Privacy policy
1. What does this Privacy Policy mean?
In this privacy policy (hereinafter – Privacy Policy) we provide you with information on how UAB “Beladenta” (hereinafter – the Clinic) processes your personal data obtained: when the Clinic provides you with healthcare services; when the Clinic trades in medical devices; in order to perform contracts concluded between the Clinic and counterparties – legal entities; in order to increase the Clinic’s awareness; when you visit the Clinic’s website or the Clinic’s social media accounts; when you submit enquiries, etc. Hereinafter, all the said persons whose data is processed by the Clinic are referred to as Data Subjects.
2. About the Clinic
The Clinic means UAB “Beladenta”, legal entity code 300887039, address Santariškių g. 57 – 4, Vilnius, Republic of Lithuania; data about the Clinic is collected and stored in the Register of Legal Entities of the Republic of Lithuania. Contact e-mail for personal data protection matters info@beladenta.lt.
3. What is personal data?
Personal data is any information collected by the Clinic about a Data Subject which can be used to identify the Data Subject and which is stored electronically or by other means.
Personal data includes any information, including the Data Subject’s name, surname, address, telephone number, information about your health, etc., which the Clinic collects about Data Subjects for the purposes set out in this Privacy Policy or in a separate consent of the Data Subject or agreement with the Clinic.
4. Processing of personal data when registering persons for a visit to the Clinic
| Categories of data subjects | Legal basis for data processing (Article 6 of the GDPR) | Categories of personal data | Data recipients (controllers) | Data recipients (processors) | Data retention and erasure periods |
|---|---|---|---|---|---|
| Registration of a person for a visit to the Clinic | |||||
| Persons who register for a visit | Article 6(1)(a) of the GDPR (consent) | Name, surname, date of birth, age, e-mail, telephone number, special category (health) data (to the extent the person chooses to provide it). | None | IT equipment administrators and suppliers | Until the start of the registered visit |
| Representatives of persons who register for a visit | Article 6(1)(c) of the GDPR (legal obligation) | Name, surname, e-mail, telephone number, relationship with the person (basis of representation) | None | IT equipment administrators and suppliers | Until the start of the registered visit |
5. Provision of healthcare services
| Categories of data subjects | Legal basis for data processing (Article 6 of the GDPR) | Categories of personal data | Data recipients (controllers) | Data recipients (processors) | Data retention and erasure periods |
|---|---|---|---|---|---|
| Provision of healthcare services | |||||
| Patients | Article 6(1)(a) of the GDPR (consent), (b) (contract), (c) (legal obligation), Article 9(2)(a) of the GDPR (consent), (h) (provision of healthcare services). | Name, surname, contact details (telephone number, e-mail address, place of residence address), special category data (healthcare services provided, laboratory tests, diagnoses, visits to specialists, photographs, prescribed medicines, descriptions of patients’ conditions, health questionnaire, medical history, etc.), other data related to payment for the healthcare services provided (bank account number, price of the healthcare services provided, date of payment, information indicated on the cash receipt, etc.). | The institution supervising the data controller), other companies / institutions providing healthcare services | IT equipment administrators and suppliers, the company handling accounting | Personal data is stored for the periods specified in Order No. 515 of the Ministry of Health of the Republic of Lithuania of 29 November 1999. |
| Representatives of patients | Article 6(1)(c) of the GDPR (legal obligation) | Name, surname, e-mail, telephone number, relationship with the person (basis of representation), other data related to payment for the healthcare services provided (bank account number, price of the healthcare services provided, date of payment, information indicated on the cash receipt, etc.). | The institution supervising the data controller), other companies / institutions providing healthcare services | IT equipment administrators and suppliers, the company handling accounting | Personal data is stored for the periods specified in Order No. 515 of the Ministry of Health of the Republic of Lithuania of 29 November 1999. |
6. Trade in medical devices
| Categories of data subjects | Legal basis for data processing (Article 6 of the GDPR) | Categories of personal data | Data recipients (controllers) | Data recipients (processors) | Data retention and erasure periods |
|---|---|---|---|---|---|
| Trade in medical devices | |||||
| Buyer’s employee | Article 6(1)(f) of the GDPR (legitimate interest in respect of the counterparty’s employees) | Name, surname, e-mail address, telephone number, content of correspondence | Legal entity | None | 10 years from the performance of the specific order / the end of the contractual relationship |
| Patient | Article 6(1)(f) of the GDPR (legitimate interest) | Name, surname, age, date of birth, image, special category data (healthcare services provided, diagnosis, etc.) | Legal entity | None | 10 years from the performance of the specific order / the end of the contractual relationship |
7. Increasing the Clinic’s awareness and carrying out marketing, publishing patient reviews
| Categories of data subjects | Legal basis for data processing (Article 6 of the GDPR) | Categories of personal data | Data recipients (controllers) | Data recipients (processors) | Data retention and erasure periods |
|---|---|---|---|---|---|
| Increasing the Clinic’s awareness and carrying out marketing, publishing patient reviews | |||||
| Persons who have consented to the Company making their personal data public | Article 6(1)(a) of the GDPR (consent) | Name, surname, review of the healthcare services provided, other information that the person chooses to make public, e-mail address, signature, date of consent. | ‘www.beladenta.lt’ website visitors | Website administrator | 5 years from receipt of consent |
8. Direct marketing
| Categories of data subjects | Legal basis for data processing (Article 6 of the GDPR) | Categories of personal data | Data recipients (controllers) | Data recipients (processors) | Data retention and erasure periods |
|---|---|---|---|---|---|
| Direct marketing (service offers, reminders to visit the Clinic, etc.) | |||||
| Persons who have consented to direct marketing being carried out in respect of them | Article 6(1)(a) of the GDPR (consent) | Name, surname, e-mail address, telephone number. | None | Marketing services provider | Personal data is stored for 2 years from the giving of consent |
9. Video surveillance for the purpose of protecting property and persons
| Categories of data subjects | Legal basis for data processing (Article 6 of the GDPR) | Categories of personal data | Data recipients (controllers) | Data recipients (processors) | Data retention and erasure periods |
|---|---|---|---|---|---|
| Video surveillance for the purpose of protecting property and persons | |||||
| Persons entering the video surveillance field | Article 6(1)(f) of the GDPR (legitimate interest) | Personal image data (image) | None | Video surveillance equipment supplier | 14 calendar days from the creation of the video recording |
10. Candidate selection
| Categories of data subjects | Legal basis for data processing (Article 6 of the GDPR) | Categories of personal data | Data recipients (controllers) | Data recipients (processors) | Data retention and erasure periods |
|---|---|---|---|---|---|
| Candidate selection | |||||
| Candidates | Article 6(1)(a) of the GDPR (consent), (f) (of the person who provided the reference) | Name, surname, contact details (e-mail, telephone number), desired position, work experience (place of work, position, person able to provide / providing a reference), education, other data indicated in the CV, questionnaire or cover letter | None | None | 3 days after signing the contract with the selected candidate or taking the decision to end the selection, except where separate consent is given for the storage of the candidate’s personal data for the period indicated in the consent |
11. Conclusion and performance of the Clinic’s contracts with counterparties, legal entities and natural persons
| Categories of data subjects | Legal basis for data processing (Article 6 of the GDPR) | Categories of personal data | Data recipients (controllers) | Data recipients (processors) | Data retention and erasure periods |
|---|---|---|---|---|---|
| Conclusion and performance of contracts with legal entities and natural persons | |||||
| Employees, employees of the counterparty legal entity | Article 6(1)(f) of the GDPR (legitimate interest in respect of the counterparty’s employees), Article 6(1)(b) of the GDPR (contract in respect of the employee) | Name, surname, e-mail address, telephone number, content of correspondence | Supplier, a legal entity | None | 10 years after the expiry of the contract |
| Counterparty | Article 6(1)(b) of the GDPR (contract) | Name, surname, personal identification number, contact details (telephone number, e-mail), individual activity number, bank account details, other information indicated in the contract with the natural person | None | None | 10 years after the expiry of the contract |
12. Protection of legitimate interests
| Categories of data subjects | Legal basis for data processing (Article 6 of the GDPR) | Categories of personal data | Data recipients (controllers) | Data recipients (processors) | Data retention and erasure periods |
|---|---|---|---|---|---|
| Protection of rights and interests | |||||
| The other party to the dispute, employees of the party to the dispute | Article 6(1)(f) of the GDPR (legitimate interest) | Name, surname, position, date, circumstances of the dispute, other information related to the dispute | Law enforcement institutions, lawyers (attorneys), courts, bailiffs | None | 5 years from the date on which the court judgment becomes effective |
13. Contact us
There are several ways to contact the Clinic: by telephone or by e-mail. We receive, review and answer all messages ourselves. If you contact us, we may process the data you provide, i.e. name, surname, e-mail address, telephone number, the content of the enquiry (information which you choose to provide to us).
Such data will be processed in order to answer the questions you have and to consider your suggestions. If you do not provide your contact details, we will not be able to contact you and reply to you.
The specified personal data is stored for 1 year from receipt of the enquiry and/or request, except for information for which other retention periods are set out in this Privacy Policy or in legal acts.
All personal data you provide when communicating with us is used only for the purposes indicated above.
Please note that we may need to contact you by post, e-mail or telephone. We therefore ask you to notify us of any changes to your personal data.
14. Website
Cookies are used on our website https://beladenta.lt. A cookie is a small file of letters and numbers which, with your consent, we place on your browser or on your computer’s hard drive. We use different cookies for different purposes. Cookies also help us to distinguish you from other users of the website, thus ensuring a more pleasant experience of using the website and allowing us to improve the website.
Most browsers allow all cookies to be rejected, and some browsers offer the option of rejecting only third-party cookies. You may therefore make use of these options. However, please note that blocking all cookies will have a negative impact on the use of the website, and without cookies you will not be able to use all the services provided on the Website. More detailed information is available at AllAboutCookies.org or www.google.com/privacy_ads.html.
We may use the cookies described below:
| Cookie name | Purpose of data processing | Type of cookie (necessary, analytical, functional, commercial) | Validity period |
|---|---|---|---|
| _ga | This cookie is set by Google Analytics. The cookie collects information about user behaviour on the website and is used to store statistical information | Analytical | 2 years |
| _gid | This cookie is set by Google Analytics. The cookie collects information about user behaviour on the website and is used to store statistical information | Analytical | 1 day |
| _gat | The cookie is used to manage the request rate | Analytical | 1 year |
| _cookie_notice_accepted | Stores the user’s cookie consent state for the current domain | Necessary | 1 year |
15. Social media
The information you provide to us through social media (including messages, use of the “Like” and “Follow” buttons, and other communication) is controlled by the social network operator.
Our Website contains links to our social media accounts.
We process the information provided on our accounts for the purpose of administering our accounts on the basis of your consent.
We recommend that you read the privacy notices of third parties and contact the service providers directly if you have any questions about how they use your personal data.
16. Receipt and disclosure of data
We receive your data from you, your legal representatives, your devices, our employees, banks and from the counterparties to our contracts.
We may disclose information about you to our employees, service providers such as IT specialists, website administrators, etc., if such data is reasonably necessary in order to achieve the purposes set out in this Privacy Policy, as well as to banks and other recipients specified in the Policy.
In addition, we may disclose information about you:
- if we are required to do so by law;
- when intending to sell part of the Clinic’s business (shares) or its assets, by disclosing your personal data to a potential buyer of the business (shares) or part thereof;
- after selling the Clinic’s business (shares) or a substantial part of its assets to third parties.
Except in the cases provided for in this Privacy Policy, we do not provide your personal data to any third parties.
The list of recipients or categories of recipients specified in the Privacy Policy may change, therefore we recommend that you regularly check whether the Privacy Policy has changed.
17. Security of your personal data
Your personal data will be processed in accordance with the requirements of the General Data Protection Regulation (EU) 2016/679, the Law on Legal Protection of Personal Data of the Republic of Lithuania and other legal acts. When processing your personal data, we implement organisational and technical measures which ensure the protection of personal data against accidental or unlawful destruction, alteration or disclosure, as well as against any other unlawful processing.
18. Your rights
In this section we provide information about your rights relating to our processing of your personal data and the cases in which you may exercise these rights.
The Clinic will, without undue delay but no later than within 1 (one) month from receipt of the request, provide you with information about the actions taken following your request regarding the exercise of your rights. Depending on the complexity of the request and the number of requests received, that period may be extended by a further 2 (two) months. In such a case, we will inform you of such extension and the reasons for it within 1 (one) month from receipt of the request. The Clinic will refuse to implement your rights only in the cases provided for by legal acts.
19. Right to access your personal data
We want you to fully understand how we use your personal data so that you do not experience any inconvenience because of it. You may contact us at any time and ask whether we process any of your personal data. If we store or use your personal data in any way, you have the right to access it. To do so, submit a written request to us at the e-mail address indicated in this Privacy Policy, confirm your identity; and, when submitting such a request, observe the principles of good faith and reasonableness.
19.1. Right to withdraw consent
If you have given us explicit consent to the processing of your data, you may withdraw it at any time. You may submit information about the withdrawal of your consent to the e-mail indicated in this Privacy Policy.
19.2. Additional rights
Below we provide information about the additional rights you have, which you may exercise in accordance with the procedure described below.
- You have the right to ask us to rectify any inaccuracies in the data we hold. In such a case, we may ask you to confirm the corrected information.
- You have the right to ask us to erase your personal data. This right is exercised in the cases provided for in Article 17 of the General Data Protection Regulation (EU) 2016/679.
- You have the right to ask us to restrict the processing of your personal data or not to process it:
- for the period necessary for us to verify the accuracy of your personal data, where you make claims regarding the accuracy of the data;
- where our collection, storage or use of your personal data is unlawful, but you decide not to request the erasure of the data;
- where we no longer need your personal data, but you need it in order to establish, exercise or defend a legal claim;
- for the period necessary to determine whether we have overriding legal grounds to continue processing your personal data, if you have exercised your right to object to the processing of personal data.
- You have the right to the portability of data which is processed by automated means and which we received from you with your consent or for the purposes of concluding a contract. If you exercise this right, we will, at your request, transfer a copy of the data you provided.
- You have the right, in accordance with the procedure established in Article 21 of the GDPR, to object to our use of your personal data. You have the right to object where your personal data is processed on the basis of a legitimate interest (the basis on which the data is processed is indicated next to each of the processing purposes set out above) or for direct marketing purposes.
19.3. Right to request more information
We hope you will understand that it is very difficult to describe every possible way of collecting and using personal data. We strive to provide the clearest and most comprehensive information possible and undertake to update this Privacy Policy whenever the personal data usage process changes.
Nevertheless, if you have any questions about the use of your personal data, we will be glad to answer them or to provide any additional information that we are able to disclose. If you have any specific questions or did not understand the information provided, please contact us.
20. Complaints
If you believe that your rights as a Data Subject are and/or may be infringed, please contact us immediately at the e-mail indicated in this Privacy Policy. We assure you that upon receipt of your complaint we will contact you within a reasonable period and inform you about the progress of the investigation of the complaint and, subsequently, about its outcome.
If you are not satisfied with the results of the investigation, you may submit a complaint to the supervisory authority – the State Data Protection Inspectorate (www.vdai.lrv.lt).
21. Liability
You are responsible for the confidentiality of the data you provide, as well as for ensuring that the data you provide to us is accurate, correct and complete. If the data you have provided changes, you must inform us about it immediately by e-mail. Under no circumstances will we be liable for any damage incurred by you as a result of you providing incorrect or incomplete personal data or failing to inform us when it changed.
22. Changes to the Privacy Policy
We may update or amend this Privacy Policy at any time. You will always find the current version of the Privacy Policy on our website https://beladenta.lt.
The Privacy Policy was last updated 2024-05-27
