Privacy policy

Information about the controller:
‍
SIA "KP Klīnika"
‍
Registration number: 40203607761
Registered address: (Rīga, Vecā Biķernieku iela 17 - 24), LV-1079.

Telephone: +371 28351975
E-mail address: info@kalvispastars.lv
‍
This policy describes how SIA "KP Klīnika" (hereinafter — the Private Medical Practice) processes the personal data of its clients (patients), website visitors and other persons whose data may come into the possession of the Private Medical Practice in the course of its commercial activity.

The purpose of this policy is to give a general overview of the personal data processing operations carried out by the Private Medical Practice and of their purposes.

In order to provide clients (patients) with medical services of the highest possible quality, including reminding them of an appointment they have booked or warning them about changes to a booked appointment, the Private Medical Practice needs to collect, process and use certain types of information about clients (patients) and persons connected with them.

With this Privacy policy the Private Medical Practice wishes to emphasise its firm commitment to ensuring the protection of personal data and states that in all its communication and cooperation it will seek to ensure the protection and security of the personal data processed, in compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), the Law on the Rights of Patients and other applicable legislation in the field of personal data protection.

The Private Medical Practice may process personal data in paper or electronic form, as well as by telephone. Personal data may be processed by an employee of the Private Medical Practice or by one of its processors with whom the Private Medical Practice has concluded a contract. When processing the personal data of clients (patients), the Private Medical Practice ensures compliance with the principles of personal data protection.

Principles of personal data processing

The Private Medical Practice:
— processes personal data lawfully, fairly and in a transparent manner in relation to the data subject (including the client, patient); processes personal data adequately, relevantly and only to the extent necessary to achieve the purposes of processing;
‍
— processes personal data in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures;

— keeps personal data no longer than is necessary for the purposes for which the personal data are processed; informs data subjects (clients, patients) why it needs personal data and what the Private Medical Practice will do with them;

— processes only accurate personal data and, where necessary, updates them or asks the person to do so; collects personal data only for specified, explicit and legitimate purposes and does not further process them in a manner incompatible with those purposes, except where this is necessary to comply with obligations laid down by law.

Categories of personal data

The Private Medical Practice processes the data of clients (patients) and other natural persons, as well as special categories of personal data.

Personal data is information relating to an identified or identifiable natural person, for example a person's name, surname, personal identity number, date of birth, contact details (to ensure effective communication), information we ask you to provide so that you can receive services, and so on.

Special categories of personal data are information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, as well as the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, health data, or data concerning a natural person's sex life or sexual orientation.

Purposes of personal data processing. The processing of personal data is necessary so that the Private Medical Practice can provide high-quality medical services. In order to provide services to clients (patients), the Private Medical Practice needs to identify the client (patient), obtain their contact details and information about the client's (patient's) health, keep accounting and financial records, contact the client for the purposes of providing services and, in individual cases, also ensure the recovery of unpaid payments.

For the purposes set out above, the Private Medical Practice processes at least the following data about the client (patient): the patient's name and surname, personal identity number or date of birth, the name, surname and personal identity number of the legal representative of a minor patient, telephone number, e-mail address, address, information about the patient's insurance, payment, settlements, information about the doctor with whom the appointment is booked, information about the patient's illnesses that is necessary to provide medical services, treatment plans, health data (manipulation codes).

The Private Medical Practice processes personal data only when there is a legal basis for doing so.

Legal basis for processing personal data
The main legal bases for processing personal data are:
‍
processing is necessary for the purposes of the management of healthcare services;

compliance with a legal obligation applicable to the Private Medical Practice, including the Medical Treatment Law, the Law on the Rights of Patients, Cabinet Regulation No. 265 of 4 April 2006 “Procedure for the Management of Medical Documents” and other Cabinet regulations;

the legitimate interests of the Private Medical Practice (provision of medical services), which are necessary solely to ensure a high-quality treatment process.

Additional legal bases may also be the following:
processing is necessary for the performance of a contract or in order to take steps at the request of the person prior to entering into a contract;

the person has given consent to the processing of their personal data for one or more specific purposes;

processing is necessary in order to protect the vital interests of you or of another natural person, that is, life and health.

If the Private Medical Practice requires a person's consent to process their personal data, the Private Medical Practice will ask the person to provide it. If a person wishes to withdraw the consent given, they may withdraw it at any time by contacting the Private Medical Practice.

Please note that if a person does not provide the information necessary to complete the patient's outpatient record, the Private Medical Practice will not be able to provide the person with medical services of appropriate quality and in full.

Please note that if a person does not agree to the processing of their personal data, the person has the right not to use the services of the Private Medical Practice.

Recipients of personal data. In order to provide clients (patients) with high-quality medical services, it may be necessary to transfer personal data to other organisations where this is necessary and permissible or required by law. Personal data may be transferred to processors (a natural or legal person, public authority, agency or other body which processes personal data on behalf of the Private Medical Practice) where this is necessary to ensure the services of the Private Medical Practice in line with the services they provide, and only to the extent necessary — for example, to information technology service providers.

The Private Medical Practice may transfer personal data to third parties, but only where this is necessary to fulfil obligations laid down by law, or where the legislation on personal data protection permits it.

The recipients of clients' (patients') personal data are the medical staff of the Private Medical Practice involved in the client's (patient's) treatment, the National Health Service (the E-veselība system), service providers supplying information technology services to the Private Medical Practice, insurance companies whose client the patient is, outsourcing providers and suppliers of goods for ensuring the treatment process. In addition, when the website is used, data may be processed by technical and analytics service providers: Webflow (website hosting and handling of form submissions), Google (Google Analytics — only with consent), Meta Platforms (Meta Pixel — only with consent), Hotjar (behaviour analysis — only with consent), Cloudflare (protection of forms against automated submissions) and Phonexa (enquiry tracking, to whose page the visitor is redirected after submitting a form).

Observing the rules on personal data protection, the Private Medical Practice may also transfer personal data to organisations or suppliers and service providers that offer sufficient guarantees that appropriate technical and organisational measures will be implemented in such a way that the processing meets the requirements of legislation in the field of personal data protection and that the protection of the rights of the data subject (client, patient) is ensured, and that are able to fulfil the obligations laid down by legislation in the field of personal data protection. These guarantees and conditions are stipulated in contracts with organisations and third parties.

The Private Medical Practice will not use the personal data received for commercial communications unless the person has expressly given the Private Medical Practice consent to do so.

Sources of personal data, that is, the sources from which the Private Medical Practice obtains personal data

The Private Medical Practice obtains personal data in one of the following ways:
from the data subject (client, patient) or their authorised representative;

by obtaining information about the person (client, patient) from the unified state electronic information system of the health sector (e-veselība);

Transfer of personal data to third countries

Personal data will be stored in the European Union and also in the USA in electronic form, provided that the data processing company is certified and included in the EU–US data protection framework list, or that a company located outside the European Union or the European Economic Area is able to ensure an adequate level of protection in accordance with European Union legislation.

Storage of personal data and the rights of individuals. To ensure that personal data are not kept longer than is necessary for the purposes for which they are processed, the Private Medical Practice has established retention periods for personal data and regularly monitors compliance with them.

When assessing the retention period of personal data, the Private Medical Practice takes into account the requirements of applicable legislation, aspects of the performance of contractual obligations, the instructions of the data subject (client, patient) (for example, in the case of consent), as well as the legitimate interests of the Private Medical Practice. If your personal data are no longer needed for the specified purposes, the Private Medical Practice will delete or destroy them.
‍
Clients' (patients') personal data are kept for 10 years after the last entry (in accordance with Cabinet Regulation No. 265 of 4 April 2006 “Procedure for the Management of Medical Documents”).

The period for which the Private Medical Practice will keep personal data depends on the purpose for which they were collected and on the legal act on which this is based — for example, the Law on Accounting, the Archives Law, the Civil Law, the Commercial Law and others.

Rights of data subjects (including clients, patients)

The right to request information about what personal data the Private Medical Practice holds about you. The Private Medical Practice is obliged to reply within one month, unless it extends the reply period to three months, taking into account the complexity and number of requests.

The right to rectify data. A person has the right to have data corrected if they are inaccurate or incomplete. The Private Medical Practice is obliged to reply within one month. If the Private Medical Practice decides not to correct the data, it will provide the person with an explanation of why it will not correct them, and will inform the person of their right to lodge a complaint with the Data State Inspectorate.

The right to erasure (the right “to be forgotten”). A person has the right to request the erasure of their personal data or the cessation of their processing. The Private Medical Practice will not always be able to comply with the request — for example, if it is obliged to retain the information in accordance with obligations it must observe under the law. If the Private Medical Practice decides not to erase the data, it will provide the person with an explanation of why it will not erase them, and will inform the person of their right to lodge a complaint with the Data State Inspectorate.

The right to restrict processing. In certain cases a person has the right to restrict the processing of their personal data — for example, if the information is inaccurate. If the processing of personal data is restricted, the Private Medical Practice may retain relevant information about this so that it can ensure compliance with these rights in the future. If the Private Medical Practice decides to lift such a restriction, it will notify the person accordingly.

The right to data portability. If the Private Medical Practice processes personal data on the basis of a person's consent or on the basis of a contract, and they are stored in a structured, commonly used and machine-readable format, the person has the right to request that the personal data be transmitted directly from one controller to another, where this is technically feasible. This right does not apply to personal data processed in order to comply with a legal obligation applicable to the Private Medical Practice.

The right to object. A person may object to the use of their personal data for profiling, for direct marketing purposes, or for scientific or historical research purposes or statistical purposes, as well as to processing necessary for the purposes of the legitimate interests of the controller or a third party. On receiving such a request, the Private Medical Practice will either cease processing the personal data or will point to compelling legitimate grounds for the processing, or for the establishment, exercise or defence of legal claims.

The Private Medical Practice does not use personal data for automated decision-making.

For more detailed information about the rights set out above, see the General Data Protection Regulation (Articles 13–21).

In addition, the patient has the rights laid down in the Law on the Rights of Patients. For example, the patient has the right to receive the information specified in the Law on the Rights of Patients about the possibilities of receiving treatment services and the procedure for paying for them, the name, surname, position, profession, speciality and qualification of the attending doctor and other medical practitioners involved in the healthcare process, information about their state of health, the treatment plan and the treatment services provided to them, as well as other information specified in the Law on the Rights of Patients. The patient has the right to examine their medical documents and to request and receive extracts, transcripts and copies in accordance with the price list approved by the medical institution, except as provided by the regulation on the protection of natural persons' data.

The patient also has the right to receive information about the use of the information included in their medical documents in accordance with the Law on the Rights of Patients and the regulation on the protection of natural persons' data. The patient may receive extracts, transcripts and copies within three working days from the date on which the relevant request is submitted.

Cookies

Cookies are small files that a website stores in the visitor's browser. Strictly necessary cookies keep the website working and are set without consent. Analytics cookies (Google Analytics, Hotjar) and marketing cookies (Meta Pixel) are set only after you have given consent in the cookie banner; before consent is given, these services are not loaded. You can change or withdraw your consent at any time by clicking “Cookie settings” at the bottom of the site — withdrawing consent is as easy as giving it. Declining optional cookies does not restrict access to the content of the website. Strictly necessary cookies are stored until the end of the session or for up to 12 months; analytics and marketing cookies for up to 24 months, depending on the service. Your browser settings also allow you to delete cookies that have already been stored.