Privacy policy

We understand the special importance of protecting your personal data; therefore, we collect and process only those personal data that are necessary for carrying out our activities. We process personal data lawfully, transparently, and fairly, for predetermined purposes and only to the extent necessary to achieve those purposes. When processing personal data, we strive to ensure that they are accurate, secure, confidential, properly stored, and protected.

When processing your personal data, we comply with the General Data Protection Regulation (hereinafter – GDPR), the Law on Legal Protection of Personal Data of the Republic of Lithuania, as well as personal data processing requirements set out in other legal acts.

1. What is this document?

• This privacy policy (hereinafter – the Privacy policy) sets out the privacy conditions when you use the website inmedica.lt (hereinafter – the Website).
• Please read this Privacy policy carefully so that you understand the practices applied when processing your personal data. After reading this document, you will learn how we process your personal data, where we obtain them from, and what your rights are as a data subject.
• If you use the Website, it means that you have read and accept this Privacy policy and the purposes, methods, and procedures for processing your personal data specified herein. If you do not agree with the conditions for processing your personal data specified in the Privacy policy, you are not entitled to use the Website.
• In this Privacy policy, the term “personal data” means any information by which you can be identified – directly or indirectly. Personal data include surname, name, date of birth, postal or email address, information about your health, location data, internet identifiers, personal characteristics, etc.
• In order for you to fully use the services we provide, you must be registered in our clinic’s list of persons (patients). You can do this by visiting any of our clinics. When registering with our clinic, you will be introduced to our clinic’s personal data processing rules (hereinafter – the Rules), as well as your rights as a patient and data subject.
• The Privacy policy applies to all persons visiting any website of the “InMedica group”. The Privacy policy applies to all persons visiting the Website, regardless of whether you are a patient of our clinic, as well as to actions you may perform on the Website, including registration for an appointment with our clinic’s healthcare specialist, and also to persons participating in staff recruitment, suppliers, and partners whose data we process for contract performance.

2. Who are we?

• The Website is managed and administered by the InMedica group clinic UAB InMedica, legal entity code 300011170, address Juozas Balčikonis st. 3, LT‑08247 Vilnius.
• In accordance with the provisions of legal acts, we are the controller of your personal data.

3. What principles do we follow?

When processing your personal data, we:

• comply with applicable legal acts, including GDPR requirements;
• process your personal data lawfully, fairly, and transparently;
• collect your personal data for specified, clearly defined, and legitimate purposes and do not further process them in a manner incompatible with those purposes, except as permitted by law;
• take all reasonable measures to ensure that personal data that are inaccurate or incomplete, taking into account the purposes of processing, are corrected, supplemented, restricted, or deleted without delay;
• retain personal data in a form permitting identification of your identity no longer than is necessary for the purposes for which the personal data are processed;
• do not provide personal data to third parties or disclose them, except in cases specified in the Privacy policy or the Rules (if you are a patient of our clinic) or in cases established by law;
• ensure that personal data are processed in such a way that appropriate technical or organisational measures are applied to ensure adequate security of personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction, or damage.

4. For what purposes do we process your personal data?

5. How do we collect and process your personal data?

We process your personal data obtained in the following ways:

• when you provide them to us (e.g. when registering on the Website or by phone);
• when you use the Website (e.g. browser type, number of visits, Website pages viewed, time spent on the Website, etc.);
• when we receive your personal data from other persons in accordance with legal acts, this Privacy policy, or the Rules (if you are a patient of our clinic).

You provide us with your personal data and other information when using the Website or registering on it, writing to us, communicating with our customer service team, or submitting complaints regarding the Website or our services. When you contact us in writing or by email, we will retain correspondence data.

The information you provide may include your or the represented person’s name and surname, personal identification code, email address and phone number, age, gender, password, message text (e.g. when registering for a visit with our clinic’s healthcare specialist), and other registration, complaint, claim, or inquiry data.

When you use the Website, certain anonymous information (e.g. browser type, number of visits, pages viewed, time spent on the Website, etc.) is collected automatically. This information is used to improve the content, functionality, and attractiveness of the Website.

6. On what legal basis do we process your personal data?

• general categories of personal data are processed on the basis of GDPR Article 6(1)(a), (b), (c), (d), and (f);
• special categories of personal data are processed on the basis of GDPR Article 9(2)(a), (b), (c), (e), (f), (h), and (i).

7. What categories of your personal data do we process?

• personal data required for patient identification and provision of personal healthcare services: name and surname, date of birth, personal identification number (personal code of a resident of the Republic of Lithuania or personal code of a foreign citizen or another identification number), age, gender, data of identity documents (type, number, issuing country), reference to the newborn’s mother’s data, relationship with the mother (this data is processed when the patient is a newborn without a personal code), contact person data (name, surname, relationship to the patient, phone number, email address), facial image (for confirmation and/or identification of the identity of a patient of unknown identity when providing emergency medical assistance if the patient cannot present an identity document, and for fraud prevention in the provision of healthcare services free of charge), declared and actual place of residence address, workplace data, phone number, email address, marital status, internet protocol (IP) address, ESI identification number;

• special categories of personal data: choices of healthcare specialists and healthcare institutions; patient’s height, weight, body measurements; body mass index; blood group and Rh factor; risk factors; lifestyle (harmful habits); health-harming and hazardous environmental factors; disability level; work capacity level; general primary special needs; preventive health check-up data; vaccination data; names and codes of diseases or conditions suffered; names and codes of allergic reactions; diagnosis codes of hereditary or genetic diseases of close relatives; fact of patient’s arrival at a healthcare institution; prepared electronic medical documents (including their data and metadata); electronic medical certificates (including their data and metadata); complaints and anamnesis data; healthcare services provided (statistical accounting forms used to collect data on provided healthcare services); outpatient treatment summaries (visit statuses, logs, epicrises, discharge summaries, etc.); names and codes of diagnosed diseases or conditions; applied treatment methods; performed procedures and surgeries (interventions); long-term monitoring data; treatment with medicinal products; use of medical aid devices; referrals for consultation, examination, treatment, sampling and performed tests; indicators of health insurance coverage at the time of registration for healthcare services; issued electronic incapacity for work certificates and electronic maternity and childbirth leave certificates (personal code, name, surname); reasons for incapacity for work; periods of incapacity for work, maternity and childbirth leave, childbirth dates; issued permits for issuing incapacity for work and maternity and childbirth leave certificates in cases not provided for in the rules for issuing electronic certificates (personal code, name, surname, healthcare institution for which the permit is issued (personal code, name), incapacity period), except for data constituting a state or official secret; data on e‑prescriptions (series (reimbursable medicine passport number), number, and reference to patient data); data on medical images and reference to patient data;

• data required for sending marketing communications: name, surname, email address and/or phone number and/or residential address, gender, age;

• recruitment data of candidates for vacant positions: name, surname, date of birth, residential address, phone number, email address, education, qualifications, current or previous employer(s), information about the position and city the candidate wishes to work in, CV (curriculum vitae), cover letter;

• data for maintaining relationships with suppliers and partners: name, surname, contact details (email address, phone number, address), VAT payer code, business certificate or individual activity certificate number, its validity date, personal code, activity under business certificate or individual activity certificate, bank account number, powers of attorney, and other data;

• website visitor data, unique identifiers, and other tracking tools collecting information about newsletter subscription, (non)delivery, opening, clicking links, unsubscribing, which application/software is used to read the message, IP address and country attributed to it, as well as information provided by visitors on social networks – recommendations, complaints, opinions, suggestions, and other data;

• call center data: caller’s name, surname, contact details (email address, phone number, address), orders, audio recordings of conversations, call metadata.

If you wish to find out or verify what specific personal data are processed by the InMedica clinic, please contact us regarding the exercise of data subject rights using the methods indicated below.

8. Do we use your personal data for direct marketing?

• only with your consent may we use your personal data for direct marketing purposes in order to provide you with offers and information about our, related persons’, and partners’ goods and/or services that, in our opinion, may be of interest to you;

• for this purpose, we process the following personal data: name, surname, phone number, email address, gender, age, information about your registration with our clinic;

• you may choose whether or not you agree to the use of your personal data for direct marketing purposes. You may do this by:

  1. when registering on the Website, ticking the consent text “I agree to receive direct marketing offers” or leaving it unticked;
  2. clicking the link provided in the email sent by us regarding the use of your data for direct marketing purposes;

• by granting consent for processing data for direct marketing purposes, you also give us permission to contact you by communication means (e.g. email, phone, SMS) or other communication platforms (e.g. Skype, Viber, etc.);

• we may combine information we hold about you with information obtained from third parties in order to provide you with offers;

• if you give consent for the use of your personal data for direct marketing purposes, we may use your personal data to analyse and improve the effectiveness of our websites, advertising, and market research, as well as for other marketing and sales purposes of the company. In such cases, we use anonymised data;

• even if you have given consent for the processing of your personal data for direct marketing purposes, you may withdraw this consent at any time easily. You may do this by:

  1. in the Website section Patient area → My data change settings by indicating that you no longer wish your personal data to be used for direct marketing purposes, or
  2. notifying us of your refusal via the method specified in messages and/or offers received electronically (e.g. by clicking the “unsubscribe” link in a newsletter), or
  3. by visiting our clinic and submitting an appropriate request. The request must clearly specify your name and surname. If you withdraw consent in this way, we may ask you to present identity documents;

• from the moment of withdrawal of your consent, we will immediately stop sending direct marketing offers to you;

• withdrawal of consent does not automatically oblige us to delete your personal data or provide you with information about personal data we process; therefore, if you want us to carry out these actions, you must submit a separate request.

9. How do we use cookies?

• we collect information about you using cookies and similar technologies. Cookies are small files that are temporarily stored on your device’s hard drive and enable us to recognise you during subsequent visits to the Website, store browsing history and preferences, customise content, speed up searches on the Website, create a convenient and user-friendly environment, and present the Website more efficiently and reliably. Cookies are a standard practice for browsing websites;

• using cookies, we may collect the following information: IP address, browser type, demographic data, etc.;

• information obtained via cookies is used for the following purposes:

  1. to ensure the functionality of the Website (e.g. enabling personalisation);
  2. to improve and develop the Website so that it better meets your needs;
  3. for service development and analysis of Website usage;
  4. for targeted marketing orientation;

• we may, without violating legal acts, combine information obtained via cookies with information obtained about the person by other means (e.g. information about Website usage, personal data provided by you);

• the Website may use the following cookies:

  1. technical (necessary) cookies – cookies required for the operation of the Website;
  2. functional cookies – cookies that are not necessary for the operation of the Website but significantly improve its performance, quality, and user experience;
  3. analytical cookies – cookies used to prepare statistical analyses of visitors’ navigation methods; data collected by these cookies are used anonymously;
  4. targeting or advertising cookies – cookies used to display offers or other information that may interest you;
  5. social network cookies – cookies required to use Website information on your social media profile account;

• all information about cookies used on the Website, their purpose, validity period, and processed data is provided in the table below.

9.7. Consent to use cookies may be given in the following ways:

1. by clicking the “I agree” button in the cookie notification banner displayed on the Website;
2. by giving consent during registration on the Website;
3. by making cookie preference changes at any time via the cookie banner and selecting cookie settings.

• You may withdraw the consent given to us to use cookies at any time. You can do this by changing your internet browser settings to disable cookies. How to do this depends on the operating system and internet browser you use. Detailed information about cookies, their use, and options to refuse them can be found at http://AllAboutCookies.org or http://google.com/privacy_ads.html.

• In some cases, disabling functional cookies, not accepting cookies, or deleting cookies may slow down internet browsing speed and limit the functionality of certain Website features.

10. To whom do we provide your personal data?

• We guarantee that your personal data will not be sold, transferred, or otherwise disclosed to third parties without a lawful basis, except where used for purposes specified in this Privacy policy or when required by law. We may disclose your personal data to courts, law enforcement authorities, or other institutions carrying out lawful investigations, as required by applicable laws.

• We may provide your personal data to partners whose services we use to perform activities, including direct marketing and quality surveys. We require such partners to process your personal data in accordance with our instructions and applicable personal data protection requirements.

• We may transfer data collected about you to the following third countries:

1. third‑party service providers (e.g. technical service providers) performing services under our contracts with them, including newsletter distribution or other marketing-related activities;
2. third‑party service providers storing data used for the operation of services, telecommunications, and Website maintenance;
3. security organisations, pre‑trial investigation bodies, courts, lawyers, public authorities, and other data recipients to whom data must be disclosed in accordance with legal requirements or with your consent.

• The ability of the above-mentioned service providers to use your data is limited — they may not use such data for purposes other than service provision.

11. How long do we store your personal data?

• Personal data collected for the purposes specified in section 4(a) of the Privacy policy are stored until you are registered with our clinic.
• Personal data collected for the purposes specified in section 4(b) of the Privacy policy are stored no longer than the cookie retention period specified in section 7.6 of this Privacy policy.
• Personal data collected for the purposes specified in section 4(c) of the Privacy policy are stored until you are registered with our clinic. If you are not registered with our clinic, but your consent is required under this Privacy policy to process your personal data for direct marketing purposes, in such cases your personal data are stored for no longer than 3 months from the date you give your consent.
• Personal data collected for the purposes specified in section 4(d) of the Privacy policy are stored for the periods established by legal acts.
• Personal data collected for the purposes specified in section 4(e) of the Privacy policy are stored for one year after the final resolution of the inquiry.
• Personal data collected for the purposes specified in section 4(f) of the Privacy policy are stored until the end of the recruitment process, unless we have your consent to store them longer.
• Personal data collected for the purposes specified in section 4(g) of the Privacy policy are stored no longer than necessary to achieve the established purposes.
• Personal data collected for the purposes specified in section 4(h) of the Privacy policy are stored for the duration of cooperation and for 10 years after the end of the contract.
• Personal data collected for the purposes specified in section 4(i) of the Privacy policy are stored for the duration of cooperation and for 10 years after the end of the contract.
• Personal data collected for the purposes specified in section 4(j) of the Privacy policy are stored for the periods established by law.
• We store your personal data no longer than required by the purposes of processing or as provided by law, where longer retention periods are established.
• We seek to store only up-to-date and accurate personal data; therefore, we update them (e.g. after you update or change information) so that current information is stored. Historical information is stored where required by law or necessary for the performance of our activities.

12. How do we protect your personal data?

• Data collected from you are stored within the EU; however, they may be transferred or stored outside the EU. They may also be processed by our staff or the staff of our suppliers operating outside the EU. When transferring your data outside the EU, we will take all necessary measures to ensure that your personal data are processed securely and in accordance with this Privacy policy.
• Unfortunately, the transmission of information via the internet is not completely secure. Although we make every effort to protect your personal data, we cannot guarantee the security of data transmitted to the Website. Any data transmission is at your own risk. Once we receive your data, we apply strict procedures and security measures to prevent unauthorised access.
• If we become aware of a breach of personal data security that may pose a high risk to your rights and freedoms, we will notify you without undue delay once we become aware of and determine what information may have been accessed.

13. External websites

• The Website may contain links to external websites – websites of our social partners where our goods and/or services are advertised. By following such links to external websites, please note that these websites and services have their own privacy policies and we assume no responsibility or liability for such policies. Please review these policies before providing personal data on such websites or using any services.

12. What rights do you have?

• When processing personal data, we ensure your rights under the GDPR and the Law on Legal Protection of Personal Data of the Republic of Lithuania. As a data subject, you have the following rights:

1. to be informed about the processing of your personal data;
2. to access your personal data that we process;
3. to request rectification or supplementation of inaccurate or incomplete personal data;
4. to request erasure of personal data where they are no longer necessary for the purposes for which they were collected;
5. to request deletion of personal data if they are processed unlawfully or if you withdraw your consent where such consent is required;
6. to object to the processing of personal data or to withdraw previously given consent;
7. to request restriction of the processing of your personal data where the processing is disputed or where it is necessary to verify data accuracy, or where we no longer need your personal data but you do not want them to be deleted;
8. to request portability of personal data collected on the basis of consent or contract performance in a structured, commonly used, and machine-readable format and to transmit those data to another controller;
9. we make efforts to ensure that your rights as a data subject are implemented; however, we inform you that these rights are not absolute and may be restricted in cases provided by law.

• You may submit requests related to the exercise of your rights to us in person, by post, or by electronic means. Upon receipt of your request, we may ask you to provide documents confirming your identity, as well as to submit additional information related to the request.
• Upon receipt of your request, we will respond no later than within 30 calendar days from the date of receipt of all documents necessary to respond.
• If we refuse to fulfil your request, we will clearly indicate the grounds for such refusal.
• If you do not agree with our actions or responses to your requests, you may lodge a complaint with the competent public authority.

13. Where can you submit a complaint?

• If you are dissatisfied with how we process your personal data, please submit a written request providing as much information as possible using the contact details provided at the end of this policy. We will cooperate with you and seek to resolve all disputes promptly.
• If you believe that your rights under the GDPR have been violated, you may submit a complaint to the supervisory authority – the State Data Protection Inspectorate; however, we encourage you to first try to resolve any disputes with us.
• Upon receipt of your request related to the processing of your personal data, we will endeavour to examine it without undue delay, but in any case no later than within two months from the date of receipt. This period may be extended by a further two months depending on the complexity and number of requests. We will inform you of any such extension and the reasons for the delay.
• When submitting your request electronically, the information will also be provided electronically where possible. If you submit your request in another way, we will handle it accordingly. Where we have reasonable doubts regarding your identity, we may request additional information necessary to confirm your identity.

14. How will this Privacy policy be changed?

• All changes to this Privacy policy will be published on the Website. If necessary, we will notify you accordingly. Updated Privacy policy terms may also be provided on the Website, and you may be required to review them and agree in order to continue using the Website and/or our services.

15. How can you contact us?

• Please send all documents related to this Privacy policy using the contacts provided below:

1. by post – UAB InMedica, Juozas Balčikonis st. 3, LT‑08247 Vilnius;
2. by email – asmensduomenys@meliva.lt 

Date of last update: 2023‑06‑23