Privacy policy

Information note on the processing of personal data

The owner of the www.amaoptimex.ro site is AMA OPTIMEX SRL, Romanian company based in 54 Toamnei Street, District 2, Bucharest, registered at the Trade Register under No. J40/2891/1991, having a Sole Identification Code 35629 (“the Company”). The company, as a personal data controller, processes personal data safely and in compliance with the legal provisions in this field.

CATEGORIES OF DATA SUBJECTS AND PERSONAL DATA PROCESSED

Depending on the activity and the nature of the relationship it has with the person concerned, the company may process the following categories of personal data:

1. For website users:

  • Personal data collected on the basis of cookies (e.g. location data, website browsing history data, user preference data, etc.). More information on the use of cookies can be obtained by consulting the section – Cookies policy.
  • Identification data, contact details (name, surname, date of birth, phone number, email address, place of residence) and any health data provided by filling in the existing forms on the websites of the company.

2. In the case of users of social networks of the company:

  • Identification data (the name chosen on the social network, possibly, identification data and contact details provided by private messages), messages/comments from the respective social network.

3. In the case of patients:

  • Identification data (full name, date of birth);
  • Contact details (e.g.: phone number, address, e-mail);
  • The personal identification number;
  • Medical photos/videos;
  • Medical data, resulting from previous and current diagnostics, as well as from examinations and analyses carried out by the company;
  • Video recordings during surgery;
  • Photos and/or video images;
  • Testimonials;
  • Images taken over by the video surveillance system installed in the supervised areas (the entire space of the company: surroundings, entrance, waiting rooms)

4. In the case of legal representatives of under-aged patients or those who cannot validly give consent to the medical act:

  • Identification data and contact details;
  • Images taken over by the video surveillance system installed in the supervised areas (the entire space of the company: surroundings, entrance, waiting rooms).

5. In the case of legal representatives or/and contact persons of the collaborators:

  • Identification data;
  • Contact details;
  • Certificate of Empowerment;
  • Licenses / certification;
  • Images taken over by the video surveillance system installed in the supervised areas (the entire space of the company: surroundings, entrance, waiting rooms).

6. In the case of job applicants:

  • Identification data;
  • Contact details;
  • CV (including professional experience and skills);
  • Images taken over by the video surveillance system installed in the supervised areas (the entire space of the company: surroundings, entrance, waiting rooms).

7. In the case of third parties:

  • Images taken over by the video surveillance system installed in the supervised areas (the entire space of the company: surroundings, entrance, waiting rooms).

HOW WE COLLECT PERSONAL DATA

We collect the personal data you provide to us directly and voluntarily, in order to access and use the social media site/networks, to conclude/execute a contract, in order to benefit from the medical services provided by Society.

Personal data can also be obtained indirectly from third parties (for children and persons in special conditions) or through recruitment platforms (for candidates in the recruitment process).

Your personal data is collected from you verbally, by written forms, as well as by phone, if any, by means of cookies and in the form of a photo or video images.

WHAT HAPPENS IF YOU DO NOT PROVIDE YOUR PERSONAL DATA

We inform you that you are free to decide if you provide us with this personal data. However, some personal data are necessary for the provision of medical services and/or for the conclusion/ the performance of a contract, the lack of the data preventing us from providing you with medical services or to conclude/perform the contract in the case.

THE PURPOSES AND THE LEGAL BASIS FOR THE PROCESSING

The personal data collected are processed exclusively for the purposes specified in this information, as follows:

(i) The identification data, the contact details of the patients and, where appropriate, those of the legal representatives of children or persons in special conditions are processed on the basis of the performance of a contract with you, for the purpose of providing medical services.

(ii) The Personal Identification Number of the patients is processed on the basis of a legal obligation, in order to conclude the medical services contract with us.

(iii) Medical data (including medical photographs) are processed for the purpose of establishing a medical diagnosis, for the delivery of healthcare or of a medical treatment, based on an agreement concluded with a medical professional. Thus, you can benefit from consultations, further investigations, analyses, medical treatment and surgery from the Company.

(iv) The contact details provided are processed on the basis of the legitimate interest of the company for:

  • Sending informative messages prior to appointments, in order to confirm the appointments made by patients;
  • Sending post-surgery indications by e-mail, in order to make the patient’s recovery as easy as possible;
  • Requesting feedback from the patients, in order to assess and improve the services offered by the company, as well as, if applicable, for other non-commercial communications strictly related to the medical services provided or about to be provided.

(v) Video recordings captured by the video surveillance system are processed, based on our legitimate interest, for the purpose of video surveillance of the surroundings and of the company’s premises, in order to ensure the security of these areas, in order to prevent and combat crime, as well as to ensure the security and the protection of people and property.

(vi) Video recordings of surgery are processed on the basis of our legitimate interest, in accordance with Law No. 46/2003 regarding the patient’s rights, for conducting scientific discussions based on the images, as well as, in case of litigation, for evidence in court. The video recordings are taken exclusively by medical devices used and do not include any other type of images in the operating room.

(vii) We process photographs or video images of the patients and testimonials, for publication thereof in order to promote the Company or we can associate your photos with the medical file in order to facilitate your identification by the medical staff, only on the basis of your consent. Testimonials and/ or photos submitted on the www.amaoptimex.ro website may be published on any of the websites administered by the Company (www.amaoptimex.ro, www.scapadeochelari.ro, www.cataracta.ro) and/or on the social media pages of the company (all Facebook pages, Instagram page, LinkedIn page, YouTube channel, Google Business account) only on the basis of the consent of the user of the website, as expressed at the time of the transmission of the testimonial and/or photos. You are free to withdraw you consent at any time, resulting in the cessation of this processing and the removal of this personal data from our websites, from our database or from the pages of social networks where these have been made public.

(viii) Contact details, as well as those collected through cookies, will be processed for marketing purposes (e.g. receiving commercial e-mails and delivering content and personalized advertisements) only on the basis of your consent, Consent that you are free to withdraw it at any time, causing the processing to cease.

(ix) The identification data, contact details and any data concerning your health provided by filling in the existing forms on the company’s websites are processed based on the conclusion /performance of a contract, in order to be provided a medical service.

(x) The personal data of the legal representatives or/and the contacts of the collaborators are processed for the purpose of performing the contracts concluded with them, on the basis of the legitimate interest of the company to ensure the proper performance of the contract.

(xi) The personal data of the candidates will be processed for the purpose of the recruitment activity and the compatibility assessment of the candidates with the vacant position within the company for which they apply on the basis of the conclusion of a contract.

We will inform you before processing your personal data for any purpose other than those for which you have entrusted this data us. Furthermore, we properly protect your interests, rights and freedoms. Personal data are stored in a secure location as well as protected in transit. Data that are no longer needed for the fulfillment of the purpose are erased.

STORAGE DURATION

Personal data from the medical records, including the medical data, will be stored for the entire duration of the provision of medical services, as well as subsequently, according to the legal obligations of the Company.

Video recordings with you from the surveillance cameras will be stored for a period of 30 days, after which these will be automatically deleted.

Any video recordings from the operating rooms, which record the surgical operations, will be stored for a period of 3 years after the operation, given the interests of the Company that determines this processing.

If applicable, the photo/video images with you, as well as the testimonials, published for the purpose of promoting the Company or for the purpose of facilitating your identification by the medical staff, will be stored during the period of maintaining your consent regarding these, but not more than 3 years.

Your contact details will be processed for marketing purposes, if you consent to such processing, for a maximum period of 3 years or until the time of withdrawal of consent, if this moment is earlier.

If the storage of personal data is required under express legal provisions, we may continue to store your personal data for the duration provided by those legal provisions.

THIRD PARTIES

Our IT service provider has access to your personal data for the sole purpose of maintenance, along with the marketing agencies we work with, for the purpose of managing our Internet pages and social networks, if you consent to such processing.

Your personal data can be transferred to other entities that carry out a medical activity, according to S.9 (2) (h), for the establishment of a medical diagnosis, the provision of medical assistance or of a medical treatment, in order for you to benefit from all the necessary care according to the medical condition. Also, if the medical services you benefit from are settled by other entities, we may transmit data regarding the services provided to those entities, for the settlement of the services provided by us, pursuant to the performance of the agreement with you.

The Company also discloses personal data to Ama Optic (eg identification data, dioptres), based on its legitimate interest in facilitating and streamlining the lens/eyeglass procurement process based on your prescription. The data thus disclosed to Ama Optic is used solely for the purpose of ordering glasses or lenses.

TRANSFER OF PERSONAL DATA TO THIRD COUNTRIES

The company does not transfer or intendents to transfer your personal data to third countries or international organizations.

If such a transfer will be needed in the future, we will inform you in advance about this decision or intention.

AUTOMATED DECISION-MAKING

We inform you that you are not the subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.

SECURITY OF PERSONAL DATA

The Company will take all the organizational and technical measures considered necessary to ensure the security, integrity and confidentiality of your personal data.

If we discover an incident regarding the security of personal data that presents a risk to your rights and freedoms, we will notify the National Supervisory Authority for the Processing of Personal Data (ANSPDCP) within 72 hours. You will also be personally informed of the security incident if it is likely to present a high risk to your rights and freedoms.

YOUR RIGHTS

You have the following rights regarding the processing of your personal data:

(i) The right of access to personal data;

(ii) The right to obtain the rectification or erasure of personal data;

(iii) The right to obtain the restriction of processing of personal data;

(iv) The right to the portability of your personal data;

(v) The right to object to processing of your personal data.

Where data processing is based on your consent, you have the right to withdraw your consent at any time, without affect the lawfulness of processing based on consent before its withdrawal.

If you have any questions regarding the processing of your personal data or if you would like to ask us any questions, and to exercise any of your rights regarding the processing of your personal data, you can contact us:

Each request will be reviewed as soon as possible, but not later than one month. If you feel that we have not solved all your requests or are dissatisfied with our responses, you can file a complaint with ANSPDCP. You can also contact the ANSPDCP or the competent courts directly.

This information note can be amended from time to time, without affecting the rights conferred on you by the law. Any amendment will be published on the website before it becomes applicable.

DEFINITIONS:

  • “personal data” means any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
  • “processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;
  • “controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law;
  • “processor” means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller;
  • “data concerning health” means personal data related to the physical or mental health of a natural person, including the provision of health care services, which reveal information about his or her health status.