App privacy policy

UAB InMedica, legal entity code 300011170, registered address Juozo Balčikonio g. 3, LT-08247 Vilnius, Republic of Lithuania (hereinafter referred to as the Clinic or We) respects your privacy and strives to ensure the security of the data of its patients and other persons, as well as the transparency of the procedures for processing personal data.

Accordingly, this Privacy Policy (hereinafter referred to as the Policy) informs you how the Clinic handles the personal data of users, visitors and other data subjects (hereinafter referred to as you, patients, users or data subjects) of the Meliva Lietuva mobile application (hereinafter referred to as the App). It is very important that you read this Policy carefully, as by using the App or providing the Clinic with your personal data, you acknowledge that you are aware of the provisions of this Policy and agree that it will apply to you.

The terms used in the Policy shall be understood as defined in the European Union's General Data Protection Regulation 2016/679 (hereinafter referred to as the GDPR). The Policy also uses the terms defined in the Meliva Lietuva Mobile App Terms of Use.

When processing personal data, the Clinic is guided by and complies with the GDPR, the Republic of Lithuania Law on Legal Protection of Personal Data and other applicable legal acts governing the protection of personal data.

The Clinic is the controller of your personal data. If you wish to enquire about our processing of personal data, you can contact the Clinic by phone +37052193399 or by e-mail asmensduomenys@inmedica.lt

I. PERSONAL DATA

For the purposes of this Policy, the term “personal data” means information about a Patient or information from which a Patient can be directly or indirectly identified, including data relating to health.

The Clinic has no means to verify the accuracy of the information provided by the Patient and its conformity to reality. The Patient undertakes to familiarize himself with the Policy and the information on data processing contained therein and undertakes to provide only accurate and correct personal data.

The App may contain links to the Clinic’s website(s) and privacy policies and other websites or social network accounts. Such websites or social network accounts are not covered by this Policy and you should review their privacy policies before submitting your personal data to these websites or accounts.

If you use biometric authentication (facial recognition or fingerprint recognition technologies) to log in to the App or to use other functionalities of the App, you may refer to the privacy policies or privacy notices published by the manufacturer of the smart device you are using for information about the processing of your biometric personal data. The Clinic does not have access to your biometric personal data and does not process such data.

II. DATA PROCESSING PRINCIPLES

When processing your personal data, the Clinic:

complies with the requirements of current and applicable legislation, including the GDPR;
processes your personal data in a lawful, fair and transparent manner;
collects your personal data for specified, clearly defined and legitimate purposes and does not further process your personal data in a manner incompatible with those purposes, except to the extent permitted by law;
takes all reasonable steps to ensure that any personal data that are inaccurate or incomplete in relation to the purposes for which they are processed are promptly rectified, supplemented, suppressed, or erased;
keeps them in a form which permits your identification for no longer than is necessary for the purposes for which the personal data are processed;
does not disclose personal data to third parties or make them public, except as provided in the Policy or applicable law;
ensures that your personal data is processed in such a way as to ensure, through appropriate technical or organisational measures, adequate security of personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage.

III. HOW IS YOUR PERSONAL DATA COLLECTED?

We process your personal data collected in the following ways:

(i) When you provide personal data to us:

Information provided by identification means and/or information obtained during the process of identification;
Registration information that you provide when registering on the App, creating an account on the App, ordering services, contacting us by email or telephone, etc.;
Information that you send when using the chat feature of the App;
Information about your use of the App (service usage history, IP address, visit history, preferences, etc.);
Information you provide when you participate in our surveys, call our customer service or otherwise contact us.

(ii) When we receive your personal data from other parties in accordance with the law and/or this Policy. For example, from the State Electronic Health Services and Cooperation Infrastructure Information System (hereinafter referred to as ESPBI IS), payment institutions about payments made, etc.

IV. ON WHAT GROUNDS AND FOR WHAT PURPOSES DOES THE CLINIC PROCESS PERSONAL DATA?

The Clinic collects and processes personal data in accordance with the legal acts of the European Union and the Republic of Lithuania regulating the protection of personal data.

The Clinic processes personal data on the following grounds:

Based of consent, which is expressed by your active actions (for example, when you consent to receive direct marketing communications);
On a contractual basis, where the Clinic processes personal data for the purposes of concluding and/or performing a contract with you (the Terms of Use of the App; also, applicable where the Clinic provides healthcare services to you on a contractual basis);
When necessary to protect the vital interests of the individual;
In the performance of duties imposed on the Clinic by law (for example, when dealing with complaints from patients (their representatives), providing data to public authorities);
When pursuing legitimate interests (for example, administering the App and ensuring its safe and proper functioning);
When necessary to assert, exercise or defend legal claims of the Clinic.

The processing of individual categories of data for specific purposes is described below.

For the purposes of establishing and/or confirming personal identity:

Categories of data	Name, surname, personal identification number, content of identity documents, any other information provided by the user of the App that proves his/her identity. ESPBI IS data processed by the State Enterprise Centre of Registers: name, surname, gender, date of birth, ESPBI IS identification code, personal identification code, as well as the list of principals (children, persons under guardianship, persons with limited legal capacity in a certain area) and their names, surnames, personal identification codes, dates of birth, ESPBI IS identification codes.
Legal basis for data processing	Performance of a contract with the data subject or for the purpose of taking steps prior to entering into a contract with the data subject (Article 6(1)(b) of the GDPR). The legitimate interest of the Clinic or a third party in the quality and efficiency of the performance of its obligations (Article 6(1)(f) of the GDPR).
Duration of data processing	Personal data are processed during the period of use of the App by the user and for a period of 5 years from the cancellation of the account or the last access to the App.
The data is obtained	Directly from the data subjects and, during synchronisation, from the ESPBI IS.
The data is provided or transferred to	Companies that offer data storage and accounting services, payment processing service providers (only to the extent necessary to properly provide the App), and companies within the Clinic’s group (only to the extent necessary to properly provide the App and fulfil the Clinic’s obligations).

Processing of personal data for the purposes of creating Accounts, using and administering the App:

Categories of data	Name, surname, email address, phone number, residential address, App and Account usage history, App and Service order history, content and notifications related to services, content of representatives. The time and type of confirmation of registration in the App and the unique device identifier.
Legal basis for data processing	Performance of a contract with the data subject or for the purpose of taking steps prior to entering into a contract with the data subject (Article 6(1)(b) of the GDPR). The legitimate interest of the Clinic or a third party in the quality and efficiency of the performance of its obligations (Article 6(1)(f) of the GDPR).
Duration of data processing	Personal data are processed during the period of use of the App by the user and for a period of 5 years from the cancellation of the account or the last access to the App. Personal data may be processed for a longer period of time if such obligation to retain data or documents is laid down in the legal requirements applicable to the Clinic.
The data is obtained	Directly from data subjects.
The data is provided or transferred to	Data storage service providers, companies within the Clinic’s group (only to the extent necessary for the proper provision of the App and the Clinic's obligations).

For the purpose of providing App services:

Categories of data	Name, surname, personal identification number (only if required), email address, phone number, residential address, payment account, App and Account usage history, App and Service order history, content and notifications related to services, content of representatives, and other information necessary for the proper provision of App services, as well as data provided during consultations with a doctor, which may include health data of data subjects (special categories of data).
Legal basis for data processing	Performance of a contract with the data subject or for the purpose of taking steps prior to entering into a contract with the data subject (Article 6(1)(b) of the GDPR). The legitimate interest of the Clinic or a third party in the quality and efficiency of the performance of its obligations (Article 6(1)(f) of the GDPR). Special categories of data (health data) are processed on the basis of the data subject’s explicit consent (Article 9(2)(a) of the GDPR).
Duration of data processing	Personal data are processed for the period during which the App is used by the App user (validity of the contract/performance of the service order) and for a period of 5 years after the end of the contract (performance of the service order). Personal data may be processed for a longer period of time if such obligation to retain data or documents is laid down in the legal requirements applicable to the Clinic.
The data is obtained	Directly from data subjects.
The data is provided or transferred to	Data storage service providers, companies within the Clinic’s group (only to the extent necessary for the proper provision of the App and the Clinic's obligations).

The Clinic notes: Once a user of the App has become a registered patient of the Clinic, the Clinic processes the patient’s personal data in accordance with the Clinic’s privacy policy, which is available at: https://inmedica.lt/apie-mus/privatumo-politika/29.

For the purposes of payment for the services of the App, financial accounting and debt management:

Categories of data	First name, last name, email address, phone number, residential/legal entity address, relationship with the represented legal entity (when representing a legal entity), payment information, debt information, data transferred by the company managing payment collections, and payment confirmations.
Legal basis for data processing	Performance of a contract with the data subject or for the purpose of taking steps prior to entering into a contract with the data subject (Article 6(1)(b) of the GDPR). Performance of a legal obligation on the part of the Clinic (Article 6(1)(c) of the GDPR).
Duration of data processing	Personal data shall be processed in accordance with the requirements laid down by the legislation, i.e., in accordance with the Index of General Document Retention Periods approved by Order No V-100 of the Chief Archivist of the Republic of Lithuania of 9 March 2011. Where the personal data do not fall within the above-mentioned scope of retention, the data shall be processed during the period of validity of the contract or cooperation between the parties and for 10 years after the termination of the contract and/or relationship (last contact).
The data is obtained	Directly from data subjects, the companies/service providers that administer the collection of payments.
The data is provided or transferred to	Companies that offer data storage services, companies within the Clinic’s group (only to the extent necessary to properly provide the App and fulfil the Clinic’s obligations); companies managing payment collections; debt recovery companies.

For the purposes of quality assurance, consultation on the Clinic’s services and administration of enquiries:

Categories of data	Name, surname, email address, telephone number, the content of the request and the response to the request, the information for ordering the service, the doctor’s consultation and/or visit identification information, the price, and any other information necessary to provide the consultation and administer the request.
Legal basis for data processing	Performance of a contract with the data subject or for the purpose of taking steps prior to entering into a contract with the data subject (Article 6(1)(b) of the GDPR). The legitimate interest of the Clinic or a third party in the quality and efficiency of the performance of its obligations, the quality of its services, the provision of advice and the resolution of any issues arising (Article 6(1)(f) of the GDPR).
Duration of data processing	Personal data are processed for the duration of the administration of the matter and for 1 year after the end of the consultation or the last contact. Personal data may be processed for a longer period of time if such obligation to retain data or documents is laid down in the legal requirements applicable to the Clinic.
The data is obtained	Directly from data subjects.
The data is provided or transferred to	Data storage service providers, companies within the Clinic’s group (only to the extent necessary for the proper provision of the App and the Clinic's obligations).

For the purposes of direct marketing, conducting surveys, and providing products and services that may be of interest to the App user:

Categories of data	Name, surname, email address, telephone number, data provided in the survey questionnaire (if the survey is not anonymous), information collected when the data subject uses the App.
Legal basis for data processing	Consent of the data subject to receive direct marketing notifications (Article 6(1)(a) of the GDPR). The legitimate interest of the Clinic or a third party to provide the information (Article 6(1)(f) of the GDPR).
Duration of data processing	Personal data are processed during the period of validity of the data subject’s consent (until such time as the data subject’s withdrawal of consent is obtained). If the personal data is not processed on the basis of consent, it is processed during the period of use of the App and for a period of 5 years after the last use of the App.
The data is obtained	Directly from data subjects.
The data is provided or transferred to	Data storage service providers, companies within the Clinic’s group (only to the extent necessary for the proper provision of the App and the Clinic’s obligations).

For the purposes of dispute resolution and complaint handling:

Categories of data	Name, surname, email address, phone number, name of the represented legal entity, address, position, relationship with the represented legal entity, content of a claim or other similar document, information and/or documents related to the dispute and/or claim.
Legal basis for data processing	Performance of a legal obligation on the part of the Clinic (Article 6(1)(c) of the GDPR). The Clinic’s legitimate interest to assert, enforce, or defend its rights and legal claims (Article 6(1)(f) of the GDPR).
Duration of data processing	Personal data is processed for the entire duration of the dispute and/or claim examination period, and for 3 years after the completion of non-judicial dispute and/or claim resolution, and 10 years after the completion of judicial dispute resolution. Personal data may be processed for a longer period of time if such obligation to retain data or documents is laid down in the legal requirements applicable to the Clinic.
The data is obtained	Directly from data subjects.
The data is provided or transferred to	Data storage service providers, companies within the Clinic’s group (only to the extent necessary for the proper provision of the App and the Clinic’s obligations).

For the purpose of managing, operating, ensuring the security, and improving the quality of the App:

Categories of data	In-App activity data, engagement and activity (date and time of login, location, activity, preferences, technical errors), analytical data, such as information about your visit, including information about the links you click on, through and from the App (including the date and time), the services you view or search for, the response time, the amount of time spent on particular pages, page interaction information (such as clicks, gestures, scrolling and clicking, and other on-screen actions), and the methods used to exit the page. The App conversion rates (e.g., login rates, most used features, etc.).
Legal basis for data processing	Consent of the data subject (Article 6(1)(a) of the GDPR). The legitimate interest of the Clinic in ensuring the security and quality of the App (Article 6(1)(f) of the GDPR).
Duration of data processing	Personal data are processed only for the period necessary to fulfil the purpose set out in this Policy, but no longer than 3 years from the date of collection. Personal data may be processed for a longer period of time if such obligation to retain data or documents is laid down in the legal requirements applicable to the Clinic.
The data is obtained	Directly from data subjects.
The data is provided or transferred to	Data storage service providers, companies within the Clinic’s group (only to the extent necessary for the proper provision of the App and the Clinic’s obligations).

V. DATA PROCESSORS AND OTHER DATA RECIPIENTS

The Clinic uses data processors and other service providers to process general and special categories of personal data of patients and other data subjects.

Such data processors may include: persons providing data centre services; persons developing, providing, enhancing, and/or maintaining software; persons providing information technology infrastructure services; email service providers; call centre service providers; other data processors to whom personal data is disclosed only to the extent necessary to provide their services. We require data processors to process your data only in accordance with the instructions of the Clinic and in compliance with data protection legislation.

Personal data may also be disclosed to persons providing advertising and marketing services, persons providing accounting services, bailiffs, persons providing legal and/or debt collection services, other service providers.

In any case, the Clinic will only use data processors and other service providers that can ensure the secure and GDPR-compliant processing of your personal data.

In case of an appropriate legal basis (for example, when it is necessary for the proper provision of healthcare services, for the proper performance of a contract with a data subject) and in compliance with the requirements of the law, patient data (including health data) may be transferred to other healthcare institutions, laboratories performing tests.

Additionally, where provided by law and in accordance with the procedures established therein, the Clinic may disclose patients’ (or their representatives’) personal data to authorized state and/or municipal authorities (including the State Enterprise Centre of Registers, the Ministry of Health, the National Public Health Centre, the National Health Insurance Fund and territorial health insurance funds, the State Social Insurance Fund Board under the Ministry of Social Security and Labour, the Agency for the Protection of the Rights of Persons with Disabilities under the Ministry of Social Security and Labour, the State Data Protection Inspectorate, the Special Investigation Service, the Police, the Commission for the Protection of Patients’ Rights and the Determination of Damage, etc.), as well as to other healthcare institutions and authorities (including data provided through the Lithuanian ESPBI IS system).

In a specific case, if there is a proper legal basis, data of patients and other persons may be provided to the State Child Rights Protection and Adoption Service under the Ministry of Social Security and Labour, pre-trial investigation authorities, courts, the State Accreditation Service, the Commission for the Protection of Patients’ Rights and the Determination of Damage, the Police, the State Patients’ Insurance Fund and Territorial Patients’ Insurance Funds, the Special Investigation Service, and other state and/or self-government authorities and institutions (at the request of the latter or at the initiative of the Clinic).

In a specific case, if there is an appropriate legal basis (e.g., consent of the data subject), the insurance company may also be provided with the data of patients (their representatives) necessary for the purposes of the claims administration procedure.

Your personal data may only be provided to other data recipients on the basis of legal grounds and/or with your explicit consent or request.

VI. DATA TRANSFERS

The Clinic informs you that certain data (IP address, cookies, technical information) about your use of the App, for the purposes of browsing statistics, analysis, marketing and related purposes, may be transferred to or made available to entities operating both within and outside the European Economic Area. The Clinic reminds you that personal data may be subject to less protection in countries outside the European Economic Area than in countries within the European Economic Area, but the Clinic will carefully assess the conditions under which such personal data will be processed and stored after transfer to the above entities. The Clinic ensures that personal data is securely transferred in accordance with at least one of the grounds established in Articles 44–50 of the GDPR (e.g., an adequacy decision, the standard contractual clauses approved by the European Commission for data transfer outside the European Economic Area, etc.).

VII. DATA SECURITY

The Clinic applies appropriate technical and organisational measures to ensure the security of your personal data. These measures are chosen taking into account the risks to your rights and freedoms as a data subject.

The Clinic also responsibly controls access to your personal data and restricts it to those employees or other persons for whom it is necessary for the performance of their functions.

However, please remember that it is impossible to completely guarantee the security of information transmitted over the Internet. In this regard, your use of the Internet connection to provide us with data on the App is at your own discretion and at your own risk.

VIII. DATA RETENTION PERIODS

The Clinic aims not to store outdated, irrelevant personal data, and therefore, when it is updated (e.g., by updating your Account details or contact details), only relevant information will normally be stored. Historical information is retained where it is necessary to do so by law or for the purposes of our business.

Your personal data may be retained for a longer period than stated elsewhere in this Policy where:

it is necessary for the Clinic to defend itself against claims, demands or actions, and to exercise its rights;
there are reasonable suspicions of unlawful activity and an investigation is underway;
your data is necessary for the proper investigation of a complaint or resolution of a dispute;
It is necessary for creating and storing backup copies, as well as for other purposes related to the operation and maintenance of information systems;
there are other grounds laid down by law.

IX. YOUR RIGHTS AS A DATA SUBJECT

To the extent and subject to the conditions set out in the personal data protection legislation, you have the following rights in relation to your personal data:

to have access to your personal data processed by the Clinic and to receive information about their processing;
to request the rectification of incorrect, inaccurate or incomplete data;
to request the erasure of personal data (“right to be forgotten”) or the restriction of the processing of personal data when they are processed in breach of the requirements of the legislation or on other legal grounds;
to request the transfer of personal data to another controller or to provide it directly in a form that is convenient for you (this applies to data provided by you and processed by automated means on the basis of a contract or consent);
to object to the processing of personal data where the processing is carried out for legitimate interest, unless there are overriding legitimate grounds for such processing, or where the processing is for the establishment, exercise or defence of legal claims;
to withdraw your consent at any time where personal data are processed on the basis of consent.

Where a patient or other data subject considers that his or her personal data are being processed unlawfully or in breach of his or her rights, he or she may contact the State Data Protection Inspectorate (website: www.vdai.lrv.lt , email: ada@ada.lt , phone number: (8 5) 271 28 04) and lodge a complaint with the Inspectorate. In all cases, the Clinic recommends that you contact us at asmensduomenys@inmedica.lt before submitting a complaint to the State Data Protection Inspectorate in order to find a solution to the problem more quickly and efficiently together.

X. HOW CAN PATIENTS AND OTHER DATA SUBJECTS EXERCISE THEIR RIGHTS?

In order to exercise one or more of the rights listed above, the patient or other data subject must submit a request to the Clinic himself/herself (or through his/her representative) by hand delivery, post or email (to the contacts listed below). The request must be legible, signed, and contain at least the data subject’s name, contact details and information on the rights and the extent to which the data subject wishes to exercise them, and may also indicate how the patient or other data subject wishes to receive a reply.

Before complying with a data subject’s request, the Clinic shall verify the identity of the person making the request in order to ensure that the information is only provided to the person entitled to receive it. If the request is made in person (at the Clinic), the data subject must provide proof of identity upon request by a Clinic employee.

Upon receipt of the request and successful verification of the identity of the person making the request, the Clinic will inform the applicant of the action it has taken in response to the request and will respond to the request no later than within 1 month (from the date of receipt of the request and the verification of the identity of the person making it). Depending on the complexity and number of requests, the Clinic has the right to extend the 1-month period by a further 2 months (by informing the applicant no later than 1 month after receipt of the request and verification of identity, and stating the reasons for the extension of the period).

In complying with a data subject’s request for the exercise of his or her rights, the Clinic:

has the right to request clarification of the submitted request;
the Clinic provides information only to the extent that the rights of other individuals are not violated (when the requested information is related to other individuals).

In cases where the legal provisions and/or circumstances apply, the Clinic will refuse to fulfil the request of the patient or another data subject, informing them in writing and providing the reasons for such refusal.

XI. HOW CAN YOU CONTACT THE CLINIC?

If you have any questions related to this Policy or requests related to the processing of your personal data, you can contact the Clinic:

By mail: UAB InMedica, Juozo Balčikonio g. 3, LT – 08247 Vilnius; · By e-mail: asmensduomenys@inmedica.lt .

XII. LINKS TO OTHER WEBSITES

The Clinic is not responsible for the processing and security of patients’ and other subjects’ personal data on third-party websites, including cases where third-party websites are accessed (or can be accessed) through links posted in our App. In all cases, we recommend carefully reviewing the privacy protection information provided on third-party websites.

XIII. OTHER PROVISIONS

The Clinic may update or otherwise modify this Policy at any time. The Clinic will inform its Patients and other data subjects about updates and other changes to the Policy by publishing a new version of the Policy (with the date of the latest changes) in the App and/or on the website.

If any provision of the Policy is found to be invalid, it will not affect the legality and validity of the remaining provisions of the Policy.

The Policy is effective from the date of its publication.

The Policy was last updated on: January 31, 2025.