This document provides information on what personal data we process, for what purposes, on what legal basis, for how long, and what rights you have in connection with the processing of personal data.
1. Controller
The controller is:
ON CLINIC, s.r.o.
with its registered office at Olivova 948/6, 110 00 Prague 1 – Nové Město
Company ID (IČO): 25668536
VAT ID (DIČ): CZ25668536
registered in the public register kept by the Municipal Court in Prague, Section C, Insert 59640
E-mail: info@onclinic.cz
Telephone: 800 103 300
Web: www.onclinic.cz
ON CLINIC, s.r.o. is a provider of health services in outpatient care.
Establishments:
ProctoClinic Praha
Olivova 948/6
110 00 Prague 1 – Nové Město
ProctoClinic Brno
Bartošova 1832/5
602 00 Brno – Černá Pole
Referred to below as the "Controller" or "ON CLINIC".
2. What personal data we process
The scope of the data processed varies depending on whether you merely contact us, request an appointment, or are our patient.
In particular, we may process:
- first name and surname,
- date or year of birth,
- personal identification number (rodné číslo), where its processing is necessary or required by legal regulations,
- residential address,
- telephone number,
- e-mail address,
- information on the selected branch,
- information on whether you have already been a patient of ON CLINIC,
- data on booked and completed appointments,
- data on health status, diagnosis, examinations, treatment and health services provided,
- data contained in medical records,
- data necessary for issuing medical reports, prescriptions, referrals or other medical documents,
- data related to the payment for services provided,
- data arising from communication with us,
- technical data related to the use of our website to the extent described in the Cookie Policy.
Data on health status constitute special categories of personal data under the GDPR, and we afford them appropriate heightened protection.
3. For what purposes and on what legal basis we process the data
A. Appointment booking and communication before a visit
If you use the contact form on our website, contact us by telephone or e-mail, we process the data necessary to handle your request and arrange an appointment.
This concerns in particular:
- first name and surname,
- year of birth,
- telephone number,
- e-mail,
- selected branch,
- information on whether you have already been our patient.
The purposes of the processing are in particular:
- handling of an appointment request,
- contacting the patient,
- confirmation or change of an appointment,
- identification of an already registered patient,
- preparation for the provision of health services.
The legal basis is in particular the taking of steps at your request prior to entering into a contract under Article 6(1)(b) GDPR and, in cases where the processing is related to the fulfilment of the legal obligations of a health services provider, Article 6(1)(c) GDPR.
If data on health status or other special categories of personal data are processed in this context, the legal basis is also Article 9(2)(h) GDPR, that is, processing necessary for the purposes of healthcare, the establishment of a diagnosis or the provision of health services.
Data from an appointment request that was not realised are retained only for the period necessary for its handling and subsequent administration. If health services are subsequently provided, relevant data may become part of the medical records and are further retained in accordance with the rules set out below.
B. Provision of health services and keeping of medical records
If you become a patient of ON CLINIC, we process the personal data necessary for the provision of health services and the keeping of medical records.
In particular, we process:
- identification and contact data,
- personal identification number (rodné číslo), where its processing is required by legal regulations,
- data on health status,
- medical history,
- diagnoses,
- examination results,
- information on procedures performed and treatment,
- prescribed medicinal products,
- medical reports and other data that are necessary for the provision of health services.
We process these data in particular for the purposes of:
- provision of health services,
- establishment of a diagnosis,
- management of treatment,
- keeping of medical records,
- issuing medical reports, prescriptions, referrals and other medical documents,
- ensuring continuity of healthcare,
- fulfilment of the other obligations of a health services provider.
The legal basis for the processing is in particular:
- Article 6(1)(c) GDPR – compliance with a legal obligation of the Controller,
- Article 9(2)(h) GDPR – processing necessary for the purposes of preventive or occupational medicine, medical diagnosis, the provision of health or social care or treatment or the management of healthcare systems and services.
The processing takes place in particular on the basis of Act No. 372/2011 Coll., on Health Services, and related legal regulations.
Patient consent to the processing of personal data is not required for this processing.
Any withdrawal of consent given for another purpose therefore has no effect on the processing of data that we are obliged to carry out on the basis of legal regulations.
C. Accounting and tax matters
Personal data contained in accounting, tax and payment documents are processed for the purposes of recording payments, keeping accounts, fulfilling tax obligations and fulfilling other legal obligations.
The legal basis is Article 6(1)(c) GDPR. The data are retained for the period stipulated by the relevant accounting, tax and other legal regulations.
D. Protection of rights and legal claims
To the extent necessary, we may also retain or process certain personal data for the purpose of protecting our rights, dealing with complaints, claims, legal disputes, or asserting or defending legal claims.
The legal basis is, as a rule, the legitimate interests of the Controller under Article 6(1)(f) GDPR, or, in the case of special categories of personal data, Article 9(2)(f) GDPR.
4. How long we retain personal data
We retain personal data only for the period necessary for the purpose for which they are processed, or for the period stipulated by legal regulations.
Medical records
We retain medical records in accordance with Act No. 372/2011 Coll., on Health Services, and Decree No. 444/2024 Coll., on Medical Records.
For other outpatient care, the general retention period for medical records is set at 5 years after the last provision of health services to the patient, unless a legal regulation stipulates a different period for a particular part of the medical records or a particular type of healthcare.
Individual parts of the medical records may therefore have different retention periods under legal regulations.
Data from the contact form
If the person does not subsequently become a patient of ON CLINIC, we retain the data from the contact form only for the period needed to handle the communication and related administration. If health services are provided, relevant data may be further kept within the medical records.
Accounting and tax data
We retain accounting and tax documents for the period stipulated by the relevant legal regulations.
Legal claims
Data necessary for the protection of the Controller's rights may be retained for the duration of the relevant limitation or other statutory periods and, where applicable, for the duration of the related proceedings.
5. To whom personal data may be made available
Access to personal data is granted only to persons who need it for the performance of their work or the fulfilment of legal or contractual obligations.
These may be in particular:
- physicians and other healthcare professionals of ON CLINIC,
- authorised employees of the Controller,
- other providers of health services in cases stipulated by legal regulations or necessary to ensure the continuity of healthcare,
- providers of medical and information systems,
- providers of IT support, server, hosting and security services,
- providers of e-mail and communication services,
- accounting, tax and legal advisers,
- public authorities and other persons to whom we are obliged to provide the data on the basis of a legal regulation.
Persons who process personal data for us as processors are required to process them only in accordance with our instructions, to the necessary extent, and while ensuring an appropriate level of protection.
Physicians, healthcare professionals and other persons who come into contact with information on patients' health status are bound by the statutory duty of confidentiality.
6. Transfers of data outside the European Economic Area
When using certain technological services, personal data may in certain cases be processed by providers with their registered seat outside the European Economic Area.
Where such transfers take place, they are carried out only in compliance with the conditions of the GDPR, in particular on the basis of a European Commission decision on an adequate level of protection, standard contractual clauses, or another transfer mechanism permissible under the GDPR.
Details of the third-party technologies used on the website are also set out in our Cookie Policy.
7. Website and cookies
The website www.onclinic.cz uses necessary cookies and, depending on your settings, also other technologies, for example for statistical, functional or marketing purposes.
For cookies and other technologies that require consent, the legal basis for the processing is your consent. You can change or withdraw your consent at any time via the cookie settings on our website.
More detailed information, including a list of the technologies used, their purposes and validity periods, is provided on the separate page Cookie Policy.
8. Is the provision of personal data mandatory?
When using the contact form, it is necessary to provide the data marked as mandatory, because without them we may not be able to handle your request correctly or contact you.
In connection with the provision of health services, the provision of certain personal data is necessary for the proper identification of the patient, the provision of healthcare and the fulfilment of the legal obligations of ON CLINIC as a health services provider.
Failure to provide data that is necessary under legal regulations or for the safe provision of health services may result in the relevant health service not being able to be provided or another legal obligation fulfilled.
9. Your rights
In connection with the processing of personal data, you have, subject to the conditions laid down in the GDPR, in particular the right:
- to obtain confirmation as to whether we process your personal data,
- to request access to your personal data and to obtain a copy of them,
- to request the rectification of inaccurate personal data or the completion of incomplete personal data,
- to request the restriction of processing,
- to request the erasure of personal data in cases where the statutory conditions are met,
- to object to processing based on legitimate interests,
- to obtain your personal data in a structured, commonly used and machine-readable format and, where applicable, to transmit them to another controller, provided that the conditions of the right to data portability are met,
- to withdraw consent at any time where a given processing is based on consent,
- to lodge a complaint with a supervisory authority.
Please note that some rights are not absolute. In particular, it is not possible to request the erasure of data that we are obliged to retain under legal regulations, for example medical records for the duration of their statutory archiving period.
Likewise, the withdrawal of consent has no effect on processing that takes place on another legal basis, for example for the purpose of fulfilling a legal obligation of a health services provider.
10. How you can exercise your rights
You can contact us with a request concerning the processing of personal data:
ON CLINIC, s.r.o.
Olivova 948/6
110 00 Prague 1 – Nové Město
E-mail: info@onclinic.cz
In order to prevent unauthorised disclosure of data to another person, we may in justified cases require reasonable verification of the identity of the applicant.
11. Complaint to a supervisory authority
If you believe that the processing of your personal data involves a breach of legal regulations, you have the right to lodge a complaint with:
the Office for Personal Data Protection (Úřad pro ochranu osobních údajů)
Pplk. Sochora 27
170 00 Prague 7
In addition, you have the right to turn to the competent court.
12. Security and confidentiality
We protect personal data, in particular data on health status, using appropriate technical and organisational measures commensurate with their nature and the risks associated with their processing.
Access to personal data is restricted to persons who need it for the performance of their work or the fulfilment of legal obligations.
Healthcare professionals and other persons who come into contact with patient data are bound by the statutory duty of confidentiality.
13. Final provisions
We may update this Privacy Policy from time to time in the event of a change in legal regulations, in the manner of processing personal data, or in the services used.
The current version is always published on the website www.onclinic.cz
Updated: August 2026