PRIVACY POLICY

Purpose of This Document

As a leading dental clinic, we place the utmost importance on consistently protecting our patients’ personal data to a high standard and keeping it secure. This document explains the grounds on which and purposes for which we process your personal data, as well as the organisational and technical measures we use to protect it. It also provides information about your rights and the ways in which you can protect them.

Who This Document Is For

This document is intended for:

• Patients who use the Clinic’s medical services.
• Prospective patients who are interested in our services and may provide us with personal data, for example, to arrange a consultation.
• Legal representatives of patients and prospective patients.
• People who contact our Clinic by telephone, email or other means to obtain information, book an appointment or seek advice on other matters.

How We Collect Your Data

We obtain your personal data from the following sources:

• Directly from you when you contact the Clinic to receive services, including by telephone, electronically or in person.
• From your legal representative.
• From third parties where an appropriate legal basis exists or with your consent, for example, from insurance companies or relevant healthcare authorities.

Categories of Personal Data Processed When Providing Services

In the course of providing services, the information we process may include the following categories of data, to an extent proportionate to the purpose of processing:

Data that the Clinic is required by law to process:

The patient medical record and examination form approved by the Ministry of Health, which contain identification and other data, including special categories of data: first name, surname, sex, date of birth, telephone number, personal identification number, address, workplace and profession, insurance policy number and insurance company, allergies, past and/or coexisting illnesses, complaints and medical history. The patient’s written informed consent to the provision of medical services.

Data processed to provide appropriate dental services (objective examinations):

Results of an oral examination; assessment of the bite, oral mucosa and periodontal condition; examination plan; consultation/examination findings; final diagnosis; treatment provided; date of the next visit; treatment outcome (discharge summary); and advice/instructions or prescriptions.

Identity and other documents:

Identity card, passport, birth certificate, residence permit, temporary identity card, document confirming authority to act as a representative, and insurance policy.

Recordings:

Audio recordings (only during telephone calls to the Clinic’s hotline) and video recordings (only of the Clinic’s external perimeter, reception area and corridors).

Data obtained through communications:

Data obtained via email, social media pages and telephone calls.

Purposes of Data Processing

We process your personal data only for specific, clearly defined and legitimate purposes. We do not process your data for purposes incompatible with the original purpose for which it was collected. The Clinic may process data for the following purposes:

Providing medical services:

• Diagnosis and treatment planning;
• Performing medical procedures;
• Monitoring after treatment and providing recommendations;
• Creating and retaining medical records.

Complying with legal obligations:

• Providing information to regulatory and supervisory authorities in the cases and manner prescribed by law;
• Fulfilling other legal obligations.

Protecting people and property:

• Protecting the safety of patients and employees and the Clinic’s property.

Legal Grounds for Processing Personal Data

Our processing of your data is based on the following legal grounds:

• Providing you with medical services, including diagnosis, treatment and follow-up care;
• Your consent to processing data for a specific purpose;
• The need to consider your application when you submit an application to the Clinic concerning a matter;
• The public availability of data that you have made publicly available;
• Compliance with legal obligations when processing is required under applicable law.

When We Share Your Data with Third Parties

Where an appropriate legal basis exists, we may share your data with:

• Your legal representative;
• Authorities designated by law (for example, the Ministry of Health, courts and investigative bodies);
• Insurance companies, for the purpose of financing medical services;
• Other medical institutions and specialists, for your treatment and with your consent, where necessary;
• Our contractors and service providers who help us carry out our activities. To ensure appropriate protection of your data, before transferring your personal data to third parties, we ensure that they process it in accordance with our instructions and applicable data protection law. We also check that they have adopted appropriate organisational and technical measures to protect the data;
• Other third parties, with your consent.

Your Rights Regarding Your Personal Data

We respect your rights regarding your personal data. Under the law, you have the right to request and receive information about whether we process your data and, if so, for what purpose and on what grounds. You may also request information about:

• The specific data processed about you;
• The source from which the data was obtained;
• How long the data is retained;
• If the data is transferred, to whom and for what purpose it is transferred.

We will provide this information no later than 10 working days after your request. In exceptional cases, this period may be extended by a further 10 days; we will inform you in advance.

You have the right to access the personal data we hold about you and receive copies free of charge. Exceptions apply where a fee is prescribed by law or where you request the data in a different form that entails additional costs. In the latter case, a reasonable fee may be charged.

If your data is incorrect, inaccurate or incomplete, you have the right to request that it be corrected, updated or completed. No later than 10 working days after your request, we must correct the data or inform you of the reasons for refusal and how to appeal. If we ourselves discover that your data is incorrect, we will correct it and notify you.

You have the right to request that we stop processing, erase or destroy your data if:

• You withdraw consent that was the sole basis for processing the data;
• Processing is no longer necessary for the purpose for which the data was collected;
• The data is processed unlawfully.

We will review your request and, no later than 10 working days after it is made, stop processing, erase or destroy the data, or inform you of the grounds for refusal.

In certain cases, you have the right to request that your data be blocked, for example, if you contest its accuracy or if processing is unlawful but you do not want the data erased. Blocking means that the data will temporarily not be processed, except for storage.

If you provided data to us on the basis of your consent or a contract and it is processed automatically, you have the right to request that the data be provided to you in a structured, easy-to-use format and to request its transfer to another organisation, where technically feasible.

Where processing is based on your consent, you have the right to withdraw that consent at any time. After consent is withdrawn, we will stop processing the data unless another lawful basis permits us to continue.

If you believe your rights have been violated, you have the right to contact the Personal Data Protection Service of Georgia, a court or other competent authorities.

How to Exercise Your Rights

To exercise your rights, you may contact us in writing, by email or in person at our Clinic. Our contact details appear at the beginning of this policy. We will consider your request within the time limits established by law and provide an appropriate response.

Restrictions on Data Subject Rights

In specific cases provided for by law, the rights listed above may be restricted where necessary to protect state or public security, prevent crime, serve the interests of justice or protect other important legitimate purposes. In such cases, we are required to inform you of the restriction unless doing so would be contrary to law.

Data Security

The security of your personal data is of the utmost importance to us. We provide physical, technical and organisational safeguards to protect your data against unauthorised access, use or disclosure, as well as loss or destruction.

We use a range of security measures, including:

• Physical security — our electronic devices, files and physical premises are protected against unauthorised access;
• Technical security — we have implemented modern technological measures for data protection and cybersecurity, including encryption, firewalls and access controls;
• Organisational security — we have developed and implemented internal policies and procedures to protect data and confidentiality. Our employees receive regular training on data security and are required to comply with our confidentiality policies and procedures.

We continuously monitor and update our security measures to provide the highest possible level of protection for your data.

Data Retention

We retain your personal data only for as long as is necessary to achieve the specific purpose of processing or in accordance with retention periods prescribed by applicable Georgian law.

Specific retention periods are determined by taking into account the following criteria:

• The specific purpose of processing — data is retained for as long as needed to achieve the purpose for which it was collected;
• The scope of services and/or a contract — where there is a service agreement or contract between us, the retention period may be determined by those documents;
• The Clinic’s legitimate interests — we may need to retain data for longer to protect our legitimate interests (for example, in the event of legal disputes). In such cases, we ensure that the retention period is reasonable and does not infringe your rights;
• Consent — where processing is based on your consent, data will be retained for the duration of that consent unless you withdraw it earlier.

Once the retention period has expired, or the purpose of processing has been fulfilled and no lawful basis for further retention exists, your data will be securely erased or destroyed.

This policy may be updated. Changes to the document are made in consultation with the Clinic’s Personal Data Protection Officer, and the Clinic undertakes to inform you of any updates.

2025