Information on Personal Data Processing
Introduction
We would like to assure you that for CrossBorderMedCare Medical Company, the protection of our customers’ personal data is our prime priority. Taking that into account we are taking all necessary actions to protect the personal data we process and to ensure that the processing of personal data is always carried out in accordance with the obligations laid down by the legal framework, both by the company itself and by third parties processing personal data on behalf of the company.
Processing Manager – Data Protection Officer (DPO)
The company CrossBorderMedCare with registered office at 13, M. GEROULANOU STREET, email: privacy@bioiatriki.gr, tel: +30 210 6912111, website: www.crossbordermedcare.com informs that, for the purposes of its business activities, it processes personal data of its customers in accordance with the applicable national law and European Regulation 2016/679 of individuals protection regarding to the processing of personal data and on the free movement of such data (General Data Protection Regulation, hereinafter “the Regulation”) as in force.
For any issue regarding the processing of personal data, please contact the DPO directly, via email: dpo@bioiatriki.gr, phone: +302106966222.
What is the purpose of processing and how we use your personal data
The personal data you provide to us, such as your name, email, mobile/landline telephone, and health data are processed only when we have a legitimate reason to proceed with its processing.
Legal reasons for processing your personal data are:
(a) the provision of the services you assign to us and you wish to receive from us / purchase of products you wish to buy from us
(b) compliance with an obligation imposed by law, such as compliance with the Code of Medical Ethics Law. 3418/2005
(c) safeguarding and protecting the legitimate interests of yours as well as ours. Thus, we use closed CCTV and security cameras to be able to protect the security of individuals, materials, equipments, and in accordance with the specific conditions set for the installation of cameras in hospitals
(d) the consent you provide under certain conditions set by the legal framework in order to receive updates on products, services, offers, etc from CROSSBORDERMEDCARE or third affiliating parties that process personal data according to the current framework
(e) regarding the processing of specific categories of data processing necessary for the purposes of medical diagnosis, healthcare or social care or treatment. If processing is done for other purposes, then your explicit consent is requested, as well as in the event of a patient participation in a clinical trial
(f) excluding the patient’s medical records used in the occasion that are necessary in order to identify, exercise or defend his or her rights in cases relating to medical liability and generally the provision of health services, if it has been provided in the permission received by the Authority for the establishment and operation of a file with sensitive personal data.
Where we transmit the data
CrossBorderMedCare transmits personal data to third parties to whom the company assigns the processing of personal data on its behalf. In these cases, CrossBorderMedCare remains responsible for the processing of your personal data and specifies the details of the processing, signing a specific agreement with the third parties to whom it assigns processing activities in order to ensure that the processing is carried out in accordance with the applicable legal framework and that any individual may freely and unhindered exercise the rights conferred on the legal framework.
Moreover, the data are transferred to other companies within Biomedicine Group and to third collaborating companies for the purpose of sending advertising material and information about products, services and offers, under the condition that every natural person has provided its respective consent.
The following exceptions permit access to patient medical records:
a) to the judicial and prosecuting authorities in the exercise of their functions ex officio or at the request of a third party claiming a legitimate interest and in accordance with the legal procedures
b) in Greek State other institution that according to their constitutional provisions have such a right and competence.
Storage Period
The data storage period is decided on the basis of the following specific criteria, as appropriate:
In the event that data processing performed under contract, your personal data will be stored for as long as is necessary for the contract’s execution and for the acquisition, exercise, and / or support of legal claims under the contract.
When processing is obligatory as a requirement under provisions of the applicable legal framework, your personal data will be stored for as long as required by the relevant provisions. Particularly, according to the Article 14, of the Code of Medical Ethics Law 3418/2005, the maintenance of a medical record is provided for a period of 10 years from the patient’s last visit to private clinics and other primary health care facilities in the private sector and for 20 years from the last visit of the patient in any other case.
For the purposes of marketing activities and in any other case where the processing is based on your consent, your personal data will be retained until your consent is withdrawn. This can be done by you at any time. Withdrawal of consent does not affect the legality of consent-based processing in the period before it is revoked.
To withdraw your consent, please contact the DPO at the following contact details, Email: dpo@bioiatriki.gr, phone: +302106966222. You can also use the subscription options by clicking on the respective link in our electronic communications.
What are your rights with respect to your personal data
Any natural person whose data is being processed by CrossBorderMedCare had the following rights:
Right of Access:
You have the right to be aware and verify the legitimacy of the processing. So, you have the right to access the data and get additional information about how we to process it. Regarding the medical file, the patient has the right to access his/her medical records as well as copies of his/her file.
Right of Correction:
You have the right to study, correct, update or modify your personal data by contacting the Data Protection Officer (DPO) at the above contact details
Right of Deletion:
You have the right to request a deletion of your personal data when we process it given your consent or in order to protect our legitimate interests. In all other cases (the obligation to process personal data required by law), depending per case, this right is subject to specific restrictions or might even not exist.
Right to Limit Processing:
You have the right to request a limitation on the processing of your personal data in the following cases: (a) when the accuracy of personal data is questioned and verified (b) when you oppose the deletion of personal data and request the restriction of use (c) when personal data are not needed for the purposes of processing, but are however indispensable for the foundation, exercise, support of your legal claims, and (d) when you object to the processing and until it is verified that there are legitimate reasons that concern us and supersedes your opposed reasons to processing.
Right to Oppose Processing:
You have the right to oppose at any time the processing of your personal data where, as described above, it is necessary for the purposes of legitimate interests we seek as processors, as well as for the processing for direct marketing and the set up of consumer’s profile.
Right to Mobility:
You have the right to receive your personal data free of charge in a format that allows you to access, use, and edit them with commonly used editing methods. Based on your consent or performance of a relevant contract, you also have the right to ask us, if technically feasible, to pass the data directly to another processor. You have this right for the data you have provided to us and are processed by automated means.
To exercise any of these rights you can contact the DPO at the following: email: dpo@bioiatriki.gr, phone: +302106966222.
Right to complain to the AIDCP
You have the right to file a complaint with the Personal Data Protection Authority (www.dpa.gr): Telephone Center: +302106475600, Fax: +30210 6475628, Email: contact@dpa.gr
Privacy Policy
CrossBorderMedCare applies appropriate technical and organizational measures to secure the processing of personal data and to prevent accidental loss or destruction and unauthorized and/or unauthorized access to, use, modification or disclosure thereof. In any case, the way in which the internet operates and the fact that it is free to anyone cannot guarantee that unauthorized third parties will never be able to violate the applicable technical and organizational measures by gaining access and possibly using personal data for unauthorized and/or unfair purposes.
Transfer to Third Countries and/or International Organizations
Such cases of transmission comply with the applicable legal framework and the specific conditions per case.
Additional Data When Data is Collected by Third Parties and Not Directly from the Natural Person
We may receive your identification information from the associated insurance companies.
CrossBorderMedCare is a medical care provider with facilities in Sweden and Greece. CrossBorderMedCare offers a wide spectrum of health care services that meet all the needs of an international patient ranging from urgent to planned medical and dental care. 
Athens BioClinic Hospital is a member of Bioiatriki Healthcare Group which is the largest private medical care provider in Greece. Bioiatriki Healthcare Group owns 26 fully automated primary care Diagnostic Centers and 2 hospitals in Athens and Thessaloniki serving more than 2 million people every year. 
