This Privacy Policy sets out the conditions under which MB Adenas, legal entity code 306738073, located at V. Kudirkos g. 22-44, Utena (hereinafter – the Controller), processes personal data when the Controller provides services, serves individuals who contact it by telephone or in other ways, and when individuals use the website www.medarts.eu or shop in the online store.

We are not responsible for the privacy policies of other websites to which you may be redirected in order to obtain more information. Visitors may be redirected to the Controller's social media accounts, the links to which are provided on the website www.medarts.eu.

When information is sent through social media accounts, the personal data provided by visitors may be disclosed to the operators of those social networks and to other persons with whom the operators of the social networks share personal data. The Controller is not responsible for the privacy policies of these networks, so we recommend that you also read them.

The following terms are used in this Privacy Policy:

ADTAĮ – the Law on Legal Protection of Personal Data of the Republic of Lithuania.

Personal data – any information relating to an identified or identifiable natural person (data subject); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data and an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

Company / Controller / we – MB Adenas, 306738073, located at V. Kudirkos g. 22-44, Utena, e-mail info@medarts.eu, tel. +37067467406.

GDPR / General Data Protection Regulation – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).

Data recipient – a natural or legal person, public authority, agency or another body to which personal data are disclosed, whether a third party or not.

Data subject – an employee, client or other natural person whose personal data are processed by the Company.

Data processing means any operation or set of operations performed on personal data, by automated or non-automated means, such as collection, recording, sorting, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction.

Data processor – a legal person that processes personal data on behalf of the Company.

Privacy Policy – this policy, which sets out the conditions for the personal data processed by the Company.

Other terms used in this Policy correspond to the terms used in the GDPR and the ADTAĮ.

In this Privacy Policy we describe how, for what purposes and which of your data we process, so please read this policy carefully, and if you have any questions, contact us using the contact details given in this Privacy Policy and we will answer your questions.

How do we obtain your personal data?

We process personal data that we receive in the following ways:

– when you provide personal data to us;

– when we receive your personal data from other persons in accordance with legislation and/or the procedure set out in this Privacy Policy (we may receive data from other healthcare institutions, insurance companies, laboratories, territorial health insurance funds or by other lawful means).

What information do we collect and what is it used for?

We will process your personal data for the following purposes:

A. Provision of services (including healthcare services), conclusion and performance of contracts, including transfer of your health data to laboratories and other healthcare institutions where additional tests are necessary

Data categories: For this purpose we will process your first name, surname, contact details (telephone number, e-mail address), date of birth, insurance ID number, special categories of data (services provided, tests, diagnoses, visits to specialists, descriptions of services provided, medical histories, health data, referrals, consent forms for procedures, etc.), photographs (including of individual body parts).

Legal basis for processing: The legal basis for the processing of personal data is set out in Article 6(1)(a), (b) and (c) and Article 9(2)(a), (b), (c) and (h) of the GDPR.

Retention periods: We will process this data for the periods set by legislation.

Contract with the client – 10 years after the contract expires;

Outpatient personal health history – 15 years after the last visit;

Statistical card of outpatient treatment – 5 years after the last visit;

Register of outpatients – 5 years after the last visit.

Source of data: We receive your data directly from you, and also from other healthcare institutions, laboratories and territorial health insurance funds.

Categories of data recipients: In accordance with legislation, we may transfer your data to other healthcare institutions, territorial health insurance funds, insurance companies, laboratories carrying out tests, institutions that examine disputes, and also to the Company's auditors and legal advisers.

B. Registration for a visit and administration of the visit

Data categories: For this purpose we will process your first name, surname, contact details (telephone number, e-mail address), date of birth, insurance ID number.

Legal basis for processing: The legal basis for the processing of personal data is set out in Article 6(1)(b) and Article 9(2)(a) of the GDPR.

Retention periods: We will keep information about registration for a visit for no longer than 5 years after your visit.

Source of data: We receive your data directly from you.

Categories of data recipients: We may transfer your data to providers of online registration services and website maintenance services.

C. Customer service (administration of requests, enquiries, complaints, feedback or other communication with interested parties)

Data categories: For this purpose we will process your first name, surname, telephone number, e-mail address, and the content of your communication with the Company.

Legal basis for processing: We will process this data on the basis of Article 6(1)(a) and (f) and Article 9(2)(a) of the GDPR.

Retention periods: We will process your data for 1 year from the date of your enquiry, unless the data must be processed for longer in order to resolve a claim, or an investigation or other dispute resolution process is under way – in which case until the end of the dispute resolution.

Source of data: We receive the data directly from you. If you submit a complaint to a supervisory authority, we may receive your data from these authorities.

Categories of data recipients: We may transfer the data to providers of online registration services and website maintenance services, institutions that examine disputes, and also to the Company's auditors and legal advisers.

D. Direct marketing

Data categories: For this purpose we will process your telephone number, e-mail address, age and gender (in order to provide you with the most suitable offer).

Legal basis for processing: We will process this data on the basis of Article 6(1)(a) of the GDPR.

Retention periods: We will process your data for 5 years from receipt of your consent or until the consent is withdrawn.

Source of data: We receive the data directly from you.

Categories of data recipients: We may transfer the data to providers of online registration services, website maintenance services and direct marketing services.

E. Processing of candidates' data

Data categories: For this purpose we will process your first name, surname, telephone number, e-mail address, professional (work) history, positions held, education, competencies, and other data that you provide to us.

Legal basis for processing: We will process this data on the basis of Article 6(1)(a) of the GDPR.

Retention periods: We will process your data for as long as the selection for the specific position is under way, and, with your consent, for 2 years after the end of the selection.

Source of data: We receive the data from you or from companies providing personnel selection services. In addition to the data you provide, we may collect and otherwise process other publicly available data about you, i.e. search for information on the internet (for example LinkedIn, Facebook, Twitter). We may also contact the former employers named in your CV and ask them to provide information about your qualifications, professional abilities and business qualities. In order to verify that the proof of qualifications you submit (diplomas, certificates, etc.) is authentic, we may contact the educational institutions named in the proof of qualifications you submit.

Categories of data recipients: We may transfer your data to personnel selection companies, data storage companies, auditors or legal advisers.

What are your rights?

You have the following rights in relation to the processing of your personal data:

– To receive information about the processing of your personal data.

– To access your personal data held by the Company.

– To withdraw your consent to the processing of personal data.

– To request that inaccurate personal data be rectified and incomplete personal data be completed.

– To request erasure ("the right to be forgotten") of personal data relating to the data subject, if this can be justified on one of the grounds set out in Article 17(1) of the General Data Protection Regulation.

– To request restriction of the processing of your personal data where one of the cases provided for in Article 18(1) of the General Data Protection Regulation applies.

– The right to data portability.

– To object to the processing of personal data relating to you.

– To lodge a complaint with a supervisory authority.

– The right to compensation for damage caused by improper processing of personal data.

If you believe that your rights have been violated or that your data are being processed unlawfully, you have the right to lodge a complaint with the State Data Protection Inspectorate (L. Sapiegos g. 17, Vilnius, tel. (8 5) 271 2804, 279 1445, e-mail ada@ada.lt) or with a supervisory authority in another European Union member state where you have your permanent place of residence or work (list of supervisory authorities: https://edpb.europa.eu/about-edpb/about-edpb/members_en#member-lt). In all cases, before lodging a complaint, please contact us so that together we can find a suitable solution.

Please note that the exercise of your rights will depend on the conditions for exercising the particular right. Where there is a legal basis, your right may not be exercised due to specific circumstances, and our Company may refuse to satisfy your request.

Your request to exercise your rights will be examined within 1 (one) month, and if necessary this period may be extended to 2 months. The Company will inform you of any extension of the period for examining the request.

Cookies

We are constantly improving the website and want to make using www.medarts.eu as simple and convenient as possible. To do this, we need to know what information interests visitors most, which cities the website is visited from, how often visitors log in, which browser they use, which website content interests them, which devices the website is read on, etc. So that the website works properly, we store small data files, called cookies, on your device. If you have any questions about the matters set out in this Privacy Policy, please contact the Company at V. Kudirkos g. 22-44, Utena, e-mail info@medarts.eu, tel. +37067467406.