Privacy Notice

Protecting your personal data is extremely important to us. This Privacy Notice explains what personal data we process about you, for what purposes and on what legal basis. It also describes your rights in relation to the processing of your personal data.

1. Details of the Data Controller

Data Controller: Mental Mood Medical Kft. (hereinafter: the “Data Controller”)

Registered office: Kiss József Street 8, Ground Floor 6, 1081 Budapest, Hungary

Company registration number: 01-09-438078

Tax number: 32699953-1-42

Website: https://mentalmood.hu/

Email: mentalmoodkft@gmail.com

2. Applicable legislation

Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation, GDPR)
Act CXII of 2011 on the Right to Informational Self-Determination and Freedom of Information
Act V of 2013 on the Civil Code
Act CXXVII of 2007 on Value Added Tax
Act C of 2000 on Accounting
Act CLIV of 1997 on Health
Act XLVII of 1997 on the Processing and Protection of Health and Related Personal Data
Act CXIX of 1995 on the Processing of Name and Address Data for Research and Direct Marketing
Act CVIII of 2001 on Electronic Commerce Services and Information Society Services
Act XLVIII of 2008 on the Basic Requirements and Certain Restrictions of Commercial Advertising Activities
Act XXXI of 1997 on the Protection of Children and the Administration of Guardianship
Decree No. 60/2003 (20 October) on the minimum professional requirements for healthcare services
Decree No. 15/1998 (30 April) on child welfare and child protection institutions and persons providing personal care
Government Decree No. 134/1999 (31 August) on subsidies for medicines, medical aids and spa treatments
Decree No. 39/2016 (21 December) on detailed rules relating to the Electronic Healthcare Services Platform (EESZT)

3. Definitions

Personal data: Any information relating to an identified or identifiable natural person (“Data Subject”). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, identification number, location data or online identifier, or to one or more factors specific to that person’s physical, physiological, genetic, mental, economic, cultural or social identity.
Processing: Any operation or set of operations performed on personal data or sets of personal data, whether or not by automated means, including collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure, dissemination, alignment or combination, restriction, erasure or destruction.
Controller: The natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of processing personal data.
Processor: A natural or legal person, public authority, agency or other body which processes personal data on behalf of the Controller.
Recipient: A natural or legal person, public authority, agency or other body to which personal data are disclosed, whether or not a third party. Public authorities receiving personal data in the framework of a particular inquiry in accordance with Union or Member State law are not regarded as recipients.

4. Principles relating to the processing of personal data

Lawfulness, fairness and transparency: personal data must be processed lawfully, fairly and transparently.
Purpose limitation: personal data must be collected for specified, explicit and legitimate purposes and not further processed incompatibly with those purposes.
Data minimisation: personal data must be adequate, relevant and limited to what is necessary.
Accuracy: personal data must be accurate and, where necessary, kept up to date.
Storage limitation: personal data must be kept in an identifiable form for no longer than necessary, subject to applicable statutory retention duties.
Integrity and confidentiality: personal data must be processed securely using appropriate technical and organisational measures.
Accountability: the Data Controller is responsible for compliance with these principles and must be able to demonstrate it.

5. Data processing activities

5.1 Website enquiries and appointment requests

Purpose: Responding to general enquiries and appointment requests submitted through the website.
Legal basis: Article 6(1)(b) GDPR where processing is necessary to take steps at the Data Subject’s request before entering into a contract; Article 6(1)(f) GDPR for other general enquiries, based on the Data Controller’s legitimate interest in responding to communications.
Data Subjects: Persons submitting an enquiry.
Personal data: Name, email address, selected enquiry category and the content of the message.
Retention: Until the end of the first year following the correspondence, unless a longer period is required by law or necessary for the establishment, exercise or defence of legal claims.
Processors and recipients: Hosting and email service providers, including Sybell Informatika Kft. and, where applicable, Google Ireland Limited.
Source: The person submitting the enquiry.
Consequences of non-provision: Without the required data, the Data Controller may be unable to respond to the enquiry or process the appointment request.
Automated decision-making: No automated decision-making or profiling with legal or similarly significant effects takes place.

5.2 Website security and bot protection

Purpose: Protecting website forms from spam, bots and abusive traffic using Cloudflare Turnstile.
Legal basis: Article 6(1)(f) GDPR, based on the Data Controller’s legitimate interest in maintaining the security and availability of the website and its forms.
Personal data and signals: Technical and device-related signals may include IP address, User-Agent, TLS fingerprint, sitekey, origin and interaction signals required to distinguish legitimate users from automated traffic.
Provider: Cloudflare, Inc. Cloudflare acts as a processor when providing Turnstile to secure the website and may act as an independent controller for certain processing used to improve its bot-detection services.
Form content: Turnstile does not access, store or transmit the content entered into the contact form.
Automated evaluation: Technical signals are evaluated automatically to determine whether a submission is likely to originate from a human user. This does not produce legal or similarly significant effects.

5.3 Satisfaction surveys

Purpose of data processing: Completing a satisfaction survey regarding the service
Legal basis for data processing: Article 6(1)(a) of the GDPR: consent
Categories of data subjects: The person completing the questionnaire
Scope of personal data: Name, email address, data provided in the questionnaire
Duration of data processing: Until consent is withdrawn, but no later than the end of the first year following the evaluation of the responses provided in the questionnaire
Data transfer: No data transfer takes place in accordance with Articles 44–49 of the GDPR
Recipients: The Data Controller uses a Data Processor: hosting provider: Sybell Informatika Kft. (registered office: 1158 Budapest, Késmárk utca 7/B, 2nd floor, door 206, company registration number: 01-09-293034); email system providers: Sybell Informatika Kft. (registered office: 1158 Budapest, 7/B Késmárk utca, 2nd floor, door 206, company registration number: 01-09-293034) Google Ireland Ltd. (registered office: Gordon House, Barrow Street, Dublin 4, Ireland)
Source of data: The source of personal data is the person completing the questionnaire
Method and consequences of data provision: The provision of data is voluntary. If you do not provide your personal data, the Data Controller will not be able to assess your satisfaction
Automated decision-making, profiling: Does not take place

5.4 Newsletters

Purpose of data processing: Sending newsletters
Legal basis for data processing: Article 6(1)(a) of the GDPR: consent
Categories of data subjects: Newsletter subscribers
Scope of personal data: Name, email address
Data retention period: Until consent is withdrawn or for 30 days from the date of unsubscribing
Data transfer: No data transfer takes place in accordance with Articles 44–49 of the GDPR
Recipients: The Data Controller uses a Data Processor: hosting provider: Sybell Informatika Kft. (registered office: 1158 Budapest, Késmárk utca 7/B, 2nd floor, door 206; company registration number: 01-09-293034) newsletter sending software: MailerLite Limited (registered office: 38 Mount Street Upper, Dublin 2, D02 PR89, Ireland)
Source of data: The source of personal data is the newsletter subscriber
Method and consequences of data provision: The provision of data is voluntary. If you do not provide your personal data, the Data Controller will not be able to send you the newsletter

5.5 Appointment booking

Purpose of data processing: To secure appointments for patients seeking healthcare for medical consultations, treatments or examinations
Legal basis for data processing: Article 6(1)(b) of the GDPR: necessary for the performance of a contract or for taking steps at the request of the Data Subject prior to entering into a contract
Categories of Data Subjects: Patients
Scope of personal data: Name, place and date of birth, address, Hungarian social security number (TAJ number), passport number (for foreign patients), telephone number, email address
Duration of data processing: 1 year from the date of booking
Data transfer: No data transfer takes place in accordance with Articles 44–49 of the GDPR
Recipients: The Data Controller uses a Data Processor: hosting provider: Sybell Informatika Kft. (registered office: 1158 Budapest, Késmárk utca 7/B, 2nd floor, door 206, company registration number: 01-09-293034); email system providers: Sybell Informatika Kft. (registered office: 1158 Budapest, Késmárk utca 7/B, 2nd floor, door 206, company registration number: 01-09-293034) Google Ireland Ltd. (registered office: Gordon House, Barrow Street, Dublin 4, Ireland) Appointment booking system provider: KARDI-SOFT Kft. (registered office: 9024 Győr, Csokonai utca 29, company registration number: 08-09-012232)
Source of data: The source of personal data is the patient
Method and consequences of data provision: Provision of the data is mandatory. If the data is not provided, the Data Controller will be unable to arrange an appointment for the healthcare service
Automated decision-making, profiling: Does not take place

5.6 Appointment reminders

Purpose of data processing: To send a reminder regarding the agreed appointment to patients attending for healthcare
Legal basis for data processing: Article 6(1)(b) of the GDPR: necessary for the performance of a contract or for taking steps at the request of the Data Subject prior to entering into a contract
Categories of Data Subjects: Patient
Scope of personal data: Name, email address
Duration of data processing: 1 year from the date of booking
Data transfer: No data transfer takes place in accordance with Articles 44–49 of the GDPR
Recipients: The Data Controller uses a Data Processor: hosting provider: Sybell Informatika Kft. (registered office: 1158 Budapest, Késmárk utca 7/B, 2nd floor, door 206, company registration number: 01-09-293034) billing system providers: Sybell Informatika Kft. (registered office: 1158 Budapest, Késmárk utca 7/B, 2nd floor, door 206, company registration number: 01-09-293034) Google Ireland Ltd. (registered office: Gordon House, Barrow Street, Dublin 4, Ireland) appointment booking system provider: KARDI-SOFT Kft. (registered office: 9024 Győr, Csokonai utca 29, company registration number: 08-09-012232)
Source of data: The source of personal data is the patient
Method and consequences of data provision: Provision of the data is required. If you do not provide the data, the Data Controller will not be able to send you a reminder about your appointment
Automated decision-making, profiling: Does not take place

5.7 Ongoing contact

Purpose of data processing: Maintaining contact
Legal basis for data processing: Article 6(1)(a) of the GDPR: consent
Categories of data subjects: Patient, the patient’s legal representative
Scope of personal data: Name, telephone number, email address
Duration of data processing: Until consent is withdrawn
Data transfer: No data transfer takes place in accordance with Articles 44–49 of the GDPR
Recipients: The Data Controller uses a Data Processor: email system providers: Sybell Informatika Kft. (registered office: 1158 Budapest, 7/B Késmárk Street, 2nd floor, door 206, company registration number: 01-09-293034) Google Ireland Ltd. (registered office: Gordon House, Barrow Street, Dublin 4, Ireland)
Source of data: The source of personal data is the patient or the patient’s legal representative
Method and consequences of data provision: Provision of the data is required. If you do not provide the data, the Data Controller will be unable to contact you should this be necessary
Automated decision-making, profiling: Does not take place

5.8 Patient registration

Purpose of data processing: pursuant to Section 4(1) of the Health Care Act: a) to promote the preservation, improvement and maintenance of health; b) to facilitate the effective provision of medical treatment by the healthcare provider, including professional supervision; c) to monitor the data subject’s state of health
Legal basis for data processing: Article 6(1)(c) of the GDPR: compliance with a legal obligation: Section 136(1) of the Health Care Act
Categories of data subjects: Patient
Scope of personal data: Relevant parts of medical records pursuant to Sections 136(1) and (2) of the Health Care Act; Section 3(e) and Section 3/B of the Health Care Activities Act
Duration of data processing: Pursuant to Section 30 (1) of the Health Care Act: final report 50 years, all other documents 30 years, diagnostic imaging records 10 years
Data transfer: No data transfer takes place in accordance with Articles 44–49 of the GDPR
Recipients: The Data Controller uses a Data Processor: patient record-keeping software: KARDI-SOFT Kft. (registered office: 9024 Győr, 29 Csokonai Street, company registration number: 08-09 -012232) collaborating doctors, a current list of whom is available on the website and at reception; collaborating psychologists, a current list of whom is available on the website and at reception. Data transfers pursuant to legal obligations to the following bodies: EESZT Data Controller: Ministry of the Interior (registered office: 1051 Budapest, József Attila utca 2–4.)
Source of data: The source of personal data is the patient
Method and consequences of data provision: Provision of the data is mandatory. If you do not provide the data, the Data Controller will be unable to provide healthcare services
Automated decision-making, profiling: Does not take place

5.9 Patient care

Purpose of data processing: Pursuant to Section 4(1) of the Health Care Act: a) to promote the preservation, improvement and maintenance of health; b) to facilitate the effective provision of medical treatment by the healthcare provider, including professional supervision; c) to monitor the data subject’s state of health
Legal basis for data processing: Article 6(1)(c) of the GDPR: compliance with a legal obligation: Section 136(1) of the Health Care Act
Categories of data subjects: Patients
Scope of personal data: relevant parts of medical records pursuant to Sections 136(1) and (2) of the Health Care Act; Section 3(e) and Section 3/B of the Health Care Activities Act
Duration of data processing: pursuant to Section 30(1) of the Health Care Activities Act: final report 50 years, all other documents 30 years, diagnostic imaging records 10 years
Data transfer: No data transfer takes place in accordance with Articles 44–49 of the GDPR
Recipients: The Data Controller engages the services of a Data Processor: patient record-keeping software: KARDI-SOFT Kft. (registered office: 9024 Győr, Csokonai utca 29, company registration number: 08-09-012232) collaborating doctors, a current list of whom is available on the website and at reception; collaborating psychologists, a current list of whom is available on the website and at reception. Data transfers pursuant to legal obligations to the following bodies: EESZT Data Controller: Ministry of the Interior (registered office: 1051 Budapest, József Attila utca 2-4. ) Notification to the police National Ambulance Service (OMSZ) The locally competent child protection authority
Source of data: The source of personal data is the patient
Method and consequences of data provision: Provision of the data is mandatory. If the data is not provided, the Data Controller will be unable to provide healthcare services
Automated decision-making, profiling: Does not take place

5.10 Diagnostic activities

Purpose of data processing: pursuant to Section 4(1) of the Health Care Act: a) to promote the preservation, improvement and maintenance of health; b) to facilitate the effective provision of medical treatment by the healthcare provider, including professional supervision; c) to monitor the data subject’s state of health
Legal basis for data processing: Article 6(1)(c) of the GDPR: compliance with a legal obligation: Section 136(1) of the Health Care Act
Categories of data subjects: Patients
Scope of personal data: relevant parts of medical records pursuant to Sections 136(1) and (2) of the Health Care Act; Section 3(e) and Section 3/B of the Health Care Activities Act
Duration of data processing: pursuant to Section 30(1) of the Health Care Activities Act: final report 50 years, all other documents 30 years, diagnostic imaging records 10 years
Data transfer: No data transfer takes place in accordance with Articles 44–49 of the GDPR
Recipients: The Data Controller engages the services of a Data Processor: patient record-keeping software: KARDI-SOFT Kft. (registered office: 9024 Győr, Csokonai utca 29. , company registration number: 08-09-012232) collaborating doctors, a current list of whom is available on the website and at reception; collaborating psychologists, a current list of whom is available on the website and at reception; laboratory service providers. Data transfer pursuant to a legal obligation (reason(s)) to the following bodies: EESZT Data Controller: Ministry of the Interior (registered office: 1051 Budapest, József Attila utca 2-4.)
Source of data: The source of personal data is the patient
Method and consequences of data provision: Provision of data is mandatory. If you do not provide the data, the Data Controller will be unable to provide healthcare services
Automated decision-making, profiling: Does not take place

5.11 Settlement relating to medical prescriptions

Purpose of data processing: Fulfilment of the obligation to settle accounts with the National Health Insurance Fund (NEAK) in accordance with the law
Legal basis for data processing: Article 6(1)(c) of the GDPR: compliance with a legal obligation: Government Decree No. 134/1999. (31 August) on the accounting for and disbursement of subsidies for the cost of medicines, medical aids and spa treatments prescribed within the framework of outpatient care
Categories of data subjects: Prescription holder
Scope of personal data: Data appearing on the prescription, specifically: name, address, date of birth, social security number, BNO code of the condition, public health care card number and its validity, product name and quantity
Data retention period: Pursuant to Section 30(7) of the Health Care Act: in the case of a medical aid dispensed at a specialist medical aid shop with a usage period exceeding 5 years, the paper-based prescription, and the dispensing certificate must be retained for a period equal to the useful life. Following the mandatory retention period, paper-based prescriptions and dispensing certificates must be destroyed
Data transfer: No data transfer takes place in accordance with Articles 44–49 of the GDPR
Recipients: The Data Controller uses a Data Processor: patient record-keeping software: KARDI-SOFT Kft. (registered office: 9024 Győr, Csokonai utca 29, company registration number: 08-09-012232) Data transfers based on a legal obligation: National Health Insurance Fund Administration (NEAK)
Source of data: The source of personal data is the person entitled to the prescription
Method and consequences of data provision: The provision of data is mandatory. If you do not provide your personal data, the Data Controller will be unable to fulfil its legal obligations

5.12 Recording data in the EESZT system

Purpose of data processing: Recording in the Electronic Healthcare Services Space (EESZT) system is carried out for the purposes specified in Section 4(1) of the Health Care Act
Legal basis for data processing: Article 6(1)(c) of the GDPR: compliance with a legal obligation: EMMI Decree No. 39/2016 of 21 December 2016 on detailed rules relating to the Electronic Healthcare Services Space
Categories of data subjects: Patients
Scope of personal data: Health and personal identification data
Data retention period: For 5 years following the death of the data subject, in accordance with Section 35/J(2) of the Health Care Act
Data transfer: No data transfer takes place in accordance with Articles 44–49 of the GDPR
Recipients: The Data Controller engages the following Data Processor(s): patient record-keeping software: KARDI-SOFT Kft. (registered office: 9024 Győr, Csokonai utca 29., company registration number: 08-09-012232) Data transfers made in accordance with legal obligations to the following bodies: EESZT Data Controller: Ministry of the Interior (registered office: 1051 Budapest, József Attila utca 2–4.)
Source of data: The source of personal data is the patient
Method and consequences of data provision: The provision of data is mandatory. If you do not provide your personal data, the Data Controller will be unable to fulfil its legal obligations

5.13 Healthcare service contract

Purpose of data processing: Fulfilment of obligations arising from the healthcare service contract
Legal basis for data processing: Article 6(1)(b) of the GDPR: performance of a contract
Categories of data subjects: Persons using the service
Scope of personal data: Relevant parts of medical records pursuant to Sections 136(1) and (2) of the Health Care Act; Section 3(e) and Section 3/B of the Health Care Activities Act
Duration of data processing: Pursuant to Section 30(1) of the Health Care Act: final report 50 years, all other documents 30 years, diagnostic imaging records 10 years
Data transfer: No data transfer takes place in accordance with Articles 44–49 of the GDPR
Recipients: The Data Controller does not use a Data Processor for this activity
Source of data: The source of personal data is the person using the service
Method and consequences of data provision: Provision of the data is mandatory. If the data is not provided, the Data Controller will be unable to provide healthcare services
Automated decision-making, profiling: Does not take place

5.14 Operation of a social alert system

Purpose of data processing: To assist patients at risk in accordance with statutory requirements
Legal basis for data processing: Article 6(1)(c) of the GDPR: compliance with a legal obligation: Act XXXI of 1997 on the Protection of Children and Guardianship Administration (Gyvt.); Decree No. 60/2003 (20 October) of the Ministry of Social Affairs and Labour on the minimum professional requirements for the provision of healthcare services; Decree No. 15/1998. (30 April) NM Decree on the professional duties and operating conditions of child welfare and child protection institutions and persons providing personal care Article 9(2)(h) of the GDPR: data processing for healthcare and occupational health purposes
Categories of data subjects: Patient
Scope of personal data: Relevant parts of medical records pursuant to Sections 136(1) and (2) of the Health Care Act; Section 3(e) and Section 3/B of the Health Care Activities Act
Duration of data processing: Pursuant to Section 30(1) of the Health Care Act: final report 50 years, all other documents 30 years, diagnostic imaging records 10 years
Data transfer: No data transfer takes place in accordance with Articles 44–49 of the GDPR
Recipients: The Data Controller uses a Data Processor: patient record-keeping software: KARDI-SOFT Kft. (registered office: 9024 Győr, Csokonai utca 29., company registration number: 08-09-012232) collaborating doctors, a current list of whom is available on the website and at reception; collaborating psychologists, a current list of whom is available on the website and at reception. Data transfer based on a legal obligation (reasons): Provision of data to the National Social Information System (OSZIR); Notification of the police; National Ambulance Service (OMSZ); the locally competent guardianship authority
Source of data: The source of personal data is the Data Controller
Method and consequences of data provision: The provision of data is mandatory. If you do not provide the data, the Data Controller will be unable to fulfil its legal obligations
Automated decision-making, profiling: None

5.15 Invoicing

Purpose of data processing: Issuing an invoice
Legal basis for data processing: Article 6(1)(c) of the GDPR: compliance with a legal obligation: Section 159 (1)
Categories of data subjects: The person using the service
Scope of personal data: Name, address, tax number (in the case of a corporate client), email address Health fund member and membership ID Name of the insured person and insurance ID
Duration of data processing: 8 years, in accordance with Sections 169(1) and (2) of the Accounting Act
Data transfer: No data transfer takes place in accordance with Articles 44–49 of the GDPR
Recipients: The Data Controller engages the following data processor(s): accounting: ADOMIX PLUSZ KFT. (registered office: 4024 Debrecen, Csapó utca 18, 2nd floor, door 5, company registration number: 09-09-012860) patient record-keeping software: KARDI-SOFT Kft. (registered office: 9024 Győr, Csokonai utca 29, company registration number: 08-09-012232) invoicing software: KBOSS.hu Kft. (registered office: 1031 Budapest, Záhony utca 7., company registration number: 01-09-303201) The Data Controller provides data to the National Tax and Customs Administration (NAV) in accordance with point 1 of Annex 10 to Act CXXVII of 2007 on Value Added Tax (VAT Act)
Source of data: The source of personal data is the person using the service
Method and consequences of data provision: The provision of data is mandatory. If you do not provide the necessary data, the Data Controller will be unable to fulfil the invoicing obligation prescribed by law
Automated decision-making, profiling: Does not take place

5.16 Payment for services

Purpose of data processing: Payment for the service: credit card payment, bank transfer, cash payment, health insurance card, or via an insurance company
Legal basis for data processing: Article 6(1)(b) of the GDPR: necessary for the performance of a contract or for taking steps at the data subject’s request prior to entering into a contract
Categories of data subjects: Persons using the service
Scope of personal data: Name, bank account number, service, date of performance, email address, health insurance fund membership and identification number, insurance identification number, data relating to payment by bank card or online bank card payment
Duration of data processing: 8 years pursuant to Sections 169(1) and (2) of the Accounting Act
Data transfer: No data transfer takes place in accordance with Articles 44–49 of the GDPR
Recipients: The Data Controller uses a Data Processor: provider of online credit card payment services: SimplePay, operated by OTP Mobil Kft. (registered office: 1138 Budapest, Váci út 135–139. Building B, 5th floor, company registration number: 01-09-174466) Barion Payment Zrt. (registered office: 1117 Budapest, Irinyi József utca 4–20, 2nd floor, company registration number: 01-10-048552) In the case of bank transfers, the Data Controller’s account-holding bank, acting as an independent data controller, has access to personal data: Raiffeisen Bank Zrt. (registered office: 1133 Budapest, Váci út 116–118, company registration number: 01-10-041042) . The Bank’s privacy policy is available here: https://www.raiffeisen.hu/raiffeisen-csoport/raiffeisen-bank-zrt/jogi-nyilatkozatok/adatkezelesi-tajekoztato Wise Europe SA (registered office: Rue du Trône 100 bte 3, 1050 Brussels, company registration number: 0713.629.988, branch: Wise Payments Limited Hungarian Branch, 80 Váci út, 1133 Budapest, company registration number: 01-17-000945) The Bank’s privacy notice is available here: https://wise.com/gb/legal/privacy-notices When paying with a health fund card or when payment is made by an insurer, the following service provider(s) have access to personal data as independent data controllers: Prémium Health Fund, contact details: https://premiumegeszsegpenztar.hu/ OTP Bank, contact details: https://www.otpbank.hu/portal/hu/MaganszemelyekMBH Bank, contact details: https://www.mbhbank.hu/ Generali Insurance, contact details: https://www.generali.hu/ Életút Health and Mutual Aid Fund, contact details: https://www.eletut.hu/egeszseg-es-onsegelyezo-penztar/ Allianz Hungária Insurance, contact details: https://www.allianz.hu/hu_HU/lakossagi.html Újpillér Health Fund, health fund, contact details: https://www.ujpiller.hu/ ISYS Health and Mutual Aid Fund, contact details: https://izys.hu/ Vitamin Health Fund, contact details: https://www.vitaminep.hu/main/ Vasutas Health and Mutual Aid Fund, contact details: https://www.epenztar.hu/ Patika Health Fund, contact details: https://www.patikapenztar.hu/
Source of data: The source of personal data is the person using the service
Method and consequences of data provision: Provision of data is required. If you do not provide the data, you will not be able to pay for the service
Automated decision-making and profiling: Does not take place

5.17 Contractual communications

The Data Controller communicates with its contracted Partners (suppliers, customers) through the designated contact person specified in the contract, and maintains a business relationship.

Purpose of data processing: To maintain communication and facilitate cooperation for the purpose of fulfilling the contract between the Data Controller and the Partner
Legal basis for data processing: Article 6(1)(f) of the GDPR: legitimate interests
Categories of data subjects: Employees of the Partner (sole trader, limited liability company, limited partnership, private limited company) designated as contact persons
Scope of personal data: Name, job title, telephone number, email address
Duration of data processing: Until the end of the fifth year following the performance or termination of the contract
Data transfer: No data transfer takes place in accordance with Articles 44–49 of the GDPR
Recipients: The Data Controller uses a Data Processor: email service providers: Sybell Informatika Kft. (registered office: 1158 Budapest, Késmárk utca 7/B, 2nd floor, door 206, company registration number: 01-09-293034) Google Ireland Ltd. (registered office: Gordon House, Barrow Street, Dublin 4, Ireland)
Source of data: The source of personal data is the Partner’s contact person
Method and consequences of data provision: Provision of the data is mandatory. If you do not provide the required data, the Data Controller will be unable to liaise with the Partner
Automated decision-making, profiling: Does not take place

5.18 Investigation of healthcare complaints

Purpose of data processing: Investigation of the patient’s complaints
Legal basis for data processing: Article 6(1)(c) of the GDPR: legal obligation: Section 29 of the Health Care Act; Article 9(2)(h) of the GDPR: data processing for healthcare and occupational health purposes
Categories of data subjects: Complainant
Scope of personal data: Identification data, email address, postal address
Duration of data processing: In accordance with Section 29(4) of the Health Act: 5 years
Data transfer: No data transfer takes place in accordance with Articles 44–49 of the GDPR
Recipients: The Data Controller does not use any data processors
Source of data: The source of the personal data is the complainant
Method and consequences of data provision: Provision of the data is mandatory. If you do not provide your personal data, the Data Controller will be unable to investigate the complaint
Automated decision-making, profiling: None

5.19 Communication on social media platforms

Purpose of data processing: Communication on social media platforms
Legal basis for data processing: Article 6(1)(a) of the GDPR: consent
Categories of data subjects: Persons registered on social media platforms
Scope of personal data: Name, public profile data
Data retention period: Data processing takes place on social media platforms; therefore, the Data Controller and the operator of the relevant social media platform are considered joint controllers
Data transfer: No data transfer takes place in accordance with Articles 44–49 of the GDPR
Recipients: The Data Controller does not use any data processors
Source of data: The source of the personal data is the person registered on the social media site
Method of data provision, consequences: The provision of data is voluntary. If you do not provide your personal data, the Data Controller will not be able to inform you about its current activities or services on social media sites
Automated decision-making, profiling: None takes place

6. Website data processing

6.1 Cookies

The website uses cookies.

A cookie is a file that is placed on your computer when you visit a website. A cookie is a packet of information sent by the server to your browser; each time you make a request, your browser sends this back to the server with the data content specified by the server. The purpose of this is to save the web settings of the website you have visited, so that if you visit the same website again from the same device, the site will already remember the parameters you have set.

Cookies have numerous functions. They are most commonly used to personalise adverts and services, and to analyse website traffic.

Under current legislation, cookies may only be stored on your device if this is strictly necessary, i.e. essential for the website to function, these are known as ‘essential cookies’. Your consent is required for the use of all other types of cookies. You can view and configure the cookies currently used on the website in the pop-up window that appears when you access the site.

Modern browsers allow you to change your cookie settings. Some browsers automatically accept cookies by default, but this setting can be changed so that you can prevent automatic acceptance in future. Once changed, the browser will offer you the option to choose your cookie settings each time you visit the website.

Given that the purpose of cookies is to support and facilitate the usability and processes of the website, if you disable cookies, we cannot guarantee that you will be able to make full use of all the website’s features. In this case, the website may not function as intended in your browser. Further detailed information on cookie settings for the following browsers:

6.2 Social media

The Data Controller can be found on the following social media platform(s).

The operator of the social media platform is considered a joint data controller alongside the Data Controller; information regarding data processing is available via the following links:

Social media platform: Name of Data Controller: Link to privacy notice:

Facebook Meta Platforms Ireland Ltd. (registered office: Merrion Road, Dublin 4 D04 X2K5, Ireland) https://www.facebook.com/privacy/explanation

Instagram Meta Platforms Ireland Ltd. (registered office: Merrion Road, Dublin 4 D04 X2K5, Ireland) https://www.facebook.com/help/instagram/155833707900388/

LinkedIn LinkedIn Ireland Unlimited Company (registered office: Wilton Plaza, Wilton Place, Dublin 2, Ireland) https://www.linkedin.com/legal/privacy-policy

The Data Controller does not record or process personal data relating to users of the relevant social media site in its internal database or system.

7. Access to personal data

Personal data may be accessed by the Data Controller’s authorised staff to the extent necessary for the performance of their duties.

8. Data security measures

The Data Controller shall take appropriate IT, technical and organisational measures to ensure that the personal data it processes is protected against, amongst other things, unauthorised access or unauthorised alteration.

9. Data Subject rights

Right to information

Articles 13–14 of the GDPR

You have the right be informed, at the time your personal data is collected, of the fact that your data is being processed and the purposes of such processing. The Data Controller shall also provide you with any further information necessary to ensure fair and transparent data processing, taking into account the specific circumstances and context of the processing of personal data. You must also be informed of the fact that profiling is taking place and of its consequences.

Right of access

Article 15 of the GDPR

You have the right to request information as to whether your personal data is being processed and, if such processing is taking place, you have the right to know: what personal data the Data Controller is processing; on what legal basis; for what purpose; for how long; to whom and when; under which legislation, to whom access to your personal data has been granted or to whom your personal data has been disclosed, from what source your personal data originates (if you did not provide it to the Data Controller yourself), whether automated decision-making, and the logic behind it, including profiling.

Right to rectification

Article 16 of the GDPR

You have the right to request that the Data Controller rectify any inaccurate personal data concerning you or complete any incomplete personal data. You may therefore request that the Data Controller to amend any of your personal data (for example, you may change your email address or other contact details at any time).

Right to erasure (‘right to be forgotten’)

Article 17 of the GDPR

You have the right to request that the Data Controller erases your personal data if any of the following grounds apply: your personal data is no longer necessary for the purposes for which it was collected or otherwise processed; you withdraw your consent, which forms the basis for the processing of your personal data pursuant to Article 6(1)(a) or Article 9 (2)(a) and there is no other legal basis for the processing; you object to the processing pursuant to Article 21(1) and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Article 21 (2) and your personal data has been processed unlawfully; your personal data must be erased to comply with a legal obligation under Union or Member State law applicable to the Data Controller; or the collection of your personal data took place in connection with the provision of information society services referred to in Article 8 (1) in connection with the provision of information society services.

Right to restriction of processing

Article 18 of the GDPR

You have the right to obtain from the Data Controller restriction of processing upon request if any of the following grounds apply: You contest the accuracy of your personal data (in which case the restriction applies for a period enabling the Data Controller to verify the accuracy of the personal data); the processing is unlawful, and you oppose the erasure of the data and request the restriction of its use instead; the Data Controller no longer needs the personal data for the purposes of processing, but you require it for the establishment, exercise or defence of legal claims; you have objected to the processing pursuant to Article 21(1) (in which case the restriction applies for as long as it is not established whether the Data Controller’s legitimate grounds override your legitimate grounds).

Right to data portability

Article 20 of the GDPR

You have the right to receive the personal data concerning you, which you have provided to a Data Controller, in a structured, commonly used and machine-readable format, and you are also entitled to transmit those data to another Data Controller without hindrance from the Data Controller to whom you have provided the personal data, provided that: the processing is based on consent pursuant to Article 6(1)(a) or Article 9(2)(a), or on a contract pursuant to Article 6(1)(b), and the processing is carried out by automated means. You have the right to – where technically feasible – request the direct transfer of your personal data between data controllers.

Right to object

Article 21 of the GDPR

You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data based on Article 6(1)(e) or (f), including profiling based on those provisions. In such a case, the Data Controller may no longer process your personal data, unless the Data Controller demonstrates that there are compelling legitimate grounds for the processing, which take precedence over your interests, rights and freedoms, or which are related to the establishment, exercise or defence of legal claims. Where your personal data are processed for direct marketing purposes, you have the right to object at any time to the processing of your personal data for this purpose, including profiling, insofar as it relates to direct marketing.

Right to withdraw consent

Article 7(3) of the GDPR

You have the right to withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent prior to its withdrawal. You must be informed of this before giving your consent. Withdrawing consent must be made just as easy as giving it.

10. Remedies

Right to lodge a complaint with the supervisory authority

Article 77 of the GDPR

In the event of a breach of your rights regarding the protection of your personal data, you may lodge a complaint with the following authority: National Authority for Data Protection and Freedom of Information, registered office: 1055 Budapest, 9–11 Falk Miksa Street. Postal address: 1363 Budapest, PO Box 9. Telephone: +36 (1) 391-1400. Email: ugyfelszolgalat@naih.hu. Website: www.naih.hu

The right to an effective judicial remedy against the Data Controller or Data Processor (initiating legal proceedings)

Article 79 of the GDPR

You are entitled to bring a claim before a court against the Data Controller or Data Processor if you consider that the processing of your personal data is unlawful. The court will deal with the case as a matter of priority. In this instance, you are free to decide whether to lodge your claim with the court having jurisdiction over your place of residence or your current place of stay. Contact details for the courts: www.birosag.hu/torvenyszekek

11. Updates to this Privacy Notice

The Data Controller reserves the right to amend this Privacy Notice unilaterally. This notice may be amended, in particular, where required by changes in legislation, the practice of data protection authorities, business needs, or other circumstances. At the Data Subject’s request, the Data Controller shall send them a copy of the notice currently in force in the form agreed with them.

Budapest, 19 May 2025