Adatkezelési tájékoztató

Effective: September 22, 2026
Website: gyermekdoki.hu

A Medic Mini Ltd. as the operator and data controller of the gyermekdoki.hu website, we consider the protection of the personal data of users, patients, and the legal guardians of children—particularly their health data—to be of the utmost importance.

The purpose of this Privacy Notice is to explain in plain language the data processing activities carried out through this website, including their purpose, legal basis, duration, recipients of the data, and the rights of data subjects.

Data processing is governed in particular by Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR), on the processing and protection of health and related personal data Act XLVII of 1997 (Eüak.), as well as other applicable Hungarian laws and regulations.

1. Information About the Data Controller

Name of the data controller: Medic Mini Ltd.
Headquarters: 1025 Budapest, Józsefhegyi utca 20–24. B épület, földszint 2. ajtó
Company Registration Number: 01 09 431228
Tax ID: 32570894-1-41
E-mail: medicminikft@gmail.com
Representative: Dr. Nagy Dora Zsuzsanna

2. Fundamental Principles of Data Processing

The Data Controller processes personal data:

in a lawful, fair, and transparent manner;
for a specific, clear, and lawful purpose;
only to the extent necessary;
as accurate and up-to-date as possible;
for as long as necessary to achieve the specific purpose;
protected by appropriate technical and organizational measures

handles.

Under the GDPR, health data is considered special categories of personal data, and therefore its processing is subject to stricter data protection requirements.

3. Legal Bases for Data Processing

The legal basis for the processing of personal data related to health care and the associated administrative procedures depends on the specific data processing activity and includes, in particular:

compliance with a legal obligation under Article 6(1)(c) of the GDPR;
the performance of a task carried out in the public interest pursuant to Article 6(1)(e) of the GDPR, provided that the conditions for such processing are met;
with regard to health data, Article 9(2)(h) of the GDPR, which permits the processing of such data for the purposes of medical diagnosis, the provision of health care or treatment, or the management of health systems and services;
the provisions of the Health Care Act and other Hungarian laws governing health care services.

The use of the online form alone does not mean that the Data Controller processes health data based on consent.

If the legal basis for a specific data processing operation is consent, the data subject will be provided with specific, prior information regarding it.

4. Request for a Referral

Data Processed

The following information, in particular, may be provided on the referral request form:

child's first name;
the child's last name;
the child's date of birth;
Social Security number;
contact email address;
address;
country;
zip code;
county;
city;
address;
any other information necessary for the review of the application.

Purpose of Data Processing

Receiving and reviewing requests for referrals, verifying medical and professional eligibility, and handling related medical and administrative procedures.

Legal Basis

Article 6(1)(c) and, where applicable, (e) of the GDPR, as well as Article 9(2)(h) of the GDPR with respect to health data and the provisions of the Health Care Act.

Retention Period

The information provided on the online form is used to forward and process the request. The website does not maintain this information as a separate, permanent record.

If the information contained in the request becomes part of the medical records during the course of medical care, its further processing and retention shall be governed by the provisions of the Health Care Act regarding medical records.

As a general rule, medical records must be retained for at least 30 years from the date of data entry, in accordance with the Health Care Act.

5. Request for a Certificate

Data Processed

child's first name;
the child's last name;
the child's date of birth;
contact email address;
brief description of the complaint;
the start and end dates of the certificate;
the need for an exemption from physical education;
the preferred method for forwarding the certificate.

Purpose of Data Processing

Receiving and reviewing applications for certificates; conducting technical and administrative reviews to determine whether a certificate can be issued; and handling administrative matters related to the certificate.

Legal Basis

Article 6(1)(c) and, where applicable, (e) of the GDPR, as well as Article 9(2)(h) of the GDPR and the provisions of the Health Care Act.

Retention Period

The information provided on the online form is used to forward and process the request. The website does not maintain this information as a separate, permanent record.

6. Application for a Sick Leave Certificate

Data Processed

Child's information:

name;
date of birth;
address;
description of complaints;
the period covered by sick pay.

Information about the parent or legal guardian:

name;
date of birth;
her mother's name;
Social Security Number;
workplace;
job title;
contact email address.

Purpose of Data Processing

Health and administrative procedures related to child care sick pay, inability to work, and the associated documentation.

Legal Basis

Article 6(1)(c) and, where applicable, (e) of the GDPR; with respect to health data, Article 9(2)(h) of the GDPR; the Health Care Act; and the applicable social security regulations.

Retention Period

The information provided on the online form is used to forward and process the request. The website does not maintain this information as a separate, permanent record.

If the information contained in the request becomes part of medical or social security records, its further processing and retention shall be governed by the applicable statutory retention rules.

7. Processing of Minors' Data

The practice provides pediatric care; therefore, a significant portion of its data processing involves the personal and health information of minors.

The online application form may be submitted by the child’s legal representative or by any other person lawfully authorized to act on the child’s behalf.

By submitting this form, the person filling it out declares that they are authorized to act on behalf of the child in question and to provide the information necessary to process the request.

8. Processing of Data on Legal Representatives

In the course of providing health care to a child and handling related administrative matters, the Data Controller may also process the personal data of the child’s legal representative.

The data processed may include, in particular, the legal representative’s name, contact information, and date of birth, as well as any other information necessary for handling the matter or verifying the representative’s authority.

The purpose of data processing is to ensure the exercise of the child’s rights, to identify the legal representative, to maintain contact, and to handle health-related and administrative matters.

The legal basis for data processing is compliance with a legal obligation applicable to the Data Controller and the lawful provision of health care.

9. Contact and Email Communication

If the data subject contacts the Data Controller via email or through the website, the Data Controller may process:

the name of the person;
your email address;
the content of the message;
other information required for processing the request.

The purpose of data processing is to respond to the inquiry and handle the matter.

In the case of an email or message containing health-related data, the processing of such data is also governed by special rules applicable to health-related data.

10. Technical Data and Server Logs

While using this website, technical data may be processed, specifically:

IP address;
browser type and version;
operating system;
date of visit;
page visited;
data on technical errors and security incidents.

Purpose of data processing:

the secure operation of the website;
troubleshooting;
prevention of abuse;
ensuring system security.

The legal basis for data processing is a legitimate interest pursuant to Article 6(1)(f) of the GDPR.

The retention period depends on the technical settings of the hosting provider and the security systems in use.

11. Cookies and Similar Technologies

Cookies and other technologies necessary for the website to function may be used.

Cookies that are strictly necessary for the website to function support the technical operation of the website.

If the website uses statistical, marketing, or other non-essential cookies that require consent, they may only be loaded after the data subject has provided the appropriate consent.

A detailed list of the cookies and technologies used on the website, along with their purpose, provider, and duration, can be found at Cookie Policy, as well as in the cookie management interface on the website.

12. Data Processors

The Data Controller may engage a data processor to operate the website.

Web Hosting Provider

Rackhost Zrt.
Company Name: 6722 Szeged, Tisza Lajos körút 41.
E-mail: info@rackhost.hu

In particular, his or her duties include:

providing storage space;
server operation;
technical logging;
backup;
providing the technical infrastructure necessary for the email service.

In the course of providing web hosting and the related technical infrastructure, Rackhost Zrt. may have technical access to personal data transmitted through the website.

The data processor may not use personal data for its own purposes; it may process such data solely in accordance with the Data Controller’s instructions, within the framework of the data processing agreement, and in compliance with applicable laws.

13. WordPress and Web Forms

The website runs on a WordPress-based system.

The online forms are powered by the form management system associated with the website.

The personal and health information provided on the forms is intended solely for the purpose of forwarding the relevant application to the Data Controller and facilitating the related administrative procedures.

The website uses the information provided in the forms does not treat them as a separate, permanent record, and does not permanently store them in the WordPress database. The information provided on the form will be transmitted electronically to the Data Controller.

The Data Controller will subsequently process the data received solely to the extent necessary for the assessment of the specific request, the provision of health care, and the related administrative procedures.

If the information provided on this form becomes part of the medical records during the course of medical care, its further processing and retention shall be governed by the legal provisions applicable to medical records.

During the technical operation of the website, temporary technical data—such as server logs or system data necessary for data transmission—may be generated. This data is processed only to the extent necessary for the secure operation of the website, the proper transmission of requests, troubleshooting, and security purposes.

The Data Controller takes appropriate technical and organizational measures to ensure that only authorized persons have access to the health data transmitted through the website.

14. Health Information Technology Systems and EESZT

Certain health data and documents generated during the provision of health care are stored, in accordance with applicable laws, in the health information technology system used by the Data Controller, as well as in the Electronic Health Services Space (EESZT) may also be recorded or transmitted.

The EESZT is a legally mandated health data management system.

Therefore, this information notice treats the EESZT not merely as a data processor, but as a health information system operating in accordance with the law.

15. Data Transfer

The Data Controller transfers personal and health data solely for lawful purposes, based on an appropriate legal basis, and to the extent necessary.

Data may be transferred, in particular:

toward the Electronic Health Services Platform (EESZT);
to the health insurance agency;
to another healthcare provider or patient care provider, if it is lawfully necessary for the patient’s care;
to a public health or epidemiological authority;
to a child protection or child welfare agency in cases specified by law;
to a court, a prosecutor’s office, the police, or another authority in response to a legal request;
to a legal representative for the purpose of filing, enforcing, or defending a legal claim.

In all cases, the Data Controller will transfer only the personal data necessary for the specific purpose.

16. Data Security

The Data Controller ensures the security of personal data through appropriate technical and organizational measures.

Such measures may include, in particular:

HTTPS encrypted connection;
password-protected administration interface;
restricted access privileges;
two-factor authentication, if applicable;
regular security updates;
logging;
backups;
technical safeguards against unauthorized access.

Healthcare data may be accessed only by those individuals who need it for the purpose of providing healthcare or handling related administrative matters.

17. Rights of Data Subjects

Depending on the nature and legal basis of the applicable data processing, the data subject may have the following rights, in particular:

Right of Access

The data subject may request information regarding whether their personal data is being processed and may request access to the data being processed.

Right to Correctio

The data subject may request that inaccurate personal data be corrected and that incomplete data be supplemented.

Right to Erasure

In certain cases, the data subject may request the deletion of their personal data.

However, the right to erasure does not apply to data that the Data Controller is required by law to retain, in particular during the mandatory retention period for medical records.

The Right to Restrict Data Processing

The data subject may request the restriction of data processing in the cases specified in the GDPR.

The Right to Protest

The data subject has the right to object to data processing based on legitimate interests.

Right to Data Portability

If the legal basis for data processing is consent or a contract, and the data processing is carried out by automated means, the data subject may have the right to data portability under the terms of the GDPR.

Requests to exercise data subject rights may be sent to the following address:

medicminikft@gmail.com

18. Handling Requests from Data Subjects

The Data Controller shall review and respond to the data subject’s request without undue delay, generally within one month of its receipt.

If necessary, this deadline may be extended in accordance with the provisions of the GDPR, taking into account the complexity of the request and the number of requests.

The Data Controller is entitled to request additional information necessary to verify the identity of the data subject.

19. Data Processing Related to the Child Protection Alert System

As a pediatric healthcare provider, the Data Controller is required, in cases specified by law, to report any concerns regarding a child’s well-being and to cooperate with the relevant child welfare, child protection, or other authorities.

In such cases, the processing of health and personal identification data, as well as their disclosure to the extent necessary, is based not on the data subject’s consent but on a legal obligation.

In all cases, data transfers are made exclusively for the purposes specified by law and are limited to the necessary scope of data.

20. Epidemiological and Public Health Data Management

In cases specified by law, the Data Controller is required to record data regarding certain infectious diseases, epidemiological events, or other public health circumstances, and to provide such data to the competent authority.

The legal basis for such data processing is not the data subject’s consent, but rather the Data Controller’s compliance with its legal obligations, as well as the GDPR provisions governing data processing for medical and public health purposes.

21. Remedies

If the data subject believes that the processing of their personal data violates the law, they may file a complaint with the supervisory authority or seek judicial remedy.

National Authority for Data Protection and Freedom of Information

NAIH
Address: 1055 Budapest, Falk Miksa utca 9–11.
Mailing Address: 1363 Budapest, Pf. 9.
E-mail: ugyfelszolgalat@naih.hu
Phone number: +36 (1) 391-1400
Website: naih.hu

The contact information above is the NAIH's current official information.

Patient Rights Advocate

In matters related to health care or patient rights, the affected individual may also contact the regionally authorized patient rights representative.

The network of patient rights advocates was established by the Integrated Legal Protection Service (IJSZ) operates.

Integrated Legal Protection Service
Address: 1134 Budapest, Tüzér u. 33–35.
Mailing Adress: 1365 Budapest, Pf. 646.
Phone number: +36-1/8969-000
Toll-free number: +36-80/620-055
E-mail: ijsz@ijsz.bm.gov.hu
Website: ijsz.hu

Enforcement of Rights Through the Courts

The data subject has the right to bring a claim before a court in the event of unlawful processing of his or her personal data.

22. Amendments to the Prospectus

The Data Controller is entitled to amend this Privacy Notice, in particular:

change in legislation;
changes to the technical operation of the website;
new purpose of data processing;
new data processor;
launch of a new online service or form

in such cases.

The current version is available on the gyermekdoki.hu website.

This privacy notice applies exclusively to the processing of personal data that occurs during the use of the gyermekdoki.hu website and when using the online forms and electronic communication channels available on the website.

Additional data processing activities carried out in the course of personal health care are governed by specific health data processing rules and legal provisions.