Privacy policy
1. General principles
1.1
The protection of personal data is very important to us, and we take it seriously. This Privacy Policy sets out the principles followed by Health Tests OÜ, hereinafter referred to as the Service Provider (www.terviseuuringud.ee), and provides detailed information about what personal data is collected about you, how it is used, and who has access to it. These Privacy Terms describe the procedures and conditions under which the Service Provider processes the Patient’s personal data.
1.2
In processing personal data, we comply with applicable data protection legislation, including the Health Services Organisation Act, the Regulation on the Documentation and Retention of Health Care Service Documents, Regulation (EU) 2016/679 of the European Parliament and of the Council (hereinafter “GDPR”), and the Estonian Personal Data Protection Act.
1.3
The Service Provider processes the Patient’s personal data only where a lawful basis exists and solely for legitimate purposes.
1.4
The Service Provider processes the Patient’s personal data for the conclusion and performance of contracts and for the provision of services, as well as in other cases specified in these Privacy Terms.
1.5
The Service Provider has the right to amend the Privacy Terms unilaterally by notifying users at least one month in advance via the Service Provider’s website or by other means chosen by the Service Provider.
1.6
In the course of our activities, we collect and use personal data relating to you in order to provide the best possible service, consultation, and solutions.
1.7
The Service Provider respects your rights regarding control over your privacy. It is important to us that you are able to exercise your rights. Details on how to do so are provided below.
Data controller
Company name: Health Tests OÜ
Address: Sepapaja 12/1, Tallinn 11415
Email: info@terviseuuringud.ee
You may contact the Data Protection Officer of Health Tests OÜ via email at info@terviseuuringud.ee.
2. Definitions
2.1
Personal data – any information relating to an identified or identifiable natural person, including health data.
2.2
Processing of personal data – any operation or set of operations performed on personal data, whether automated or not, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.
2.3
Patient – a natural person who has entered into a contract with the Service Provider or has expressed a wish to do so.
2.4
Service Provider – Health Tests OÜ, registry code 12702440.
2.5
Privacy Terms – these personal data processing terms.
2.6
Data Controller – the Service Provider, who determines the purposes and means of processing personal data.
2.7
Processor – a natural or legal person, public authority, agency, or other body which processes personal data on behalf of the Data Controller.
3. Collection and use of personal data
3.1
The Service Provider is obliged to obtain the Patient’s consent for processing personal data for purposes not specified in these Privacy Terms.
3.2
The Service Provider processes the following categories of the Patient’s personal data:
3.2.1
Name, personal identification code, date of birth, and other general data (including preferred communication language);
3.2.2
Contact details (including phone number, email address, postal address, and place of residence);
3.2.3
Health data, including examination, diagnostic, and treatment data, as well as information on heredity and health behaviour related to the provision of healthcare services;
3.2.4
Information relating to concluded contracts;
3.2.5
Bank account number and information related to invoicing, payments, and debt collection;
3.2.6
Communication records (customer communication), including email correspondence and phone calls (patients are always informed if calls are recorded);
3.2.7
Information collected to fulfil legal obligations;
3.2.8
In the event of changes to personal data, the Patient undertakes to inform the Service Provider within a reasonable time, but no later than ten days.
3.3 Website browsing statistics
3.3.1
In addition to personal data, anonymous website browsing statistics are collected from the website www.terviseuuringud.ee. Health Tests OÜ aims to make its website as user-friendly as possible. To improve user experience, the following information may be collected when visiting the website: browser type and version, device type and operating system, IP address, session duration and time, pages visited, and demographic information such as language preference and location. This data is used anonymously and is not linked to any specific individual.
3.3.2
Health Tests OÜ uses Google Analytics to collect and analyse the above data. You may disable data collection by Google Analytics at any time as described by Google.
3.4 Logs
The server hosting the Health Tests OÜ website may store requests made to the server (visited URL, browser and device used, IP address, access time). This data is used solely for technical purposes to ensure proper functioning and security of the website and to investigate potential security incidents.
3.5 Cookies
3.5.1 What are cookies?
A cookie is a small text file stored on your computer or mobile device when you visit a website. Cookies allow the website to remember your actions and preferences over time so you do not need to re-enter them when revisiting the site or navigating between pages.
3.5.2
Please note that the website uses persistent cookies that remain on your device after closing the browser. Persistent cookies may remain for days, months, or even years. These cookies may also be used to display targeted advertising on platforms such as Facebook, Google, Instagram, and YouTube.
3.6 Disabling and deleting cookies
You may restrict or disable cookies through your browser settings and delete existing cookies stored on your device. Please note that doing so may require manual adjustment of preferences on each visit and may cause certain services and functionalities to not work properly.
3.7 Website enquiries
3.7.1
If you wish to order services from Health Tests OÜ or receive additional information via the website, sharing personal data is necessary. Enquiries can be submitted via the contact form or by emailing info@terviseuuringud.ee.
3.7.2
To respond to enquiries, we collect the following personal data: name, contact details (email, phone number), and personal identification code or date of birth. When submitting a contact form, previously stored cookie information may be linked to the submitted data, creating a contact history.
3.7.3
The legal basis for processing is the performance of a contract or taking steps prior to entering into a contract at the request of the data subject (GDPR Art. 6). Access to this data is limited to Health Tests OÜ employees and, where applicable, IT service providers. Appropriate technical and organisational measures are applied to ensure data security.
3.7.4
Personal data collected from enquiries is retained for the duration of the contract. If no contract is concluded, data is retained for statistical purposes (sales statistics) for up to 5 years. This processing is based on the Service Provider’s legitimate interest (GDPR Art. 6).
3.8 Processing of health data
3.9
The Service Provider processes the Patient’s personal data for the purpose of concluding and performing contracts in order to:
prepare the conclusion of a contract;
fulfil contractual obligations and provide high-quality healthcare services, which requires processing health data and, where necessary, hereditary and health behaviour information;
ensure billing and debt collection;
protect the Service Provider’s rights in disputes;
provide important contractual information to the Patient.
3.10
Personal data is also processed to fulfil legal obligations, including:
providing data to authorised institutions (e.g. Health Insurance Fund, Health Board);
ensuring protection of the Patient’s rights;
retaining data as required by law;
fulfilling other statutory obligations.
3.11
Based on legitimate interest, the Service Provider processes personal data to:
improve service quality;
make direct offers for additional services;
assess risks, conduct audits, and perform analyses.
Health data is processed solely for the provision and organisation of healthcare services and to comply with legal obligations. Confidentiality and security of health data are key priorities.
3.12 Disclosure and transfer of personal data
Personal data may be disclosed without consent only where required by law.
Data may be shared with insurance companies only with Patient consent.
For contract performance, data may be shared with processors (e.g. laboratories, specialists, software providers).
In the event of contract breaches, data may be shared with third parties (e.g. legal counsel, auditors, debt collection agencies) where legally permitted.
3.13 Data retention
Personal data is retained only as long as necessary to fulfil the purposes set out in these Privacy Terms or legal obligations.
Customer service data is retained for at least five years after contract termination unless a longer retention period is required by law.
3.14 Your rights
By contacting Health Tests OÜ at info@terviseuuringud.ee, you may exercise your rights, including:
access to your personal data;
rectification of personal data;
erasure of personal data;
data portability;
objection to automated decision-making;
withdrawal of consent;
restriction of processing and the right to object.
Rights are exercised in accordance with GDPR and applicable local legislation.
3.15 Data protection measures
The Service Provider implements appropriate technical and organisational security measures.
Access to personal data is restricted to authorised personnel.
Confidentiality is ensured at all times.
Data processing agreements are concluded with all processors.
If you believe your privacy has been violated, please contact info@terviseuuringud.ee. You also have the right to lodge a complaint with the Estonian Data Protection Inspectorate.
3.16 Complaints
If you believe personal data processing does not comply with applicable law, you may request corrective action or file a complaint with the Data Protection Inspectorate.
In the event of a data breach posing a risk to rights and freedoms, the Service Provider will notify the authority within 72 hours and inform affected Patients without undue delay.
For any questions, please contact info@terviseuuringud.ee.