Tokuda Hospital Sofia

 БГ EN  РУ

Personal Data Protection - Pharmacy

Personal data protection - Pharmacy

 For the purpose of carrying out its business operations as a trading company, TOKUDA PHARMACY EOOD (hereinafter referred to as "Tokuda Pharmacy") processes personal data of individuals ("data subjects") in strict compliance with Regulation (EC) 2016/679 (General Data Protection Regulation - GDPR), the Personal Data Protection Act, the healthcare regulatory framework, and the Company's Privacy Policy.

 

According to the General Regulation, 'personal data' means any information relating to a natural person through which that natural person can be directly or indirectly identified.

 

'Data concerning health’ means personal data related to the physical or mental health of a natural person. These data are subject to special protection, considering their sensitive nature, and are to be processed by pharmacists bound by the obligation of professional secrecy.

 

Personal data processing means any operation or set of operations which is performed on personal data by automated or other means.

 

This policy provides information on:

 

Who is data controller?

Who are the natural persons whose personal data are processed by the Company?

For what purposes and on what basis is personal data being processed?

To whom are personal data transmitted or disclosed?

Personal data storing periods?

Data security measures;

Rights of individuals and methods by which they can be exercised.

 

Data Controller

 

The Data Controller is TOKUDA PHARMACY EOOD, address: 51B, Nikola Y. Vaptsarov Blvd., Sofia, phone/fax: 02/403 4000

 

The Company has specially appointed a Data Protection Officer who can be contacted by e-mail:  dpo@acibademcityclinic.bg and phone: 0878739296

 

Natural persons whose personal data are processed by the Company

 

Tokuda Pharmacy processes personal data of the following natural persons:

(a) Clients whose prescriptions are being executed or reported to the NHIF;

(b) Staff – current and former employees of the Company, job applicants and trainees;

(c) Visitors to the pharmacy;

(d) Contractors or potential contractors of the Company and their employees.

 

Purpose of processing

 

The Company processes personal data for the following purposes:

(a) Provision of health services – sale of medicines, medicinal products, cosmetic products, medical devices, etc.;

(b) Implementation of the Company's legal obligations, in particular under the Health Act, the Health Insurance Act, the Medicinal Products in Human Medicine Act, the Medical Devices Act, Ordinance 31 on good medical practice and the secondary legislation on their application;

(c) Compliance with the staff-related requirements of the labour and social security legislation;

(d) Ensuring the security of clients, employees and property through video surveillance, registration, physical security and access control;

(e) Other legitimate purposes such as accounting services, maintenance and security of the Company's website and IT systems, protection of the Company's legitimate interests, including by court, etc.

 

Legal grounds for processing

 

Tokuda Pharmacy processes special categories of personal data such as health data, only if any of the conditions of the General Regulation exists, and in particular:

(a) For the purposes of preventive or occupational medicine, assessment of the employee's ability to work, medical diagnostics, provision of health or social care or treatment;

(b) To protect the vital interests of the data subject or of another natural person when the data subject is physically or legally incapable of giving his/her consent;

(c) To protect the public interest in public health by ensuring high standards of quality and safety of healthcare and medicinal products or medical devices;

(d) Subject to the explicit consent of the data subject for processing data for one or more specific purposes, unless the legislation does not allow for such consent.

 

The Company also processes other personal data in the presence of any of the alternative legal grounds under the General Regulation, in particular:

(a) Statutory obligations of the Company;

(b) Implementation of a contract, including the pre-contractual relations prior to its execution;

(c) The Company's legitimate interests, in so far as they prevail the interests or the fundamental rights and freedoms of the data subjects;

(d) Freely expressed specific informed and unambiguous consent of the data subject. The consent already granted may be withdrawn by the data subject at any time in the same manner as it was granted.

To whom are personal data transmitted or disclosed

 

Tokuda Pharmacy provides personal data to:

(a) Competent public authorities pursuant to statutory provisions, including to the National Health Insurance Fund, the Ministry of Health, NRA, NSSI, etc.;

(b) Other companies of Acibadem City Clinic Group;

(c) Businesses providing services to the Company, including information maintenance and security of IT systems.

 

In all these cases, Tokuda Pharmacy takes the necessary measures to protect the rights and interests of data subjects, such as requiring that data processors undertake explicit contractual obligations to ensure data security and confidentiality protection.

 

Personal data storing periods

 

The personal data of the clients is kept in compliance with the statutory periods set out for the relevant medical records.

 

The personal data of job applicants not approved for recruitment in the Company are kept for the period defined by the current data protection legislation following the end of the procedure and then returned to the data subjects or destroyed. The personal data may be stored for a longer period in order to make job offers only upon the written consent of the concerned applicant.

 

Video surveillance records are stored for 60 (sixty) days under the Private Security Act.

                                                                                                                                                                                                                      

The personal data contained in accounting documents should be kept for the periods under Article 12 of the Accountancy Act.

 

Personal data security

 

Tokuda Pharmacy applies all appropriate technical and organizational measures to ensure the security of personal data, including the express commitment of the employees to professional secrecy and confidentiality.

 

Rights of data subjects

 

Any natural person whose data is processed by Tokuda Pharmacy has the following rights:

 

- The right of access to their personal data, including to receive a copy thereof;

- The right to correct or supplement any inaccurate or incomplete personal data;

- The right to delete any personal data illegally processed;

- The right to restrict the processing – in case of a legal dispute between the Company and the data subject – until the dispute is resolved or the legal claims are settled, exercised or protected;

- The right to the portability of the personal data concerning the data subject and which the latter has provided to the Company in a structured, commonly used and machine-readable format.

- The right to object – at any time and on grounds relating to his or her particular situation, unless there are compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the implementation of court procedures.

 

 

Pursuant to the Personal Data Protection Act, the above rights may be exercised by submitting a written application to: 51B, Nikola Y. Vaptsarov Blvd., Sofia. The application may also be sent electronically in accordance with the procedure laid down in the Electronic Document and Electronic Certification Services Act. Tokuda Pharmacy is currently constructing its electronic submission system, and at the earliest opportunity the natural persons will be notified when the system begins to operate. The application should be made personally by the data subject or by a person explicitly authorized by him/her with a power of attorney certified by a notary and a copy thereof should be submitted with the application.

The response to the request for exercised right should be prepared on paper and received by the applicant at the address of the Company. The employees of Tokuda Pharmacy should verify the identity of the applicant by reference to the identity document submitted by the applicant and provide the reply in two copies, one for each party, signed by the applicant.

 

Protection of the rights of data subjects

 

Pursuant to the Personal Data Protection Act and the General Data Protection Regulation, any natural person who considers that his/her right to the protection of his or her personal data is violated may file a complaint with the Personal Data Protection Commission at: 2, Prof. Tsvetan Lazarov Blvd., 1592 Sofia, website: www.cpdp.bg.

 

 

Personal data protection - Hospital

 

For the purpose of carrying out its business operations as a medical facility and a trading company, ACIBADEM CITY CLINIC TOKUDA HOSPITAL EAD (hereinafter referred to as "Tokuda Hospital") processes personal data of individuals ("data subjects") in strict compliance with Regulation (EC) 2016/679 (General Data Protection Regulation - GDPR), the Personal Data Protection Act, the healthcare regulatory framework, and the Company's Privacy Policy.

 

According to the General Regulation, 'personal data' means any information relating to a natural person through which that natural person can be directly or indirectly identified.

 

'Data concerning health’ means personal data related to the physical or mental health of a natural person. These data are subject to special protection, considering their sensitive nature, and are to be processed by medical professionals bound by the obligation of professional secrecy.

 

Personal data processing means any operation or set of operations which is performed on personal data by automated or other means.

 

This policy provides information on:

 

Who is data controller?

Who are the natural persons whose personal data are processed by the Company?

For what purposes and on what basis is personal data being processed?

To whom are personal data transmitted or disclosed

Personal data storing periods;

Data security measures;

Rights of individuals and methods by which they can be exercised.

 

Data Controller

 

The Data Controller is ACIBADEM CITY CLINIC TOKUDA HOSPITAL EAD, address: 51B, Nikola Y. Vaptsarov Street, Sofia, phone/fax: 02/403 4000

 

The Company has specially appointed a Data Protection Officer who can be contacted by e-mail: dpo@acibademcityclinic.bg and phone: 0878739296

 

Natural persons whose personal data are processed by the Company

 

Tokuda Hospital processes personal data of the following natural persons:

(a) Patients and, where appropriate, their relatives;

(b) Staff – current and former employees of the Company, job applicants and trainees;

(c) Visitors to the medical facility;

(d) Contractors or potential contractors of the Company and their employees.

 

Purpose of processing

 

The Company processes personal data for the following purposes:

(a) Provision of health services – medical diagnostics, treatment, clinical tests, etc.;

(b) Implementation of the Company's legal obligations, in particular under the Health Act, the Health Insurance Act, the Medical Facilities Act, the secondary legislation on their application, the National Framework Agreement;

(c) Compliance with the staff-related requirements of the labour and social security legislation;

(d) Ensuring the security of patients, employees and property through video surveillance, registration, physical security and access control;

(e) Other legitimate purposes such as accounting services, maintenance and security of the Company's website and IT systems, protection of the Company's legitimate interests, including by court, etc.

 

Legal grounds for processing

 

Tokuda Hospital processes special categories of personal data such as health data, genetic data, or sexual life or sexual orientation data, only if any of the conditions of the General Regulation exists, and in particular:

(a) For the purposes of preventive or occupational medicine, assessment of the employee's ability to work, medical diagnostics, provision of health or social care or treatment;

(b) To protect the vital interests of the data subject or of another natural person when the data subject is physically or legally incapable of giving his/her consent;

(c) To protect the public interest in public health, such as protection against serious cross-border health threats or ensuring high standards of quality and safety of healthcare and medicinal products or medical devices;

(d) Subject to the explicit consent of the data subject for processing data for one or more specific purposes, unless the legislation does not allow for such consent.

 

The Company also processes other personal data in the presence of any of the alternative legal grounds under the General Regulation, in particular:

(a) Statutory obligations of the Company;

(b) Implementation of a contract, including the pre-contractual relations prior to its execution;

(c) The Company's legitimate interests, in so far as they prevail the interests or the fundamental rights and freedoms of the data subjects;

(d) Freely expressed specific informed and unambiguous consent of the data subject. The consent already granted may be withdrawn by the data subject at any time in the same manner as it was granted.

 

To whom are personal data transmitted or disclosed

 

Tokuda Hospital provides personal data to:

(a) Competent public authorities pursuant to statutory provisions, including to the National Health Insurance Fund, the Ministry of Health, NRA, NSSI, etc.;

(b) Other companies of Acibadem City Clinic Group, external laboratories or other medical facilities;

(c) Businesses providing services to the Company, including information maintenance and security of IT systems.

 

In all these cases, Tokuda Hospital takes the necessary measures to protect the rights and interests of data subjects, such as requiring that data processors undertake explicit contractual obligations to ensure data security and confidentiality protection.

 

Transfer of personal data to third countries

 

Where necessary for treatment purposes, Tokuda Hospital may send samples, accompanied by the patient's personal data, for clinical tests at the Acibadem LabMed Laboratory in the Republic of Turkey. In these cases, in order to protect the rights and interests of the patient, the explicit prior consent of the patient to the transfer of the data is required. Personal data may also be protected by other means, e.g. by signing a contract by and between the Company and Acibadem LabMed Laboratory, including standard privacy clauses adopted by the European Commission.

 

Personal data storing periods

 

The personal data of the patients is kept in compliance with the statutory periods set out for the relevant medical records.

 

The personal data of job applicants not approved for recruitment in the Company are kept for the period defined by the current data protection legislation following the end of the procedure and then returned to the data subjects or destroyed. The personal data may be stored for a longer period in order to make job offers only upon the written consent of the concerned applicant.

 

Video surveillance records, call records at the Information Registry Office, and visitors' registers are stored for 60 (sixty) days under the Private Security Act.

 

The personal data contained in accounting documents should be kept for the periods under Article 12 of the Accountancy Act.

 

Personal data security

 

Tokuda Hospital applies all appropriate technical and organizational measures to ensure the security of personal data, including the express commitment of the employees to professional secrecy and confidentiality.

 

Rights of data subjects

 

Any natural person whose data is processed by Tokuda Hospital has the following rights:

 

- The right of access to their personal data, including to receive a copy thereof;

- The right to correct or supplement any inaccurate or incomplete personal data;

- The right to delete any personal data illegally processed;

- The right to restrict the processing – in case of a legal dispute between the Company and the data subject – until the dispute is resolved or the legal claims are settled, exercised or protected;

- The right to the portability of the personal data concerning the data subject and which the latter has provided to the Company in a structured, commonly used and machine-readable format.

- The right to object – at any time and on grounds relating to his or her particular situation, unless there are compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the implementation of court procedures.

 

The right of access to health information can be exercised as laid down in Article 27 of the Health Act. Health information may be provided to third parties when:

- The treatment of the data subject continues in another medical institution;

- There is a threat to the health or life of others;

- It is necessary to identify a human body or to establish the causes of death;

- It is necessary for the needs of the state health control to prevent epidemics and spread of infectious diseases;

- It is necessary for the needs of medical expertise and social security;

- It is necessary for the needs of medical statistics or for medical research, once data identifying the patient has been deleted;

- It is necessary for the needs of the Ministry of Health, the National Center for Health Information, NHIF, regional health inspectorates and the National Statistical Institute.

- It is necessary for the needs of insurers licensed under Section I of Appendix 1 or item 2 or under item 1 and 2 of Section II, letter "A" of Appendix 1 to the Insurance Code.

 

Online access to the comments on imaging scans and laboratory test results is provided through the Company's website. In order to protect personal data, the ID and the password for online access are provided to the relevant data subject only. They cannot be delivered by phone or sent by e-mail.

 

Pursuant to the Personal Data Protection Act, the above rights may be exercised by submitting a written application to: 51B, Nikola Y. Vaptsarov Blvd., Sofia. The application may also be sent electronically in accordance with the procedure laid down in the Electronic Document and Electronic Certification Services Act. Tokuda Hospital is currently constructing its electronic submission system, and at the earliest opportunity the natural persons will be notified when the system begins to operate. The application should be made personally by the data subject or by a person explicitly authorized by him/her with a power of attorney certified by a notary and a copy thereof should be submitted with the application.

 

The response to the request for exercised right should be prepared on paper and received by the applicant at the address of the Company in the Registry Department. The employees of the Registry Department should verify the identity of the applicant by reference to the identity document submitted by the applicant and provide the reply in two copies, one for each party, signed by the applicant.

 

Protection of the rights of data subjects

 

Pursuant to the Personal Data Protection Act and the General Data Protection Regulation, any natural person who considers that his/her right to the protection of his or her personal data is violated may file a complaint with the Personal Data Protection Commission at: 2, Prof. Tsvetan Lazarov Blvd., 1592 Sofia, website: www.cpdp.bg.

 

 

Personal data protection - Diagnostic Consultative Center

 

For the purpose of carrying out its business operations as a medical facility and a trading company, ACIBADEM CITY CLINIC TOKUDA DIAGNOSTIC CONSULTATIVE CENTER EAD (hereinafter referred to as "Tokuda DCC") processes personal data of individuals ("data subjects") in strict compliance with Regulation (EC) 2016/679 (General Data Protection Regulation - GDPR), the Personal Data Protection Act, the healthcare regulatory framework, and the Company's Privacy Policy.

 

According to the General Regulation, 'personal data' means any information relating to a natural person through which that natural person can be directly or indirectly identified.

 

'Data concerning health’ means personal data related to the physical or mental health of a natural person. These data are subject to special protection, considering their sensitive nature, and are to be processed by medical professionals bound by the obligation of professional secrecy.

 

Personal data processing means any operation or set of operations which is performed on personal data by automated or other means.

 

This policy provides information on:

 

Who is data controller?

Who are the natural persons whose personal data are processed by the Company?

For what purposes and on what basis is personal data being processed?

To whom are personal data transmitted or disclosed?

Personal data storing periods;

Data security measures;

Rights of individuals and methods by which they can be exercised.

 

Data Controller

 

The Data Controller is ACIBADEM CITY CLINIC  TOKUDA DIAGNOSTIC CONSULTATIVE CENTER EAD, address: 51B, Nikola Y. Vaptsarov Blvd., Sofia, phone/fax: 02/403 4000

 

The Company has specially appointed a Data Protection Officer who can be contacted by e-mail:  dpo@acibademcityclinic.bg and phone: 0878739296

 

Natural persons whose personal data are processed by the Company

 

Tokuda DCC processes personal data of the following natural persons:

(a) Patients and, where appropriate, their relatives;

(b) Staff – current and former employees of the Company, job applicants and trainees;

(c) Visitors to the medical facility;

(d) Contractors or potential contractors of the Company and their employees.

 

Purpose of processing

 

The Company processes personal data for the following purposes:

(a) Provision of health services – medical diagnostics, treatment, clinical tests, etc.;

(b) Implementation of the Company's legal obligations, in particular under the Health Act, the Health Insurance Act, the Medical Facilities Act, the secondary legislation on their application, the National Framework Agreement;

(c) Compliance with the staff-related requirements of the labour and social security legislation;

(d) Ensuring the security of patients, employees and property through video surveillance, registration, physical security and access control;

(e) Other legitimate purposes such as accounting services, maintenance and security of the Company's website and IT systems, protection of the Company's legitimate interests, including by court, etc.

 

Legal grounds for processing

 

Tokuda DCC processes special categories of personal data such as health data, genetic data, or sexual life or sexual orientation data, only if any of the conditions of the General Regulation exists, and in particular:

(a) For the purposes of preventive or occupational medicine, assessment of patients' and employee's ability to work, medical diagnostics, provision of health or social care or treatment;

(b) To protect the vital interests of the data subject or of another natural person when the data subject is physically or legally incapable of giving his/her consent;

(c) To protect the public interest in public health, such as protection against serious cross-border health threats or ensuring high standards of quality and safety of healthcare and medicinal products or medical devices;

(d) Subject to the explicit consent of the data subject for processing data for one or more specific purposes, unless the legislation does not allow for such consent.

 

The Company also processes other personal data in the presence of any of the alternative legal grounds under the General Regulation, in particular:

(a) Statutory obligations of the Company;

(b) Implementation of a contract, including the pre-contractual relations prior to its execution;

(c) The Company's legitimate interests, in so far as they prevail the interests or the fundamental rights and freedoms of the data subjects;

(d) Freely expressed specific informed and unambiguous consent of the data subject. The consent already granted may be withdrawn by the data subject at any time in the same manner as it was granted.

 

To whom are personal data transmitted or disclosed

 

Tokuda DCC provides personal data to:

(a) Competent public authorities pursuant to statutory provisions, including to the National Health Insurance Fund, the Ministry of Health, NRA, NSSI, etc.;

(b) Other companies of Acibadem City Clinic Group, external laboratories or other medical facilities;

(c) Businesses providing services to the Company, including information maintenance and security of IT systems.

 

In all these cases, Tokuda DCC takes the necessary measures to protect the rights and interests of data subjects, such as requiring that data processors undertake explicit contractual obligations to ensure data security and confidentiality protection.

 

Transfer of personal data to third countries

 

Tokuda DCC does not transmit personal data to third countries outside of the European Union. When necessary for treatment purposes, Tokuda DCC may transfer personal data to third countries. In these cases, in order to protect the rights and interests of the patient, the explicit prior consent of the patient to the transfer of the data is required. Personal data may also be protected by other means, e.g. by signing a contract by and between the Company and the recipient, including standard privacy clauses adopted by the European Commission.

 

Personal data storing periods

 

The personal data of the patients is kept in compliance with the statutory periods set out for the relevant medical records.

 

The personal data of job applicants not approved for recruitment in the Company are kept for the period defined by the current data protection legislation following the end of the procedure and then returned to the data subjects or destroyed. The personal data may be stored for a longer period in order to make job offers only upon the written consent of the concerned applicant.

 

Video surveillance records, call records at the Information Registry Office, and visitors' registers are stored for 60 (sixty) days under the Private Security Act.

                                                                                                                                                                                                                      

The personal data contained in accounting documents should be kept for the periods under Article 12 of the Accountancy Act.

 

Personal data security

 

Tokuda DCC applies all appropriate technical and organizational measures to ensure the security of personal data, including the express commitment of the employees to professional secrecy and confidentiality.

 

Rights of data subjects

 

Any natural person whose data is processed by Tokuda DCC has the following rights:

- The right of access to their personal data, including to receive a copy thereof;

- The right to correct or supplement any inaccurate or incomplete personal data;

- The right to delete any personal data illegally processed;

- The right to restrict the processing – in case of a legal dispute between the Company and the data subject – until the dispute is resolved or the legal claims are settled, exercised or protected;

- The right to the portability of the personal data concerning the data subject and which the latter has provided to the Company in a structured, commonly used and machine-readable format.

- The right to object – at any time and on grounds relating to his or her particular situation, unless there are compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the implementation of court procedures.

 

The right of access to health information can be exercised as laid down in Article 27 of the Health Act. Health information may be provided to third parties when:

- The treatment of the data subject continues in another medical institution;

- There is a threat to the health or life of others;

- It is necessary to identify a human body or to establish the causes of death;

- It is necessary for the needs of the state health control to prevent epidemics and spread of infectious diseases;

- It is necessary for the needs of medical expertise and social security;

- It is necessary for the needs of medical statistics;

- It is necessary for the needs of the Ministry of Health, the National Center for Health Information, NHIF, regional health inspectorates and the National Statistical Institute.

- It is necessary for the needs of insurers licensed under Section I of Appendix 1 or item 2 or under item 1 and 2 of Section II, letter "A" of Appendix 1 to the Insurance Code.

 

Online access to the comments on imaging scans and laboratory test results is provided through the Company's website. In order to protect personal data, the ID and the password for online access are provided to the relevant data subject only. They cannot be delivered by phone or sent by e-mail.

 

Pursuant to the Personal Data Protection Act, the above rights may be exercised by submitting a written application to: 51B, Nikola Y. Vaptsarov Blvd., Sofia. The application may also be sent electronically in accordance with the procedure laid down in the Electronic Document and Electronic Certification Services Act. Tokuda DCC is currently constructing its electronic submission system, and at the earliest opportunity the natural persons will be notified when the system begins to operate. The application should be made personally by the data subject or by a person explicitly authorized by him/her with a power of attorney certified by a notary and a copy thereof should be submitted with the application.

 

The response to the request for exercised right should be prepared on paper and received by the applicant at the address of the Company in the Registry Department. The employees of the Registry Department should verify the identity of the applicant by reference to the identity document submitted by the applicant and provide the reply in two copies, one for each party, signed by the applicant.

 

Protection of the rights of data subjects

 

Pursuant to the Personal Data Protection Act and the General Data Protection Regulation, any natural person who considers that his/her right to the protection of his or her personal data is violated may file a complaint with the Personal Data Protection Commission at: 2, Prof. Tsvetan Lazarov Blvd., 1592 Sofia, website: www.cpdp.bg.

 

 

 

Personal data protection - Clinical Research center

 

For the purpose of carrying out its business operations as a trading company, TOKUDA CLINICAL RESEARCH CENTER AD (hereinafter referred to as "TCRC") processes personal data of individuals ("data subjects") in strict compliance with Regulation (EC) 2016/679 (General Data Protection Regulation - GDPR), the Personal Data Protection Act, the healthcare regulatory framework, and the Company's Privacy Policy.

 

According to the General Regulation, 'personal data' means any information relating to a natural person through which that natural person can be directly or indirectly identified.

 

'Data concerning health’ means personal data related to the physical or mental health of a natural person. These data are subject to special protection, considering their sensitive nature, and are to be processed by medical professionals bound by the obligation of professional secrecy.

 

Personal data processing means any operation or set of operations which is performed on personal data by automated or other means.

 

This policy provides information on:

 

Who is data controller?

Who are the natural persons whose personal data are processed by the Company?

For what purposes and on what basis is personal data being processed?

To whom are personal data transmitted or disclosed?

Personal data storing periods;

Data security measures;

Rights of individuals and methods by which they can be exercised.

 

Data Controller

 

The Data Controller is TOKUDA CLINICAL RESEARCH CENTER AD, address: 51B, Nikola Vaptsarov Blvd., Sofia.

The Company has specially appointed a Data Protection Officer who can be contacted by e-mail:  dpo@acibademcityclinic.bg and phone: 0878739296

 

Natural persons whose personal data are processed by the Company

 

TCRC processes personal data of the following natural persons:

(a) Participants in clinical trials and, where appropriate, their relatives;

(b) Staff – current and former employees of the Company, job applicants and trainees;

(c) Contractors or potential contractors of the Company and their employees.

 

Purpose of processing

 

The Company processes personal data for the following purposes:

(a) Administration of clinical trials/studies;

(b) Implementation of the Company's legal obligations, in particular under the Health Act, the Health Insurance Act, the Medicinal Products in Human Medicine Act, the Medical Devices Act, Ordinance 31 on good medical practice, the secondary legislation on their application;

(c) Compliance with the staff-related requirements of the labour and social security legislation;

(d) Ensuring the security of patients, employees and property through video surveillance, registration, physical security and access control;

(e) Other legitimate purposes such as accounting services, maintenance and security of the Company's website and IT systems, protection of the Company's legitimate interests, including by court, etc.

 

Legal grounds for processing

 

TCRC processes special categories of personal data such as health data, genetic data, or sexual life or sexual orientation data, only if any of the conditions of the General Regulation exists, and in particular:

(a) For the purposes of clinical trials/studies;

(b) To protect the vital interests of the data subject or of another natural person when the data subject is physically or legally incapable of giving his/her consent;

(c) To protect the public interest in public health, such as protection against serious cross-border health threats or ensuring high standards of quality and safety of healthcare and medicinal products or medical devices;

(d) Subject to the explicit consent of the data subject for processing data for one or more specific purposes, unless the legislation does not allow for such consent.

 

The Company also processes other personal data in the presence of any of the alternative legal grounds under the General Regulation, in particular:

(a) Statutory obligations of the Company;

(b) Implementation of a contract, including the pre-contractual relations prior to its execution;

(c) The Company's legitimate interests, in so far as they prevail the interests or the fundamental rights and freedoms of the data subjects;

(d) Freely expressed specific informed and unambiguous consent of the data subject. The consent already granted may be withdrawn by the data subject at any time in the same manner as it was granted.

 

To whom are personal data transmitted or disclosed

 

TCRC provides personal data to:

(a) Competent public authorities pursuant to statutory provisions, including to the Ministry of Health, NRA, NSSI, BDA, etc.;

(b) Other companies of Acibadem City Clinic Group, research centers, researchers, external laboratories or other medical facilities;

(c) Businesses providing services to the Company, including information maintenance and security of IT systems.

 

In all these cases, TCRC takes the necessary measures to protect the rights and interests of data subjects, such as requiring that data processors undertake explicit contractual obligations to ensure data security and confidentiality protection.

 

Transfer of personal data to third countries

 

When necessary for the purpose of the trial/study, TCRC sends anonymized or pseudonymized samples and health data of the participants in the clinical trial/study to third countries. In these cases, in order to protect the rights and interests of the patient, the explicit prior consent of the patient to the transfer of the data is required. Personal data may also be protected by other means, e.g. by signing a contract by and between the Company and the recipient, including standard privacy clauses adopted by the European Commission.

 

Personal data storing periods

 

The personal data of the participants is kept in compliance with the statutory periods set out for the relevant medical records.

 

The personal data of job applicants not approved for recruitment in the Company are kept for the period defined by the current data protection legislation following the end of the procedure and then returned to the data subjects or destroyed. The personal data may be stored for a longer period in order to make job offers only upon the written consent of the concerned applicant.

 

Video surveillance records, call records, and visitors' registers are stored for 60 (sixty) days under the Private Security Act.

 

The personal data contained in accounting documents should be kept for the periods under Article 12 of the Accountancy Act.

 

Personal data security

 

TCRC applies all appropriate technical and organizational measures to ensure the security of personal data, including the express commitment of the employees to professional secrecy and confidentiality.

 

Rights of data subjects

 

Any natural person whose data is processed by TCRC has the following rights:

 

- The right of access to their personal data, including to receive a copy thereof;

- The right to correct or supplement any inaccurate or incomplete personal data;

- The right to delete any personal data illegally processed;

- The right to restrict the processing – in case of a legal dispute between the Company and the data subject – until the dispute is resolved or the legal claims are settled, exercised or protected;

- The right to the portability of the personal data concerning the data subject and which the latter has provided to the Company in a structured, commonly used and machine-readable format.

- The right to object – at any time and on grounds relating to his or her particular situation, unless there are compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the implementation of court procedures.

 

The right of access to health information can be exercised as laid down in Article 27 of the Health Act. Health information may be provided to third parties when:

- The treatment of the data subject continues in another medical institution;

- There is a threat to the health or life of others;

- It is necessary to identify a human body or to establish the causes of death;

- It is necessary for the needs of the state health control to prevent epidemics and spread of infectious diseases;

- It is necessary for the needs of medical expertise and social security;

- It is necessary for the needs of medical statistics or for medical research, once data identifying the patient has been deleted;

- It is necessary for the needs of the Ministry of Health, the National Center for Health Information, BDA, regional health inspectorates and the National Statistical Institute.

- It is necessary for the needs of insurers licensed under Section I of Appendix 1 or item 2 or under item 1 and 2 of Section II, letter "A" of Appendix 1 to the Insurance Code.

 

 

Pursuant to the Personal Data Protection Act, the above rights may be exercised by submitting a written application to: 51B, Nikola Vaptsarov Blvd., Sofia. The application may also be sent electronically in accordance with the procedure laid down in the Electronic Document and Electronic Certification Services Act. TCRC is currently constructing its electronic submission system, and at the earliest opportunity the natural persons will be notified when the system begins to operate. The application should be made personally by the data subject or by a person explicitly authorized by him/her with a power of attorney certified by a notary and a copy thereof should be submitted with the application.

 

The response to the request for exercised right should be prepared on paper and received by the applicant at the address of the Company. The employees of the Company should verify the identity of the applicant by reference to the identity document submitted by the applicant and provide the reply in two copies, one for each party, signed by the applicant.

 

Protection of the rights of data subjects

 

Pursuant to the Personal Data Protection Act and the General Data Protection Regulation, any natural person who considers that his/her right to the protection of his or her personal data is violated may file a complaint with the Personal Data Protection Commission at: 2, Prof. Tsvetan Lazarov Blvd., 1592 Sofia, website: www.cpdp.bg.

 

 

Personal data protection - Hospice

 

For the purpose of carrying out its business operations as a medical facility and a trading company, ACIBADEM CITY CLINIC HOSPICE EOOD (hereinafter referred to as "Acibadem City Clinic Hospice") processes personal data of individuals ("data subjects") in strict compliance with Regulation (EC) 2016/679 (General Data Protection Regulation - GDPR), the Personal Data Protection Act, the healthcare regulatory framework, and the Company's Privacy Policy.

 

According to the General Regulation, 'personal data' means any information relating to a natural person through which that natural person can be directly or indirectly identified.

 

'Data concerning health’ means personal data related to the physical or mental health of a natural person. These data are subject to special protection, considering their sensitive nature, and are to be processed by medical professionals bound by the obligation of professional secrecy.

 

Personal data processing means any operation or set of operations which is performed on personal data by automated or other means.

 

This policy provides information on:

 

Who is data controller?

Who are the natural persons whose personal data are processed by the Company?

For what purposes and on what basis is personal data being processed?

To whom are personal data transmitted or disclosed?

Personal data storing periods;

Data security measures;

Rights of individuals and methods by which they can be exercised.

 

Data Controller

 

The Data Controller is ACIBADEM CITY CLINIC HOSPICE EOOD, address: 51B, Nikola Y. Vaptsarov Blvd., Sofia.

 

The Company has specially appointed a Data Protection Officer who can be contacted by e-mail:  dpo@acibademcityclinic.bg and phone: 0878739296

 

Natural persons whose personal data are processed by the Company

 

Acibadem City Clinic Hospice processes personal data of the following natural persons:

(a) Patients and, where appropriate, their relatives;

(b) Staff – current and former employees of the Company, job applicants and trainees;

(c) Visitors to the medical facility;

(d) Contractors or potential contractors of the Company and their employees.

 

Purpose of processing

 

The Company processes personal data for the following purposes:

(a) Provision of health services –  palliative care for terminally ill patients, etc.;

(b) Implementation of the Company's legal obligations, in particular under the Health Act, the Health Insurance Act, the Medical Facilities Act, the secondary legislation on their application, the National Framework Agreement;

(c) Compliance with the staff-related requirements of the labour and social security legislation;

(d) Ensuring the security of patients, employees and property through video surveillance, registration, physical security and access control;

(e) Other legitimate purposes such as accounting services, maintenance and security of the Company's website and IT systems, protection of the Company's legitimate interests, including by court, etc.

 

Legal grounds for processing

 

Acibadem City Clinic Hospice processes special categories of personal data such as health data, genetic data, or sexual life or sexual orientation data, only if any of the conditions of the General Regulation exists, and in particular:

(a) For the purposes of preventive or occupational medicine, assessment of the employee's ability to work, medical diagnostics, provision of health or social care or treatment;

(b) To protect the vital interests of the data subject or of another natural person when the data subject is physically or legally incapable of giving his/her consent;

(c) To protect the public interest in public health, such as protection against serious cross-border health threats or ensuring high standards of quality and safety of healthcare and medicinal products or medical devices;

(d) Subject to the explicit consent of the data subject for processing data for one or more specific purposes, unless the legislation does not allow for such consent.

 

The Company also processes other personal data in the presence of any of the alternative legal grounds under the General Regulation, in particular:

(a) Statutory obligations of the Company;

(b) Implementation of a contract, including the pre-contractual relations prior to its execution;

(c) The Company's legitimate interests, in so far as they prevail the interests or the fundamental rights and freedoms of the data subjects;

(d) Freely expressed specific informed and unambiguous consent of the data subject. The consent already granted may be withdrawn by the data subject at any time in the same manner as it was granted.

 

To whom are personal data transmitted or disclosed

 

Acibadem City Clinic Hospice provides personal data to:

(a) Competent public authorities pursuant to statutory provisions, including to the Ministry of Health, NRA, NSSI, etc.;

(b) Other companies of Acibadem City Clinic Group, external laboratories or other medical facilities;

(c) Businesses providing services to the Company, including information maintenance and security of IT systems.

 

In all these cases, Acibadem City Clinic Hospice takes the necessary measures to protect the rights and interests of data subjects, such as requiring that data processors undertake explicit contractual obligations to ensure data security and confidentiality protection.

 

 

Personal data storing periods

 

The personal data of the patients is kept in compliance with the statutory periods set out for the relevant medical records.

 

The personal data of job applicants not approved for recruitment in the Company are kept for the period defined by the current data protection legislation following the end of the procedure and then returned to the data subjects or destroyed. The personal data may be stored for a longer period in order to make job offers only upon the written consent of the concerned applicant.

 

Video surveillance records, call records at the Information Registry Office, and visitors' registers are stored for 60 (sixty) days under the Private Security Act.

                                                                                                                                                                                                                      

The personal data contained in accounting documents should be kept for the periods under Article 12 of the Accountancy Act.

 

Personal data security

 

Acibadem City Clinic Hospice applies all appropriate technical and organizational measures to ensure the security of personal data, including the express commitment of the employees to professional secrecy and confidentiality.

 

Rights of data subjects

 

Any natural person whose data is processed by Acibadem City Clinic Hospice has the following rights:

 

- The right of access to their personal data, including to receive a copy thereof;

- The right to correct or supplement any inaccurate or incomplete personal data;

- The right to delete any personal data illegally processed;

- The right to restrict the processing – in case of a legal dispute between the Company and the data subject – until the dispute is resolved or the legal claims are settled, exercised or protected;

- The right to the portability of the personal data concerning the data subject and which the latter has provided to the Company in a structured, commonly used and machine-readable format.

- The right to object – at any time and on grounds relating to his or her particular situation, unless there are compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the implementation of court procedures.

 

The right of access to health information can be exercised as laid down in Article 27 of the Health Act. Health information may be provided to third parties when:

- The treatment of the data subject continues in another medical institution;

- There is a threat to the health or life of others;

- It is necessary to identify a human body or to establish the causes of death;

- It is necessary for the needs of the state health control to prevent epidemics and spread of infectious diseases;

- It is necessary for the needs of medical expertise and social security;

- It is necessary for the needs of medical statistics or for medical research, once data identifying the patient has been deleted;

- It is necessary for the needs of the Ministry of Health, the National Center for Health Information, NHIF, regional health inspectorates and the National Statistical Institute.

- It is necessary for the needs of insurers licensed under Section I of Appendix 1 or item 2 or under item 1 and 2 of Section II, letter "A" of Appendix 1 to the Insurance Code.

 

Online access to the comments on imaging scans and laboratory test results is provided through the Company's website. In order to protect personal data, the ID and the password for online access are provided to the relevant data subject only. They cannot be delivered by phone or sent by e-mail.

 

Pursuant to the Personal Data Protection Act, the above rights may be exercised by submitting a written application to: 51B, Nikola Y. Vaptsarov Blvd., Sofia. The application may also be sent electronically in accordance with the procedure laid down in the Electronic Document and Electronic Certification Services Act. Acibadem City Clinic Hospice is currently constructing its electronic submission system, and at the earliest opportunity the natural persons will be notified when the system begins to operate. The application should be made personally by the data subject or by a person explicitly authorized by him/her with a power of attorney certified by a notary and a copy thereof should be submitted with the application.

 

The response to the request for exercised right should be prepared on paper and received by the applicant at the address of the Company in the Registry Department. The employees of the Registry Department should verify the identity of the applicant by reference to the identity document submitted by the applicant and provide the reply in two copies, one for each party, signed by the applicant.

 

Protection of the rights of data subjects

 

Pursuant to the Personal Data Protection Act and the General Data Protection Regulation, any natural person who considers that his/her right to the protection of his or her personal data is violated may file a complaint with the Personal Data Protection Commission at: 2, Prof. Tsvetan Lazarov Blvd., 1592 Sofia, website: www.cpdp.bg.

 

 

 

Hospital location

51B "Nikola I. Vaptsarov" blvd. (if you drive, the entrance is from "At. Dukov" str.), "Hladilnika" distr., 1407 "Lozenets".

The hospital has a parking lot. The first 30 min. are free of charge, then a fee of 3 bgn/hours applies.

Public transport:
Buses: №88, 120
Shuttle bus: 32

Subway: Getting off at "James Bourchier" station, after that walking through "Lozenets" distr., or tram №10, taking off at "Nikola I. Vaptsarov" stop. or a bus №88, taking ff at "Tokuda Hospital" stop.

Map 

From the Central Railway Station

Bus line №305 getting off at "Romanian embassy" stop
From "Romanian embassy" stop – Bus line №120 getting off at "Tokuda Hospital" stop.
(after the traffic lights at "Atanas Dukov" str.

With a subway, from "Central Railway Station" station, getting off at "James Bourchier" station, after that walking through "Lozenets" distr., or tram №10, taking off at "Nikola I. Vaptsarov" stop. or a bus №88, taking ff at "Tokuda Hospital" stop.