Privacy Policy

1. Data Controller

The controller of personal data is the limited liability company “Latvian Center for Plastic, Reconstructive, and Microsurgery” (hereinafter referred to as the “Medical Institution”), registration No.: 40003524503, legal address: Brīvības gatve 410, Riga, LV-1024

Contact Information:

Phone No. (+371) 679 698 30
Email address: registratura@mcl.lv

Contact information for inquiries regarding personal data protection:

Email address: datu.aizsardziba@mcl.lv

2. Purposes and Legal Basis for the Processing of Personal Data

We ensure the fair and lawful processing of personal data by processing your personal data only for specific, predefined purposes and where there is an appropriate legal basis. We process your personal data for the following purposes:

2.1. To schedule a doctor's appointment and facilitate communication

When scheduling an appointment with one of our doctors, we need to identify you so that we can locate your medical record, if one has been created with us, and to determine whether you are eligible for government-funded healthcare services. We need your contact information so that, if necessary, we can notify you of any unexpected changes to your appointment. We also need to know what health issue you are experiencing so that we can schedule you with the appropriate specialist. For this purpose, we process the following personal data about you: first name, last name, personal identification number, phone number or email address, and the health issue you are experiencing.

The legal basis for this data processing is the provision of medical treatment or the management of health care services (Article 9(2)(h) of the General Data Protection Regulation [1]).

2.2. For the purpose of identifying individuals

In order to provide you with medical services, we need to identify you by asking you to present a form of identification. In order to complete medical records in accordance with applicable laws, we must process the following personal data: first name, last name, personal identification number, year of birth or age, and gender.

In cases where a patient is represented by their legal representatives or authorized representatives, we are required to verify the representatives’ identity (first name, last name, personal identification number) and the basis for their representation.

The legal basis for this data processing is the fulfillment of a legal obligation to which the medical institution is subject (Article 6(1)(c) of the General Data Protection Regulation, Section 15(4) of the Law on Patients“ Rights, and Cabinet of Ministers Regulation No. 265 of April 4, 2006, ”Procedures for the Maintenance of Medical Records”).

2.3. For the provision of medical services

To ensure the provision of high-quality medical services, we need to process your health data (for example: health status, including diagnosis of illness; disability; blood type and Rh factor; allergies; side effects of medications, intolerances; medications taken regularly; past illnesses and injuries; test results; surgical procedures; anesthesia methods; postoperative complications; course and outcomes of treatment, but this list is not exhaustive; the health data processed may vary depending on the issue for which you have sought care at the medical facility and the chosen treatment method).

To fulfill our obligation to document the treatment process, we make health records in your medical file as part of the provision of medical services. To comply with legal requirements and complete medical records, such as an outpatient medical record or an inpatient medical record, we need information about your place of work or educational institution.

In order to inform you of any changes to your scheduled procedures, to assess your health status during outpatient treatment, and to issue medical certificates and referrals, we need your contact information (address and phone number or email address). In certain cases (if, due to your health condition or age, you are unable to make decisions regarding your treatment yourself), we may need the contact information of your authorized representatives or legal guardians, spouse, or next of kin (first name, last name, phone number) in order to communicate with them regarding matters related to your treatment.

The legal basis for this data processing is data processing for the purpose of medical treatment (Article 9(2)(h) of the General Data Protection Regulation), the protection of the patient’s vital interests, if the patient is physically or legally incapable of giving consent (Article 9(2)(c) of the General Data Protection Regulation), as well as compliance with a legal obligation to which the healthcare institution is subject (Article 6(1)(c) of the General Data Protection Regulation, Cabinet of Ministers Regulation No. 265 of April 4, 2006, “Procedures for the Maintenance of Medical Records”).

2.4. Prescribing Prescription Medications

In order to fill the prescription medications you need, we process the following personal data about you: first name(s), last name; personal identification number; declared, registered, or self-reported residential address; gender; date of birth; information on whether you have been granted low-income status, if the medications distributed under the reimbursement program are prescribed on a special prescription. The prescription also includes the following information, which may directly indicate your health condition: diagnosis, prescribed medications, and instructions for use.

The legal basis for this data processing is data processing carried out for the purposes of health management (Article 9(2)(h) of the General Data Protection Regulation, Cabinet of Ministers Regulation No. 175 of March 8, 2005, “Regulations on the Production and Storage of Prescription Forms, as well as the Issuance and Storage of Prescriptions,” Cabinet of Ministers Regulation No. 134 of March 11, 2014, “Regulations on the Unified Electronic Information System for the Health Sector”).

2.5. For filling out a sick leave form

In order to complete and submit a sick leave form, we need to process the following data: the personal identification number of the recipient of the sick leave form; if applicable, the personal identification number of the child or dependent; first name(s), last name, the cause of temporary incapacity for work, and, where applicable, notes regarding violations of the regimen prescribed by a doctor or physician’s assistant, periods of incapacity for work, notes regarding referral to another physician, the date on which the recipient of the sick leave certificate is required to return to work, the date on which the recipient’s incapacity for work will continue, notes regarding referral to the State Commission of Physicians for Health and Work Capacity Assessment.

The legal basis for this data processing is data processing carried out for the purposes of health management (Article 9(2)(h) of the General Data Protection Regulation and Cabinet of Ministers Regulation No. 152 of April 3, 2001, Regulations No. 152 of April 3, 2001, “Procedures for Issuing Sick Leave Certificates,” and Cabinet of Ministers Regulations No.134 of March 11, 2014, “Regulations on the Unified Electronic Information System for the Health Sector”).

2.6. Administration of Payments for Medical Services

In order to administer the receipt of payments for medical services provided, we may need to process the following personal data: first name, last name, personal identification number, account number, address, diagnosis, place of employment, status (e.g., person in need, person with an occupational disease, person with a disability, child), and state budget funds spent.

The legal basis for this data processing is the legitimate interests of the controller (Article 6(1)(f) of the General Data Protection Regulation) or the performance of a contract (Article 6(1)(b) of the General Data Protection Regulation).

In order to receive a decision from the insurance company regarding coverage of medical expenses, we would need to process information about your health insurance policy and send your personal data, including health data—information regarding your diagnosis, treatment process, and costs—to the insurance company. Such data may be transmitted if you have provided written consent to the transmission of the aforementioned personal data to the insurance company.

The legal basis for data processing is your written consent (Article 9(2)(a) of the General Data Protection Regulation).

2.7. For the conduct of clinical trials

Clinical trials are conducted to analyze patients’ conditions and the course of their treatment, in order to obtain data that can help improve the quality and safety of patient care. For this purpose, the patient’s personal data is processed—first name, last name, phone number, or email address; occasionally, a personal identification number; but primarily, date of birth, information regarding diagnosis, the course of treatment, and life expectancy.

The legal basis for data processing is data processing carried out for scientific research purposes (Article 9(2)(j) and Article 89(1) and (2) of the General Data Protection Regulation, Sections 10(7), (8), and (9) and Section 11 of the Patient Rights Act).

2.8. Detection of Criminal Offenses

The medical facility conducts video surveillance at the entrance and in the hallway for the purpose of detecting criminal offenses in connection with the safety of visitors and the Data Controller, as well as the protection of property. Through video surveillance, the following personal data about you is processed: image, behavior, location, and time. The data obtained through video surveillance is not used for any purpose other than the detection of criminal offenses.

The legal basis for this data processing is the legitimate interests of the controller or a third party (Article 6(1)(f) of the General Data Protection Regulation).

3. How do we collect personal data, and why do you need to provide your personal data?

Information provided by the patient, identification documents, information from specialists regarding test results, the unified electronic health information system, the doctor’s diagnosis (test results), information from insurance companies, and recordings from video surveillance cameras.

The provision and receipt of information is necessary so that we can provide you with appropriate, high-quality, and safe medical services and fulfill the legal obligations imposed on the medical institution by applicable laws. In certain cases, failure to provide information may hinder or prevent us from providing services.

4. Potential Recipients of Personal Data

We process your personal data in accordance with applicable laws and take care to ensure that third parties who have no legal basis for processing your personal data do not gain access to it.

Personal data may be disclosed, as necessary, to: the patient regarding their own data, the patient’s legal or authorized representatives, physicians involved in the treatment process, the medical institution and its authorized employees, a person delegated for the study, laboratories for conducting necessary tests, the insurance company designated by the patient, authorized employees of the processor (the technical maintainer of the IT infrastructure), the State Social Insurance Agency, and the State Revenue Service.

Other medical institutions, in accordance with the procedures set forth in the Patient Rights Act—for the purpose of achieving medical objectives; The State Data Inspectorate—for the purpose of verifying compliance of personal data processing with the requirements of regulatory enactments; The State Labor Inspectorate—for the investigation and recording of workplace accidents and occupational diseases; The State Commission of Medical Experts on Health and Work Capacity—to conduct disability assessments; courts, the prosecutor’s office, the police, state child rights protection inspectors, the Orphan’s Court, the State Probation Service, the Ombudsman, and pretrial investigation authorities—for the performance of their functions as prescribed by law; the association “Latvian Motor Insurers” Bureau” and insurance companies that provide mandatory civil liability insurance for owners of land vehicles, — to compensate a person injured in a traffic accident for damages suffered; the employer of an employee who has suffered an occupational accident — for the investigation of the occupational accident in accordance with the regulatory acts governing the procedures for the investigation and recording of occupational accidents; the Center for Disease Prevention and Control—for the collection, compilation, processing, and analysis of statistical information on public health and health care, for the epidemiological surveillance of infectious diseases, as well as for the processing of personal data for the purpose of transmitting information to a statistical agency; National Health Service — for the administration of health care services funded from the state budget, as well as for the processing of personal data for the purpose of transmitting information to the statistical authority; State Agency of Medicines — for the supervision of the safety of medicinal products; Health Inspectorate — to ensure the performance of supervisory functions in the health sector.

5. Is your personal data transferred to countries outside the European Union (EU) or the European Economic Area (EEA)?

Your personal data is not transferred outside the European Union (EU) or the European Economic Area (EEA).

6. Is your personal data used in automated decision-making?

Your personal data is not used for automated decision-making.

7. How is the retention period for your personal data determined?

We will retain personal data that must be stored to comply with legal requirements in accordance with the time limits specified in the relevant laws (for example, medical records included in an Inpatient Medical Record or an Outpatient Medical Record are retained for 75 years after the last entry). We will retain data necessary to demonstrate compliance with our obligations in accordance with the general statute of limitations for contractual obligations—10 years. We will retain video surveillance recordings for 1 month to provide evidence in the event of an incident.

8. Your Rights

In accordance with the provisions of the General Data Protection Regulation, you have the right to access your personal data in our possession, request its correction, erasure, or restriction of processing, object to the processing of your data, and exercise your right to data portability in the cases and in accordance with the procedures set forth in the General Data Protection Regulation.

We respect your right to access and control your personal data, therefore, upon receiving your request, we will respond within the timeframes specified by law, and, if possible, we will correct or delete your personal data accordingly.

You can obtain information about the personal data we hold about you or exercise your other rights as a data subject in any of the following ways:

1. by submitting the relevant application in person and presenting identification at our office at the following address: Limited Liability Company “Latvian Center for Plastic, Reconstructive, and Microsurgery,” Brīvības gatve 410, Riga, LV-1024, every business day from 9 a.m. to 4 p.m.;

2. by submitting the relevant application and mailing it to us at the following address: Limited Liability Company “Latvian Center for Plastic, Reconstructive, and Microsurgery,” Brīvības gatve 410, Riga, LV-1024.

3. by submitting the relevant application to our email address: centre@mcl.lv, and signing the application with a secure electronic signature.

Upon receiving your request, we will review its content and verify your identity, and, depending on the situation, we reserve the right to ask you to provide additional proof of identity to ensure the security of your data and its disclosure to the appropriate person.

Withdrawal of Consent

If the processing of your personal data is based on your consent, you have the right to withdraw it at any time, and we will no longer process your personal data, which we processed on the basis of your consent, for the relevant purpose. However, please note that withdrawing your consent does not affect the lawfulness of data processing activities carried out prior to the withdrawal of consent.

9. Where should you turn to ensure that your rights are protected?

If you have any complaints regarding our processing of personal data, we encourage you to contact us first so that we can resolve the issue. If you believe that your rights regarding the protection of personal data have been violated, you have the right to file a complaint with the State Data Inspectorate.

[1] Regulation (EU) 2016/679 of the European Parliament and of the Council (April 27, 2016) on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)