Section 1 Identity and contact details of controller
According to the relevant data protection law, your personal data will be processed by:
Unilabs Slovensko, s.r.o.
Záborského 2, 036 01 Martin,
Slovakia
Section 2 What personal data we collect
Unilabs collects the following personal data related to patients:
- Identification Data: Name, surname, date of birth, identification number, home address, contact information - email address and phone number,
- Medical Data: health data, diagnosis code, clinical referrals, samples, exams.
Unilabs collects the following personal data related healthcare professionals:
- Identification Data: Name, surname.
- Professional Data:, position, specialization, business name and location of workplace, contact information – email address and phone number.
- Usage Data: IP Address, time and date of logs.
Section 3 Purposes of the processing and legal basis
Your personal data will be processed for the following purposes and in accordance with the legal basis as set out below:
| Purpose | Legal basis | Retention period |
|---|---|---|
| Registering referrals and samples | For personal data: compliance with legal obligation (art. 6, lett. C). For special categories of personal data: for the purpose of medical diagnosis on the basis of Union or Member State law (art. 9, par. 2, lett. H). | 20 years from providing healthcare |
| Conduct analysis and examinations | For personal data: compliance with legal obligation (art. 6, lett. C). For special categories of personal data: for the purpose of medical diagnosis on the basis of Union or Member State law (art. 9, par. 2, lett. H). | 20 years from providing healthcare |
| Interpret results and report | For personal data: compliance with legal obligation (art. 6, lett. C). For special categories of personal data: for the purpose of medical diagnosis on the basis of Union or Member State law (art. 9, par. 2, lett. H). | 20 years from providing healthcare |
| Send report and images to referrer | For personal data: compliance with legal obligation (art. 6, lett. C). For special categories of personal data: for the purpose of medical diagnosis on the basis of Union or Member State law (art. 9, par. 2, lett. H). | 20 years from providing healthcare |
| Invoice clients for services performed and perform credit control activities | Personal data: compliance with legal obligation (art. 6, lett. C). For special categories of personal data: provision of health or social care (art. 9, par. 2, lett. H). | 10 years from invoicing |
| Communicate to clients and prospects | Legitimate interest of Unilabs to develop its relationship | During relationship |
| Manage surveys | Legitimate interest of Unilabs to develop its service | During relationship |
Section 4 Profiling or Automated Decision Making
- Not applicable – no profiling or automated decision making are involved in the context of using the Unilabs Pro platform.
Section 5 Indirect collection of data
- Patient´s identification data and clinical information are collected indirectly from healthcare professionals.
Section 6 Categories of recipients of the personal data
Your personal data will be shared within the Group, i.e. other Unilabs companies such as: authorised personnel in charge commercial activities and operational activities.
Section 7 Data retention period
We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for. To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.
When personal data is no longer needed or has reached its retention period it is deleted.
Personal data might be kept for a longer period of time where it is necessary in accordance with legal requirements.
Section 8 Transfer of personal data
Due to the international dimension of Unilabs Group, your personal data may be transferred outside of the European Economic Area (‘EEA’) to countries recognised by the European Commission as ensuring an adequate level of protection on the basis of an adequacy decision such as Switzerland where the Unilabs headquarters is based.
Section 9 Data subjects rights
In relation to your personal data, you have the following rights:
- (a) Right to object: You can object to our processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this basis. Please contact us, providing details of your objection.
- (b) Access to your personal data: You can request access to a copy of your personal data that we hold, along with information on what personal data we use, why we use it, who we share it with, how long we keep it for and whether it has been used for any automated decision making. You can make a request for access free of charge.
In compliance with the GDPR, we will respond to a valid subject access request without undue delay and at the latest within one month of receiving the request. In some circumstances, we can extend the time to respond by a further two months. For example, when the request is complex. In this case, we will let you know within one month of receiving your access request and explain to you why the extension is necessary. - (c) Consent: Where you have given us your consent to use personal data, you can always withdraw your consent at any time. If you withdraw your consent, Unilabs will cease to process your personal data.
- (d) Rectification: You can ask us to change or complete any inaccurate or incomplete personal data held about you.
- (e) Erasure: You can ask us to delete your personal data where it is no longer necessary for us to use it, you have withdrawn consent, or where we have no lawful basis for keeping it.
- (f) Portability: You can ask us to provide you or a third party with some of the personal data that we hold about you in a structured, commonly used, electronic form, so it can be easily transferred.
- (g) Restriction: You can ask us to restrict the personal data we use about you where you have asked for it to be erased or where you have objected to our use of it.
- (h) No automated-decision making: Automated decision-making takes place when an electronic system uses personal data to make a decision without human intervention. You have the right not to be subject to automated decisions that will create legal effects or have a similar significant impact on you, unless (i) you have given us your consent (ii) it is necessary for a contract between you and us, or (iii) is otherwise permitted by law. You also have certain rights to challenge decisions made about you. We do not currently carry out automated decision-making in connection with our relationship with you, but we will notify you in advance if this changes.
Section 10 Means of exercising
These rights can be exercised by sending an e-mail at the following address: dpo@unilabs.com.
The exercise of your rights is free of charge.
Section 11 Contact details of the Data Protection Officer
If you have any comments or questions regarding this Privacy Notice or our data handling practices, please contact the Data Protection Officer.
Email: dpo@unilabs.com