Privaatsuspoliitika, Sakala Hambaravi teenuste osutamisel
Book a visit

Book a dental appointment

Instead of calling, you can book an appointment with the dentist here
Start booking - choose the necessary dental treatment service, dentist and suitable visit time.
BOOK TIME

Privacy Policy

SAKALA HAMBARAVI PRIVACY POLICY

Last modified on 12 September 2023

  1. Application of the Privacy Policy 
    1. This Privacy Policy (hereinafter: Privacy Policy) applies in all cases when OÜ Bluegate (hereinafter: Sakala Hambaravi) processes the personal data of natural persons (hereinafter: Data Subject) as a controller, for the provision or offering of dental care and related services (hereinafter: Service) to a patient (hereinafter: Patient). This Privacy Policy also applies in situations where a Data Subject is applying for a job at Sakala Hambaravi or Sakala Hambaravi is actively looking for a new employee.
    1. The Privacy Policy is effective as of the date stipulated above. Sakala Hambaravi has the right to unilaterally amend and supplement the Privacy Policy. Data Subjects will be notified of changes to the Privacy Policy by e-mail or other means.
    1. In processing personal data, Sakala Hambaravi complies with the European Union General Data Protection Regulation No. 2016/679 (hereinafter: GDPR) and other applicable legislation regulating the protection of personal data. In this Privacy Policy, the terms (controller, personal data, processing, etc.) are used in accordance with the GDPR.
    1. For Sakala Hambaravi, the protection of the personal data of Data Subjects (including Patients) is extremely important. Please read this Privacy Policy carefully to understand how Sakala Hambaravi processes personal data.
  1. The controller
    1. The controller of the personal data of the Data Subjects is OÜ Bluegate, registry code 10871635, with place of business at Kotka 12, Tallinn, 11315 and registry address at Nõlvaku Str 1, Muraste village, Harku Parish, 76905.
    1. In all matters related to the Privacy Policy and the processing of personal data, you can contact the data protection specialist of Sakala Hambaravi, by sending an inquiry to the e-mail address andmekaitse@sakalahambaravi.ee. 
  1. Purposes, categories and legal bases of processing of personal data
    1. Below, we shall give an overview of the purposes for which Sakala Hambaravi processes personal data (i.e. why personal data is processed), which personal data Sakala Hambaravi processes and what the legal bases for processing personal data in accordance with applicable legislation are.
Purpose of processing personal data  Personal data that is processed Legal basis for the processing of personal data
Carrying out procedures prior to the provision of the Service, incl. registration for an appointment and communication within the framework of preparing for the Service. Contact details of the Patient (including name, address, phone number and e-mail address); the reason why the Patient wants to come to the appointment; the Patient's personal identification code, date of birth, gender and data related to identifying the person; data related to booking the appointment, including the place, time and content of the appointment; other data that the Patient may disclose.

The Patient's health data that is relevant to preparing the health care service (incl. data on the state of health, previous diseases, currently received treatment, etc.); data on health insurance.

If a parent or a guardian (or other representative) registers their child or a person under their guardianship (or other person they represent) for an appointment as a Patient, the contact details (including name, address, phone number and e-mail address) and personal identification code of the parent, guardian or other representative and their connection with the Patient.

If a person is communicated to by phone, the phone call may be recorded.

 When planning the provision of a health care service (incl. dental treatments), Sakala Hambaravi processes the Patient's personal data (incl. health data) on the basis of § 4¹, subsec. 1 and subsec. 1¹, clause 1 of the Health Services Organisation Act (hereinafter: HSOA).

If a Patient contacts Sakala Hambaravi for a Service other than health care services, the basis for the processing of personal data is the Patient's request within the meaning of Article 6, section 1, clause b of the GDPR.

The personal data of the Patient's parent, guardian (or other representative) is processed for the performance of the legal obligation of Sakala Hambaravi in accordance with Article 6, subsec. 1, clause c of the GDPR.
Providing a Service and performing the necessary procedures for this purpose, incl. the Patient coming for the appointment, treating the Patient (diagnosing and treating an illness or injury in order to alleviate the Patient's ailments, prevent deterioration of the state of health or exacerbation of the disease and restore health), and communication within the framework of the provision of the Service. Contact details of the Patient (including name, address, phone number and e-mail address); the Patient's personal identification code, date of birth, gender and data related to identifying the person; data related to the booking of the visit, including the place, time and content of the visit; other data that the Patient may disclose. 

When providing a health care service, the Patient's health data (incl. data on the state of health, previous diseases, the treatment currently received, the health service provided to the Patient, etc.); data on health insurance.

If the Patient is a child, a ward or a person represented, the personal data of the parent, guardian or representative (incl. name, personal identification code, address, phone and e-mail address) and connection with the Patient. 

If a person is communicated to by phone, the phone call may be recorded.

The Patient's payment data (e.g. bank account number) or, if another person pays the bill for the Patient, their payment data when paying for the Service.

 When providing a health care service, Sakala Hambaravi processes the Patient's personal data (incl. health data) on the basis of § 4¹, subsec. 1 of the HSOA. 

If Sakala Hambaravi provides the Patient with a Service other than a health care service, the processing is based on the Service Contract concluded between the Patient and Sakala Hambaravi in accordance with Article 6, section 1, clause b of the GDPR.

The personal data of the Patient's parent, guardian or representative are processed for the performance of the legal obligation of Sakala Hambaravi in accordance with Article 6, section 1, clause c of the GDPR.

If a person other than the Patient pays for the Service, Sakala Hambaravi processes the respective payment data on the basis of its legitimate interest (on the basis of Article 6, section 1, clause f of the GDPR). The legitimate interest of Sakala Hambaravi is to receive a fee for the provided Service and to process the payer's personal data.
If a Patient has appointed a person as a contact person or the Patient is a child or under guardianship, then forwarding information related to the Patient to the aforementioned person. Contact details of the contact person, parent or guardian (including e-mail address and phone number).  When providing a health care service, Sakala Hambaravi processes the Patient's personal data (incl. health data) for the provision of the health care service on the basis of § 4¹, subsec. 1 of the HSOA, and the personal data of a contact person, parent or guardian is processed by Sakala Hambaravi for the performance of its legal obligation (Article 6, subsec. 1, clause c of the GDPR).
Issuance of medical records. Patient's health data according to a specific treatment document.  When issuing a treatment document, Sakala Hambaravi processes the Patient's health data for the provision of a health care service on the basis of § 4¹, subsec. 1 of the HSOA or on the basis of the Patient's consent (Article 9, subsec. 2, clause 1 of the GDPR).
Handling and responding to received proposals and complaints. Data related to the complaint or proposal submitted by a Patient, their parent, guardian or other representative (including the contact details of the complainant). Sakala Hambaravi processes the Patient's personal data (incl. health data) on the basis of § 4¹, subsec. 1 of the HSOA. In other respects, Sakala Hambaravi processes personal data on the basis of its legitimate interest (Article 6, subsec. 1, clause f of the GDPR). The legitimate interest of Sakala Hambaravi is to respond competently to proposals and complaints and to take appropriate measures.
Ensuring the quality of the health care service. This may also include sending a satisfaction survey to the Patient's contact e-mail address after the Service has been provided, with the aim of receiving feedback and analysing it and improving the Service. Patient's health data. Also, the Patient's contact details (incl. name and e-mail address) and the information received in the feedback.  Sakala Hambaravi processes personal data to ensure the quality of the health care service on the basis of § 41, subsec. 11, clause 2 of the HSOA. The contact details are processed by Sakala Hambaravi on the basis of legitimate interest pursuant to Article 6, subsec. 1, clause f of the GDPR. The legitimate interest of Sakala Hambaravi is to ask for feedback on the provided Service with the aim of improving its Service.

 
A reminder to a Patient about the latest appointment with a proposal to come to a new appointment. Contact details of the Patient (including name and e-mail address) and the time and content of the last appointment. Sakala Hambaravi processes personal data either with the Patient's prior consent (Article 6, subsec. 1, clause a of the GDPR) or on the basis of legitimate interest according to Article 6, subsec. 1, clause f of the GDPR. The legitimate interest of Sakala Hambaravi is to remind the Patient that a long time has passed since his/her last appointment and to make a proposal to come for a new appointment.
Processing the personal data of job applicants and new potential employees for the purpose of assessing their suitability for the job. Personal data of job applicants (incl. information revealed by the applicant: name, e-mail address, phone number, address, CV, education, work experience, skills, etc.) as well as other personal data of new potential employees found in public sources. If a person applies for a job at Sakala Hambaravi on their own initiative, his/her personal data will be processed in accordance with the person's request (Article 6, subsec. 1, clause b of the GDPR), in order to take measures required prior to the conclusion of the contract.

If Sakala Hambaravi itself is actively looking for a new potential employee, the legal basis for the processing of personal data is the legitimate interest of Sakala Hambaravi (Article 6, subsec. 1, clause f of the GDPR). The legitimate interest of Sakala Hambaravi is to find new employees.

If the person was not hired, but Sakala Hambaravi wishes to keep the personal data of the job applicant or the potential employee it was actively looking for, after the recruitment process, then Sakala Hambaravi does so only with the consent of the respective person (Article 6, subsec. 1, clause a of the GDPR). 
To comply with the obligations Sakala Hambaravi has arising from applicable law. Personal data of the Data Subject in accordance with the obligation that Sakala Hambaravi must comply with. In connection with the provision of health care services, the legal basis is § 4¹, subsec. 1 of the HSOA. Otherwise, the legal basis is Article 6, subsec. 1, clause c of the GDPR.

 
Implementation of Sakala Hambaravi's rights arising from the applicable law and arising from the Service Contracts concluded with the Patients. Personal data of the Data Subject in accordance with the right exercised by Sakala Hambaravi. Health data is processed by Sakala Hambaravi on the basis of Article 9, subsec. 2, clause f of the GDPR. Other personal data is processed by Sakala Hambaravi on the basis of Article 6, subsec. 1, clause f of the GDPR, i.e. on the basis of a legitimate interest. The legitimate interest of Sakala Hambaravi is to protect and exercise its rights as it sees fit. 
  1. Sources of personal data and voluntary disclosure
    1. Sakala Hambaravi processes personal data that it receives both directly from a Patient and from third sources. Such a third source can primarily be the Patient's representative (e.g. a parent or a guardian), Tervisekassa (the Health Insurance Fund), Patsiendiportaal (the Patient Portal) information system, Retseptikeskus (the Prescription Centre), Pildipank (the Image Bank) or another health-related IT environment. 
    1. The disclosure of personal data to Sakala Hambaravi is voluntary, but if the Patient decides not to disclose the data, the Patient cannot book and/or use the Services offered by Sakala Hambaravi.
  1. Storage of personal data
    1. Sakala Hambaravi does not store personal data for longer than is necessary for the purpose of processing personal data on the basis of the applicable law.
    1. On the basis of the Health Services Organisation Act, Sakala Hambaravi stores:
      1. data proving the provision of outpatient and inpatient health care services, as a rule, for 30 years from the confirmation of the data of the health care service provided to the Patient;
      1. information system logs of Sakala Hambaravi as a health care service provider for 5 years; 
      1. feedback collected to assess a Patient's satisfaction for 5 years from the date of receiving the feedback.
    1. On the basis of the Accounting Act, accounting documents are stored for 7 years from the end of the relevant financial year. 
    1. As a general rule, Sakala Hambaravi stores the data collected for entering into a contract with the Patient, the longer storage period of which does not arise from the applicable law, for as long as it is needed in connection with the performance of the contract during the validity of the contract or up to 5 years after the termination of the contract.
    1. If a Service is not provided to the Patient (e.g. the appointment is booked, but the Patient does not arrive for the appointment), Sakala Hambaravi stores personal data for up to 1 year after the last contact with the given Data Subject. 
    1. The data collected about a job applicant or a person actively sought for a job by Sakala Hambaravi, in order to assess the suitability for the job, will be deleted immediately after the end of the recruitment process if no employment contract is concluded with the person. Alternatively, if a person is asked for and grants consent to store data for a longer period of time, the data will be stored until the consent is withdrawn (but in any case for no longer than 3 years). 
    1. In the Health Information System (to which Sakala Hambaravi is obliged to forward the Patient's health data – see section 6.3 below), as a general rule, health data is stored indefinitely, except for dental radiographs, which are stored for 15 years.
  1. Transfer of personal data to third parties
    1. Pursuant to § 768 of the Law of Obligations Act, a health care service provider and the persons participating in the provision of health care services are obliged to adhere to the confidentiality of the data that has become known to them during the provision of health care services or during the performance of their duties regarding the Patient's identity and the state of his/her health.
    1. Sakala Hambaravi does not transfer personal data to third parties, unless such a right is provided for by the law for Sakala Hambaravi or if the transfer of personal data to third parties is necessary for the provision of the Service to the Patient.
    1. When providing a health care service to a Patient, Sakala Hambaravi transfers, on the basis of the applicable law, health data (dental card) to the Health Information System, which is a central state-operated database, and the personal data about the Patient stored there can be seen by the Patient on the Patient Portal (https://id.digilugu.ee). The controller of the Health Information System is the Ministry of Social Affairs. In case of questions related to the Patient Portal, the Patient can contact the helpdesk of the Health and Welfare Information Systems Centre by phone +372 794 3943 or e-mail abi@tehik.ee.
    1. When providing a health care service to a Patient, Sakala Hambaravi may, if necessary, transfer and/or receive the Patient's health data on the basis of the applicable law through an image bank, the controller of which is Sihtasutus Eesti Tervishoiu Pildipank (Estonian Health Care Image Bank Foundation) (registry code 90007945, address Puusepa 8, 51014, Tartu). If you have any questions about the image bank, you can contact their helpdesk by phone +327 5331 8888 or by e-mail at abi@pildipank.ee.
    1. When providing a health care service to a Patient, Sakala Hambaravi may transfer the Patient's health data (dental card) to Tervisekassa (Health Insurance Fund) (registry code 74000091, address Lastekodu 48, 10113 Tallinn), if Tervisekassa pays the Patient's medical bill in part or in full from health insurance funds. If you have any questions about Tervisekassa, you can contact them by phone +372 669 6630 or by e-mail info@tervisekassa.ee. 
    1. When providing a health care service to a Patient, Sakala Hambaravi may, if necessary, forward and/or receive the Patient's health data on the basis of applicable law through the Prescription Centre, the controller of which is Tervisekassa (the Health Insurance Fund). If you have any questions about the Prescription Centre, you can contact the helpdesk of the Health and Welfare Information Systems Centre by phone +372 794 3943 or by e-mail at abi@tehik.ee.
    1. If the Patient has health insurance, Sakala Hambaravi may transfer the health data (dental card) to the respective insurer who has a corresponding insurance contract with the Patient.
    1. When providing a Service to a Patient, the Patient's personal data (incl. health data) may be forwarded to the dental care programme service provider HAMMAS (Innovaatik OÜ; registry code 11439963, address Aleksandri tn 9, 51004, Tartu).
    1. Sakala Hambaravi transfers to the parent or guardian the data reflecting the Patient's health condition in accordance with the law. This happens only in case the Patient or the investigating body (e.g. the police) has not prohibited the transfer of the data. 
    1. If a Patient wishes to use the hire-purchase service, Sakala Hambaravi will forward the Patient's contact details and payment data (e.g. bank account number) to the hire-purchase service provider for concluding the hire-purchase agreement. The controller of this personal data is the respective hire-purchase service provider.
    1. Based on the applicable law, Sakala Hambaravi may be obliged to transfer personal data to a court or law enforcement authorities based on a regulation issued by the relevant body on the basis of applicable law or, for example, if the transfer of personal data is mandatory under the Insurance Activities Act in connection with an inquiry made by the insurer. In all such cases, Sakala Hambaravi will transfer personal data only if it is mandatory under applicable law and in compliance with all the principles applicable to the processing of personal data.
  1. Rights of a Data Subject with regard to the processing of personal data
    1. A Data Subject (incl. a Patient) has the right to contact Sakala Hambaravi at any time with a corresponding request at the e-mail address andmekaitse@sakalahambaravi.ee in order to: 
      1. request access to the personal data concerning the Data Subject, i.e. to view the personal data that Sakala Hambaravi has processed and collected in relation to the Data Subject;
      1. request the correction of personal data;
      1. request the deletion of personal data;
      1. restrict the processing of personal data;
      1. object to the processing of personal data;
      1. request the transfer of personal data;
      1. demand that no decision be taken regarding the Data Subject based on automated processing;
      1. withdraw the consent given to the processing of personal data;
      1. submit a complaint to the data protection specialist of Sakala Hambaravi or to the Data Protection Inspectorate (Tatari 39, 10134, Tallinn; e-mail address info@aki.ee).
    1. In accordance with the provisions of applicable law, Sakala Hambaravi may have the right to refuse to comply with the Data Subject's request, in which case Sakala Hambaravi will explain this to the Data Subject.
  1. Final provisions
    1. The website of Sakala Hambaravi contains links to third party websites (hereinafter: Third Party Websites). Third Party Websites may be subject to terms and conditions different from this Privacy Policy, the implementation of which cannot be controlled by Sakala Hambaravi. Sakala Hambaravi is not responsible for the privacy policies of Third Party Websites or for the processing of personal data through Third Party Websites.
    1. Sakala Hambaravi uses cookies on its website www.sakalahambaravi.ee. Cookies are small data files that are stored on the website visitor's device. Sakala Hambaravi uses only cookies necessary for the functioning of the website. The cookies do not collect any personal data. 

Read more about our services here.
Read more about oral health here.