Data Privacy Policy

This privacy policy provides information on the processing of personal data of private customers at Euromedfin Oy (hereinafter “Medfin”) in accordance with data protection legislation.

Data controller

Euromedfin Oy / Medical Centre Medfin Itämerenkatu 11 EF, 00180 Helsinki Tel.: +358 10 574 39 70

The Medfin patient register is jointly used both by Medfin itself and by various healthcare service providers working at Medfin as independent professionals or through separate legal entities.

Purposes and legal bases for processing personal data

Personal data are processed for the following purposes and on the following legal bases:

Provision of healthcare services – based on law Provision of occupational health / occupational hygiene services – based on law or the customer’s consent Assessment of the need for work ability and health promotion services, as well as their provision and personalisation – based on the contract between the customer and Medfin, law or legitimate interest Ensuring the quality of healthcare professionals’ work – based on law Carrying out marketing and/or communication activities – based on the customer’s consent, a contract or Medfin’s legitimate interest Planning, development, management, monitoring and reporting of Medfin’s own services and operations, quality assurance and data management – based on law or Medfin’s legitimate interest Research and statistical purposes – based on consent, law, public interest or Medfin’s legitimate interest Processing customer contacts, feedback, official requests and incident reports – based on law or Medfin’s legitimate interest Provision of digital services for registered users – based on law, the contract between the customer and Medfin or the customer’s consent Invoicing, payment processing and debt collection – based on law or the contract between the customer and Medfin Detecting and resolving technical faults in IT services (such as websites, applications) or devices – based on Medfin’s legitimate interest Monitoring users’ behaviour and use of digital services – based on legitimate interest or the customer’s consent Ensuring the legal protection of Medfin and the customer, fulfilling obligations under laws and regulatory provisions/instructions, detecting misuse and monitoring the use of services – based on law or legitimate interest

More detailed information on purposes of processing

Personal data are processed for the provision of healthcare services:

For organising, planning, providing, monitoring and supervising medical examinations and treatment of the patient For managing appointments For invoicing the services provided As part of the provision of healthcare services, data on health status generated in connection with the use of healthcare services are analysed automatically for healthcare purposes, such as health promotion (profiling).

Personal data are processed for the provision of occupational health / occupational hygiene services:

For planning, providing and monitoring occupational health examinations and treatment For assessing work ability For implementing an individual occupational health / occupational hygiene action plan For managing appointments; if the service includes profiling-based booking, profiling is carried out only with the patient’s consent For invoicing and statutory and/or group-level reporting to customer organisations As part of the provision of healthcare services, health data generated in connection with the use of healthcare services are analysed automatically, for example, to assess the need for work ability support and to promote employees’ health (profiling).

Personal data are processed for the provision of work ability and health promotion services:

For providing work ability coaching For providing services aimed at improving health.

Personal data are processed to ensure the quality and proper performance of duties by healthcare professionals:

To ensure the correct use of medical information and compliance with procedures.

Personal data are processed for marketing and communication purposes:

For customer service, such as reminders about visits, renewal of prescriptions and vaccinations For informing about clinical studies with the patient’s consent For collecting, analysing and improving services based on customers’ interests, preferences and choices of services and service locations For registering and promoting loyalty/benefit programmes and related offers For taking into account customer wishes and personalising offers For promoting products and services For targeting communication, marketing and services For conducting market research and opinion surveys For analysis, profiling, segmentation and statistics for the above purposes.

Personal data are processed for handling customer contacts, feedback, official requests and incident reports:

For handling customer contacts and feedback For handling complaints in accordance with the Patient Rights Act For handling other official requests For handling reports of incidents posing a risk For recording communication (such as telephone calls) between customers and customer service in order to verify the interaction, ensure service quality, develop operations and safeguard the rights of the parties.

Personal data are processed for the provision of digital services for registered customers (for example, the Oma Medfin app, web portal):

For managing the user’s own contact details and expressed consents, as well as for viewing medical data For managing appointments For using remote healthcare services For communication and exchange of information between the customer and Medfin For processing payments related to services For offering and marketing services and products of the controller or its partners For sending health-related notifications and recommendations via the service For tracking, analysing and profiling the user’s interests, preferences and choices, and for improving customer service.

Categories of personal data processed

We process the following personal data:

Basic information Medical data Data related to work ability Data related to wellbeing Genetic test data, samples and organ models Employer data Appointment data Customer service interaction data and recordings Invoicing and payment data Data on digital services for registered customers (for example, the Oma Medfin app, Medfin web service) Data on customer contacts, feedback, official requests and incident reports Other service-related data Data on the use of means and services of identification and authentication Data on the use of the website and digital services, online behaviour and analytics Consents, refusals and expressions of will

More detailed information on personal data categories

Basic information

Name, personal identity code, date of birth, contact details, mother tongue or service language, occupation, as well as other identification data (for example, a copy of passport if necessary); the next of kin or other contact person indicated by the patient with their contact details; guardians or other legal representatives of a minor patient with their contact details; information about a minor child for whom the patient is responsible; information on the patient’s role as a carer (omaishoitajuus); the legal representative appointed for the patient and their contact details

Medical data

Information necessary and sufficient for organising, planning, providing, monitoring and supervising the patient’s treatment (for example: medical record entries, photographs, video and audio recordings, referrals, statements, certificates, forms) Health and self-care information provided by the patient (for example, medical history, responses to questionnaires) Laboratory, radiology and other examination results Prescriptions and related notes Data related to physiotherapy and occupational physiotherapy, as well as related employer information (for example, workplace visits)

Data related to work ability

Information related to the assessment of work ability Customer data used in work ability services

Data related to health and wellbeing

Information related to health, such as responses to questionnaires, monitoring data and analyses Measurement data entered or provided by the person themselves Data on the use of health-related services

Employer data

Information about the employer of occupational health customers, such as department/unit, job title, supervisory relationships, membership in a sickness fund, information on the employer’s insurance company

Appointment data

Customer, date, time, place and the professional with whom the appointment is booked, as well as the person who made the booking and the booking date Appointment history

Customer service interaction data and recordings

Communication between Medfin and the customer Caller’s phone number, recipient’s identifier, date and time, and call recording Chat logs Parties to the communication, date and time, and recording of the conversation

Payment and billing data

Information on invoices and payments related to treatment and other services Information on the payer of treatment (for example, insurance company) Orders, payments and payment information related to the use of the online service

Data on digital services for registered customers (for example, the Oma Medfin app)

Information on health status and any mobility limitations, injuries, diseases and other complaints indicated by the user Other information entered by the user concerning their state of health and physical condition Payment data Communication between the customer and Medfin Data necessary for the implementation of remote appointments, such as audio and video, as well as images sent by the user Location data of the user’s device (if the user has allowed the processing) – in order to offer service points close to the user Data on the use of identification and authentication systems and means Usage logs and user actions in digital services

Data on customer contacts, feedback, official requests and incident reports

Customer contact, feedback or request and the responses given Contact details provided by the person submitting the contact or feedback Description of the incident and the information provided to the person concerned

Data related to other services

Name, position and time of entry of the person making an entry in the patient record Client data from social services obtained for organising and providing healthcare services Data on satisfaction and comments on the services of the data controller Information on wishes and preferences, as well as desired services of the user Responses provided in the context of market research and opinion surveys Contact history Data obtained from third-party registers with the explicit consent of the user Loyalty customer information

Data on the use of the website and digital services, online behaviour and analytics

User’s IP address and data on their network connection Information on the user’s device, browser and operating system Session identifier, timestamps and similar data Data on the use of applications and services, including data collected using logs, cookies and other similar technologies, as well as website analytics User’s behaviour on the website during the session

Consents, prohibitions and expressions of will

Permissions, consents and prohibitions related to the disclosure of data via Kanta services Organ donation wishes, living will and other expressions of will of the patient Information on consent or prohibition regarding direct marketing and the processing of personal data

Retention periods for personal data

Medfin stores only those data that are necessary for its operations and the purposes of processing, and for which there is a lawful basis. The retention period depends on the purpose of processing and/or the type of data. Retention periods are also affected by statutory obligations and other factors determining the need for storage (for example, limitation periods for claims or criminal proceedings).

Medical data related to the patient’s treatment are retained in accordance with the Act on the Processing of Client Data in Healthcare and Social Welfare: as a rule, 12 years from the patient’s death or, if the date of death is not known, 120 years from the date of birth. Customer service interaction recordings are generally retained for six months.

Medfin also deletes data that have become unnecessary for the stated purpose, including during the customer relationship (for example, data related to marketing or the use of web services). Data that are outdated, no longer relevant or lack a legal basis are anonymised or destroyed in a secure manner.

Sources of data

Personal data are generally collected from the customer themselves, from the patient’s legal representative or from the parent of a minor. Data are also obtained in the course of examination and treatment – from healthcare staff, medical devices and software.

The healthcare provider may obtain patient data from other healthcare organisations and social services via the Kanta service in accordance with the patient’s permissions (consents) and prohibitions on data disclosure. Data may also be obtained through a shared information system.

Permissions and prohibitions can be managed via the OmaKanta service (www.kanta.fi/omakanta) or through the healthcare provider. If the patient is unable to give informed consent (for example, due to dementia, mental disorder, disability) and has no legal representative, or if the patient is unconscious, the healthcare provider may obtain necessary data from other organisations without consent in order to provide necessary care.

Basic client information may be updated from the Digital and Population Data Services Agency’s register (Digi- ja väestötietovirasto).

In the context of occupational healthcare, data may be obtained from the employer – including contact information and changes to it.

Data may also be obtained from other healthcare organisations with the patient’s consent or on a statutory basis, and in certain cases from insurance or pension companies.

Processing and disclosure of personal data

The Medfin patient register is jointly used with healthcare service providers working at Medfin as independent practitioners or separate companies. The patient may give consent to the disclosure of their medical data between such providers involved in their treatment within Medfin.

Additional information:

Personal data may be transferred outside the EU or EEA within the limits permitted by law. In such cases, the transfer is carried out using the European Commission’s standard contractual clauses or another transfer mechanism permitted by data protection legislation. However, for example, Medfin’s medical data systems are located within the EU/EEA.

In certain situations, personal data may be disclosed to service providers acting as independent data controllers, such as companies providing payment, financial or debt collection services, as well as delivery and courier companies.

Disclosure of personal data

Personal data may be disclosed to third parties on a statutory basis or with the customer’s consent to the following recipients:

Kanta services (Kela)

Patient medical data are stored on a statutory basis in national data system services maintained by Kela, such as the client data repository. The information management service compiles up-to-date summary information from patient records that is essential for providing healthcare. Kela and healthcare providers act as joint controllers of the information management service. Kela acts as the statutory point of contact and is responsible for the disclosure of data. More information on the joint register of the information management service: www.kanta.fi/tietosuojaselosteet. In the expressions-of-will service, records are kept of informing the patient about Kanta services, their consents, prohibitions and expressions of will (for example, living will, organ donation wishes). Electronic prescriptions and, where applicable, information on dispensed medicines are stored in the Prescription Centre. The joint controllers of the Prescription Centre are Kela, pharmacies, healthcare units and independent practitioners.

Kela acts as the statutory controller for the registers assigned to it by law. More information: www.kanta.fi/tietosuojaselosteet.

Other healthcare units

Information necessary for providing healthcare may be disclosed to another healthcare provider with the patient’s consent or in accordance with the permissions and prohibitions recorded in Kanta. If, due to dementia, mental illness, disability or a condition comparable to unconsciousness, the patient is unable to give informed consent and has no legal representative, necessary medical data may be disclosed without consent in order to provide necessary care.

Kela

Information concerning fees for medical services and referrals is disclosed to Kela if the customer requests Medfin to apply for reimbursement on their behalf.

Insurance companies

For statutory insurance, necessary data are disclosed without consent on a statutory basis. For voluntary insurance, data are disclosed only with the patient’s consent.

Employers

In the context of occupational healthcare, information may be disclosed to the employer only with the patient’s separate and explicit consent.

Authorities and institutions

Data may be disclosed in written form and to the extent required by law to authorities or institutions that have a statutory right to receive them, or with the customer’s consent.

Close relatives of the patient

If an adult patient is unable to decide on their treatment, a legal representative, next of kin or other close person has the right to receive necessary information about the patient’s treatment. If the patient is unconscious or in a comparable condition, information may be provided to a close person unless there is reason to believe that the patient has prohibited this.

Research organisations

Data contained in patient records may be disclosed for research purposes with the customer’s consent. After the patient’s death, the data remain protected and may only be disclosed on a statutory basis. In accordance with the Communicable Diseases Act, data may be disclosed to the Finnish Institute for Health and Welfare (THL) and regional health authorities for monitoring epidemics.

Rights of the data subject

Right of access to personal data

The data subject has the right to know whether their personal data are being processed and to access the data concerning themselves. The data subject can view and access their data via digital services intended for registered customers (for example, the Oma Medfin app and Oma Medfin web portal), as well as via the OmaKanta service (www.kanta.fi/omakanta). In addition, the data subject may submit an official request for their personal data.

Right to rectification of data

The data subject has the right to request the rectification of inaccurate or incomplete personal data. The data subject has the right to request the deletion of their personal data. Requests for deletion are fulfilled to the extent permitted by law. With regard to health data, Medfin is legally obliged to retain such information in accordance with the Act on the Processing of Client Data in Healthcare and Social Welfare.

Right to object to processing and to restrict processing

In certain cases, the data subject has the right, at any time, to object to the processing of their personal data on grounds relating to their particular situation. In certain situations, the data subject has the right to request the restriction of the processing of their personal data. For example, if the data subject contests the accuracy of their data, processing is restricted for the duration of the verification.

Right to data portability

The data subject has the right to request the transfer of data they have provided from one system to another when processing is based on consent or a contract. However, this right does not apply to medical data.

Right not to be subject to automated decision-making

The data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them. Legislation may, however, provide exceptions to this rule.

Withdrawal of consent

If the processing of personal data is based on consent, the data subject may withdraw their consent at any time. The withdrawal may be carried out in the relevant service or by contacting customer service.

Right to lodge a complaint with a supervisory authority

The data subject has the right to bring the matter before the Data Protection Ombudsman if they consider that the processing of their personal data breaches data protection legislation.

More information can be found on the website of the Office of the Data Protection Ombudsman: www.tietosuoja.fi.

Requests concerning the exercise of data subject rights must generally be submitted in writing directly at a Medfin office. The identity of the person submitting the request is verified in a reliable manner. At the Medfin office, this is done on the basis of an official identity document. In this way, the confidentiality of personal data and the proper handling of requests are ensured.

Protection of personal data

Medfin applies physical, technical and administrative security measures to protect data against misuse: monitoring and filtering of network traffic, use of encryption technologies and secure servers, locking systems and access control, management of access rights and monitoring of their use, staff training, and risk management at all stages from design to maintenance. Medfin’s subcontractors are carefully selected and are required to comply with data protection legislation and good practices as set out in contracts.

Contact information

Medfin / Medical Centre Medfin Itämerenkatu 11 EF, 00180 Helsinki Tel.: +358 10 574 39 70 Data Protection Officer: Olga Loginov — olga.loginov@medfin.fi Patient Ombudsman: Marina Meier — marina.maier@medfin.fi ⚠️ Please do not send medical information or other sensitive personal data (such as a personal identity code) by regular email.