Privacy and Data Protection Terms

1. General provisions and controller

1.1. These privacy and data protection terms (hereinafter the “Terms”) explain how Eho Clinic OÜ (hereinafter the “Clinic” or “we”) processes the personal data of clients, patients, website visitors and other persons who contact us on the websites ehoclinic.ee and shop.ehoclinic.ee, when booking and providing services, fulfilling online store orders, and in client communications.

1.2. The controller is Eho Clinic OÜ, registry code 16606489, registered address Tehnika tn 35-1, 10149 Tallinn, service location Sepapaja 12/1, 11415 Tallinn, email info@ehoclinic.ee, telephone +372 5810 1356.

1.3. If a specific service or product is provided or sold by another legal person, that person’s details will be provided in connection with the relevant service or purchase before the contract is concluded. A separate notice may apply to the processing of its personal data where necessary.

1.4. We rely on Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation, GDPR), the Personal Data Protection Act, the Electronic Communications Act, and legislation governing the provision of healthcare services. This notice is not consent to a medical intervention and does not authorise the use of patient data in advertising.

2. Types and sources of data processed

2.1. Personal and contact data: first and last name, telephone number, email address, communication language, and, where necessary, postal address, date of birth or personal identification code. We request the date of birth and personal identification code only when there is a justified need or a statutory obligation.

2.2. Enquiry and booking data: the content of the enquiry, the service of interest, appointment time, booking status, organisational communications, and the history of service provision to the extent necessary.

2.3. Health data: complaints, medical history, examination results, diagnoses, treatment plans, contraindications, healthcare services provided, medical photographs, consents and healthcare documents. These are special categories of personal data within the meaning of the GDPR.

2.4. Purchase and payment data: goods ordered, price, invoice and payment details, payment status, selected delivery method, parcel locker or delivery address, returns and complaints. Full payment card details are processed by the relevant payment service provider in accordance with the selected payment solution.

2.5. Website usage data: IP address, general device and browser data, session information, technical logs, and, at the user’s choice, additional analytics and advertising-related identifiers.

2.6. Direct marketing data: email address and/or telephone number, communication language, time of giving and withdrawing consent, source, text version, selected channel and necessary evidence.

2.7. Data is obtained mainly from the individual, their representative, the booking environment, the online store order or direct contact. Where a legal basis exists, we may receive data from a healthcare professional, the health information system or a service provider involved in fulfilling an order. If data does not originate from the individual, we comply with the notification obligation under Article 14 of the GDPR or an applicable exemption.

3. Purposes and legal bases for processing

3.1. Responding to an enquiry and steps prior to entering into a contract: Article 6(1)(b) of the GDPR; for other justified contacts, point (f) (legitimate interest).

3.2. Booking and providing a non-medical service and arranging an online store order, payment and delivery: Article 6(1)(b) of the GDPR; point (c) for mandatory reporting.

3.3. Planning, providing, ensuring the safety of and documenting healthcare services: depending on the operation, Article 6(1)(b) or (c) of the GDPR and, for health data, additionally Article 9(2)(h), together with sector-specific healthcare rules and the duty of confidentiality.

3.4. Accounting, tax accounting and reporting required by legislation: Article 6(1)(c).

3.5. Necessary non-advertising notices related to a booking, order or service: Article 6(1)(b) or (c), depending on the content of the notice.

3.6. Direct marketing by email and SMS: generally Article 6(1)(a) (consent) and section 103¹ of the Electronic Communications Act. The use of a previous purchaser’s contact details to offer our own similar goods or services without new consent takes place only if all conditions for the statutory exemption are met.

3.7. Optional analytics and marketing cookies and similar technologies: prior consent where required; where personal data is processed, generally Article 6(1)(a).

3.8. Website security, prevention of misuse and protection of legal claims: Article 6(1)(f) or (c), and, where necessary in relation to health data, Article 9(2)(f). When applying legitimate interest, we take account of the individual’s rights and interests.

3.9. If data necessary for providing a service is not supplied, we may be unable to resolve an enquiry, confirm a booking or fulfil a transaction. Marketing consents are voluntary.

4. Special protection of patient personal and health data

4.1. Patient data is processed only for a lawful purpose and to the extent necessary. Access is limited to persons whose duties and authorisation require it. A personal interest in a patient does not give a person the right to access the patient’s data.

4.2. The necessary preparation and retention of healthcare documents is based on legislation and generally does not require separate GDPR consent. By contrast, the patient’s informed consent to a specific medical intervention is a separate legal issue and is recorded in accordance with the Law of Obligations Act.

4.3. Data is transferred to the health information system, competent authorities, other healthcare professionals and technical processors only on a legal basis and to the extent necessary. Naming a relative or contact person does not automatically give them the right to access the patient’s health data.

4.4. General newsletter consent does not authorise the use of a diagnosis, treatment history, booked medical service or other information revealing health data to create advertising audiences or for marketing profiling.

4.5. Photographs required to document treatment may be retained as part of the healthcare documentation. Their public use on a website or in advertising requires separate specific consent where necessary and must comply with the restrictions of the Advertising Act.

4.6. Informing a patient about data protection does not replace their right to receive understandable information about the planned healthcare service, risks and alternatives, or their separate decision to consent to the intervention.

5. Recipients and transfers of data

5.1. Within the limits of their competence and the need to provide services, personal data may be received by the Clinic’s authorised employees and providers of IT, web-hosting, booking, payment, delivery, accounting, communications and client relationship services. Data may be transferred to public authorities in cases provided for by law.

5.2. If a service provider processes personal data on our behalf, we apply contractual requirements under Article 28 of the GDPR. Some service providers may be independent controllers. Further information on specific data recipients and their roles can be requested at info@ehoclinic.ee.

5.3. If personal data is transferred outside the European Economic Area, this is done on a basis permitted under Chapter V of the GDPR, for example an adequacy decision of the European Commission or appropriate standard contractual clauses with the necessary safeguards. Further information about the applicable safeguards can be obtained from the contact stated above.

6. Data retention periods

6.1. We retain personal data only for the time necessary to achieve the purpose or for the period established by legislation. We apply the usual periods below provided that no longer mandatory period or justified need to protect a legal claim applies to the specific type of data.

6.2. An ordinary enquiry that does not lead to a service or contract: generally up to 12 months from the last substantive communication. Organisational data from an unconfirmed or cancelled booking: generally up to 12 months from the scheduled appointment time, unless it is part of healthcare documentation.

6.3. Client relationship and contractual data relating to non-medical services which is not subject to mandatory accounting or healthcare documentation: generally up to 3 years after the provision of the service or termination of the contract.

6.4. Primary accounting records: generally 7 years from the end of the relevant financial year, unless the law provides otherwise. Data evidencing the provision of healthcare services: for the period prescribed by law, as a general rule 30 years from confirmation of the data for certain documents, taking account of differences between document types and the health information system.

6.5. Marketing data: until consent is withdrawn or another permitted basis ends. We assess the necessity of an active contact database at least every 24 months. We may retain minimum evidence of consent and withdrawal for up to 3 years after marketing ends; the minimum information necessary to honour an opt-out may be retained longer to a justified extent.

6.6. Ordinary website security logs: generally up to 90 days. Information necessary in the event of a security incident, dispute or legal obligation may be retained longer. Cookie retention periods are stated in section 8 of these Terms and in the website’s actual cookie list.

6.7. The aforementioned periods are the retention rules applied by the Clinic. When data is no longer necessary to retain, we delete or anonymise it. A mandatory healthcare or accounting document is not deleted merely because marketing consent has been withdrawn.

7. Direct marketing and consents

7.1. The Clinic may send information by email or SMS about its news, permitted non-medical services, goods and offers, in compliance with the Electronic Communications Act and the Advertising Act. Special restrictions apply to healthcare service advertising.

7.2. We request separate voluntary consent for direct marketing by email and SMS. Selecting one channel does not include the other channel. Checkboxes are not pre-selected, and agreeing to advertising is not a condition of booking, purchase or receiving a healthcare service.

7.3. To demonstrate consent, we retain the selected channel, date, place or source of consent, text version and subsequent withdrawal. If the conditions provided for in section 103¹(3) of the Act are met, we may use a previous purchaser’s electronic contact details to offer our own similar goods or services, providing a simple free opt-out opportunity when collecting the contact details and in every subsequent message.

7.4. Every marketing email contains a working unsubscribe link. An SMS message provides a simple and free electronic way to opt out. Consent can also be withdrawn at info@ehoclinic.ee. Following an opt-out, we stop advertising messages through the relevant channel, but necessary booking and order notices may continue where another legal basis exists.

7.5. Consent to receive an email newsletter is not consent to install analytics or marketing cookies. These choices are made separately in cookie settings. Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

8. Cookies and similar technologies

8.1. A cookie is a small set of data that can be stored in a web browser. The website may also use other identifiers that can be stored on or read from a device, local storage data and web beacons.

8.2. Strictly necessary cookies enable security, session management, the online store shopping cart, checkout and storage of cookie preferences. They are used without separate consent only where permitted by law.

8.3. Optional functional cookies enable additional preferences. Analytics cookies help assess use of the website. Marketing cookies and pixels may measure advertising effectiveness and support permitted advertising activities. Technologies requiring consent are not activated before a valid choice is made.

8.4. In the cookie banner, visitors can choose “Accept all”, “Reject optional cookies” or “Change settings”. Optional categories are initially switched off. Silence and continued use of the site do not constitute consent. Choices can later be changed through the “Cookie settings” link in the website footer.

8.5. The website’s cookie settings view separately discloses for each domain the name, provider, purpose, category and duration of each cookie or similar technology actually used, and, where necessary, information on third-party access or cross-border transfer. The list is updated when technical solutions change. The actual list displayed in the website’s cookie settings forms part of this section.

8.6. The content of medical enquiries, diagnoses, treatment plans or other special categories of personal data are not automatically transmitted to advertising pixels. Technical tracking of healthcare service pages and booking flows is assessed separately and permitted only to the extent legally justified.

8.7. Cloudflare Turnstile may be used to reduce automated misuse of public enquiry and callback forms. The service loads for the form security check; its use is described in Cloudflare’s privacy policy.

Cloudflare privacy policy

9. Individual rights and requests

9.1. Subject to the conditions set out in the GDPR, an individual has the right to information about and access to their personal data, to request correction or deletion of inaccurate data, restriction of processing, to object, to exercise the right to data portability, and to withdraw consent given.

9.2. Processing of personal data for direct marketing purposes may be objected to at any time. Some rights are not absolute: healthcare and accounting documentation required by law may not be capable of deletion.

9.3. Please send requests to info@ehoclinic.ee. We respond without undue delay, generally within one month; where provided by law, we may extend the time limit and notify you of this. In the event of reasonable doubt, we may verify the identity of the person making the request.

9.4. A person has the right to lodge a complaint with the Data Protection Inspectorate (www.aki.ee) or to apply to a court. Questions related to healthcare service quality or patient harm may additionally be subject to special healthcare and patient insurance rules.

10. Security, minors and changes to the Terms

10.1. We apply technical and organisational protection measures that take account of the confidentiality, integrity and availability of personal data, including restricting access according to duties. In the event of personal data breaches, we comply, where necessary, with the notification obligations arising from Articles 33 and 34 of the GDPR.

10.2. When processing minors’ data, we take account of the child’s rights, authority of representation and special rules applicable to healthcare services. A minor’s health data is not automatically added to a marketing list.

10.3. If we use solely automated decision-making which produces legal effects or similarly significant effects for an individual, we provide the additional information required by law. Ordinary booking automation does not in itself constitute such decision-making.

10.4. The Terms may be updated when legislation, processing methods or technologies used change. The current version is published on the website; in cases provided for by law, material changes are notified separately.