PERSONAL DATA PROCESSING STATEMENT

Statement on the processing of personal data pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the information provided to data subjects (hereinafter referred to as the “GDPR”)

1) Personal Data Controller

Leonis Clinic s.r.o., Company ID No.: 22235183, with its registered office at Senovážné náměstí 980/22, Nové Město, 110 00 Prague 1, registered in the Commercial Register maintained by the Municipal Court in Prague under file No. C 413010, gdpr@leonis.clinic, +420 224 142 412 (hereinafter referred to as the “Controller”), hereby informs you, in accordance with Article 12 of the GDPR, about the processing of your personal data and about your rights.

2) Scope of Personal Data Processing

Personal data means any information relating to an identified or identifiable natural person; an identifiable natural person is a natural person who can be identified, directly or indirectly, in particular by reference to a certain identifier, such as a name, identification number, location data, network identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

Personal data is processed to the extent to which the relevant data subject has provided it to the Controller in connection with entering into a contractual or other legal relationship with the Controller, or to the extent to which the Controller has collected it otherwise and processes it in accordance with applicable legal regulations or for the fulfilment of the Controller’s legal obligations.

Personal data is processed in medical records in accordance with applicable legal regulations, in particular Act No. 372/2011 Coll., on Health Services and Conditions of Their Provision, Decree No. 444/2024 Coll., on Medical Records, and other related legal regulations. Its security and protection are ensured in accordance with these regulations as well as in accordance with the GDPR. On the basis of this legislation, persons processing your personal data are bound by confidentiality.

Personal data may, to the necessary extent, be made available in particular to the Controller’s healthcare professionals and other authorised persons, health insurance companies, public authorities, providers of follow-up healthcare services, accounting and payroll processors, IT administrators, providers of medical software, providers of web hosting, e-mail and booking services, website administrators, legal and tax advisors, or other persons where required by law or where necessary for the protection of the Controller’s rights and legitimate interests.

3) Records of Processing Activities

a) Processing of personal data in connection with the provision of health services – medical records

Categories of data subjects: patient, legal representative, relative, authorised entities under applicable legislation, healthcare professionals

The Controller processes personal data when providing health services in accordance with Act No. 372/2011 Coll., Decree No. 444/2024 Coll., and other legal regulations governing the healthcare sector, for the purpose of providing healthcare. The Decree on Medical Records sets out the minimum requirements for individual parts of medical records, while the current wording of the applicable legislation is always publicly available on the internet, at least in the Collection of Laws, where every personal data subject (patient) can become familiar with the scope of data processed in connection with the provision of health services. The scope of authorised persons who may access medical records is set out in Act No. 372/2011 Coll.

The Controller records the following personal data of the personal data subject in the patient’s medical records: name, surname, date of birth, sex, birth identification number, residential address, delivery address, contact details (telephone, e-mail), occupation (job position), employer and special categories of personal data consisting of information about the patient’s health condition, the course and results of the health services provided, other significant circumstances related to the patient’s health condition and the procedure followed in providing health services, including medical history data necessary for the provision of health services, and, where applicable, information about the patient’s legal capacity, a record of recognition or termination of the patient’s temporary incapacity for work, assessment of the health condition during its duration, data on the prescribed regime of the temporarily incapacitated insured person and changes thereto, a record of the commencement of the need for nursing care and its duration, for the purpose of providing health services, reporting covered health services, and communicating data about the health condition.

The Controller (health service provider) processes the patient’s personal data in fulfilment of a statutory obligation – a legal obligation under Act No. 372/2011 Coll. Consent of the personal data subject is not required for the processing of personal data in connection with the provision of health services, as the Controller fulfils legal obligations arising from applicable legislation.

Personal data processed in connection with the provision of health services and recorded in medical records is not transferred abroad.

The following types of processing are associated with personal data kept in medical records: collection, recording, storage, retrieval, consultation, use, disclosure, restriction, erasure, destruction.

In connection with the provision of health services, patients’ personal data is, again within the scope of applicable legislation, provided to health insurance companies for the purpose of reporting and reimbursement of provided covered health services by the health insurance company, in particular in accordance with Act No. 48/1997 Coll., contracts with health insurance companies, relevant methodologies, data interfaces and related legal regulations. The patient’s personal data is provided only to the health insurance company with which the personal data subject is insured. Medical records are kept in electronic form.

Medical records are retained for the period specified by Decree No. 444/2024 Coll.

The list of discarded medical records (destruction log) is kept in accordance with Decree No. 444/2024 Coll. and contains basic personal data of patients (name, surname, date of birth or birth identification number) whose medical records have been destroyed. The purpose is the protection of personal data. The following types of processing are associated with this list: collection, recording, storage, retrieval, use, erasure, destruction. The list is kept in electronic form. The list is accessible to the Controller, its employees and public authorities. Personal data is not transferred abroad. The list of discarded medical records is retained until the Controller’s authorisation to provide health services ceases to exist.

b) Processing of personal data in connection with the provision of health services – receipts, invoices, billing for non-covered health services

Categories of data subjects: patient, legal representative, patients’ employers

Within accounting documents relating to provided non-covered services, the Controller records personal data of the personal data subject in the scope of name, surname, date of birth, residential address, and special categories of personal data consisting of the provided covered health service, for the purpose of billing health services and keeping tax and accounting records.

The Controller records the personal data of the personal data subject within the scope of statutory obligations, i.e. fulfilment of a legal obligation arising from Act No. 372/2011 Coll. and Act No. 634/1992 Coll. The following types of processing are associated with personal data kept in connection with the agenda of issued receipts and tax documents for non-covered health services: recording, storage, retrieval, consultation, use, disclosure, erasure, destruction.

Personal data processed in connection with the agenda of issued receipts and tax documents for non-covered health services is not transferred abroad.

Only the patient, legal representative and employees of the Controller have access to the information.

Personal data is kept in electronic form. Personal data is archived in accordance with legal regulations governing tax and accounting records.

c) Processing of personal data in connection with the provision of health services – Medistar booking system

Categories of data subjects: patient, healthcare professionals

Within the booking system and patient records, the Controller records in particular the name, surname, telephone number, e-mail address, date and time of the booked examination, and, where applicable, a brief note necessary for the organisation of the provision of health services. These data are processed for the purpose of organising the provision of health services, communication with the patient and keeping records of booked appointments. The legal basis for processing is in particular the implementation of measures taken prior to the provision of a health service at the patient’s request, fulfilment of the Controller’s legal obligations in the field of health service provision and the Controller’s legitimate interest in the proper organisation of the outpatient clinic’s operation.

The booking system and patient directories are maintained for the purpose of organising the provision of health services.

The following types of processing are associated with personal data kept in the booking system and patient directory: collection, recording, storage, retrieval, use, disclosure, restriction, erasure, destruction.

Personal data processed in connection with the booking system and patient directory is not transferred abroad.

Only the Controller and, where applicable, an authorised employee of the Controller have access to the information.

Personal data is kept in electronic form. Personal data kept in the booking system is retained for the period necessary to organise the provision of health services and subsequently for the period necessary to protect the Controller’s rights and legitimate interests. If the data becomes part of medical records, it is retained for the period specified by legal regulations governing the keeping and retention of medical records.

d) Processing of personal data in connection with the provision of health services – complaints register

Categories of data subjects: patient, legal representatives, complainants, healthcare professionals

In addition to the basic identification data of the personal data subject (name, surname, date of birth, permanent residence address), special categories of personal data are also recorded: information about the patient’s health condition, the course and results of the health services provided, and other significant circumstances related to the patient’s health condition and the procedure followed in providing health services, including medical history data necessary for the provision of health services, for the purpose of handling complaints under Act No. 372/2011 Coll.

The Controller records the personal data of the personal data subject within the scope of statutory obligations, i.e. fulfilment of a legal obligation arising from Act No. 372/2011 Coll.

The following types of processing are associated with personal data kept in the complaints register: recording, storage, retrieval, consultation, use, disclosure, restriction, erasure, destruction.

Personal data processed in connection with the complaints register is not transferred abroad. Only the Controller and, where applicable, an authorised employee of the Controller have access to the information. In accordance with the Health Services Act, the relevant public authority also has access.

Personal data is kept in electronic form. Personal data is retained for the period specified by Decree No. 444/2024 Coll.

e) Processing of personal data in connection with the provision of health services – records and reporting of adverse events and adverse effects

Categories of data subjects: patient, healthcare professionals

Within this register, the Controller collects the following personal data: name, surname, date of birth, and also states a description of the adverse event and any consequence for the health or life of the person concerned, for the purpose of protecting health in the use of medical devices and medicinal products.

The Controller records the personal data of the personal data subject within the scope of statutory obligations, i.e. fulfilment of a legal obligation arising from Act No. 372/2011 Coll.

The following types of processing are associated with personal data kept in the register of adverse events and effects: collection, recording, storage, retrieval, consultation, use, disclosure, restriction, erasure, destruction.

Personal data processed in connection with the records and reporting of adverse events and adverse effects is not transferred abroad.

Only the Controller and, where applicable, an authorised employee of the Controller have access to the information. In accordance with the Act on Pharmaceuticals and the Act on Medical Devices, the relevant public authority also has access.

Personal data is kept in electronic form. Personal data is retained for the period specified by Decree No. 444/2024 Coll.

f) Processing of personal data in connection with the provision of health services – employee personnel file

Categories of data subjects: employees of the Controller

The Controller records in the employee personnel file personal data of the personal data subject (employee) in the scope of name, surname, date of birth, birth identification number, residential address, contact details, membership in a professional organisation, membership in professional societies, professional and specialised competence, lifelong learning, and special categories of personal data in the scope of medical fitness, integrity, incapacity for work, for the purpose of fulfilling the Controller’s legal obligation under Act No. 262/2006 Coll., the Labour Code, i.e. the exercise of rights and obligations related to an employment relationship.

The following types of processing are associated with personal data kept in the employee personnel file: collection, recording, storage, retrieval, consultation, use, disclosure, erasure, destruction.

Personal data processed in connection with the employee personnel file is not transferred abroad.

Only the Controller and the payroll processor have access to the information.

Personal data is kept in electronic form. Personal data is archived in accordance with legal regulations governing social security and the keeping of tax and accounting records.

g) Processing of personal data in connection with the provision of health services – payroll agenda

Categories of data subjects: employees of the Controller, family members

Within the payroll agenda, the Controller records the employee’s personal data in particular in the scope of name, surname, date of birth, birth identification number, residential address, contact details, bank account number, health insurance company details, salary details, deductions, taxes, tax credits, working time arrangement, working hours, holiday, obstacles to work, incapacity for work to the necessary extent, and other data necessary for payroll processing, payment of income tax, payment of health insurance and social security contributions and fulfilment of other employment-law obligations.

The Controller records the personal data of the personal data subject within the scope of statutory obligations, i.e. fulfilment of a legal obligation arising from Act No. 586/1992 Coll., Act No. 48/1997 Coll., Act No. 187/2006 Coll., and Act No. 589/1992 Coll.

The following types of processing are associated with personal data kept in the payroll agenda: collection, recording, storage, retrieval, use, erasure, destruction.

Personal data processed in connection with the payroll agenda is not transferred abroad.

Only the Controller and the payroll agenda processor have access to the information.

Personal data is kept in electronic form. Personal data is archived in accordance with legal regulations governing social security and the keeping of tax and accounting records.

h) Processing of personal data in connection with the provision of health services – tax documents of suppliers

Categories of data subjects: suppliers of the Controller

Within the accounting agenda, the Controller records personal data of personal data subjects (suppliers) in the scope of name, surname, company ID number, registered office address, contact details (telephone, e-mail), services provided, for the purpose of tax records and accounting.

The following types of processing are associated with personal data kept within accounting documents and tax records: collection, recording, storage, retrieval, use, erasure, destruction.

Personal data processed in connection with the accounting and tax agenda is not transferred abroad.

Only the Controller and tax and accounting agenda processors have access to the information.

Personal data is kept in electronic form. Personal data is archived in accordance with legal regulations governing the keeping of tax and accounting records.

i) Processing of personal data in connection with the provision of health services – records and reporting of personal data security breaches

Categories of data subjects: patients, employees, collaborators, suppliers, website visitors and other persons whose personal data may be affected by a security incident.

As part of the obligation to report security incidents, the Controller records personal data of the data subject in the scope of name, surname, date of birth, residential address, for the purpose of protecting personal data. The Controller records the personal data of the personal data subject within the scope of fulfilling the legal obligation imposed by Regulation (EU) No. 2016/679 of the European Parliament and of the Council.

The following types of processing are associated with personal data kept within security incident reports: collection, recording, storage, retrieval, use, erasure, destruction.

Personal data processed in connection with the reporting of security incidents is not transferred abroad.

Only the Controller, the public authority (Office for Personal Data Protection) and the affected data subjects have access to the information.

Personal data is kept in electronic form. Records of security incidents are retained for the period necessary to demonstrate the Controller’s compliance with its obligations under the GDPR and to protect the Controller’s rights and legitimate interests, usually for a period of 5 years from the resolution of the incident, unless a longer period is necessary in a specific case.

j) Processing of personal data in connection with the provision of health services – records of completed training and instruction

Categories of data subjects: employees of the Controller, trainers

Within employee training, the Controller records personal data of the personal data subject in the scope of name, surname, date of birth, residential address, contact details, for the purpose of keeping prescribed records of completed training and instruction.

The Controller records the personal data of the personal data subject within the scope of statutory obligations, i.e. fulfilment of a legal obligation arising from Act No. 262/2006 Coll. and Act No. 268/2014 Coll.

The following types of processing are associated with personal data kept for employee training purposes: collection, recording, storage, retrieval, use, erasure, destruction.

Personal data processed in connection with employee training is not transferred abroad.

Only the Controller, the public authority and, where applicable, the legal successor have access to the information.

Personal data is kept in electronic form. Personal data is archived in accordance with legal regulations that impose the obligation to keep records.

k) Processing of personal data in connection with the operation of the website, contact form, cookies, analytics and online advertising

Categories of data subjects: website visitors, persons contacting the Controller via the contact form, patients, persons interested in the provision of health services, legal representatives of patients, or other persons communicating with the Controller through the website.

The Controller operates the website for the purpose of presenting the health services provided, providing basic information to patients and the public, enabling contact with the Controller, booking or requesting health services, ensuring the secure operation of the website, measuring website traffic and, where applicable, also for the purpose of online advertising and evaluating its effectiveness.

In connection with the operation of the website, the Controller may process in particular the following personal data: identification data, especially name and surname, contact details, especially e-mail address and telephone number, the content of a message sent through a contact or booking form, date and time of sending the message, IP address, technical data about the device and browser, data on the use of the website, cookie identifiers and similar online identifiers. If a person also provides data concerning their health condition through a form, the Controller may also process these special categories of personal data, only to the extent necessary to handle the request, book an examination or provide health services.

Personal data from a contact or booking form is processed for the purpose of handling a query, request, enquiry or booking of a health service. The legal basis for processing is in particular the implementation of measures taken prior to entering into a contractual or similar relationship at the request of the data subject, fulfilment of the Controller’s legal obligations in the field of health service provision, or the Controller’s legitimate interest in ensuring communication with patients and persons interested in the services.

The Controller may use technical cookies on the website that are necessary for the proper functioning and security of the website. These cookies are processed on the basis of the Controller’s legitimate interest in ensuring the functionality and security of the website and do not require the visitor’s consent.

The Controller may also use analytical, marketing or advertising cookies and similar technologies, in particular for the purpose of measuring website traffic, evaluating the effectiveness of advertising campaigns, improving website content and displaying relevant advertising. These cookies and similar technologies are used only on the basis of the website visitor’s consent, granted through a cookie banner or another similar tool. The visitor may withdraw or change their consent at any time through the cookie settings on the website, or through the settings of their internet browser.

Within analytics and online advertising, personal data may be made available to providers of analytical and advertising services, in particular companies providing tools such as Google Analytics, Google Ads, Google Tag Manager, Meta Pixel or similar services, if used by the Controller. A specific overview of the tools and cookies used is provided in the cookie banner or cookie settings on the Controller’s website.

In connection with the operation of the website, personal data may also be made available to the web hosting provider, website administrator, e-mail service provider, contact or booking form provider, IT administrator, or other technical suppliers involved in the operation, security and administration of the website.

Some providers of analytical or advertising services may also process personal data outside the European Union or the European Economic Area. If such transfer takes place, the Controller ensures that it is carried out only under the conditions set out by the GDPR, in particular on the basis of an adequacy decision, standard contractual clauses or another appropriate mechanism under the GDPR.

The following types of processing are associated in particular with personal data processed in connection with the operation of the website: collection, recording, storage, retrieval, use, disclosure, restriction, erasure and destruction.

Personal data obtained through a contact or booking form is retained for the period necessary to handle the request and subsequently for the period necessary to protect the Controller’s rights and legitimate interests, or for the period specified by legal regulations, if it subsequently becomes part of medical records or accounting records. Technical data relating to website operation is retained for the period necessary to ensure the security and functionality of the website. The retention period for individual cookies is specified in the cookie banner or cookie settings on the Controller’s website.

If the Controller takes photographic documentation for the purposes of medical records, it does so only to the extent necessary for the provision of health services and the keeping of medical records. The use of photographs, videos, references or other patient data for marketing purposes is possible only on the basis of the patient’s separate consent.

4) Rights of Data Subjects

In connection with the processing of personal data, data subjects have the rights listed below.

To exercise these rights, it may be necessary to verify the identity of the person concerned, so as to ensure that the right is being exercised by the person who is the data subject. As the Controller, we verify identity in a manner proportionate to the right exercised; in some cases, we may use verification through these data (login details).

You may send your request by e-mail to gdpr@leonis.clinic

a) Right of access to personal data

i) Right to confirmation

The data subject has the right to obtain confirmation as to whether or not personal data concerning them is being processed and, where that is the case, has the right to access such personal data and the following information:

the purposes of the processing
the categories of personal data concerned
the recipients or categories of recipients to whom the personal data has been or will be disclosed, in particular recipients in third countries or international organisations
the envisaged period for which the personal data will be stored, or, if this is not possible, the criteria used to determine that period
the existence of the right to request from the Controller rectification or erasure of personal data concerning the data subject or restriction of processing, or to object to such processing
the right to lodge a complaint with a supervisory authority
where the personal data is not collected from the data subject, any available information as to its source
the existence of automated decision-making, including profiling, and at least in such cases meaningful information about the logic involved, as well as the significance and envisaged consequences of such processing for the data subject
where personal data is transferred to a third country or an international organisation, the data subject has the right to be informed of the appropriate safeguards relating to the transfer

ii) Right to a copy

The data subject has the right to a copy of the personal data being processed. The Controller is able to provide the copy in person or send it by registered delivery addressed to the addressee only, in which case the Controller will require reimbursement of postage costs. Where possible, a copy will be made available in electronic form. In the event of a repeated request for a copy, the Controller will provide only the data that has not yet been provided and that is newly processed, or information that no new data is being processed. This does not limit the possibility of issuing a full copy of the data again against payment.

iii) Right to rectification of inaccurate data

If the data subject finds that the data processed by the Controller about them is inaccurate, incorrect, false or incomplete, they have the right to have it rectified. It is in the Controller’s interest to keep information as accurate as possible. On the other hand, in some archival records, data is intentionally kept as it was valid at the time of its creation. If the request for rectification is granted, the Controller shall notify any original recipients of this information, unless this proves impossible or involves disproportionate effort, and if the data subject requests it, the Controller shall inform them who those recipients were.

iv) Right to erasure

The data subject has the right to have the Controller erase personal data concerning them without undue delay, and the Controller has the obligation to erase personal data without undue delay where one of the following grounds applies:
the personal data is no longer necessary for the purposes for which it was collected or otherwise processed
the data subject withdraws consent on which the processing is based and there is no other legal ground for the processing
the data subject objects to processing based on legitimate interests and there are no overriding legitimate grounds for the processing, or the data subject objects to processing for direct marketing purposes
the personal data has been unlawfully processed
the personal data must be erased for compliance with a legal obligation under European Union law or the law of the Czech Republic.

The right to erasure does not apply to the extent that the processing of personal data is necessary for compliance with the Controller’s legal obligation, for the provision of health services, keeping and retention of medical records, protection of public health or for the establishment, exercise or defence of legal claims.

The Controller retains personal data only for the period necessary for the relevant processing purposes and, after this period expires, ensures its erasure, anonymisation or destruction in accordance with legal regulations and the Controller’s internal rules.

v) Right to restriction of processing

The data subject has the right to request restriction of processing from us in parallel
with the exercise of the right to rectification, until the data subject’s request is handled
in the event of unlawful processing, instead of erasure of the data
where the data subject needs the data for the establishment, exercise or defence of legal claims
where the data subject has objected to processing on the grounds of legitimate interest, pending verification whether the legitimate grounds of the Controller override those of the data subject

Restriction of processing means that such personal data may, with the exception of storage, be processed only with the data subject’s consent, or for the establishment, exercise or defence of legal claims, for the protection of the rights of another natural or legal person, or for reasons of important public interest.

vi) Right to data portability

Where the data subject has provided the Controller with consent in relation to certain data, or where the data is processed on the basis of a concluded contract and the data is processed by automated means, the data subject may request that the Controller provide it in a structured format.

vii) Right to object to legitimate interest

The data subject has the right to object to the processing of personal data concerning them if it is processed on the basis of the Controller’s declared legitimate interest. The Controller shall cease processing the data unless it demonstrates compelling legitimate grounds for the processing which override the interests or rights and freedoms of the data subject, or unless the data is processed for the establishment, exercise or defence of legal claims.

viii) Right to object to direct marketing

If the data subject objects to the processing of personal data for direct marketing purposes, the Controller shall cease processing the data for this purpose and remove it from all further direct marketing.

ix) Right not to be subject to a decision based on automated decision-making, including profiling

Given that, as the data controller, the Controller does not issue decisions that would have legal effects for the data subject solely on the basis of automated processing or profiling, the exercise of this right is only hypothetical.

x) Right to withdraw consent

If the data subject grants the Controller consent for any processing, they may withdraw such consent, preferably in a similar manner to that in which it was granted: if on the website, then on the website; if by e-mail, then by e-mail from the same address; if by telephone, then by telephone from the same telephone number. Consent may always be withdrawn in writing, or the Controller may be asked to provide an overview of consents granted for processing. Consent to the use of analytical, marketing or similar cookies may be withdrawn or changed by the data subject at any time through the cookie settings on the Controller’s website, if this option is available on the website, or through the settings of their internet browser.

xi) Right to contact the supervisory authority

If the data subject is not satisfied with how the Controller proceeds when processing personal data or how the Controller fulfils the related rights, they may lodge a complaint with the Office for Personal Data Protection.

Supervisory authority:
Office for Personal Data Protection
https://www.uoou.cz
Pplk. Sochora 27
170 00 Prague 7

5) Rights Relating to Medical Records

The provision of the Subject’s personal data for the purpose of medical records is a statutory requirement, and the Subject as a patient is obliged to provide it, just as the healthcare professional has the right to request it. Failure to provide personal data will mean that the Controller will not be able to provide health services to the Subject, which may result in harm to the Subject’s health or direct threat to the Subject’s life.

When merely visiting the Controller’s website, the data subject is not obliged to provide identification or contact details. However, if the data subject contacts the Controller through a contact or booking form, the provision of certain data, in particular contact details and the content of the request, is necessary for handling the query, booking or provision of the requested service. Without such data, the Controller may not be able to respond to the request or provide the service.

6) Risks to the Rights and Legitimate Interests of Natural Persons in Connection with Personal Data Protection

When handling personal data, the Personal Data Controller is obliged to take into account any risks that may affect the rights and legitimate interests of the personal data subjects whose personal data it records in connection with the provision of health services within the scope of the above record of processing activities.

The Controller states that, in handling personal data from the sources listed above, it has identified the following potential risks:

breach of confidentiality of personal data,
breach of integrity of personal data,
breach of availability of personal data,
loss of personal data.

7) Minimum Standards for Personal Data Security within the Scope of Applicable Regulations (General Data Protection Regulation, Act on Personal Data Processing and Section 55d of the Health Services Act)

The Controller has adopted appropriate technical and organisational measures to minimise the risks associated with the processing of personal data, in particular measures to protect the confidentiality, integrity and availability of personal data. Through internal assessment, the Controller concluded that it has properly secured IT infrastructure, including access passwords to PCs or medical software, e-mail communication and other software resources used within its activities. Regular backups are also performed, and archives are securely stored against unauthorised use.

These measures include in particular the use of individual user accounts, password protection of access, restriction of access rights according to job position, regular data backups, physical security of the clinic premises, locking of paper documentation, instruction of employees on confidentiality and personal data protection, restriction of access to medical records only to authorised persons, and rules for terminating access upon termination of an employment or contractual relationship.

The Controller has also properly secured the card index where patients’ medical records are stored, and the above-mentioned sources containing personal data of individual subjects are also properly archived. In particular from the perspective of physical security, available lockable systems equipped with a key or other mechanism are used to prevent unauthorised access.

The clinic, as well as adjacent premises (waiting room, entrance, nurse’s room, etc.), are properly secured against intrusion.

The Controller follows the applicable legislation for handling personal data, both in terms of ensuring the electronic form of stored information containing personal data and, within acceptable possibilities and needs, has taken all available measures for the storage of personal data in paper form.

Through the adopted technical and organisational measures, the Controller appropriately minimises the risks that could lead to a breach of the rights or legitimate interests of data subjects.

These measures also included proper instruction of all employees, as well as business partners, suppliers and other entities whose activities are connected with the provision of health services.

8) Assessment of the Obligation to Carry Out a Data Protection Impact Assessment

After assessing the nature, scope, context and purposes of processing, the Controller concluded that, within the current scope of its activities, it is not obliged to carry out a data protection impact assessment under Article 35 of the GDPR, for the reasons set out below:

The Controller assessed whether it is obliged to carry out a data protection impact assessment under Article 35 of the GDPR. Pursuant to Article 35(1) of the GDPR, such assessment is carried out where a type of processing, in particular using new technologies and taking into account the nature, scope, context and purposes of the processing, is likely to result in a high risk to the rights and freedoms of natural persons. Pursuant to Article 35(3) of the GDPR, an assessment is necessary in particular in cases of systematic and extensive evaluation of personal aspects relating to natural persons based on automated processing, extensive processing of special categories of personal data or extensive systematic monitoring of publicly accessible areas.

The Controller is a provider of outpatient health services in the field of ENT. According to the last sentence of recital 91 of the General Data Protection Regulation, a data protection impact assessment should not be mandatory, given the fact that, in view of the scope of its activities, i.e. the statutory obligation to process personal data within the keeping of medical records, the Controller does not process personal data to such an extent that would justify the existence of a high risk to the rights and freedoms of natural persons within the meaning of Article 35(1) of the GDPR.

The Controller does not carry out any operations evaluating personal aspects relating to natural persons. The Controller is a health service provider that, within its main activity, is obliged to process personal data. These data are not evaluated in any way; no profiling or other similar operations are carried out, among other reasons because such handling of personal data which the Controller is obliged to process is prohibited by law.

The Controller’s main activity includes processing operations within the keeping of medical records, i.e. also the processing of special categories of personal data, namely information about health condition (Article 9(1) of the General Data Protection Regulation). This processing is in accordance with Article 9(2)(h) of the General Data Protection Regulation. However, it does not constitute extensive processing, with reference to the above analysis of extensive processing.

The Controller does not carry out extensive systematic monitoring of publicly accessible areas. If the Controller introduces a camera system or similar monitoring in the future, it will assess its impact on personal data protection separately before commencing such processing.

The Controller also does not carry out automated decision-making or profiling that would produce legal effects or similarly significant effects on data subjects. Any analytical or advertising tools used on the website serve only to measure traffic, evaluate the effectiveness of marketing and display advertising, and not to make decisions about the provision of health services or about patients’ rights.

9) Final Provisions

The Controller has not appointed a data protection officer. In matters of personal data protection, the Controller may be contacted at gdpr@leonis.clinic.

The Controller is entitled to amend these terms. The Controller is obliged to publish a new version of the terms on its website without undue delay, or send the new version to the Subject’s e-mail address.

Contact details of the Controller in matters concerning these terms: +420 224 142 412, gdpr@leonis.clinic

Relations not expressly regulated by these terms are governed by the GDPR and the laws of the Czech Republic, in particular Act No. 89/2012 Coll., the Civil Code, as amended.

These terms take effect on 3 August 2026.