Privacy Statement

This privacy statement describes how the customer’s personal data is processed on the Dokport website, the patient record system and the digital doctor service. Data protection is important to us and we are committed to protecting the privacy of our customers and users in compliance with applicable legislation, such as the EU General Data Protection Regulation (GDPR).‍

‍

  1. Data Controllers 

Dokport Suomi Oy (”Dokport”) provides the Dokport network service (”Chassis“) through which remote healthcare services can be ordered (”Service“), by physicians or other health care professionals (”Service Provider“) provide to individuals (”Customer”). 

With regard to the personal data processed on the platform and its own patient data, Dokport is the data controller. The service provider with whom the Customer has a care relationship is the controller of his/her own medical records. Dokport may also act as a Service Provider on a case-by-case basis. 

‍

  1. Contact Information

If the Customer has any questions about this privacy policy or the Customer wishes to exercise its data protection rights, the Customer may contact Dokport customer service:

Dokport Suomi Oy/data protection issues

Postal address: Maria Jotunin tie 11 LT, 00400 Helsinki
E-mail: asiakaspalvelu@dokport.com

‍

  1. Purposes of data processing Basics

Processing related to the use of the Platform and the contractual relationship between Dokport and the Customer: 

  • Dokport processes the Customer’s personal data on the basis of an agreement between the Customer and Dokport in order to provide the Service requested by the Customer, to send communications related to the Service and to bill the Customer. 
  • Upon termination of the contractual relationship, Dokport retains log data and billing information in order to fulfill its legal obligations. 
  • Dokport and its partners use the Platform usage data and anonymised patient data for the development, statistical and research purposes of the Platform based on Dokport’s legitimate interest. 
  • The electronic direct marketing sent by Dokport to the Customer is based on a legitimate interest related to the customer relationship or the consent expressly given by the Customer. 
  • Dokport processes the Customer’s personal data for the processing of feedback, formal requests for clarification and hazard events on the basis of legislation or legitimate interest.

Processing related to the care relationship and the contractual relationship between the Customer and the Service Provider:

  • The Service Provider processes the Customer’s personal data for the purpose of examining and treating the Customer’s health status, illnesses and injuries. The processing is based on the contract and management relationship between the Customer and the Service Provider and the fulfillment of statutory obligations.
  • The Service Provider processes the Customer’s personal data for the processing of feedback, official requests for clarification and hazard events on the basis of legislation or legitimate interest. 

To the extent that the processing is based on a legitimate interest, the data controllers have assessed that the processing does not conflict with the fundamental rights or freedoms of the Customer.

‍

  1. Data to be processed

Information related to the use of the Platform and the contractual relationship between Dokport and the Customer:

  • Customer Identification and Identification Information
  • Customer contact information
  • Customer’s contractual information and consents
  • Information resulting from the communication between the user and Dokport
  • Log data generated from the use of the platform
  • Receipts, invoices and other payment information provided to the customer

Information related to the care relationship between the Customer and the Service Provider or Dokport:

  • Customer’s name, personal identity number and contact information (e.g. address, telephone number, e-mail address)
  • The guardian of the minor Client or other close relative appointed by the Customer and the contact details of this person and, if necessary, personal identity number
  • Consents to the processing and disclosure of data
  • Medical records in accordance with the legislation, including treatment and examination data, information about the author and status of the entry and the date of the entry
  • Communication and communication between the Customer and the Service Provider, including all possible attachments
  • Information related to the coil direct replacement procedure.

‍

  1. Sources of information

Personal data about the Customer is collected mainly from the Customer in connection with contacts or the use of the services. In the case of a minor, information can also be obtained from the guardian of the minor. The data in the patient register are formed in connection with treatment and examinations. In the case of a login based on strong electronic identification, the identification data comes from Telia Finland Plc.

Dokport.com uses cookies to collect information about your use of this website. For more information on their use you can find about our cookie policy . Cookies typically do not identify the Customer personally, and the information collected by the cookies is never combined with the Customer’s medical records. 

‍

  1. Retention period of personal data

In order to fulfill the contract, personal data will be collected from the moment the Customer is strongly identified on the Platform and will be processed for as long as the health service is produced. Dokport may retain information related to the use of the Platform for a reasonable period of time after the termination of the contractual relationship in order to communicate about the Service or to develop the Service. 

Dokport and the Service Providers comply with legal requirements when it comes to storing personal data. For example, patient documents have long retention periods regarding the processing of social and healthcare customer data (703/2023). They are stored for 12 years from the patient’s death or, in the absence of information, 120 years from the patient’s birth. Accounting receipts are retained for six years from the end of the accounting period for which the vouchers were created.

Data may be retained beyond these time limits in exceptional circumstances, such as at the request of a law or authority or due to a legal claim.

The information collected by cookies is stored for the period described in the Cookie Consent Mechanism and Cookie Policy. 

‍

  1. Disclosure of data

The customer’s personal data will be disclosed in the following cases: 

  • Kanta: patient document entries are made in the National Health Data Archive (Kanta) so that the data can be read by the Customer through the Omakanta service. More information www.kanta.fi .
  • Consent: personal data is disclosed in accordance with the written consent of the Client or in the patient document, with the Client’s oral consent or on the basis of the consent that arises from the relevant contact to another healthcare provider in order to enable the Client’s treatment. Anonymised and/or statistical data may be processed and disclosed for research and statistical purposes without consent.
  • Authorities: to courts, other authorities or entities with a legal right of access to information, information is disclosed on the basis of a written and specific request, in the form and scope required by the case.
  • Mergers: if we sell or otherwise organize our business, the Customer’s personal data may be disclosed to buyers and their advisors.
  • Collection and legal claims: Customer information may be provided to selected partners to recover our claims and to assert and defend legal claims.

The payment feature of the platform has been implemented using Paytrail Plc’s payment intermediation service. Paytrail acts as a processor of personal data in respect of the data transmitted by Dokport in connection with a payment transaction.

‍

  1. International transfers of personal data

As a rule, personal data are not transferred outside the EU and EEA. For example, the data centers of the customer information systems we use are located in EU or EEA countries. In exceptional cases where data is transferred outside the EU or EEA, Dokport complies with the appropriate safeguards of data protection regulations, such as standard contractual clauses approved by the Commission. 

‍

  1. Principles of protection of personal data

The register is technically and organizationally protected. We use measures in accordance with Article 32 of the EU General Data Protection Regulation, such as pseudonymisation and encryption, to ensure that the processing of personal data is secure. Persons who process personal data are bound by a duty of confidentiality. We adhere to industry best practices and standards to ensure data security.

‍

  1. Rights 

The customer has the right to:

  • Get information about the processing of data
  • Access the data
  • Request a rectification of the information
  • Request deletion of data (“right to be forgotten”)
  • Restrict the processing of data
  • Objects to the processing of data
  • Transferring data from one system to another
  • Withdraw consent
  • Notifies complaints to the Data Protection Authority, www.tietosuoja.fi  

The above rights are exercised to the extent permitted and required by data protection and other regulations. In order to exercise the rights, we ask the Customer to contact us at the address set out in section 2. We ask the Customer to verify your identity so that we can ensure that the information is not disclosed to any person other than the data subject. 

‍

  1. Changes

We are constantly improving the Service and our policies and may change this privacy statement. Changes may also be based on changes in legislation or regulatory guidelines. We recommend that you review the contents of the privacy policy regularly. 

‍

This privacy statement was last updated on 6 September 2024.