Data processing notice

Why a separate notice

Information about your health is treated differently in law from an ordinary name and telephone number. Article 9 of the GDPR classes it as a special category of personal data, and processing it requires your explicit consent, given separately. That is why the form asks you to tick a specific declaration rather than burying it in general terms.

This is a translation for convenience. In case of any discrepancy the Hungarian version of this document prevails.

The controller

Dr. Dorina Soltész, 1036 Budapest, Bécsi út 57-61. Email: [email protected]. Telephone: +36 70 408 1068.

What is processed, and why

The form collects two kinds of information:

• Contact details — surname, first name, email address, telephone number, contact preference and the type of consultation. These are needed to reply to you and to arrange an appointment. Legal basis: your consent, Article 6(1)(a) GDPR.
• Medical history — age, sex, drug allergies, regular medication, the conditions you tick, the history of the hair loss, family history, previous treatments and hair care habits, plus anything you write in the message field. These are used to prepare the consultation and to draw up a treatment plan. Legal basis: your explicit consent, Article 9(2)(a) GDPR.

Who sees it

Only the clinic. Enquiries arrive in the clinic's own email account and are read by the treating physician and the staff preparing the consultation.

A copy of each enquiry is also kept, encrypted, in the clinic's private admin area, so that an email that fails to arrive is never lost. Only named clinic staff can open it, signing in with a one-time code, and every access is logged.

The data is not passed to third parties for marketing, is not sold, and is not used to build any advertising profile. It leaves the clinic only where a legal obligation requires it.

How long it is kept

If an appointment follows, the data becomes part of the medical documentation and is retained for the period required by the legislation on healthcare records.

If no appointment follows, the enquiry is deleted once it is clear that it has not led to treatment, and in any case on your request.

The encrypted copy on the website is kept only as long as it is needed to prepare the consultation, and is deleted sooner on your request.

Your rights

Under the GDPR you have the right to:

• withdraw your consent at any time, which does not affect the lawfulness of processing before withdrawal (Article 7(3));
• ask what data we hold about you and receive a copy (Article 15);
• request rectification of inaccurate data (Article 16);
• request erasure (Article 17);
• request restriction of processing (Article 18);
• request your data in a portable format (Article 20).