Preamble
This Personal Data Protection Policy, hereinafter referred to as “Policy”, aims to inform about the following points:
- The commitments adopted by the Ruy Garcia Clinic, about the Protection of Personal Data, under and following Regulation (EU) 2016/679, on the protection of natural persons concerning the processing of Personal Data and the free movement of such data. Such commitments are adopted based on the General Data Protection Regulation, hereinafter “GDPR”, and other legislation in force.
- How the Ruy Garcia Clinic handles Personal Data that it collects directly or receives, in physical or digital format.
1. Mission and Commitment
The Ruy Garcia Clinic collects personal data online and on paper, and this policy is applicable regardless of the mode of collection or processing (treatment).
This policy aims to define the general principles and rules to be applied by Ruy Garcia Clinic to the Personal Data collected by it, considering the applicable norms, standards, and legal requirements, and a specific, explicit, and informed notification about the processing of your data, allowing the application of the legislation in force on Personal Data.
The concept of personal data (“Personal Data”) applies to any information relating to an identified or identifiable natural person. A person is “identifiable” if he or she can be identified, directly or indirectly, in particular through an identification number or one or more elements that are unique to him or her.
During the use of the website of Ruy Garcia Clinic, the Personal Data that the user agrees to communicate to us is subject to the provisions of this Policy and the applicable conditions of use.
- Ruy Garcia Clinic ensures the appropriate management of Personal Data in compliance with the standards and applicable legislation. Therefore, it develops tools and implements actions to ensure and monitor the effectiveness of the protection of Personal Data.
- The Ruy Garcia Clinic has several internal policies and procedures that raise awareness among its employees about the importance of Personal Data protection, providing them with operational guidance on how to comply with the Data Protection legislation and monitor compliance with Personal Data protection.
- The Ruy Garcia Clinic establishes in this document a Privacy Notice to the holders of Personal Data that complies with the requirements of the legislation in force and guarantees a specific, explicit, and informed notification to the Holders about the processing of their data. Responsibilities for notifying Personal Data leaks the competent Supervisory Authorities are also defined.
2. General Principles
The Ruy Garcia Clinic collects and processes Personal Data by the following principles:
- Personal Data is processed legally, impartially, and transparently (legality, impartiality, and transparency);
- Personal Data are collected and processed for specific, explicit, and legitimate purposes arising from the legislation in force and are not further processed in a way incompatible with those purposes (purpose limitation principle);
- Personal Data is kept adequate, relevant, and limited to what is necessary for the view of the purposes for which they are processed (principle of data minimization).
- Personal Data is accurate and, whenever necessary, rectified and updated (principle of accuracy).
Clínica Ruy Garcia defines appropriate technical and organizational Security measures to effectively implement the principles of Personal Data protection, complying with the legislation in force, and protecting the rights and freedoms of the Data Subjects.
Ruy Garcia Clinic imposes the same level of Personal Data protection to all its Processors (service providers, suppliers, partners, etc.) through contracts.
3. Collection and Processing of Personal Data
Why and how Personal Data are collected
When you visit our website, you may provide us with your Personal Data.
In this regard, Ruy Garcia Clinic is likely to collect your Personal Data through the following means:
- When you press contact and send a message through the form (complaints, suggestions, or information);
- When you post comments or images on our social media pages;
- When you establish a relationship with us in the context of the provision of services by our Clinic;
- When you subscribe to the newsletter provided by Ruy Garcia Clinic;
- When you participate in a contest, marketing program, test, or survey;
- When you apply for a job with the Clinic; or
- When you otherwise send us personal information. The information collected in this context may be processed for the purposes of the relationship between Ruy Garcia Clinic and the Data Subject, in compliance with regulatory and/or legal obligations, to protect and defend the rights, interests, property, and safety of Ruy Garcia Clinic, its employees or others with whom it collaborates.
What is the legal basis for the Treatment?
The Treatment operations carried out concerning the Personal Data of clients by the Ruy Garcia Clinic are based on:
- On its legitimate interest in the realization of services, protection of its activities, in knowing better the preferences of its clients to customize offers and highlight articles, products, and/or services that best match the needs and desires of its clients;
- In the need to perform contracts entered into with its customers for the provision of services; and
- When the Treatment is required by the laws in force.
The Ruy Garcia Clinic also has a legitimate interest in carrying out recruitment operations to manage its activities in the best possible way. In this sense, the Ruy Garcia Clinic collects all necessary data on interested candidates.
The Ruy Garcia Clinic only collects and processes Personal Data if, inter alia:
- You have given consent to the Processing of your Personal Data for one or more specific purposes (where required); or
- Processing is necessary for the performance of a contract to which you are a party, or to take steps at your request before entering into a contract; or
- Treatment is necessary for compliance with a legal obligation to which Ruy Garcia Clinic is subject; or
- Processing is necessary for the purposes of the legitimate interests of Clínica Ruy Garcia except when those interests are overridden by the interests or fundamental rights and freedoms of the Data Subject, which requires the protection of Personal Data, especially if the Data Subject is a child.
The personal data collected in the Clinic, including those directly or indirectly related to your health, shall be processed by the Clinic for the provision of medical and dental services, in particular for making a medical diagnosis and providing health care or treatment appropriate to your needs and audit, as well as for managing the administrative services, in particular for scheduling appointments and complementary means of diagnosis or billing.
The data relating to your health will only be processed by professionals bound to confidentiality and the extent necessary for the provision of health care. If you wish the services provided by the Clinic to be covered by your insurance or health subsystem, the health data related to such services may be communicated to the Insurance Company and the subsystem of which you are a beneficiary, which is also required to maintain confidentiality.
What is the period of Retention of Personal Data?
The Ruy Garcia Clinic keeps Personal Data in accordance with the retention periods imposed by the legislation in force, particularly taking into account its activities, never keeping Personal Data longer than necessary according to the purposes for which they were collected and are being processed, for compliance with legal obligations (eg audit, accounting, and tax obligations), resolution of legal disputes and/or exercise their legal rights The circumstances may vary depending on the context and type of Personal Data.
How Personal Data is shared
Ruy Garcia Clinic guarantees that:
- Personal Data is not provided to third parties without the prior consent of its holders;
- Personal Data is not sold or given free of charge to companies that use them for direct marketing purposes or to other entities that use mailing lists for advertising products and/or services;
- Transfers Personal Data to third parties when it receives the request from a judicial authority or a public authority with legal powers to do so, following the legal rules in force.
- Ensures the confidentiality and security of Personal Data during transfer to the above-mentioned recipients.
4. Security Measures
The Ruy Garcia Clinic has all the appropriate technical and organizational measures in place to ensure a level of security of Personal Data appropriate to the risk and, in particular, to protect Personal Data against destruction, loss, alteration, unauthorized disclosure, or accidental or illegal access.
The same level of protection is contractually imposed by Clínica Ruy Garcia to its Processors.
Any employee of Ruy Garcia Clinic who, during their work, has access to Personal Data agrees to keep them in the strictest confidence within the scope of the confidentiality agreements signed.
Right to access, rectify, update and delete data
In compliance with the applicable rules regarding the protection of Personal Data, if he/she so requests, the Data Subject may exercise his/her right to obtain access, rectification, deletion, and transfer of his/her Personal Data and also to restrict and object to the Processing of his/her Personal Data.
Where Processing is based on the Data Subject’s consent, the Data Subject has the right to withdraw his or her consent at any time.
In their own interest, the Data Holder shall seek to keep their data up to date, for which purpose they may contact the Ruy Garcia Clinic by email: geral@clinicaruygarcia.pt.
Data Subjects have the right to complain to the competent Supervisory Authority in case of violation of the applicable rules regarding the protection of Personal Data.
6. Privacy Notice
The purpose of the personal data collected and processed is solely and exclusively to comply with legal or contractual requirements or in the interest of Ruy Garcia Clinic.
The provisions regarding the collection and processing of personal data are described in this Policy.
The owners of Personal Data may exercise, at any time, the right to access, rectify, cancel, delete or oppose the use of their personal data, including revocation of consent. To do so, they shall contact the Ruy Garcia Clinic through the email geral@clinicaruygarcia.pt, or by contacting the Clinic’s Management by mail at the following address: R. de Damião de Góis 270, 4050-223 Porto. The right exercised by the data subjects shall be recorded and processed by Ruy Garcia Clinic as soon as possible and always in compliance with the legislation in force.
The Data Holders have the right to file a complaint to the competent Supervisory Authority in case of violation of the applicable rules regarding the protection of Personal Data.
In the event of a proven leak of Personal Data, Ruy Garcia Clinic shall report it to the competent Supervisory Authorities.
7. Changes to the Privacy Policy
This Privacy Policy may be changed at any time. The last date of change can be checked in this statement. Changes are effective as of the last date of change indicated. Please check this privacy policy regularly for any changes in the way we use your personal information.
8. Contact
If you have any questions about this Privacy Policy, you can contact us at geral@clinicaruygarcia.pt.