МНОГОПРОФИЛНА БОЛНИЦА ЗА АКТИВНО ЛЕЧЕНИЕ ВИТА ЕООД (МБАЛ ВИТА) is a medical institution which, for the purposes of its activity, processes personal data of individuals in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation) (GDPR), the Personal Data Protection Act, the regulatory acts in the field of healthcare, and the company's Personal Data Protection Policy.
"Personal data" is any information relating to an identified or identifiable natural person.
"Health data" means personal data related to the physical or mental health of a natural person. This data enjoys special protection, given its sensitive nature, and is processed by medical professionals bound by an obligation of professional secrecy.
"Processing of personal data" refers to actions and activities that may be carried out in relation to personal data by automated or other means.
This policy provides information regarding:
1. Who is the data controller?
„МНОГОПРОФИЛНА БОЛНИЦА ЗА АКТИВНО ЛЕЧЕНИЕ ВИТА“ ЕООД is the controller of personal data, carrying out this activity at the following address: 10 Filip Kutev Blvd., Sofia.
2. Whose data is processed?
МБАЛ ВИТА processes personal data relating to the following individuals:
- Patients, and, when necessary, their relatives;
- Staff - current and former employees of the company, job applicants, and trainees;
- Visitors to the medical facility;
- Contractors or potential contractors of the company, and their employees.
3. What are the purposes of the processing?
The need to process personal data is related to the core activity of the medical facility, the purpose of which is to provide medical services, fulfill statutory obligations in the field of healthcare, meet the requirements of labor and social legislation with regard to employees, ensure the safety of patients, employees, and property through registration, physical security and access control, video surveillance, as well as other lawful purposes, such as accounting services, information related to the Commerce Act, maintenance and security of the company's website and IT systems, protection of the company's legitimate interests, including through legal proceedings, and others.
4. Legal grounds for processing
МБАЛ ВИТА processes personal data classified as special categories - concerning health, genetic data, or data concerning sex life or sexual orientation - only where one of the conditions under the General Data Protection Regulation is met, and in particular:
- For the purposes of preventive or occupational medicine, for the assessment of the employee's working capacity, medical diagnosis, the provision of health or social care or treatment;
- In order to protect the vital interests of the data subject or of another natural person, where the data subject is physically or legally incapable of giving consent;
- For reasons of public interest in the area of public health, such as protection against serious cross-border threats to health, or ensuring high standards of quality and safety of healthcare and of medicinal products or medical devices;
- Where the individual has given explicit consent to the processing for one or more specific purposes, unless the law excludes the possibility of such consent.
Legal grounds for the processing of personal data under the General Data Protection Regulation:
- Statutory obligations of the company;
- Performance of a contract, including pre-contractual relations prior to its conclusion;
- The legitimate interests of the company, insofar as they override the interests or fundamental rights and freedoms of the data subjects;
- Freely given, specific, informed, and unambiguous consent of the data subject. Consent already given may be withdrawn by the individual at any time, in the same manner in which it was given.
5. Transfer of personal data
МБАЛ ВИТА provides personal data to:
- Competent public authorities in fulfillment of statutory provisions, including the National Health Insurance Fund, the Ministry of Health, the National Revenue Agency, the National Social Security Institute, and others;
- Related parties;
- Commercial companies providing services to the company, including for IT system support and security.
МБАЛ ВИТА takes the necessary measures to protect personal data in order to ensure its security and maintain its confidentiality.
Personal data is stored for the relevant periods, depending on the applicable legislation and the nature of the information.
Video surveillance recordings, recordings of calls to the "Information Desk," and visitor logs are stored for a period of 60 (sixty) days, in accordance with the Private Security Activities Act.
Personal data contained in accounting documents is stored for the periods specified in Art. 12 of the Accountancy Act.
МБАЛ ВИТА applies all appropriate technical and organizational measures to ensure the security of personal data, including requiring employees to undertake an explicit obligation of professional secrecy and confidentiality.
Rights of data subjects
Every individual whose data is processed by МБАЛ ВИТА has the following rights:
- the right of access to their personal data, including the right to obtain a copy of it;
- the right to rectification or completion of inaccurate or incomplete personal data;
- the right to erasure of personal data that is processed without legal grounds;
- the right to restriction of processing - in the event of a legal dispute between the company and the individual, until it is resolved, or for the establishment, exercise, or defense of legal claims;
- the right to portability of personal data concerning them that they have provided to the company, in a structured, commonly used, and machine-readable format;
- the right to object - at any time and on grounds relating to their particular situation, provided that there are no compelling legitimate grounds for the processing which override the interests, rights, and freedoms of the data subject, or a legal proceeding.
Health information may be provided to third parties when:
- the individual's treatment continues at another medical facility;
- there is a threat to the health or life of other persons;
- it is necessary for the identification of a human corpse or to determine the cause of death;
- it is necessary for the purposes of state health control, to prevent epidemics and the spread of infectious diseases;
- it is necessary for the purposes of medical expert assessment and social insurance;
- it is necessary for the purposes of medical statistics or medical scientific research, after the data identifying the patient have been removed;
- it is necessary for the purposes of the Ministry of Health, the National Center for Health Information, the National Health Insurance Fund, the regional health inspectorates, and the National Statistical Institute;
- it is necessary for the purposes of an insurer licensed under Section I of Annex No. 1, or under item 2, or under items 1 and 2 of Section II, letter "A" of Annex No. 1 to the Insurance Code;
- it is necessary for investigative, judicial, and oversight authorities.
The right of access to health information is exercised in accordance with Art. 27 of the Health Act.
Online access to the readings of imaging studies and laboratory results is provided through the company's website. In order to protect personal data, the identification number and password for online access are provided only in person. They may not be provided by telephone or sent by email.
In accordance with the Personal Data Protection Act, the rights listed above may be exercised by submitting a written request to the following address: 10 Filip Kutev Blvd., Sofia. The request must be submitted in person by the data subject or by a person explicitly authorized by them, with a notarized power of attorney, a copy of which must be provided together with the request.
A response to a request to exercise a right is prepared in paper form and is collected by the applicant at the address of the medical facility, after due identification and signing confirming that the applicant has received the requested information.
In accordance with the Personal Data Protection Act and the General Data Protection Regulation, any individual who believes that their right to the protection of their personal data has been violated may file a complaint with the Commission for Personal Data Protection at the following address: 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia; website: www.cpdp.bg.
On this page, you can change your choices at any time after you have read and understood our