Skip to main content

INFORMATION ABOUT THE SUPERVISOR AND ITS CONTACT INFORMATION

[1] The personal data processing supervisor is the Latvian Health Tourism Cluster (hereinafter referred to as – LHTC), Uniform Registration No.40008131781, registered office address: Brīvības gatve 214B, Riga, Latvia, LV-1039

[2]    Contact information for matters related to personal data processing is as follows:

  •  Postal correspondence: Brīvības gatve 214B, Rīga, Latvija, LV-1039
  •  Phone: +371 28801844;
  •  E-mail correspondence: info@healthtravellatvia.lv.

GENERAL INFORMATION

[3]    The purpose of this privacy policy is to provide a private individual – the data subject – with information about the purpose, legal grounds, scope of processing, protection and processing term of personal data at the time of data acquisition and in processing the data subject’s personal data.

[4]    The privacy policy is implemented in order to guarantee privacy and personal data protection in relation to:

  •  Private individuals – clients (patients), (including potential, former and existing);
  •  Internet homepage visitors.

[5]    The privacy policy applies to data processing regardless of the form or environment in which the Client provides his personal data (in person, on the internet homepage, in paper format or by phone).

[6]   The LHTC is responsible for patient privacy and personal data protection, lawfully respects the Client’s rights to personal data processing in accordance with applicable law – Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to personal data processing and such data (hereinafter referred to – the Regulation), the Personal Data Processing Law, the Law on the Rights of Patients and other applicable laws and regulations in the realm of privacy and data processing.

[7]    In its work, the LHTC:

  •  Protects the Data Subject’s personal data, implementing administrative, technical and physical security measures, in so far as these reasonable given potential risks;
  •  Informs and explains which personal data is required to receive services and how it will be used;
  • Data transfer to third parties is implemented, in accordance with the laws and regulations currently in force;
  • Implements measures to provide its employees with regular training and information on personal data protection matters to reduce the possibility of the possible occurrence of security incidents;
  • Implements internal control procedures, with the help of which it is possible to reduce the possibility of the possible occurrence of security incidents and the consequences resulting from such.

PURPOSES OF AND LEGAL GROUNDS FOR PROCESSING PERSONAL DATA

[8]    The LHTC processes personal data for the following purposes:

  •  Provision and administration of health care services:
  • Identification of the patient;
  • Preparing the patient’s appointment with specialists;

iii.    Preparing the patient’s medical documentation in accordance with the requirement stipulated in laws and regulations;

  •  Reminding patients about a planned visit to a specialist;
  •  Performance of medical examinations;
  •  Performance of doctors’ consultations and medical manipulations;

vii.    Assessing the state of health of the patient or other private individuals;

viii.    Payment administration;

  •  Debt recovery from debtors;
  •  Reviewing patients’ complaints and quality control;
  •  Fostering patient loyalty, satisfaction measurements;

xii.   Preparing and signing agreements with patients;

xiii.   Homepage maintenance and operational improvement;

  •  Performance of research work related to clinical studies;
  •  Provision of information to governmental bodies and operational activity subjects in the instances and scope stipulated in external laws and regulations;
  •  Guaranteeing the security of patients and employees as well as protection of property;
  •  Entering information in the Joint State Medical Information System (E – health).

[9]    The LHTC processes patients’ personal data on the following grounds:

  •  Determination of medical diagnoses for medical treatment purposes (Article 9, second paragraph, point (h));
  •  With the consent of the data subject (the patient) (Article 9, second paragraph, point (a), Section 10, Paragraph two of the Law on the Rights of Patients);
  •  To comply with laws and regulations – to fulfil duties stipulated in external laws and regulations binding on the LHTC to the exercise the rights of the data subject stipulated in external laws and regulations (Article 9, second paragraph, point (b), Section 10 of the Law on the Rights of Patients);
  •  In instances when processing is required to exercise or protect the LHTC’s lawful interest in court (Article 9, second paragraph, point (f));
  •  In instances when processing is required to safeguard the LHTC’s legitimate interests (to organise an efficient health care service provision process, to ensure an efficient process for making and cancelling patients’ appointments, and to receive payment for health care services provided);
  •  In instances when processing is required to implement the agreement with the data subject (patient) or to conduct measures at the request of the data subject before the signing of the agreement (Article 9, first paragraph, point (b));
  •  In instances when processing is required to protect the vital interests of the data subject (the patient) or another private individual (Article 9, first paragraph, point (d)).

VOLUME OF ACCUMULATED INFORMATION

[10]    In its basic operations, the LHTC primarily obtain information from the Data Subject that is necessary for the clear identification of the relevant person for the provision medical treatment services and for communication purposes:

  •  Name
  •  Surname
  •  Personal ID Code (identification number)
  •  Address
  •  Phone number and/or e-mail address

[11]    As part of the provision of services, LHTC may obtain additional information from the Data Subject and other third parties, which primarily includes, but is not restricted to, referral information, information about previous medical treatment, an information obtained during a specific case of medical treatment.

[12]    The specific volume of information depends on the specifics of the relevant service to be rendered and laws and regulations currently applicable, which regulate the terms and conditions of the provision of the service.

[13]    The LHTC is aware that, in providing its services, it is processing health data which are considered as a special category of personal data in the context of the Regulation.

PERSONAL DATA PROCESSING AND PROTECTION

[14]    The LHTC processes the Patient’s data, using modern technological capabilities, in accordance with the privacy risks existing and the organisational, financial and technical resources available to the LHTC.

[15]    The LHTC continually improves and augments the technical solutions at its disposal, taking current industry trends and available capabilities into account, based on identified risks.

TERMS AND CONDITIONS FOR DATA USAGE AND ISSUANCE

[16]    The personal data at the disposal of the LHTC and that obtained during the provision of services are used to:

  •  Ensure the functioning of the LHTC and, in so far as this is necessary, to provide the best quality service possible;
  •  Foster cooperation with other third parties in order to implement the patient’s medical treatment process.

[17]    The LHTC, in cooperation with third parties, in relation to obtaining and transferring the necessary data, shall conduct its activities strictly in accordance with the laws and regulations, which govern the implementation of the LHTC’s capabilities in relation to the implementing measures for the exchange of personal data.

[18]    In its daily operations, in relation to its employees the LHTC implements measures to minimise the amount of personal data processing by only providing employees with access to the patient data they require to perform their job duties.

[19]    The LHTC ensures that personal data at its disposal is issued only to the data subject himself. Disclosure of data to third parties, including persons related to data subjects is only done in instances where the written permission of the data subject has been received or in the case in which such disclosure of data is permitted as stipulated in laws and regulations.

[20]    The LHTC will not transfer data in instances in which it cannot verify the identity of the data subject or in which there are suspicions that the identity presented by the data subject is not the same as his true identity.

[21]   In instances when data transfer is implemented by e-mail, the LHTC will ensure that this process is only conducted after the receipt of written permission from the data subject.

[22]    In transferring data by e-mail or using other online data exchange solutions, including information system self-service platforms, the, LHTC will take measures to protect the relevant data by implementing data access protection or encryption methods.

[23]    The LHTC transfers personal data to third parties ensuring that the relevant third parties preserve the confidentiality of the personal data and provide suitable security.

[24]    The LHTC is entitled to transfer personal data to clinic service providers that help the LHTC to ensure the fulfilment of its functions. In this case, the principle of minimising the data to be transferred will be observed.

[25]    In the cases mentioned in Clause [24], service providers that receive and process personal data are considered to be data processors in the sense of the Regulation, and a written agreement is concluded with them, in which it is stipulated that the LHTC requires an undertaking from recipients of data to only use information received for the purposes for which the data was transferred, and in accordance with the requirements of the applicable laws and regulations in the realm of data processing and data protection.

[26]    The LHTC only transfers data to third countries (countries outside the European Union and European Economic Area in which cases, where it has receive the written permission of the data subject.

PERSONAL DATA STORAGE DURATION

[27]   The LHTC stores and processes the Client’s personal data, while at least one of the following criteria is applicable:

  •  While the obligations arising from the agreement concluded between the LHTC and the Client are being fulfilled or the Client is being provided with a health care service;
  •  While the LHTC has a duty to store the relevant data as stipulated in laws and regulations;
  •  While the contents of the Client’s request/application are being reviewed and/or implemented in full;
  •  While the Client’s consent to the relevant processing of personal data is valid unless other lawful grounds for data processing exist.

[28]    Once terms and conditions come into force that stipulate that further storage of the Client’s data is no longer necessary, the Client’s personal data will be deleted.

ACCESS TO PERSONAL TO PERSONAL DATA AND OTHER RIGHTS OF CLIENTS

[29]    The LHTC guarantees the patient’s rights to receive the information stipulated in laws and regulations in relation to processing of his data.

[30]    In accordance with laws and regulations, the Client is also entitled to ask the LHTC for access to his personal data, as well as to ask the LHTC to augment, correct or delete it, or to restrict processing in relation to the Client, or for the right to object to processing, as well as rights to data transferability. These rights are exercisable, in so far as data processing does not arise from the LHTC’s duties, imposed upon it in accordance with laws and regulations currently applicable.

[31]    The Client may submit a request to exercise its rights:

  •  in writing in person, presenting a personal identity document;
  •  by e-mail, signing a letter with a secure electronic signature and sending it to the following e-mail address:  info@healthtravellatvia.lv;
  •  sending the LHTC a letter by post.

[32]    Upon receiving the Client’s request to exercise its rights, the LHTC will verify the Client’s identity, assess the request and execute it in accordance with laws and regulations.

[33]    The LHTC will reply to the Client at the earliest opportunity, using the means of sending the reply specified by the Client.

[34]     If the reply is sent by post, it will be addressed to the data subject (the person whose personal data is requested) by registered letter. If the answer is provided electronically, it will be signed with a secure electronic signature (if the application has been submitted with a secure electronic signature).

[35]    The LHTC guarantees compliance with data processing and protection requirements in accordance with laws and regulations and, in the event of objections from the Client, will take practical to resolve the objection. However, if this does not resolve the matter, the Client is entitled to contact the supervisory body – Data State Inspectorate.

[36]    The Client is entitled to receive one free copy of his personal data being processed.

[37]    Receipt and/or use of the information referred to in Clause [36] of this document may be restricted with the goal of preventing a negative impact on the rights and liberties of other people (including LHTC employees).

[38]    The LHTC undertakes to ensure the accuracy of personal data and relies on its Customers, suppliers and other third parties that transfer personal data to ensure the completeness and accuracy of the transferred personal data.

CLIENT’S CONSENT TO DATA PROCESSING AND RIGHT TO REVOKE IT

[39]    The Client gives his consent to personal data processing, whose legal grounds are this consent, in person in writing by sending it in paper format using postal services, or by e-mail signed with a secure electronic signature.

[40]    The Client is entitled to revoke consent for data processing at any time in the same way as it was given, and in this case subsequent data processing based on the consent previous given for the specific purpose will not carried out henceforth.

[41]    Revocation of consent does not affect data processing, which was performed during the period, when the Client’s consent was valid.

[42]    In revoking consent, data processing carried out on other legal grounds (e.g. in accordance with external laws and regulations or the agreement signed between the LHTC and the Client) cannot be stopped.

HOMEPAGE VISITS AND COOKIE PROCESSING

[43]    The LHTC homepage may use cookies.

[44]    Cookies are files that websites place on users’ computers in order to recognise the user and make their use of the site easier. Internet browsers can be configured to warn the visitor about the use of cookies and allow them to choose whether or not they agree to accept them. Not accepting cookies will not prevent the visitor from using the LHTC website, but it may restrict the visitor’s ability to use the homepage.

[45]    LHTC homepages may contain links to third parties’ internet homepages, which have their own usage and personal data protection terms and conditions for which the LHTC is not liable.

CHANGES TO PRIVACY POLICY

[46]    The LHTC retains the rights to make changes to its Privacy Policy if there is a change in certain circumstances that affect regulation of personal data processing. LHTC recommends visiting this section regularly to find out the latest information.

[47]    The LHTC saves previous versions of the Privacy Policy and these are available of the LHTC homepage.