Privacy Policy (Personal Data Processing Policy)
1. Who is the controller of your data
Laserová-dermatologická klinika ALTOS s.r.o., Company ID (IČO) 28192257, registered office at Lyčkovo náměstí 508/7, 186 00 Praha 8 – Karlín, entered in the Commercial Register kept by the Municipal Court in Prague, Section C, File 131829. Place of business: Karlovo náměstí 2097/10, 120 00 Praha 2.
Contact for data protection matters: office@altos-klinika.cz, +420 731 472 021.
2. What data we process
Identification and contact data – first name, surname, date of birth, address, telephone, e-mail.
Health data – medical history, course and results of procedures, medical records, before/after photographs taken for the purposes of care.
Booking and payment data – appointment dates, selected services, visit history, issued documents.
Website data – cookies and similar technologies (see the Cookie Policy).
CCTV footage – images of persons in the publicly accessible areas of the clinic.
3. Why we process data and on what legal basis
| Purpose | Legal basis |
|---|---|
| Provision of medical and aesthetic services, keeping medical records | Art. 6(1)(b) and Art. 9(2)(h) GDPR, Act No. 372/2011 Coll. |
| Appointment booking, reminders and confirmations | Art. 6(1)(b) GDPR |
| Accounting and tax obligations | Art. 6(1)(c) GDPR |
| Sending news to existing clients | legitimate interest, Art. 6(1)(f) GDPR, Section 7 of Act No. 480/2004 Coll. |
| Sending news to other persons | consent, Art. 6(1)(a) GDPR |
| Use of before/after photographs to present our services | explicit written consent, Art. 9(2)(a) GDPR |
| CCTV system – protection of persons and property | legitimate interest, Art. 6(1)(f) GDPR |
| Handling complaints and claims, protection of legal claims | Art. 6(1)(c) and (f) GDPR |
| Website marketing (Meta pixel) | consent given in the cookie bar |
4. Bookings and your data in the booking system
For appointments we use a booking system that stores your contact data, visit history and booked appointments. The system’s servers are located in the EU. You can change or cancel an appointment by telephone, by e-mail or via the link in the confirmation message. We will correct or delete contact data from the booking system upon your request sent to office@altos-klinika.cz. Medical records are kept separately; they are subject to statutory retention periods and cannot be deleted on request (see point 7).
5. Newsletters and how to unsubscribe
We may send existing clients information about our services on the basis of legitimate interest. Every message includes an unsubscribe option. You can also unsubscribe at any time by e-mail to office@altos-klinika.cz or by telephone. After unsubscribing, we flag you as “do not send” and send no further messages. Unsubscribing does not affect service messages (appointment confirmations and reminders).
6. Who we share data with
Processors who provide our booking system, medical records management, accounting, IT and hosting – only on a contractual basis and to the extent necessary.
Meta Platforms Ireland Ltd. – only if you have consented to marketing cookies. Data may be transferred to the USA; the transfer is covered by a European Commission decision (EU–US Data Privacy Framework).
Public authorities, health insurance companies and other entities where required by law.
An insurance company and legal representative in the event of a legal claim.
No other transfers to third countries take place.
7. How long we keep data
Medical records – for the period set by Decree No. 98/2012 Coll.
Accounting and tax documents – 10 years.
Data in the booking system – 3 years from the last visit.
Data processed on the basis of consent – until consent is withdrawn, but no longer than 3 years.
CCTV footage – 7 days; in the event of an incident, until it is resolved.
Complaints and claims – 3 years from resolution; in the event of a dispute, until it is concluded.
After these periods expire, we delete or anonymise the data.
8. Your rights
You have the right to access your data, to have it rectified, erased (unless a statutory retention obligation prevents this), to restrict processing, to data portability, to object to processing based on legitimate interest, and to withdraw your consent at any time. We will handle your request within 30 days; we may ask for additional information to verify your identity. Please send requests to office@altos-klinika.cz.
You may lodge a complaint with the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Praha 7, www.uoou.cz.
9. Security
We protect data through encrypted transmission, access control, confidentiality obligations of employees and contractual obligations of processors. Medical records are kept separately from the booking system.
10. Obligation to provide data and automated decision-making
Data necessary for providing the service and keeping medical records is a statutory requirement; without it, the service cannot be provided. Marketing data is provided voluntarily. No automated decision-making or profiling with legal effects takes place.
11. Changes to this policy
We may update this policy. The current version is always available on this page; we will inform you of any material changes.
Effective from 1 September 2026. Supersedes the version dated 8 July 2026.