Personal data protection

Operator ensures to all visitors of this server protection of their personal data in accordance with the law no. 101/2000 Co., About protection of personal data and Regulation of the European Parliament and Council (EU) 2016/679 (hereinafter “GDPR”).

Commissioner for the personal data protection

Commissioner for the personal data protection has been established on the basis of GDPR and is the independent guarantor of proper dealing with the personal data within the company and also the intermediator between the company, the supervisory authority (Office for Personal Data Protection) and public.

Commissioner for the personal data protection – contact: gdpr@sanklim.cz

Information text for clients about processing the personal data

Dear clients,
from the applicable legislation of the law no. 101/2000 Co. about personal data protection and about change of some laws as amended and especially from The Regulation of The European Parliament and The Council (EU) 2016/679 from the 27 th of April 2016 about the protection of individuals related to the processing of personal data and about free flow of these data and about cancellation of direction 95/46/ES (general regulation about the personal data protection) that becomes operative on the 25 th of May 2018 results in many duties concerning the protection of your personal data. Believe that we put maximum emphasis on their fulfillment and in this way we would like to give you important information concerning the processing of your personal data. Personal data are processed by our delegated staff and then by processers delegated by The Administrator on the basis of contracts about the processing of the personal data. When we deal with the personal data we apply the rule of minimization which means that as soon as the period of time that we have to keep your personal data passes, our databases and information systems automatically anonymize your personal data.

1. Who we are and what kind of data we process?
AquaKlim, Ltd., based in Ostrava – Moravská Ostrava, Gorkého 3037/2, zip code: 702 00,
IN: 27849562, registered in the Commercial Register at County Court Ostrava in section C,
insertion 31571, running the non-state medical facility Sanatoria Klimkovice, Hýlov 24, zip
code: 742 84 (hereinafter “spa”) in your case process:

for your stay at our spa:
- contact personal data written in registration card that are filled in at the beginning of your stay at our spa:

• name and surname, eventually title
• date of birth
• permanent address
• ID card number and PD card number for purpose of evidence and payment of local fees
• telephone and e-mail contact
• in case of self-payers also data about payment for the stay
• in case of foreigners also data required by the law for reporting the stay of foreigners (citizenship, passport number, visa number – these data are filled in the registration form for foreigners).
• data relating to providing the spa rehabilitation treatment including out-patient care and to
  providing services and that according to the draft for curative rehabilitative treatment in specialized health resort (hereinafter SCHR), the draft for spa curative rehabilitative treatment, requests issued by physicians to provide out-patient rehabilitation necessary for medical documentation.

a) for stays paid by health insurance companies

• number of policyholder stated in the draft including policyholder’s health insurance company,
• data about drafting physician for the purpose of protection of client’s life important concerns – especially for the purpose of specification of health condition,
• data about employer,
• data about diagnosis, health condition,
• data about the length of stay,
• data about medical care outputs provided to you at out facility and further data required by the health insurance companies in case that the services are paid by the health insurance company,
• data about your absolved curative stays - data about medical care outputs provided to you at out facility and further data required by the health insurance companies in case of paid services of spa curative rehabilitative care,

b) for self-paid curative stays

• data about the length of stay,
• data about diagnosis, health condition,
• data about attending physician for the purpose of protection of client’s life important concerns – especially for the purpose of specification of health condition,
• data about medical care outputs provided to you at out facility,
• data about your absolved curative stays - data about medical care outputs provided toyou at out facility.

2. On which bases, for what purpose and for how long do we process your personal data?

We process above stated data especially on basis of the legal relationship between you and our spa that is within extent necessary to meet the contract for providing the spa treatment, accommodation and eventual other services in accordance with article 6 point 1 letter b) of GDPR regulation.

The purpose of this processing is providing stated services. Our spa receives the drafts forproviding the medical care from your health insurance company.

Likewise the data about your absolved curative stays we process on the same legal bases. In case of services paid from the public health insurance adds also our duty to handover to the health insurance company the data about medical care outputs provided to you at our facility and further data required by health insurance companies and to allow their control by insurance companies. So it is the processing necessary to meet legal duties in accordance with article 6 point 1 letter c) of GDPR regulation.
For the same legal reason we process data for evidence linked with payment of fees according to the law no. 565/1990 Co. about local fees for all accommodated and in case of foreigners we process data necessary for registration of foreigner’s stay based on the duty imposed by law no. 326/1999 Co. about the stay of foreigners at Czech Republic territory and about change of some laws as amended. This processing is done solely to accomplish stated duties and it includes handing over the data contained in the foreign police registration form.

In case when you have signed the consent to process your contact data and data about your stays at our facility we process this data on the bases of your agreement. The purpose of processing here is our possibility to inform you about offers of our services and products. So it is legal reason in accordance with article 6 point 1 letter a) of GDPR regulation. Above stated data are also processed in accordance with assignation of with article 6 point 1 letter f) of GDPR regulation for purposes of our authorized interests, certainly except cases when these our authorized interests were preponderated with your fundamental rights and freedoms. Therefore we process data only for a purpose to prove proper providing of services because of eventual complaints.
If we process special categories of personal data stated in point 1 letter a) and b) of this text then we do it exclusively in connection with providing the medical care or treatment and under conditions and guaranties stated in GDPR regulation and that all in accordance with article 9 point 2 letter h) of GDPR regulation.

As far as the length of processing of your personal data, then for the purpose of providing medical and related services we process data about provided care during your stay at our spa and after its finishing for the time, when is the health insurance company on the bases of generally binding legal regulations, authorized to control provided paid services and their billing. In case of the treatment paid by self-payer we process data about provided care for time within which can the self-payer impeach the providing of treatment.

Actuarial and tax documents with which we bill the provided care also include some personal data (client’s name and surname, type of provided service, stay from-to, payers address, date of issuing the document). These documents are kept only for purposes to fulfil duties stated by relevant actuarial and tax legislation for the time stated by this legislation.
In case of data that we process on bases of your consent is the time of processing limited with the period of validity of the agreement, mostly 10 years, if the agreement is not cancelled earlier.

3. Who can access and to whom we handover your personal data?
Only your health insurance company can access your personal data for the purpose of control that is imposed to the health insurance companies by generally binding legal regulations (law no. 48/1997 Co., about public health insurance and about change and addition of some related laws as amended).
If you are self-payer of provided care than no one can access your data. In case of foreigners we handover personal data stated in registration form to the foreign police. Your personal data can be also handed over to the third parties that provide supporting activities for us – distribution of mail, recovery of receivables, or lawyer services, supplier of IT system and to translators if necessary. These third parties are in place of processor of personal date, we handover only the personal data necessary for particular purpose to them.

4. Your rights according to the applicable legislation

We would like to also inform you that according to the applicable legislation about protection of personal data you have following rights:

• the right to access your personal data that we process in your case,
• the right to correct your personal data in case that they were in any case improper or inaccurate,
• in case that you would find out or you suppose that we process your personal data in conflict with the protection of your private and personal life or in violation of the law, especially is your personal data would be inaccurate considering the purpose of their processing, that you have the right to request the explanation and also ask us to remove the resulting state (for example blocking, repair, completing or removing your personal data),
• the right to request erasure of personal data, eventually restriction of their processing,
• the right to object against processing for the purpose of evaluation if obligations that were imposed to us by the applicable legislation were violated,
• in case that we process your personal data on the bases of the consent you have the right to cancel the consent,
• except the above stated you have also the right to fill a complaint at supervising authority which is Office for Personal Data Protection based in Prague 7, Pplk. Sochora 27, 170 00, www.uoou.cz .
• you also have the right to portability of these data that you have provided to us and that we process on the basis of necessity to process them for the purpose to meet the contract. In case that you want us to handover these data to the other administrator than we can give your personal data in structured, commonly used and machine-readable form, eventually if it will be technically feasible we can hand them over directly to the different administrator.

In case of any uncertainties or questions considering the processing of your personal data do not hesitate to contact us in written on the address: AquaKlim, Ltd. Sanatoria Klimkovice, Hýlov 24, zip code: 742 84 or you can also contact our commissioner for the personal data protection by e-mail on the address GDPR@sanklim.cz .

In Klimkovice, 24-05-2018