Transparency Policy for Personal Data Processing

Data Protection Officer

Health Information Center Medical Karadji EOOD, EIK: 204079417
Address: Sofia, Gen. Ivan Kolev St. №33V
Presented by: Zvezdelina Lyutfi - Manager
Data Protection Contact: medical@karacitours.bg / 0878500730

INFORMATION NOTICE

for processing personal and medical data

This notice has been prepared based on the requirements of Regulation (EU) 2016/679 of April 27, 2016, on the protection of natural persons with regard to the processing of personal data (Articles 13 and 14 GDPR).

I. NATURE OF THE PROCESSED DATA

I declare that I am informed that Medical Karadji Ltd. Health Information Center processes the following categories of my personal data: 1. Ordinary data: name, phone number, email; 2. Special categories of data: health (medical) data, including, but not limited to: discharge summaries; laboratory and imaging tests; medical readings and opinions; medical history and anamnesis; personal contact information; translations of medical documentation.

II. PURPOSE OF PROCESSING

The data is processed for the purpose of: obtaining a second medical opinion; referral to a medical facility and/or medical specialist; scheduling an appointment for examination, hospitalization, and treatment; ensuring medical logistics, including transfers, accommodation, and a translator; overseeing the entire process of medical consultation and treatment.
The patient agrees to be informed via the provided contact information (phone and/or email) about the progress of their specific medical case, including obtained opinions, treatment proposals, organizational details, and necessary actions.

III. LEGAL BASIS

The processing of personal data is carried out on the following legal grounds:
– Article 6, paragraph 1, point (b) of Regulation (EU) 2016/679 – performance of a contract or steps taken at the request of the data subject;
Article 6, paragraph 1, point (c) of Regulation (EU) 2016/679 – performance of a legal obligation;
– Article 9, paragraph 2, letter (a) of Regulation (EU) 2016/679 – explicit consent for the processing of health data;
– Article 9, paragraph 2, letter „h“ of Regulation (EU) 2016/679 – provision of health services.

IV. DATA RECIPIENTS

Medical data can be provided to: specialist doctors; healthcare facilities; medical coordinators; medical documentation translators; partner organizations involved in the treatment process organization, in the Republic of Bulgaria, EU member states, and outside the EU, including, but not limited to, Turkey, Serbia, Northern Cyprus, and others, when necessary for consultation purposes or at the patient's request.

V. INTERNATIONAL TRANSFER

I am informed that my personal data, including health data, may be provided to healthcare facilities and specialists outside the European Union, including in countries that do not provide an adequate level of data protection.
I am aware that such transfers carry risks, including the possibility of access by public authorities in the respective country.
I hereby give my express consent for such a transfer when it is necessary for the provision of the medical service.

VI. MODE OF DELIVERY AND STORAGE, AND SECURITY MEASURES

Medical information is provided electronically via company email, the WeTransfer platform, or on paper and/or digital media on-site. Documentation provided on-site during an information meeting is not copied or stored. The administrator implements the following security measures: encryption, access control, organizational measures.

VII. STORAGE PERIOD

• medical data – up to 5 years
• accounting data - in accordance with the law
• video surveillance - up to 30 days

VIII. LIMITED LIABILITY

The administrator acts as an intermediary and is not responsible for the medical decisions, opinions, and actions of healthcare facilities and medical professionals. The responsibility for medical activity is borne entirely by the respective healthcare facility.

IX. PATIENT RIGHTS

I am informed of my rights under the Personal Data Protection Act (PDPA) and Regulation (EU) 2016/679 (GDPR), including the right to access, rectification, erasure, restriction of processing, withdrawal of consent, data portability, and the right to lodge a complaint with the Commission for Personal Data Protection.
I can exercise my rights by written request to the email address: medical@karacitours.bg