Privacy Policy

Operator

Medirad s.r.o., Plynárenská 7/C, building BBC5, 821 09 Bratislava. Contact: info@medirad.sk, +421 2 2102 0702. For questions regarding data processing, write to info@medirad.sk with the subject "GDPR".

What data we process

Common data: name, surname, phone, email, address, age/date of birth, and insured person details. Visit data: date and time of request, type of examination, attachments (PDF/photo), message text. Technical data: IP address, browser type, language, cookies based on granted consents. Audit record of chatbot consent: phone hash, timestamp, disclaimer version, IP, browser.

Special category — health data (GDPR Art. 9)

Health data — diagnosis, clinical description, examination results, indications from the chatbot or the "For Doctors" form — constitute a special category under Article 9 of the GDPR. We process them based on Article 9(2)(h) of the GDPR (preventive medicine, medical diagnosis, healthcare provision) in conjunction with Section 24 of Act No. 18/2018 Coll. For the contact form and chatbot, where providing data is not necessary for healthcare provision, we process them based on your explicit consent under Article 9(2)(a) of the GDPR — by checking the consent box, you declare that you agree to their processing.

Purposes and Legal Bases

Provision of healthcare services (Art. 6(1)(c), Art. 9(2)(h) GDPR; Act No. 576/2004). Processing orders via chatbot or form (Art. 6(1)(b) — contract performance, Art. 9(2)(a) — explicit consent for health data). Issuing electronic referrals with KEP (Art. 6(1)(c), eIDAS Regulation 910/2014). Fulfilling legal obligations — maintaining medical records, billing, communication with health insurance providers (Art. 6(1)(c)). Website security and abuse prevention — IP address collection in forms (Art. 6(1)(f) — legitimate interest).

How long we retain data

Data retention periods: Medical records: 20 years from the date of the last medical care provided (§ 22 of Act No. 576/2004). Accounting documents: 10 years (Act No. 431/2002 on Accounting). Emails from the contact form and applications, including attachments: 24 months from the last contact, or until consent is withdrawn — whichever occurs first. Audit logs of cookie consent (medirad_cookie_consent_log) and chatbot consent (medirad_disclaimer_log): 3 years from the last consent/withdrawal — covering the limitation period for data subject claims (§ 101 of the Civil Code) and the inspection period of the Office for Personal Data Protection (§ 102 of Act No. 18/2018); daily WP-cron deletes older records. Voice recordings of the telephone line: 30 days. Browser cookies by category — see the "Cookie Settings" page.

Data Recipients

We disclose data only to the extent necessary for the above purposes:
• Health insurance companies (Union, Dôvera, VšZP) — only for covered services.
• WebSupport s.r.o. (Bratislava, SK) — WordPress hosting, email accounts.
• Bookio intermediary (Logamic s.r.o., Bratislava) — booking system, processing name, contact, and appointment.
• Google Ireland Ltd. — with consent for functional cookies: Google Fonts and Google Maps (IP address, user-agent, time).
• Slovak National Accreditation Service and State Institute for Drug Control — during inspections within legal authority.
• Authorities in criminal proceedings and courts — only upon written request.
We do not transfer data to third countries outside the EU/EEA, except for standard contractual clauses with Google (USA, SCC per EC Decision 2021/914) when consent for functional cookies is given.

Your Rights

You have the right to: access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17 — except for medical records during statutory retention), restriction of processing (Art. 18), data portability (Art. 20), objection (Art. 21), and withdrawal of consent (Art. 7(3) — without affecting prior processing). Send your request to info@medirad.sk with subject “GDPR”. We respond within 30 days. If you disagree with the resolution, you have the right to lodge a complaint with the Office for Personal Data Protection of the Slovak Republic (www.dataprotection.gov.sk).

Cookies and tracking

On your first visit, a cookie banner will appear with three categories: necessary (always enabled), functional, and analytical. Functional cookies are loaded only with your consent and enable: Google Fonts (font display), Google Maps (clinic map), and the Bookio booking widget. You can modify or withdraw your consent at any time by clicking “Cookies” in the site footer. We store your decision in the browser’s local storage (medirad_cookie_consent) and in a cookie with the same name, valid for 12 months.\n\nEach change to your selection is also recorded on our server in an audit log (medirad_cookie_consent_log) in accordance with Article 7(1) of the GDPR — to demonstrate which category was approved when. The record includes: an anonymous session ID, timestamp, selected consent, banner version, page language, browser, and hashed IP address (SHA-256 + salt — the full IP is never stored). Records are retained for 3 years from the last consent/withdrawal, after which they are deleted daily by a WP-cron job.

Manage cookies

Safety

We transmit data via an encrypted HTTPS connection (TLS 1.2+). Emails between us and the hosting provider are sent via SMTP with TLS. Access to the editorial system is restricted to two roles (administrator + editor) with individual passwords and separate permissions. We verify electronic applications using an X.509 signature (KEP via Autogram) and compare the signer's name with the one entered in the form — if they do not match, we reject the application.

Changes to these policies

We may update these policies in the event of changes to legislation, technology, or organization. The new version will be published on this page with an updated date. In case of significant changes, we will notify active clients via email.