PRIVACY POLICY

PRIVACY POLICY

Arthro Sport Clinic S.R.L. is the company that owns the website www.artrosport.ro and the private multidisciplinary medical clinic Artro Sport Clinic.

In this Privacy Policy we explain how your personal data are processed by Artro Sport Clinic (hereinafter referred to as “Artro Sport Clinic” or “We”) in a responsible manner and in accordance with the applicable legislation on the protection of personal data.

For the purposes contemplated in this Privacy Policy, Arthro Sport Clinic S.R.L. is the Controller of personal data. You can find below information regarding our identity and our contact details.

Artro Sport Clinic and our partners take the protection of personal data very seriously. Compliance with the legislation on the protection of personal data and with good practices in the field, as well as ensuring a climate of transparency, safety and trust for our patients, is a priority for us, to which our employees, collaborators, partners and management firmly declare their commitment.

This Privacy Policy contains important information regarding the manner in which Artro Sport Clinic processes your personal data. We therefore encourage you to take the time necessary to read it in full and carefully and to make sure that you understand it fully. To make the document easier to follow, we have included at the end of this notice a glossary explaining the main terms used (for example, “personal data”, “processing”, etc.). Do not hesitate to contact us if you have any questions or if you cannot find the information you are looking for.

WHO WE ARE

A private multidisciplinary medical clinic, Artro Sport Clinic proposes a different approach to treating patients, ensuring that each case is carefully examined by doctors from all the necessary specialties.

Treatment plans are tailored to the patient's medical condition, so that the patient obtains the best results following interaction with our specialists and state-of-the-art medical equipment.

Our constant concern for the correct management of medical cases, the newest equipment, which until now was unavailable in Romania, and a team of elite doctors are the guarantee that every patient of the Artro Sport Clinic medical clinic will have the chance to remain active and fit both for work and for sport.

Contact details:

• Full name: Arthro Sport Clinic S.R.L.
• Address: Strada Vasile Lascăr no. 216 – 218, Ground floor, Sector 2, Bucharest, registered with the Trade Register Office under no. J40/5576/2018, CUI 39233087
• Telephone number: 021.9885 (available Monday – Friday: 9.00 – 21.00 and Saturday: 9.00 – 17.00)
• E-mail address: programari@artrosport.ro

Contact details of the Data Protection Officer (this is the person you should contact in relation to any issues concerning the protection of your personal data)

• Correspondence address: Vasile Lascăr no. 216 – 218, Ground floor, Sector 2, Bucharest
• E-mail address: dpo@artrosport.ro

THE SOURCE FROM WHICH WE RECEIVE YOUR DATA

In most cases, we receive personal data directly from you when you sign a service contract or when you use medical services at our Clinic. We have a legal obligation to keep your personal data accurate and up to date. To this end, we may carry out campaigns to update your data. We will also correct and update your data whenever we find inaccuracies or errors.

For beneficiaries of health insurance, depending on the contract between us and your insurer, we receive from the insurer: surname; first name; personal identification number (CNP); contact details (telephone number and/or e-mail address).

WE PROCESS PERSONAL DATA FOR THE FOLLOWING PURPOSES AND ON THE FOLLOWING LEGAL BASES

1. Making an appointment at Artro Sport Clinic

1. Notification (reminder) regarding the date and time of an appointment made at Artro Sport Clinic

1. Collection of information for the Patient Record (in the case of all patients)

1. Provision of medical services to minors or persons lacking legal capacity

In principle, the processing of personal data contemplated in this Policy relates to persons over the age of 18. However, the patients of Artro Sport Clinic may also be minors, and therefore, for certain processing operations, the personal data of persons under the age of 18 are also taken into account. These will be processed on the basis of the performance of a contract (consisting of the acceptance of the services and fees applied by Artro Sport Clinic and not necessarily requiring the signing of a document), of a legal provision or for the vital interest of the data subject, and for those processing operations where consent is required, the processing of the personal data of minors may be carried out only with the prior written consent of their legal representative / guardian.

Access of minors to the services provided by Artro Sport Clinic takes place only in the presence of at least one parent or of the legal representative. Verification of the status of parent/legal representative/guardian is carried out exclusively by visually checking that the data in the documents presented by the legal representative correspond (the minor's birth certificate / another identity document of the person lacking legal capacity, as well as an identity document of the accompanying legal representative). Certain investigations, treatments or medical procedures cannot be carried out in the absence of the consent of the parent/legal representative/guardian, in which case they will be required to sign a consent form.

1. Carrying out the medical consultation and preparing the patient's file

1. Carrying out medical tests and other medical investigations

1. Communication of test results and/or other investigations

Test reports contain health data and are sent electronically after having been password-protected. When these documents are sent to unsecured e-mail addresses, their confidentiality can no longer be guaranteed by Artro Sport Clinic. It is the responsibility of the patient and of the patient's e-mail service provider to ensure the security of the data after they have been sent.

1. Manufacture of orthopaedic insoles

1. Monitoring the progress of the recommended treatment plan

1. Monitoring the state of health after completion of treatment

1. Compliance with pharmacovigilance obligations

1. Invoicing of the services provided by Artro Sport Clinic

1. Payment for the services provided by Artro Sport Clinic

1. Assessment of the quality of Artro Sport Clinic's services

1. Marketing communications / newsletter (promotion of Artro Sport Clinic's services)

Giving consent for the purpose indicated under this point is not a condition for the provision of Artro Sport Clinic's core services.

In the case of activities based on consent, please note that, after its withdrawal, your personal data may continue to be stored for a maximum period of 12 months for the purpose of carrying out the erasure operations, which may be highly complex, in particular where erasure/destruction is carried out manually. During this period, your data are not used for any other processing activity, except for storage for the purpose of erasure/destruction.

1. Carrying out consultations via the Zoom platform

The discussion with the doctor during the audio-video consultation is not recorded.

1. Uploading the medical documents required for online consultations to the Medicai platform

1. Monitoring of premises and/or property

1. Recruitment

1. Creation of a CV database

If you have chosen to send us your CV using the contact details available on our website, we understand that you gave this consent at the time you sent the CV. Your personal data will be stored by Artro Sport Clinic and processed exclusively for the purpose mentioned above.

In the case of activities based on consent, please note that, after its withdrawal, your personal data may continue to be stored for a maximum period of 12 months for the purpose of carrying out the erasure operations, which may be highly complex, in particular where erasure/destruction is carried out manually. During this period, your data are not used for any other processing activity, except for storage for the purpose of erasure/destruction.

1. Promotion of Artro Sport Clinic's services and image on social media

1. Use of the social media platforms Facebook, Instagram, YouTube

The data will not be stored in Artro Sport Clinic's databases, but, owing to the functionality of the social media platforms, we may have access to the public information in your account.

In the case of activities based on consent, please note that, after its withdrawal, your personal data may continue to be stored for a maximum period of 12 months for the purpose of carrying out the erasure operations, which may be highly complex, in particular where erasure/destruction is carried out manually. During this period, your data are not used for any other processing activity, except for storage for the purpose of erasure/destruction.

1. Initiation or performance of contracts concluded by the Clinic with its business partners

1. Initiation and conduct of relations between the Clinic and representatives of public authorities

1. Handling of requests/enquiries received at our e-mail addresses

1. Handling of data subjects' requests

HOW LONG WE WILL STORE YOUR DATA

We will store your data for periods ranging between 6 months and 100 years (in the case of medical documents), depending on the purpose of processing. To store your data (in electronic format), we use our own IT infrastructure or that of other specialised companies with which we have concluded contracts.

Personal data are stored for fixed periods, applying also the following criteria:

• storage periods laid down in the legal provisions applicable to the activity of Artro Sport Clinic;
• the time required for the expiry of legal and/or limitation periods;
• the time limits and procedures established in accordance with internal rules, including those on data storage;
• the time required, from a practical point of view, upon expiry of the legal/limitation periods/time limits set by the Controller, for the actual erasure of the data.

WHAT MAY HAPPEN IF YOU DO NOT PROVIDE US WITH YOUR DATA

You are under no obligation to provide us with the personal data we have mentioned in this document. However, refusal to provide the personal data, as mentioned for each purpose described above, makes it impossible to provide the service, to access the premises owned by Artro Sport Clinic or to handle your requests.

TO WHOM WILL WE DISCLOSE YOUR DATA?

As a rule, we do not disclose your data to other companies, organisations or persons in any country (including Romania).

In certain situations, however, we may disclose your data to other natural or legal persons.

Thus, we may transmit data to the following categories of recipients:

• Public authorities in any field, from Romania or abroad (in particular public health authorities in Romania: the National Health Insurance House, the Ministry of Health and others) – at their request or on our own initiative, in accordance with the applicable legislation.
• Insurers from Romania or from other countries – in connection with the services you have received at our Clinic.
• Accountants, auditors, lawyers – these are bound by law or by the contract concluded with us to maintain the confidentiality of your data.
• Collaborating doctors and other providers of medical services – each of these being bound by law or by the contract concluded with us to maintain the confidentiality of your data.

Where we use a processor to process your personal data, we will ensure that it has concluded a written agreement with us under which it undertakes, among other things, the obligations laid down by the legislation on the protection of personal data, namely to (i) process personal data only in accordance with our written instructions provided in advance and to (ii) effectively implement measures to protect the confidentiality and ensure the security of personal data. We will also ensure that the written agreement between us and the processor imposes on it at least all the other obligations laid down by the applicable legislation on the protection of personal data.

TO WHOM AND UNDER WHAT CONDITIONS WILL WE TRANSFER YOUR DATA OUTSIDE THE EEA

At this time we do not transfer and do not intend to transfer your personal data, or any part thereof, to other companies, organisations or persons in third countries that are not part of the European Economic Area (EEA).

If it becomes necessary to transfer your data to any of the destinations above, we will ensure that the respective transfer complies with all the legal requirements laid down by the General Data Protection Regulation.

In specific cases, for the purpose of carrying out specialised tests, at the express request of our patients, we transmit personal data to medical centres outside Romania, including the U.S.A. At this time, the transfer of personal data to the U.S.A. is carried out in accordance with the Adequacy Decision for the EU-U.S. Data Privacy Framework. Please note that, by transferring data to countries outside the EEA, third parties, such as state authorities or private entities, may have access to your data, against whom your rights established by the General Data Protection Regulation are not always enforceable.

WHAT ARE YOUR RIGHTS?

As a data subject, you have the following rights under the General Data Protection Regulation:

• The right of access to data. You have the right to obtain access to your data that we process, or to copies thereof; you also have the right to obtain from us information regarding the nature, processing and disclosure of these data.
• The right to rectification of data. You have the right to obtain the rectification of your inaccurate data.
• The right to erasure of data (“the right to be forgotten”). You have the right to obtain from us the erasure of your data that we process, to the extent permitted by law.
• The right to restriction of processing. You have the right to obtain the restriction of the processing of your data.
• The right to object. You have the right to object to processing of data based on legitimate interest.
• The right to data portability. You have the right to obtain the transfer of your data to another controller, in a structured, commonly used and machine-readable format, or you may ask us to transmit them directly to another Data Controller, where: (i) the processing is based on your consent or on the performance of a contract to which you are a party; and (ii) the processing is carried out by automated means.
• The right to withdraw your consent. Where we process your data on the basis of your consent, you have the right to withdraw your consent; you may do so at any time, at least as easily as you initially gave us your consent; withdrawal of consent will not affect the lawfulness of the processing of your data carried out before the withdrawal.
• The right not to be subject to an automated decision. Under current conditions, as a user of our services, you will not be subject to a decision based solely on the automated processing of your data (including profiling) which produces legal effects concerning you or similarly significantly affects you.
• The right to lodge a complaint with the Supervisory Authority. You have the right to lodge a complaint with the National Supervisory Authority for Personal Data Processing regarding the processing of your data by us or on our behalf, using the contact details available on the website dataprotection.ro.

HOW YOU CAN EXERCISE YOUR RIGHTS

To exercise one or more of these rights (including the right to withdraw your consent, where we process your data on that basis) or to ask any question about any of these rights or any provision of this notice or about any other aspect of the processing of your data by us, please use the contact details mentioned above, in the subsection “Contact details”.

We make every effort to respond as quickly and completely as possible to all your questions and concerns and to facilitate the exercise of your rights.

Any request concerning the above rights will be registered and, where applicable, documented by the requester. Where there are reasonable doubts as to the identity of the person making the request, in relation to the personal data, Artro Sport Clinic may request additional data/information or may refuse to act on the request.

We will inform you of the action taken on a request without undue delay and, in any event, within one month of receipt of the request. This period may be extended by two further months where necessary, taking into account the complexity and number of the requests. You will be informed of any such extension within one month of the date of the request, together with the reasons for the delay.

WHAT THE TERMS WE HAVE USED IN THIS NOTICE MEAN

• Supervisory authority for personal data processing:
  an independent public authority which, according to the law, has responsibilities relating to monitoring compliance with the legislation on the protection of personal data. In Romania, this supervisory authority for personal data processing is the National Supervisory Authority for Personal Data Processing (ANSPDCP).
• Special categories of personal data:
  personal data which: reveal racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership; genetic data; biometric data for the purpose of uniquely identifying a natural person; data concerning the health, sex life or sexual orientation of a natural person.
• Collaborators:
  medical staff who have concluded a collaboration contract with us and who provide medical services to our patients.
• Personal data:
  any information relating to an identified or identifiable natural person (referred to as the “data subject”). A natural person is identifiable if they can be identified, directly or indirectly, in particular by reference to an identifier, for example: name, identification number, location data, online identifier, one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that person. Thus, for example, the notion of personal data includes the following: surname and first name; home or residential address; e-mail address; telephone number; personal identification number (CNP); the diagnosis established (these are special data); genetic data (these are special data); biometric data (these are special data); geolocation data. The categories of personal data about you that we process are listed above.
• Controller:
  the natural or legal person who decides why (for what purpose) and how (by what means) personal data are processed. According to the law, responsibility for compliance with the legislation on personal data lies primarily with the controller. In our relationship with you, we are the controller and you are the data subject.
• Processor:
  any natural or legal person who processes personal data on behalf of the controller, other than the controller's employees.
• Data subject:
  the natural person to whom certain personal data relate (to whom they “belong”). In your relationship with us (the controller), you are the data subject.
• Processing of personal data:
  any operation or set of operations performed on personal data or on sets of personal data, whether or not by automated means; for example: collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction of the respective personal data/sets of personal data. In practice, processing means any operation on personal data, whether by automated or manual means.
• Third country:
  a country outside the European Union and the European Economic Area

Version updated on 14.08.2024