1. What is the purpose of this document?
Ledra clinic, the 'prototype' obstetrics and gynecology clinic is committed to protecting the privacy and security of your personal information. This Patient Privacy Notice describes how we collect and use personal information about you during and after your relationship with us, in accordance with the General Data Protection Regulation (GDPR) (EU) 2016/679 and the Law on the Protection of Individuals with regards to the Processing of Personal Data and the Free Movement of such Data Act of 2018 (Law 125(I)/2018) and any other applicable data protection laws and regulations.
The Clinic is a "data controller". This means that we are responsible for deciding how we hold and use personal information about you. We are required under data protection legislation to inform you regarding the information contained in this Privacy Notice.

2. Information we hold about you
Personal Data, or Personal Information, means any information about an individual from which that person can be identified or identifiable natural person; an identifiable natural person is one whose identity can be ascertained, directly or indirectly, in particular by reference to an identifier identity, such as name, ID no, location data and other. It does not include data where the identity has been removed (anonymous data). There are “special categories” of more sensitive personal data which require a higher level of protection, such as political opinions, religious or philosophical beliefs or members of trade unions, genetic data, biometric data for the sole purpose of identifying a natural person, data on health or gender data of a natural person or sexual orientation. We require to have further justification for collecting, storing and using this type of personal information. It does not include information from which the identity of a natural person has been removed, that is, it has become anonymous. We have in place an appropriate policy document and safeguards which we are required by law to maintain when processing such data.

We will collect, store, and use the following categories of your personal information:

• Personal details e.g. First Name, Surname, Sex, Birth Date, Age
• Communication data e.g. Telephone Number, Email, Address
• Photographs / Visualized Data such as CCTV footage
• Data with Social Identities e.g. ID passport
• Data regarding minors
• Next of kin and emergency contact information.
• Information related to your health insurance, such as: Insurance contract, Insurance coverage, etc.

We will also collect, store and use the following “special categories” of more sensitive personal information:

• Information about your health, including any medical conditions, health and illness records, information derived from testing or examination of a body part or bodily substance, including from genetic data and biological samples; and any information on, for example, a disease, disability, disease risk, medical history, clinical treatment or the physiological or biomedical state of the data subject independent of its source, for example from a physician or other health professional, a Clinic, a medical device or an in vitro diagnostic test.
• Medical diagnoses, examination results, assessments by treating physicians and any treatment or interventions provided;
• Genetic information and biometric data;
• Physical characteristics such as weight and height.

3. How we collect your Personal information
We collect and process various kinds of personal data that we receive from you in the following circumstances:

• You personally by filling in forms, applications and accompanying documents.
• Your representatives who are duly authorized by you to provide us with your personal data by filling out application forms and supporting documents.
• Third persons who have informed you that your personal data may be transferred to third parties, including the Clinic, based on a contractual or other relationship we have with them. Such third parties may be state or non-state entities, such as Diagnostic Centers, Physicians, Chemists, Taxation, Insurance Companies, Personal Physicians, Ministries, etc.

4. How the Clinic will take advantage of the Children's Personal Data.
We understand the importance of protecting personal data concerning children. We may collect personal data relating to children only on condition that we first obtain the consent of the parents or their legal guardian, unless otherwise permitted by the applicable law for the protection of personal data. We may collect and process personal data about children from their parents or legal guardians in the framework of a contractual relationship and / or legal obligation of our Clinic. For the purposes of this Privacy Policy, "children" are people under the age of eighteen (18).

5. How the Clinic will use your Information.
Your Personal Information will only be used where permitted by law. For the most part, they will be used in the following circumstances:

• Where necessary to execute the contract concluded with you.
• In specific cases, with your explicit consent.
• For purpose of preventive medicine, medical diagnosis, medical care or treatment, or under contract with a medical practitioner.
• Where compliance with a legal obligation must be met.
• Where it is necessary to protect your vital interests
• Where necessary for the public interest, scientific research or for statistical purposes

6. Cases in which your Personal Data will be utilized.
It is necessary that all the categories of information in the above list (see paragraph 2 above) are paramount to the execution of the contract with you, which includes use for providing medical care services and for compliance with legal liabilities.

In some cases, we may use your personal information to pursue legitimate interests of our own or those of third parties, provided your interests and fundamental rights do not override those interests.

The situations in which we will process your personal information are listed below.

• We will collect, preserve and maintain records of your personal data in order to provide you with health care services, treatments, preventative medicine services, produce a medical diagnosis or contract with medical professionals within the Company who are engaged in the provision of the most above services.
• We will send your personal data to the ‘‘Cyprus Ministry of Health’’ and any national cancer research Clinic when requested for statistical purposes.
• We will disclose your personal data to health care professionals who are not employed by the Clinic, but from whom you have received health care services, pursuant to the contract and/or previous inspection and/or consultations made with them.
• We will disclose your personal data to health care professionals who are not employed by the Clinic from whom you may receive wish to health care services or consultations from.
• We will disclose and give copies of your personal data to the named recipients you have identified (for which consent was obtained from you).
• We will store CCTV footage to ensure the security of our premises, to prevent, monitor and gather evidence for any offences or other wrongdoings that take place at our premises.
• We will disclose your personal data to insurance companies with whom you maintain a health insurance, when requested under the terms of your contract with the relevant insurance companies, for the purpose of ensuring the quality and cost-effectiveness of the procedures used for settling claims for benefits and services in the health insurance system and management of insurance claims.
• We will disclose your personal data to third party contractors, e.g. our IT consultants for the purposes of providing us with information technology services related to the operation of our company and the management and organization of the information collected during the provision of our services to you.
• Through our Website we have the option of interacting with social media, such as the "Like" option on Facebook, Twitter, Instagram. These features may allow you to access and / or link to your social media accounts. We cannot change the privacy settings of these services or set rules on how you use your personal information in them. These include your own control as well as your social networking service providers. Before using any of the social media tools suggested by our site, we recommend that you read all policies and information on the services of their respective social media outlets to find out more about their policies.

The Clinic will not share your personal data with third parties for their own purposes.

7. Automated decision-making.
Automated decision making takes place when an electronic system processes personal data for decision-making without the intervention of human intervention. The Clinic is not currently working on this kind of process. In case this is necessary, you will be informed in writing before any such process takes place.

8. If you fail to provide personal information.
If you do not provide the required information, we may not be able to enter into a contractual relationship with you for the provision of any services, including medical services, as we will not be able to examine whether your request meets the relevant requirements.

9. Change of Purpose.
We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so. Please note that we may process your personal information without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

10. Data Sharing.
We may have to share your data with third parties, including third-party service providers and other entities in the Clinic. We require third parties to respect the security of your data and to treat it in accordance with the law. We may transfer your personal information outside the EU. If we do, you can expect a similar degree of protection in respect of your personal information.

Why might you share my personal information with third parties?
We will share your personal information with third parties where required by law, where it is necessary to administer the contractual relationship with you, where you have provided your consent to us to do so or where we have another legitimate interest in doing so.

Which third-party service providers process my personal information?
“Third parties” includes third-party service providers (including IT consultants and designated agents). IT services are carried out by third-party service providers.

How secure is my information with third-party service providers and other entities in our group?
All our third-party service providers and other entities in the group are required to take appropriate security measures to protect your personal information in line with our policies. We do not allow our third-party service providers to use your personal data for their own purposes. We only permit them to process your personal data for specified purposes and according to the guidelines they receive from the Clinic. All service providers to the Clinic have entered into a contract with the Clinic for processing as Executives and accept the Clinic 's confidentiality contract as a legal agreement.

When might you share my personal information with other entities in your group?
We will share your personal information with other entities in our group [as part of our regular reporting activities on company performance, in the context of a business reorganization or group restructuring exercise, for system maintenance support and hosting of data.

What about other third parties?
We may share your personal information with other third parties, for example in the context of the possible sale or restructuring of the business. It may also be necessary to exchange your Personal Information with a Regulatory Authority or for law enforcement purposes. In this case, the Clinic will notify you of your consent to further processing your data as long as the original purpose of processing your data changes.

11. Transferring information outside the EU.
We will transfer the personal information we collect about you to non-EU countries where your doctor, health care professional or nominated recipients (for which you have provided your consent for such transfers) reside or where your health insurance is established. Such transfers will be made for the purposes of performance of your contract with the relevant doctor, health care professional or health insurance, or where your nominated recipients request information about you.

Depending on the country to which your personal data is to be transferred, there might or might not be an adequacy decision by the European Commission in respect to that country. This means that the country to which we transfer your data may or may not be deemed to provide an adequate level of protection for your personal information, but we shall transfer such personal data in compliance with the provisions under applicable data protection laws.

12. Data Security.
We have put in place measures to protect the security of your information. Details of these measures will be available upon request. Third parties will only process your personal information upon our instructions and when they have agreed to treat the information confidentially and to keep it secure.

We have applied appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorized way, altered or disclosed. In addition, we limit access to your personal information to those employees, agents, contractors and other third parties who have due to the nature of their business. They will only process your personal information upon our instructions from the Clinic and are subject to a confidentiality obligation.

We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

13. Data Retention.
Preservation is ensured for healthcare purposes (as long as it is necessary). In the case of the Clinic, personal data is kept for as long as necessary with a minimum retention time of 15 years after the death of the subject and / or 15 years after the patient's last transaction with the Clinic under the Data Protection Commissioner's Dated 03/07/2018, based on Article 23 (1) (j), Law 138 (I) / 2001.

In some circumstances we may anonymize your personal information so that it can no longer be associated with you, in which case we may use such information without further notice to you.

14. Rights of access, correction, erasure, and restriction.
Your duty to inform us of changes.
It is important that your personal information we hold is accurate and current. Please keep us informed of any personal information amendments during your working relationship with us.

Your rights in connection with personal information.
Under certain circumstances, by law you have the right to:

• Request access to your personal information (commonly known as a “data subject access request”). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.
• Request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.
• Request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see below). In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms.
• Object to processing of your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your personal information for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms.
• Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it.
• Request the transfer of your personal information to another party.

If you want to review, verify, correct, or request erasure of your Personal Information, object to the processing of your Personal Data, or request that we transfer a copy of your personal information to another party, please contact the Data Protection Officer in writing:

SIZERRO MANAGEMENT LTD c/o Christoforos Christoforou
99512278, 22328231 
dpo@sizerro.com

No fee usually required.
You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive.

What we may require from you?
We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is another appropriate security measure to ensure that personal information is not disclosed to any person who has no right to receive it.

Right to withdraw consent.
In the limited circumstances where you may have provided your consent to the collection, processing and transfer of your personal information for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. To withdraw your consent, please contact the Data Protection Officer. Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so in law.

Data Protection Officer.
We have appointed a Data Protection Officer (DPO) Christoforos Christoforou to oversee compliance with this privacy notice. If you have any questions about this privacy notice or how we handle your personal information, please contact the DPO. You have the right to make a complaint at any time to the Data Protection Office, the Cypriot supervisory authority for data protection issues at dpo@sizerro.com or the phone no 99512278.

Right to lodge a complaint.
If you feel that your concerns and questions have not been fully answered by us regarding the use of your data, you have the right to submit a complaint. You also have every legitimate right to file a complaint with the Office of the Personal Data Protection Commissioner at  https://www.dataprotection.gov.cy, which is the supervisory authority for personal data protection issues in Cyprus.

15. Cookies Policy
This site uses cookies. These are small text files stored on your device using your browser. They don't hurt.
This page uses session cookies. These are generated when the site is automatically called and deleted. They are used for identification if you revert back to the site in a short period of time, to take account of the defaults already made. Personal data are not stored or processed.
Cookies are intended to make the website user-friendly. Some cookies remain stored on your device until you delete them. They allow the site administrator to identify the browser you are using the next time you visit the site. If you don't want this, you can set your browser to inform you about setting cookies. However, disabling cookies may limit the functionality of the site.

16. Rights of access, correction, erasure, and restriction
The Clinic reserves the right to change or modify this Privacy Policy at any time deemed necessary. You will be duly notified when there are any changes or modifications to this Policy and will vary the review date on the home page. It is recommended, however, that you review this Policy periodically in order to keep abreast of the way the Clinic processes and protects your personal data.