Data Processing Notice

I. Preamble

1. Gergely Medical Szolgáltató Korlátolt Felelősségű Társaság (registered office: 2030 Érd, Aggteleki utca 23., company registration number: 13-09-232227, hereinafter referred to as the “Company“) processes personal data on the website you are visiting (hereinafter the “Website”) for the purpose of establishing contact with clients and providing information to clients.
2. Regulation (EU) 2016/679 of the European Parliament and of the Council (27 April 2016) on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (“General Data Protection Regulation”, hereinafter referred to as “GDPR“), Article 14, requires that the Company is obliged to provide appropriate information to data subjects regarding data processing.
3. This Data Processing Notice (hereinafter the “Data Processing Notice”) serves to fulfill the aforementioned information obligation specified in the GDPR, and is consistent with the provisions of Act CXII of 2011 on the Right to Informational Self-Determination and Freedom of Information.
4. This Data Processing Notice contains the rules applicable to all data processing activities conducted on the Websites operated by the Company.

II. Information

1. Name and contact details of the data controller

Company name: Gergely Medical Szolgáltató Kft.
Registered office: Hungary, 2030 Érd, Aggteleki utca 23.
Company registration number: 13-09-232227
Website: https://drgergelyrobert.hu/
Telephone number: +36-70-452-9862

2. Name and contact details of the data controller’s representative:

• Name: Dr. Róbert Gergely
• Email address: [email protected]

3. General purpose of data processing:

1. providing appointments for services to clients
2. patient information (presentation of the condition and treatment)
3. scientific activity (presentation of the procedure in electronic or printed professional journals) training of healthcare professionals (lectures, information brochures, textbooks)
4. client acquisition (presentation of the procedure on the website, flyers, and other written or electronic formats)

4. General definitions

1. Data processing: Any operation or set of operations performed on personal data, regardless of the procedure applied, including in particular the collection, recording, organization, structuring, storage, adaptation, alteration, use, retrieval, consultation, use, disclosure, transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction of personal data.
2. Data controller: the Company.
3. Data processor: A service provider who processes personal data on behalf of the data controller. They are authorized to act in accordance with contracts concluded with data controllers and instructions received.
4. Data breach: A breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored, or otherwise processed.
5. Data Subject: Any identified or identifiable natural person whose personal data is processed.
6. Consent of the Data Subject: Any freely given, specific, informed, and unambiguous indication of the Data Subject’s wishes by which they signify agreement to the processing of personal data relating to them.

5. Detailed list and purpose of data processing activities

i. Processing of data related to photographic documentation for scientific purposes in connection with healthcare provision and its use for scientific purposes

The Company plans to create photographs, video recordings, and data-displaying images (examples of the latter include: CT, ultrasound; the listed recordings hereinafter collectively referred to as: “Recording” and “Recordings”) of the ophthalmic procedures it performs, and then to publish these on its own Website and in written or electronic documents (flyers, professional journals). The purpose of creating recordings and publication is to present the ophthalmic procedure used by the Company from a medical and technical perspective to the professional and lay public, to provide patient information, and to acquire future clients for the Company.

Purpose of the planned processing of personal data: Photographic documentation of healthcare provision
Legal basis for data processing: Consent of the Data Subject
Categories of Data Subjects: Data Subject receiving the treatment
Personal data processed: name, date of birth, photographs of treatment processes
Data processor: the Company’s own storage.
Planned duration of data processing: Until withdrawn by the Data Subject.

ii. Processing of data related to providing opinions, photographic documentation, and use for online publication and recording by a film crew in connection with healthcare provision.

The Company may use the Recordings it has created on its Website. The Recordings, as online publications, help visitors to the Website become familiar with the treatments performed by the Company. Data Subjects are informed in advance about filming days organized by external film crews. The recording helps interested parties become familiar with the course and process of the procedures. With your consent, the Company is authorized to present you and the procedures performed on you, or your personal opinion about the treatments, in reports, television broadcasts, and promotional films.

Purpose of the planned processing of personal data: Photographic documentation of healthcare provision
Legal basis for data processing: Consent of the Data Subject
Categories of Data Subjects: Data Subject receiving the treatment
Personal data processed: Name, Photographic and video recordings of healthcare provision processes
Data processor: the Company’s own storage, or its business partner with whom it has concluded a contract for this purpose
Planned duration of data processing: Until withdrawn by the Data Subject

iii. Processing of data related to contact initiated via the Website

This data is processed when, prior to receiving treatment, you book an appointment on our online platform (by completing the “Register”, “Online Appointment Booking”, or “Send Message” contact forms) and initiate contact with the Company to request an appointment for our services or to obtain further information about our services.

Purpose of the planned processing of personal data: Inquiries from Data Subjects for appointment coordination, appointment bookings by Data Subjects.
Legal basis for data processing: Consent of the Data Subject
Categories of Data Subjects: Data Subject initiating use of the treatment.
Personal data processed: Name, telephone number, email address, selected service, selected appointment, desired appointment, desired callback time, message sent
Data processor: the hosting service provider of the Company’s Website (Websupport Magyarország Kft), operators of appointment management software used on the Website (Touch Me Soft doo, Rocketgenius Inc.), data management software of Service Providers who provide the Company’s work location on a contractual basis (Trioptria Kft, Premed Pharma Kft).
Planned duration of data processing: Until withdrawn by the Data Subject; in the case of partners, for the duration determined by them

6. Legal basis for data processing:

The legal basis for data processing is the consent of the Data Subject to the processing of their personal data for one or more specific purposes in accordance with Article 6(1)(a) and Articles 7 and 8 of the GDPR, as well as Article 9(2)(a).

7. Cross-border transfer of personal data:

The Company does not intend to transfer personal data to a third country or to an international organization.

8. Duration of storage of personal data:

• by default: indefinitely
• in the event of a deletion request by the Data Subject: until deletion is completed without delay

9. Rights of Data Subjects:

1. Right to transparent information and communication: The Company makes available to Data Subjects all information relating to data processing in accordance with Article 13 of the GDPR in a concise, transparent, intelligible, and easily accessible form, using clear and plain language (in this Data Processing Notice).
2. Right of access: The Data Subject has the right to obtain from the Company confirmation as to whether personal data concerning them is being processed, and, where that is the case, access to the personal data and the information set out in Article 15(1) of the GDPR.
3. Right to rectification: The Data Subject has the right to obtain from the Company without undue delay the rectification of inaccurate personal data concerning them and, taking into account the purposes of the processing, to have incomplete personal data completed, including by means of providing a supplementary statement.
4. Right to erasure: The Data Subject has the right to obtain from the Company the erasure of personal data concerning them without undue delay, and the Company is obliged to erase personal data concerning the Data Subject without undue delay where one of the grounds set out in Article 17(1) of the GDPR applies, in particular in the case of data processing based on the Data Subject’s consent, where the Data Subject withdraws their consent.
5. Right to restriction of processing: The Data Subject has the right to obtain from the Company restriction of processing where one of the conditions set out in Article 18(1) of the GDPR is met.
6. Right to data portability: The Data Subject has the right to receive the personal data concerning them, which they have provided to the Company, in a structured, commonly used, and machine-readable format.
7. Right to object: The Data Subject has the right to object, on grounds relating to their particular situation, at any time to processing of personal data concerning them which is based on point (f) of Article 6(1) of the GDPR. The Company shall no longer process the personal data unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights, and freedoms of the Data Subject or for the establishment, exercise, or defense of legal claims.

• Please direct any requests under points i.–vii. directly to Dr. Róbert Gergely (email address: [email protected]) Inquiries will be answered within 15 days.

• In addition, the Data Subject has the right to lodge a complaint with a supervisory authority. The details of the Hungarian data protection authority are as follows:

• Name: National Authority for Data Protection and Freedom of Information
  • Address: HU-1125 Budapest, Szilágyi Erzsébet Fasor 22/c
  • Telephone number: +36-1/391-1400
  • Fax number: +36-1/391-1410
  • Email address: [email protected]

10. Processing of Recordings

The Company guarantees that the recordings will not be used for performance evaluation or automated decision-making.

III. Miscellaneous Provisions

1. The Data Processing Policy, which contains detailed rules for data processing, is available at any time on the Company’s website at https://drgergelyrobert.hu.

2. The Company reserves the right to review and revise the Data Processing Policy at any time. Data Subjects will be informed in a timely and appropriate manner of any such revision.