictly necessary for the purpose for which it was collated or while the data subject's consent lasts

Data Subject’s Rights

You have the right to access, rectification and erasure regarding your data, objection to processing, to exercise your right to data portability, to revoke your consent and the right to not be subject to individualised decision-making. Please send an email to the following address: dpo@icoftalmologia.es with “Data Protection” in the subject line, or send a letter to either of the joint controllers: to ICO on Via Augusta, 48 2° (08006) Barcelona, or to GMO, c/ Balmes, 253 (08006) Barcelona. Moreover, we wish to inform you that you can seek protection of your rights with the Spanish Data Protection Agency with headquarters on Calle de Jorge Juan, 6, 28001 Madrid, or on their website, www.aepd.es

Complete Information on Data Protection

You can check the additional detailed information on Data Protection by requesting it in Patient Services or on our Website: https://www.icoftalmologia.com/en/privacy-policy-2/.