Patient information

Processing of personal data

This is an unofficial English translation for your convenience. The binding version is the Czech one at ordinacePRAHA.cz/gdpr.

This document summarises how we handle your personal and health data in accordance with the GDPR and Act No. 372/2011 Coll., on health services. As a health-care provider we process your data on a statutory basis — we do not ask for your consent to provide care and keep records. Consent is required only for a single optional service (the Emmy Scribe AI transcription), see below.

Who processes the data (controller)

ordinacePRAHA.cz s.r.o.
Company ID (IČO): 03150241, Health-facility ID (IČZ): 04352000
Registered seat: Božkovská 2967/4, Záběhlice, 141 00 Prague 4
Practice address: Šustova 1930/2, 148 00 Prague 4 — Chodov
Registered in the Commercial Register under file No. C 228029 at the Municipal Court in Prague.
Data box (datová schránka): nqvj3ux

What data we process and why

Identification and contact data (name, date of birth, birth number / insurance number, address, phone, e‑mail) – to keep your medical records and to communicate with you.
Health data (a special category of data) – for the purpose of providing health care (preventive and curative medicine). This processing does not require your consent; it is necessary under Article 9(2)(h) and (3) of the GDPR and the Act on health services.
Data from the Emmy booking and communication system – for your reservations, e‑prescriptions and delivery of results.

We obtain part of the data directly from you and part from health insurers and other health-care providers in connection with your care.

Legal basis for processing

Keeping medical records and providing care – compliance with our legal obligation (Article 6(1)(c) GDPR) and provision of health care (Article 9(2)(h) GDPR); no consent is required.
Emmy Scribe AI transcription (optional recording and transcription of the course of the consultation) – processed only on the basis of your explicit consent (Article 6(1)(a) and Article 9(2)(a) GDPR). Consent is voluntary, withholding it has no effect on the provision of care, and you may withdraw it at any time (withdrawal does not affect the lawfulness of processing before withdrawal).

Who we share the data with (recipients and processors)

Health insurers (reporting of care), laboratories and other health-care providers, where necessary for your treatment and care.
Our contractual processors who provide IT and operations for us, under concluded data-processing agreements:
- MEDAX Systems s.r.o., Company ID 27836673, seat Oběžná 2075/11, 709 00 Ostrava – the SmartMEDIX outpatient system for keeping medical records;
- Emmy Medical s.r.o., Company ID 06785247 – the Emmy virtual-nurse system (bookings, communication) and the Emmy Scribe service (AI transcription, only with your consent);
- Google (Google Workspace) – secure company file storage;
- miniTEL s.r.o., Company ID 27718808 (the odorik.cz service) – the practice telephone service;
- the web hosting provider (Cloudflare) – operation of the practice website.
Public authorities where required by law.

We will provide a current, complete list of processors on request via the data box.

Transfers to countries outside the EU/EEA

Your medical records remain in the EU. Some of our technical processors (e.g. Google, Cloudflare) may be established in the USA or may process data there; any such transfer takes place only on the basis of appropriate safeguards under the GDPR (standard contractual clauses, or the EU–US Data Privacy Framework).

How long we keep the data

We keep medical records for the period set by Decree No. 444/2024 Coll., on medical records. For a registering provider in the field of general practice, this period is generally 10 years. Copies of documents stored in company storage are subject to the same retention periods as the records themselves.

Automated decision-making

The processing of your data does not involve automated decision-making or profiling with legal effects on you.

Your rights

Under the GDPR you have the right of access to your data, to rectification, restriction of processing and to object. For data processed on the basis of consent (Emmy Scribe) you additionally have the right to withdraw consent and the right to erasure and portability. Please note that the right to erasure cannot be exercised for medical records kept as a statutory obligation. If you are dissatisfied, you have the right to lodge a complaint with the Office for Personal Data Protection (www.uoou.gov.cz).

Filing a complaint about the provision of health services

If you are dissatisfied with the way health services were provided to you, or with the conduct of our practice, you have the right under Section 93 of Act No. 372/2011 Coll., on health services, to file a complaint. A complaint may be filed by the patient, their legal representative or guardian, a close person (where the patient cannot file it themselves due to their state of health or death) and a person authorised by the patient.

Please file the complaint with us first as the provider it concerns, namely:

to the data box: nqvj3ux,
through the secure virtual nurse Emmy system, or
in writing to the practice address.

We will handle the complaint within 30 days of receiving it; in justified cases we may extend this period by a further 30 days (we will always notify you of any extension). Where appropriate given the nature of the complaint, we may propose to discuss it with you in person. You have the right to inspect the file kept on your complaint and to make copies of it. We keep records of complaints received and of how they were handled.

If you disagree with how the complaint was handled, you may file it with the administrative authority that granted us the authorisation to provide health services — this is the Prague City Hall (Department of Health). In such a submission, please state the reasons for your disagreement with how our practice handled the complaint.

This is without prejudice to other means of defence, in particular a submission to the Czech Medical Chamber (for professional misconduct), a complaint to the Office for Personal Data Protection (where it concerns the processing of personal data) or asserting claims in court.

Cookies and tracking

This website does not use cookies or tracking technologies that would require your active consent. Any traffic analysis is carried out only in anonymous, aggregate form, without storing cookies on your device.

Contact for exercising your rights

You can contact us in matters of personal data protection:

Via the data box: nqvj3ux
Through the secure virtual nurse Emmy system
In writing at the practice address: Šustova 1930/2, 148 00 Prague 4 — Chodov