FindelMedic

Data subjects and data controller

This webpage is addressed both to visitors of the website www.findelclinic.lu and to individuals who use this website or other media (forms, etc.) to communicate information to PHIAL S.A. (operating under the trade name “FindelMedic”), including medical data where applicable. For the purposes of this Policy, these individuals are referred to as “data subjects.”

The following information is provided pursuant to data protection legislation, in particular Regulation (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data (the “GDPR”), as well as applicable Luxembourg legislation, including the law of 1 August 2018. Unless otherwise stated, the terms used in this Policy have the same meaning and scope as those defined in the GDPR.

For the data processing activities listed in this Policy, the data controller is PHIAL S.A. This refers to the entity that determines the purposes and means of processing, or more simply, the entity that decides how and why your data are collected and processed.

The data controller can be contacted at the following details:

Postal address: 27 Zone d'Activités Économiques Kehlen, L-8287 Kehlen, Grand Duchy of Luxembourg
Email: contact@findelclinic.lu

For any request to exercise your rights under applicable legislation, please use these contact details.

Data collected

We collect the following data:

Identification data: last name, first name, email address, telephone number, and signature, if these data are provided to us via this website, when making an appointment, or during an interaction with FindelMedic. These data are referenced below under the symbol: [1].
Browsing data: IP address, browser type, pages visited, cookies.
Health data: only if voluntarily provided in the context of making an appointment or interacting with FindelMedic. These data are referenced below under the symbol: [3].
Banking and financial data: bank details, VAT number, bank identity identifiers. These data are referenced below under the symbol: [4].

Methods of collection

Your data are collected in several ways:

Via forms (appointment booking, contact forms, questionnaires, etc.).
During your browsing of the website (cookies and other similar technologies).
Through third-party services (for example, traffic analysis tools such as “Google Analytics”).

Legal bases for processing

The processing of your data is based on:

Your consent (newsletter subscription, acceptance of cookies)
[Article 6(1)(a) GDPR]. This legal basis is referenced below using the following acronym: [A].
Performance of a contract (appointment booking) [Article 6(1)(b) GDPR]. This legal basis is referenced below using the following acronym: [B].
Our legal and regulatory obligations [Article 6(1)(c) GDPR]. This legal basis is referenced below using the following acronym: [C].
Our legitimate interests (service improvement, security, and defense of our rights and interests in judicial or pre-litigation proceedings) [Article 6(1)(f) GDPR]. This legal basis is referenced below using the following acronym: [D].

Data retention periods

Data are retained for periods appropriate to their purpose:

3 years after the data subject’s last appointment. This legal basis is referenced below using the following acronym: [*].
Maximum 1 year from the installation of the relevant cookie or similar technology. This legal basis is referenced below using the following acronym: [**].
10 years from the last intervention by a healthcare professional or interaction (email or phone call) with a member of the data controller’s administrative staff. This legal basis is referenced below using the following acronym: [***].
10 years after issuance of the relevant invoice. This legal basis is referenced below using the following acronym: [****].

Purposes of processing

The collected data are used for:

Management of appointments and contact requests
This concerns the data categories [1], [3].
This concerns the legal bases [A], [B].
This concerns the retention period [*].
Improvement of the user experience on the website
This concerns the data categories [2].
This concerns the legal basis [A].
This concerns the retention period [**].
Security and maintenance of the website
This concerns the data categories [2].
This concerns the legal bases [C], [D].
This concerns the Retention period [**].
Compliance with legal and regulatory obligations
This concerns all of the data categories.
This concerns the legal basis [C].
This concerns the retention period [***].
Management, monitoring, and payment of invoices
This concerns the data categories [1], [4].
This concerns the legal bases [C], [D].
This concerns the retention period [****].
Defense, exercise, or enforcement of our rights and interests in judicial or pre-litigation proceedings
This concerns all of the data categories.
This concerns the legal basis [D].
This concerns the retention period [***].

Data sharing

We do not sell or share your data with unauthorized third parties. However, some data may be shared with:

Our technical providers (hosting, website maintenance).
Competent authorities, where legally required, either upon express request or where proactive disclosure is required (e.g., the CNS).

Your data are not transferred outside the European Economic Area unless you expressly request it, or the destination country is covered by a European Commission adequacy decision, or appropriate safeguards have been put in place, such as suitable contractual clauses.

User rights

In accordance with applicable law, you have the following rights regarding your personal data:

Right of access: obtain a copy of your data and the information listed in Article 15 GDPR.
Right of rectification: correct inaccurate data.
Right to erasure: request the deletion of your data, under certain conditions, in particular if it is no longer strictly necessary for processing purposes.
Right to object: object to processing and be informed of the consequences.
Right to restriction: limit the processing of your data and be informed of the consequences.
Right to withdraw consent: withdraw your consent to the processing of your data for purposes based on this separate legal basis [A].
Right to data portability: receive and transfer your data to another data controller in a structured format.

You also have the right to lodge a complaint with a competent supervisory authority, in the event of disagreement regarding how the data controller processes your data. In Luxembourg, the authority usually responsible is the National Commission for Data Protection (CNPD), which can be contacted at the following address:

CNPD
 Complaints Department
 15, Boulevard du Jazz
 L-4370 Belvaux
Or directly online via the link below:

https://cnpd.public.lu/fr/particuliers/faire-valoir/formulaire-plainte.html

Exercising your rights

For any request, you may contact us at: privacy@findelclinic.lu.

Please note that we may sometimes refuse or limit the exercise of one or more of the rights listed above, in particular where such exercise is restricted by law, subject to strict conditions that are not met, or where the rights of third parties prevail.

Changes to the policy

This policy may be updated at any time. In the event of significant changes, we will inform you via the website or by email.