Patient register of the Psychotherapy Training and Research Centre – Privacy notice

This privacy notice applies to the patient register of the Psychotherapy Training and Research Centre of the Ģ��ֱ��.

Published

23.8.2023

What should you know about the processing of your personal data?

The Ģ��ֱ�� collects personal data about you to carry out its duties. You have rights to this data, such as the right to access the data and the right to be sure that it is stored securely and only for the necessary time. Above all, you have the right to know the following:

what information we collect about youand why,
for how long, and where we keep this information, and
to whom we share this information.

All of these points are explained in this privacy notice.

How to find the information you are looking for?

We have created this privacy notice to be as easy as possible to use and understand. That is why you will find the key points summarised under each section. If you are interested in knowing more, please follow the links in the sections or contact the data protection officer of the Ģ��ֱ��.

Contact the data protection officer

Why we process your personal data?

The Psychotherapy Training and Research Centre is located in the Department of Psychology and provides therapy services for individuals, couples, families, and groups. When you come to the Psychotherapy Training and Research Centre as a customer, your personal data are saved to our patient register for the purpose of managing the patient relationship. Your data will be used for organising, planning, implementing and monitoring the therapy and therapy-related research. In addition, the data can be used for supervising the work of the health care professionals in charge of the therapy, and also for invoicing on therapies and research as well as for monitoring and statistical reporting of the activities.

What data we process and how long?

The time we store personal data is, as a rule, 12 years after the person's death. To get more information about what personal data we collect and how long we keep certain information, check the sections below.

Data collected for the patient register include name, personal identification code, contact information, occupation, first language, family relations, appointment dates, data formed in connection with care and research, possible visual records from care situations as well as given permits and consents. The data come from the patient him/herself or are formed in connection with care and research.

As a rule, patient documents are kept for 12 years after the person’s death or, if it is not known, 120 years from the person’s birth (Decree of the Ministry of Social Affairs and Health on Patient Documents 298/2009).

What rights you have and how to exercise them?

You have the following rights:

Right to access your data.
Right to have any incorrect information corrected.
Right to have your data erased (right to be forgotten), in certain situations.
Right to restrict processing.
Right to have the responsible unit inform the party to which your data is disclosed of your data being corrected, erased, or the processing being restricted.
Right to object processing, e.g. direct marketing.
Right to have your data transferred from one system to another, when processing is based on an agreement or your consent.
Right to be notified of any information security breaches resulting in a high risk.
Right to file a complaint with the supervisory authority.
Right to withdraw consent

You can exercise your rights by sending a request to the university's Registry Office. You can use the form on the Registry Office's website or send your request informally. Keep in mind that withdrawing your consent doesn’t change the processing that happened before the withdrawal.

Get to know your rights

Use the form of the Registry Office

Send an informal request to the Registry Office

Who can access your personal data?

Register data are confidential and the staff processing personal data as well as the students involved in therapy activities are under the obligation of confidentiality and secrecy. The students sign a separate non-disclosure agreement. The obligation for secrecy and confidentiality remains also after the employment or student relationship has ended

Also, the service providers we use can access your personal data in their role as data processors. However, these providers do not actively process your personal data, but they have access to it for maintenance reasons.

Learn more about data processors

To whom we transfer your data?

Within the university, invoicing data are also processed by a financial secretary in the University’s Service Centre.

According to the Act on the Status and Rights of Patients, individual person’s data can be delivered to a third party, including scientific research at a university, only by the patient’s written consent, or if this is expressly stipulated by law. When data delivery requires the patient’s consent, the person has the right to withdraw the consent at any time.

The data will not be transferred outside the EU/EEA area.

On what basis we process your personal data?

We process your personal data based on legal grounds, agreements, or your consent. If you want to dive deeper into our legal bases, such as the relevant legal provisions, you can find more information through the menu below.

The processing of personal data is necessary to fulfil the controller’s legal obligation. The legal basis for this:

EU General Data Protection Regulation (GDPR; EU 2016/679, Article 6.1c): The processing of personal data is necessary to fulfil the controller’s legal obligation.

EU General Data Protection Regulation (GDPR; EU 2016/679, Article 6.1b): Processing is necessary in order to implement an agreement involving the data subject, or in order to perform necessary actions preceding this agreement as requested by the data subject.

Patient data are confidential (Act on the Status and Rights of Patients 785/1992, Section 13) and the personnel and health care professionals are under the obligation of secrecy concerning all private information received in connection with patient care.

How to contact us?

If you want more information about the processing of your personal data, do not hesitate to contact our data protection officer via email or phone (+358 40 805 3297).

Contact our data protection officer

Below you find the contact information of the responsible unit. If you wish, you can directly contact the unit instead of the data protection officer.

If you want to exercise your rights (withdraw your consent for example) you can contact the Registry Office by email:

Send a request to the Registry Office

Ģ��ֱ��