Customer register privacy statement

1. Data controller and contact information

Docrates Cancer Center, Saukonpaadenranta 2, 00160 Helsinki, Finland, Tel. +358 10 773 2000, fax +358 10 773 2099

Our primary contact information for inquiries related to the processing of personal data is tietosuoja@docrates.com.

If your message contains health data or other sensitive personal data, please use Docrates Oy’s secure e-mail.

2. Data Protection Officer

If you wish, you can contact Docrates Oy’s Data Protection Officer directly at docrates.tietosuojavastaava@fondia.com

3. Name of the register

Docrates Syöpäsairaalan asiakasrekisteri (‘Docrates Cancer Center customer register’)

4. Purpose and grounds for the processing of personal data

The purpose of processing the data in the customer register is

• Executing service requests received from the customer and ensuring a smoother customer and transactional experience by storing the data in the CRM system
• Management and development of customer service and related communications
• Organisation of invoicing
• Sending marketing to newsletter subscribers
• Collection and processing of customer feedback and customer satisfaction data
• We also process personal data to improve the quality of customer service, in which case the legal basis is Docrates’ legitimate interest

The processing of the customer’s personal data is based on the establishment of a customer relationship between the customer and Docrates. With regard to the health data provided by the customer, the processing of personal data is based on the customer’s explicit consent.

Docrates does not perform profiling based on personal data.

5. The data content of the register and the categories of data subjects

The register includes the following personal data that is necessary for the customer:

Basic information of the customer:

• First name and surname, home country, date of birth (mandatory)
• Contact information (postal address, email address and phone number)
• Identification information (date of birth or social security number)
• Name and contact information of the guardian or legal representative of a minor patient
• Name of the next of kin of the patient
• Other basic information (such as gender, native language)
• Information of completed calls

Information necessary for maintaining and developing the customer relationship:

• Information on the customer’s ways of using the services, wishes and communication channel subscriptions
• Customer’s consents
• Feedback provided by the customer
• Relevant additional information provided by the customer related to the invoicing of services, such as insurance company information, payment commitments or employer/occupational health care provider information
• Information included in the preliminary information form (such as preliminary information concerning the customer’s profession, health or illnesses)
• Treatment history/places of treatment

We collect contact information from our partners for the customer register.

6. Data sources

Customer information is collected from the customer and from the guardian or legal representative of a minor.

7. Disclosure and transfer of data

Docrates Cancer Center uses the following external service providers in processing of personal data:

• Microsoft Oy / Fellowmind Finland Oy, customer data management

Docrates Cancer Center uses the following information systems in processing of personal data:

• Telephone center for the management of call records
• Microsoft D365 system for customer data management

Personal data shall not be transferred outside the EU or European Economic Area.

8. Principles of protecting personal data and the retention periods

B. Electronically saved data

The data saved in the register are confidential. Only designated persons have access to the data in the register and a login and password are required. Users can be identified afterwards, if necessary, from log files. The register is protected with firewalls. Devices and the server are located in a protected and monitored facilities.

Docrates Cancer Center ensures the data protection compliance of its subcontractors with data processing agreements.

If a patient relationship does not arise from the contact, the customer information is not transferred to the patient information system, and the customer information is removed from the CRM system within one year of the contact.

If the customer has subscribed to marketing messages, their contact information will be stored for as long as the marketing permission is valid.

If the customer starts a patient relationship with Docrates, the data will be deleted three years after the last transaction.

Call records are stored by Docrates for 5 years, after which they are deleted.

9. Rights of data subjects

The data subject has the right of access to the data saved in the customer register concerning them and the right to request rectification and erasure of data. Data subjects have the right to object to the processing of their data, request for restricting the processing of their data or for transferring their data in accordance with the Data Protection Regulation.

The requests must be submitted personally or in writing (provided with a handwritten signature or with otherwise verified documents).

The data subject has the right at any time to withdraw or restrict their consent.

The customer has the right to file a complaint regarding the processing of personal data with the Data Protection Ombudsman.