Privacy policy

Who processes your data

The controller of your personal data is G‑INNOVA s.r.o., a provider of health services in gynecology and obstetrics, urogynecology, physiotherapy, esthetic gynecology and obesity treatment. We decide why and how your data is handled and we are responsible for protecting it.

Controller

G-INNOVA s.r.o.

Registered office and clinic

Zenklova 340/22, 180 00 Prague 8 – Libeň, Czech Republic

Company ID

08332673

VAT ID

CZ08332673

Data box

jqu9asj

E-mail

info@ginnova.cz

Phone

+420 776 30 30 46

We have not appointed a data protection officer — our processing is not large-scale within the meaning of Article 37 GDPR. For anything concerning personal data, write to info@ginnova.cz, use our data box or the clinic’s postal address.

What data we process

• Identification data — name and surname, date of birth, birth number, insurance number and health insurance company.
• Contact data — address, phone number, e-mail and the contact for a close person if you give us one.
• Health data — medical history, findings, test results, records of procedures and prescribed medication. This is a special category of data under Article 9 GDPR and we protect it most strictly.
• Data on care provided and payments — booked and performed procedures, invoices, proof of payment, extended care card.
• Communication — the content of messages in the Medevio app, e-mails, phone calls, and messages from social networks and WhatsApp.
• Images — photographs and recordings from examinations where they form part of the medical records, and photographs beyond those records only with your consent.

We obtain most data directly from you. Some reaches us from your health insurance company, laboratories, your previous registering gynecologist or another health service provider in connection with your care.

Why we process your data

• Providing health services and keeping medical records — a legal obligation under Article 6(1)(c) and Article 9(2)(h) GDPR and Act No. 372/2011 Coll., on health services.
• Billing covered care to your health insurance company — a legal obligation under Act No. 48/1997 Coll.
• Self-paid procedures and the extended care card — performance of a contract under Article 6(1)(b) GDPR.
• Booking appointments, confirmations and reminders — performance of a contract and our legitimate interest in appointments not going to waste.
• Accounting and tax — a legal obligation under Act No. 563/1991 Coll. and Act No. 235/2004 Coll.
• Answering enquiries by e-mail, phone and social networks — our legitimate interest in communicating with people interested in our care.
• Establishing, exercising or defending legal claims — our legitimate interest.
• Photographs beyond the medical records, testimonials and newsletters — only on the basis of your consent under Article 6(1)(a) and Article 9(2)(a) GDPR.

Consent is always voluntary and withholding it has no effect whatsoever on the scope or quality of the care you receive. You can withdraw consent at any time.

We do not use your data for automated decision-making or profiling, and we never pass it to anyone for their own marketing.

Confidentiality and security

All doctors, nurses, physiotherapists and reception staff are bound by the duty of confidentiality under the Health Services Act. Only those involved in your care have access to your medical records. Paper records are kept in locked premises, electronic data in systems protected by access rights and encrypted transfer.

Who we share data with

• Health insurance companies — to the extent needed to bill covered care.
• Laboratories and other health service providers — cytology, histology, microbiology and imaging.
• The hospital where we perform procedures requiring hospitalization.
• The Institute of Health Information and Statistics of the Czech Republic — mandatory reporting to the National Health Information System.
• The operator of the Medevio booking system — as a processor handling reservations and patient communication for us.
• Our hosting provider and IT administrator — as processors.
• Our accountants and, in justified cases, our lawyer.
• Public authorities — only where required by law or where they act within their statutory powers.

We have data processing agreements under Article 28 GDPR in place with every processor. We do not transfer data outside the European Economic Area, except for the social network communication described below.

Social networks and Meta

The clinic runs profiles on Facebook and Instagram, and a WhatsApp line for Russian-speaking patients. All three services are operated by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland. If you write to us through a profile, Messenger or WhatsApp, we process the content of your message and your profile name or phone number so that we can reply. For aggregate profile statistics we act as joint controllers with Meta under Article 26 GDPR; we have no access to data on individual users, only to anonymous summaries.

Meta may transfer data to the United States on the basis of the European Commission’s adequacy decision (the EU–US Data Privacy Framework) and standard contractual clauses. The terms on which it handles data are governed by its own policy.

The website and cookies

The ginnova.cz website does not use Google Analytics or any other analytics tool. Fonts are hosted on our own server, so your browser does not connect to any third party on an ordinary page load.

The hosting server briefly records the IP address, browser type and requested address in its operational logs — the site could not run or defend itself against attacks otherwise. We do not link these logs to your person and we delete them within six months at the latest.

How long we keep data

• Medical records — for the period set by Decree No. 98/2012 Coll., on medical records. For a registering gynecological practice this is usually 10 years from the last provision of health services or from a transfer to another provider.
• Accounting and tax documents — 10 years from the end of the tax period they relate to.
• Communication outside the medical records — e-mails and social network messages for no more than 12 months from the last contact.
• Data processed on the basis of consent — until consent is withdrawn, and no longer than the period it was given for.
• Server operational logs — no more than 6 months.

Once the retention period expires we destroy the data — paper documents are shredded, electronic records irreversibly deleted.

Your rights

• Right of access — to learn what data we hold about you and receive a copy of it.
• Right to rectification — to have inaccurate data corrected or incomplete data completed.
• Right to erasure — to have data deleted where we no longer have a legal ground to keep it.
• Right to restriction of processing — to pause processing while we deal with an objection or verify accuracy.
• Right to data portability — to receive data processed on the basis of consent or a contract in a machine-readable format.
• Right to object — to processing based on a legitimate interest.
• Right to withdraw consent — at any time, without affecting the lawfulness of processing before withdrawal.
• Right to lodge a complaint — with the Office for Personal Data Protection.

Send your request to info@ginnova.cz, to data box jqu9asj, by post to the clinic, or hand it in at reception. We will deal with it without undue delay and within one month of receipt at the latest; in complex cases we may extend that by a further two months and we will always tell you in advance. To make sure we do not hand data to the wrong person, we may verify your identity.

Access to your medical records

Under Section 65 of the Health Services Act you have the right to inspect your medical records, take extracts or copies, and name the people who may inspect them or be told about your health. We record both the naming and its revocation in the file. We may charge for copies up to the cost of making them.

Supervisory authority

If you believe we are handling your data incorrectly, contact us first — most matters are resolved straight away. You can always turn directly to the supervisory authority as well.

Authority

Office for Personal Data Protection

Address

Pplk. Sochora 27, 170 00 Prague 7

E-mail

posta@uoou.gov.cz

Web

uoou.gov.cz

Changes to this policy

We may update this policy if the way we process data changes or the law does. The new version will appear on this page together with its effective date. We will notify you in advance of any material change affecting processing based on your consent.