Privacy Policy - GDPR | Medicalface Poděbrady

1. Data Controller

The data controller is Medicalface s.r.o., registered office Na Dláždění 64/15, 290 01 Poděbrady, Czech Republic.

Medicalface s.r.o.
Studentská 523/45, 290 01 Poděbrady
Company ID (IČO): 05243637
Managing director: Dr. Jiří Boháč
Registration number ČLK: 1146326176
Email: bohac@medicalface.cz
Phone: +420 777 879 849

Clinic address:
Na Dláždění 64/15, 290 01 Poděbrady

2. What Data We Collect

We collect and process the following categories of personal data:

Identification data: name, surname, date of birth
Contact details: email address, phone number
Health information: medical history, allergies, previous treatments
Photos: before/after treatment photos (only with your consent)
Billing information: invoicing and payment data

3. Purpose of Data Processing

We process your data for the following purposes:

Providing medical and aesthetic services
Managing appointments and reservations
Communication about services
Sending newsletters (consent when submitting email)
Fulfilling legal obligations
Improving our services

Post-treatment feedback

After your treatment we may email you a short satisfaction questionnaire. You can decline it by unticking the box when booking online or at any time via the link in every email. Your answers (ratings, comment, recommendation, request to be contacted) are health data. We process them to improve our care on the basis of legitimate interest (Article 6(1)(f) GDPR) and under Article 9(2)(h) GDPR. They are seen by the clinic's doctors, nurses and reception staff, who are bound by confidentiality. Reception will contact you if you ask us to. You can object to receiving questionnaires at any time. We publish a review on medicalface.cz under your initials with the treatment name only with your explicit consent (Article 6(1)(a) and Article 9(2)(a) GDPR). You can withdraw consent at any time via the link shown after submitting the review, by email or by phone, and we will then remove the review from the website. Reviews are not deleted automatically; if your data are erased, we anonymise the review.

4. Legal Basis for Processing

We process your personal data based on:

Contract performance: to provide services you requested
Legal obligation: medical documentation storage requirements
Legitimate interests: website operation, protection of property
Consent: marketing communications when submitting email; photo documentation of results only with the patient’s explicit consent
Post-treatment feedback: legitimate interest (Article 6(1)(f) GDPR) and Article 9(2)(h) GDPR; a review is published only with your explicit consent (see Post-treatment feedback in section 3)

5. Data Retention Period

Medical records: 5 years from the last entry (Decree No. 444/2024 Coll.)
Accounting documents: 10 years
Marketing purposes: until consent is withdrawn
Cookies: depending on the cookie type (from the end of the session up to 2 years)
Post-treatment feedback: not deleted automatically; if your data are erased, we anonymise it (see Post-treatment feedback in section 3)

6. Your Rights

You have the following rights regarding your personal data:

Right of access: request copy of your data
Right to rectification: correct inaccurate data
Right to erasure: delete data (where applicable)

All processors are contractually bound to protect your personal data and use it only for specified purposes.

7. Data Security

We protect your data using appropriate technical and organizational measures:

Encrypted data transmission (SSL/TLS)
Secure data storage with access controls
Regular security audits
Staff training on data protection
Right to data portability: you have the right to receive your data in a structured, commonly used format.
Right to object: you can object to certain types of data processing, particularly for marketing purposes.
Right to withdraw consent: consent to data processing can be withdrawn at any time without affecting prior lawfulness.
Right to lodge complaint: you can file a complaint with the supervisory authority (ÚOOÚ) if you believe your rights have been violated.

Pro uplatnění vašich práv nás kontaktujte na email: bohac@medicalface.cz

8. Data Sharing

We do not sell your data to third parties. We may share data with:

Healthcare providers (with your consent)
Accounting and legal services
IT service providers (under strict confidentiality)

We do not transfer data outside the EU without appropriate safeguards.

9. Cookies

Our website uses cookies to improve functionality and analyze traffic. You can manage cookie preferences in your browser settings or via our cookie banner.

Encryption of sensitive data
Regular security updates
Access restricted to authorized personnel only
Regular backups
Physical protection of premises

10. Policy Changes

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated date.

Email: bohac@medicalface.cz
Phone: +420 777 879 849
Address: Na Dláždění 64/15, 290 01 Poděbrady

Úřad pro ochranu osobních údajů:
Pplk. Sochora 27
170 00 Praha 7
Web: www.uoou.cz