en
7-103 Helyos ambulance call +38 067 000 01 50

Regulations on the procedure for processing personal data

REGULATIONS ON THE PROCEDURE AND PROCESS FOR THE HANDLING AND PROTECTION OF THE PERSONAL

DATA OF CLIENTS OF THE CENTRE FOR FAMILY HEALTH AND REHABILITATION “HELIOS”,

LLC “SKY-WINNER”


Appendix 1

to Order No. 41-o

of 01.12.2021

 

REGULATIONS

ON THE PROCEDURE AND PROCESS FOR THE HANDLING AND PROTECTION OF THE PERSONAL

DATA OF CLIENTS OF THE CENTRE FOR FAMILY HEALTH AND REHABILITATION “HELIOS”,

LLC “SKY-WINNER”

 

The Centre for Family Health and Rehabilitation “Helios”, LLC “SKY-WINNER” (hereinafter — the Centre), in accordance with the Law of Ukraine “On the Protection of Personal Data”, hereby informs data subjects of their rights, of the processing of personal data and of the procedure for protecting personal data. The Centre ensures that personal data are processed and protected in compliance with the Constitution of Ukraine, the Law of Ukraine “On the Protection of Personal Data” and other laws and regulations of Ukraine. The Centre processes the personal data of its clients, counterparties, employees, persons related to them, and also of other natural persons whose data the Centre obtains in the course of its business activity, the provision of medical services and other activity carried out in accordance with the Articles of Association of LLC “SKY-WINNER” and the legislation of Ukraine.

1.Definition of terms

Personal data base — a named set of ordered personal data in electronic form and/or in the form of personal data card indexes;

          personal data controller — a natural or legal person who determines the purpose of processing personal data, establishes the composition of those data and the procedures for their processing, unless otherwise provided by law;

         consent of the data subject — any voluntary expression of will by a natural person granting permission to process their personal data in accordance with the stated purpose of such processing;

         personal data — information or a set of information about a natural person who is identified or can be specifically identified;

personal data processor — a natural or legal person to whom the controller of personal data, or the law, has granted the right to process those data on the controller’s behalf. A person instructed by the controller and/or the processor of a personal data base to carry out work of a technical nature on that base without access to the content of the personal data is not a processor of the personal data base;

  data subject — a natural person whose personal data are processed;

third party — any person other than the data subject, the controller or processor of personal data and the Ukrainian Parliament Commissioner for Human Rights, to whom personal data are transferred by the controller or processor of personal data. 

2.Protection of personal data and contact details of the responsible persons

The procedure for protecting personal data is determined by the Centre independently, in accordance with the requirements of the Law of Ukraine “On the Protection of Personal Data” (hereinafter — the Law) and other regulations and internal documents of the Centre on the protection of personal data.

To obtain access to personal data, and on any other matter concerning the protection and processing of personal data at the Centre, the data subject should apply to the Head Administrator at: 49000, Dnipropetrovsk region, city of Dnipro, Lamana Street, building 17. 

3.Purpose of processing personal data

The Centre processes personal data for the purpose of:

  • the provision by the Centre of medical services and the conduct of other activity specified in the Articles of Association of LLC “SKY-WINNER” and provided for by the legislation of Ukraine;
  • performing the terms of contracts that have been or will be concluded by the Centre;
  • sending existing and potential clients informational and advertising messages and offers regarding the Centre’s services;
  • profiling (automated processing of the data of clients and other counterparties in order to assess the development of strategies and to design and offer the Centre’s services);
  • ensuring the quality of service and safety in the Centre’s activity;
  • protecting the legitimate interests of the Centre or of a third party to whom the Centre transfers personal data, except where the need to protect the fundamental rights and freedoms of natural persons in connection with the processing of their data outweighs such interests;
  • exercising other powers and performing the functions and duties of the Centre provided for by, or not contrary to, the legislation of Ukraine, in particular in order to comply with decisions of state authorities and bodies supervising the Centre’s activity, and with court judgments.

The purpose for which the Centre processes the personal data of data subjects may change as a result of changes in the terms of the contracts concluded with them or in the business relationship, in the nature of the Centre’s activity, including in connection with changes in the legislation of Ukraine.

Processing personal data for the purpose of providing information about, or offers of, the Centre’s services, and storing personal data in order to meet the requirements of Ukrainian legislation on the retention of documents, is not regarded as incompatible processing and is carried out by the Centre provided that the personal data are properly protected.

4.Rights of natural persons — data subjects

Pursuant to Article 8 of the Law of Ukraine “On the Protection of Personal Data”, a data subject has the right:

  1. To know the sources from which their personal data were collected, the location of those data, the purpose of their processing, and the location and/or place of residence (stay) of the controller or processor of the personal data, or to instruct authorised persons accordingly to obtain this information, except in the cases established by the legislation of Ukraine, where this applies to the Centre.
  2. To receive information about the conditions under which the Centre grants access to their personal data, in particular information about third parties to whom the Centre transfers their personal data.
  3. To access their personal data processed by the Centre.
  4. To submit a reasoned request to the controller of personal data objecting to the processing of their personal data.
  5. To receive, no later than thirty calendar days from the day a request reaches the Centre, except in the cases provided for by the legislation of Ukraine, an answer as to whether the Centre processes their personal data, and also to receive the content of those personal data.
  6. To submit a reasoned request for the amendment or destruction of their personal data by any controller or processor of personal data if those data are processed unlawfully or are inaccurate.
  7. To have their personal data protected against unlawful processing and accidental loss, destruction or damage caused by deliberate concealment, failure to provide the data or untimely provision of them, and also protected against the provision of information that is inaccurate or that disparages the honour, dignity and business reputation of a natural person.
  8. To lodge complaints about the processing of their personal data with the Ukrainian Parliament Commissioner for Human Rights or with a court.
  9. To apply legal remedies in the event of a breach of the legislation on the protection of personal data.
  10. To enter reservations limiting the right to process their personal data when giving consent.
  11. To withdraw consent to the processing of personal data.
  12. To know the mechanism of automated processing of personal data.

A data subject has the right to receive from the Centre any information about themselves, provided that the Centre is able to identify the data subject who submitted such a request.

A copy of the personal data processed by the Centre is provided to the data subject in the form of an extract, the procedure for drawing up which is determined by the Centre. The data subject’s access to their personal data (including the provision of an extract) is granted by the Centre free of charge.

5.Grounds for processing personal data

The Centre processes personal data on the grounds set out in Article 11 of the Law of Ukraine “On the Protection of Personal Data”, including:

  • the consent of the data subject to the processing of their personal data;
  • permission to process personal data granted to the Centre in accordance with the law and solely for the exercise of its powers;
  • the need to perform a duty of the Centre provided for by a law of Ukraine;
  • the conclusion and performance by the Centre of a transaction to which the data subject is also a party, or which is concluded for the benefit of the data subject, or for taking steps preceding the conclusion of a transaction at the data subject’s request;
  • protection of the vital interests of the data subject;
  • the need to protect the legitimate interests of the Centre or of a third party to whom the Centre transfers personal data, except where the need to protect the fundamental rights and freedoms of natural persons in connection with the processing of their data outweighs such interests.

The Centre processes personal data that constitute public information and/or information in the form of open data (Article 101 of the Law of Ukraine “On Access to Public Information”) obtained from publicly available sources, without obtaining the consent of the data subject. The Centre may freely copy, disseminate and otherwise use such information, including for commercial purposes and in combination with other information, solely to the extent corresponding to the purpose of processing stated above and with a mandatory reference to the source from which the information was obtained.

A natural person’s application to the Centre, or use of the Centre’s services, constitutes that person’s permission for the Centre to process their personal data in the manner and to the extent determined by the rules under which the Centre provides or performs the relevant services or operations, including the terms of the contracts concluded.

A natural person’s consent to the processing of their personal data by the Centre is a ground for processing that is separate from the contract (where such consent is given by the natural person).

The Centre processes special categories of personal data whose processing poses a particular risk to the rights and freedoms of data subjects only where there are special legal grounds determined by the legislation of Ukraine, in particular where the data subject has given unambiguous consent to the processing of such data.

6.On the obligation to provide personal data to the Centre

Within a business relationship, data subjects must provide the Centre with all personal data necessary for the Centre to decide whether to conclude the relevant contract (enter into the transaction) and for its subsequent performance, including the personal data that the Centre collects in order to comply with the requirements of the legislation of Ukraine. If data subjects refuse to provide the Centre with the data it requests, the Centre refuses to conclude the contract, or ceases to perform its obligations under a contract (transaction) already concluded, or terminates the contract if the data subject’s failure to provide the information requested by the Centre deprives the Centre of the ability to perform the contract thereafter. Data subjects are not obliged to provide the Centre with their personal data where such data are not necessary for the conclusion and performance of the contract or are not required by law or by the Centre’s internal documents.

The conclusion and performance of a contract between the Centre and a data subject is an independent ground for the Centre to process that subject’s personal data, and therefore the data subject giving the Centre separate consent to the processing of their personal data is not a mandatory condition for concluding a contract between them.

Where the Centre processes personal data on the basis of the data subject’s consent, the data subject may withdraw the consent given to the Centre, in whole or in part, by a corresponding application in a form that makes it possible to identify that natural person. Withdrawal of consent means that the personal data stored by the Centre are marked so that their processing ceases in the future; however, the Centre continues to store data subjects’ data for the periods determined by legislation where this is necessary for the Centre to perform a duty established by law (performance of the contract concluded with the data subject, exercise of rights and performance of obligations under such a contract, performance of the Centre’s duties provided for by legislation, protection of the legitimate interests of the Centre or of a third party to whom the Centre transfers personal data, and so on).

7.Composition and content of the personal data processed and the sources from which they are received

The content and scope of the Centre’s processing of personal data depend to a large extent on the type of relationship between the Centre and the relevant data subject; in particular, for clients of the Centre — data subjects — the content and scope of the processing of personal data depend on the services the Centre’s clients have requested or agreed to.

The content of the personal data processed by the Centre corresponds to information received from the natural persons who are the subjects of those personal data, or lawfully received from their representatives or from third parties, or from persons represented by the data subjects, or obtained by the Centre from publicly available sources (for example, from the Unified State Register of Legal Entities, Individual Entrepreneurs and Public Formations); it also includes information known or that has become known to the Centre in connection with contractual and other legal relations with such natural persons and other persons who are clients or counterparties of the Centre in those relations, or that was obtained from publicly available sources.

The Centre processes the personal data of natural persons received from third parties where this is provided for by the legislation of Ukraine, or provided that those third parties guarantee that the transfer is carried out by them in compliance with the requirements of the legislation of Ukraine and does not infringe the rights of the natural persons whose personal data are transferred to the Centre.

The Centre processes personal data of the following composition:

— surname, first name, patronymic;

— age and sex

— address of place of residence;

— state of health;

— e-mail addresses, telephone numbers.

In order to ensure the quality and safety of its service, the Centre makes audio recordings of natural persons’ telephone conversations with the Centre’s employees, and photographic and video recordings of natural persons on the Centre’s premises, on magnetic and/or electronic media, and uses the results of such recordings, including as evidence. Data from the Centre’s video surveillance system (photographic and video recording on the Centre’s premises) and audio recordings of telephone conversations with the Centre’s employees may be used, in each particular case, both by the Centre itself and by the competent state authorities, including a court (as evidence in criminal proceedings), by law enforcement agencies (for security purposes), by courts (to secure evidence in civil and commercial cases), by the Centre’s employees, by witnesses of offences, by victims of offences (at their request), for insurance (solely for the settlement of insurance claims), and by lawyers and other bodies for the performance of law-enforcement functions. 

  1. Persons/organisations granted access to personal data and/or to whom personal data are transferred

Within the Centre, access to personal data is granted to individual employees of the Centre for the performance of their functional (employment) duties connected with the Centre’s performance of its contractual obligations and the exercise of its legitimate interests. Every employee of the Centre signs an undertaking not to disclose the information to which they have access in the performance of their functional (employment) duties.

The Centre grants access to the personal data of natural persons to private persons and organisations (including processors of personal data) in order for them to perform their functions or for the Centre to provide its services.

The Centre transfers the personal data of natural persons who are clients of the Centre, or grants access to those data, at the request of state authorities and of persons where the grounds determined by the legislation of Ukraine for disclosing such information to third parties arise.

  1. Procedure for access to personal data

Access by third parties to personal data is granted in accordance with the requirements of the law. The procedure for third-party access to personal data held by a manager of public information is determined by the Law of Ukraine “On Access to Public Information”

A party to relations connected with personal data has the right to submit a request for access (hereinafter — the request) to personal data of which the Centre is the controller, in which the following information must be stated:

  • the surname, first name and patronymic, place of residence (place of stay) and the details of the identity document of the natural person submitting the request (for a natural person — applicant);
  • the name and location of the legal entity submitting the request, and the position, surname, first name and patronymic of the person certifying the request;
  • confirmation that the content of the request corresponds to the powers of the legal entity (for a legal entity — applicant);
  • the surname, first name and patronymic, and also other information making it possible to identify the natural person in respect of whom the request is made;
  • information about the personal data base in respect of which the request is submitted, or information about the controller or processor of the personal data;
  • the list of personal data requested;
  • the purpose of and/or the legal grounds for the request.

The period for examining a request with a view to granting it may not exceed ten working days from the day it is received. Within that period the controller of the personal data, that is to say the Centre, informs the person submitting the request that the request will be granted, or that the personal data concerned are not to be provided, stating the ground laid down in the relevant legal act.

The request is granted within thirty calendar days from the day it is received, unless otherwise provided by law.

10.Retention period for personal data

The Centre processes personal data throughout the entire duration of the business relationship with the relevant data subjects (from the conclusion of the contract or the ordering of the service, through their performance, to the termination of the relevant contract and the completion of service to the Centre’s clients), and also until the expiry of the periods for retaining information (documents containing such information) determined by the terms of the contracts concluded or by the legislation of Ukraine, including the Law of Ukraine “On the Protection of Personal Data”.

  1. Processing of personal data when clients use the Centre’s website

The conditions for processing personal data set out above, including the purpose for which personal data are used and the composition of the personal data that may be processed in accordance with the Law of Ukraine “On the Protection of Personal Data”, apply to data subjects who are users of the Centre’s website.

When a user visits the Centre’s website, all logins to the system are recorded. The Centre may collect data on website visit statistics.

The Centre may use the information it collects about users of its website for the following purposes:

  • registration of a client of the Centre in the services of the Centre’s website;
  • provision of the services or functions in the services of the Centre’s website that the client has ordered;
  • carrying out research into clients’ use of the services on the Centre’s website in order to improve the quality of its services;
  • making offers to clients of the Centre and sending them advertising messages;
  • conducting client surveys about the Centre’s services;
  • other purposes connected with the Centre’s conduct of its activity and with compliance with the requirements of the current legislation of Ukraine.

Where the stated purpose of processing personal data is changed to a new purpose that is incompatible with the previous one, the Centre informs the client of the changed purpose before further processing of those data begins, and must obtain consent to the processing of their data in accordance with the changed purpose, unless otherwise provided by law.

If a user does not agree with any of the above conditions for processing personal data, they may leave the Centre’s website and not use it thereafter.

  1. Protection of personal data

The Centre is equipped with systems, software and hardware and means of communication, and takes all necessary measures to ensure the protection of personal data at every stage of their processing, including by means of organisational and technical measures that prevent loss, theft, unauthorised destruction, unlawful processing of, or access to, personal data.

Employees who have access to personal data give a written undertaking not to disclose personal data entrusted to them or that have become known to them in connection with the performance of their professional, official or employment duties. Employees who have access to personal data, including those who process them, bear liability under the legislation of Ukraine in the event of their breaching the requirements of the Law.