Personal Data Processing Policy

Data controller

The controller of personal data processed in connection with operating mediccareconcierge.com and providing MEDICCARE CONCIERGE services is the entity named in the "Legal notice" section below (the "controller"). The controller arranges international services for clients (medical and wellness care, travel, accommodation, education, legal and financial matters, and others, depending on the request) through a network of partners, and where necessary passes personal data to the relevant partner to conclude the corresponding agreement. Data-processing agreements are signed with partners where the nature of the cooperation requires it. The controller can be reached at yourpersonalmanager@mediccareconcierge.com.

Separate controller for medical and wellness services

The medical and wellness direction of MEDICCARE CONCIERGE is delivered in cooperation with MEDICCARE CZ clinic (Mediccare.cz), operated by Forget me not s.r.o., Company ID: 07444451, registered address Olšanská 54/3, Žižkov, 130 00 Prague 3, Czech Republic, registered in the Commercial Register kept by the Municipal Court in Prague under file no. C 301160. If a client requests a medical or wellness service, the relevant personal data — including health-insurance details and, where relevant, medical records — is passed to Forget me not s.r.o., which acts as an independent controller for that data for the purpose of arranging and providing the medical care. Questions about this specific processing can be sent to info@mediccare.cz.

Data subject

A data subject is an individual who has provided their personal data to the controller in connection with a request to arrange one of the MEDICCARE CONCIERGE services, or under measures taken prior to concluding an agreement at that individual's request.

Scope of data processed

The scope of data processed depends on the nature of the requested service and may include, in particular:

• name, surname, and title where applicable
• date of birth — particularly for medical, education, and visa services
• residential address and country of residence
• phone and email contact, or a preferred messaging channel chosen by the client
• data needed for the specific service — e.g. health-insurance details for medical services; travel and visa details for travel and visa services; children's details for education and nanny services; banking details when arranging financial transfers
• personal data, including the special category of health data, voluntarily provided by the client in connection with a medical or wellness service

Purpose and legal basis of processing

The controller processes personal data for the purpose of:

• carrying out measures taken prior to concluding an agreement at the data subject's request
• performing the agreement between the data subject and the controller — arranging the requested service
• complying with legal obligations, e.g. under accounting and tax law
• protecting the controller's legitimate interests, including the defense of legal claims
• direct marketing — only where the data subject has opted in, or in direct connection with providing a service, with the option to unsubscribe at any time

Personal data contained in medical records, including the special category of health data, is processed only when voluntarily provided together with explicit consent. Consent can be withdrawn at any time by sending a message to info@mediccare.cz. The controller does not carry out automated decision-making or profiling within the meaning of Art. 22 GDPR.

Necessity assessment

The controller processes only the personal data strictly necessary for the purpose and scope of the specific service requested.

Retention period

Data processed to perform an agreement is kept for the duration of the contractual relationship and a further 3 years, reflecting the limitation period for potential damage claims. Data processed to comply with a legal obligation is kept for the period set by the relevant legislation. Data processed for marketing purposes or on the basis of consent is kept for 3 years unless an objection is raised or consent withdrawn earlier.

Withdrawing consent

Where consent to processing was given voluntarily, the data subject may withdraw it at any time by emailing yourpersonalmanager@mediccareconcierge.com (for medical records, info@mediccare.cz). Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

Recipients of personal data

Personal data is accessible to the controller and, where necessary, to third parties that provide appropriate processing safeguards under applicable law:

• external accounting, legal, and tax service providers
• IT and website administrators
• contractual partners to whom conclusion of the relevant agreement is arranged — medical facilities and physicians, hotel and travel partners, educational institutions, legal and financial advisors, and others, depending on the service requested
• public authorities to which the controller is legally required to provide personal data

International data transfers

The controller does not currently transfer personal data to third parties outside the EU/EEA. If the controller uses a tool or partner based outside the EU/EEA in the future, data subjects will be informed in advance through an update to this policy, and separate consent will be requested where required.

Data subject rights

A data subject may exercise the following rights by emailing yourpersonalmanager@mediccareconcierge.com:

• the right of access to personal data (Art. 15 GDPR)
• the right to rectification (Art. 16 GDPR)
• the right to erasure in certain cases (Art. 17 GDPR)
• the right to restriction of processing (Art. 18 GDPR)
• the right to data portability (Art. 20 GDPR)
• the right to object to processing (Art. 21 GDPR)
• the right to withdraw consent at any time (Art. 7(3) GDPR)
• the right to lodge a complaint with a data protection supervisory authority
• the right to be informed of a personal data breach in certain cases (Art. 34 GDPR)

Raising an objection

Under Art. 21(2) GDPR, a data subject has the right to object to processing based on legitimate interest, including direct marketing. In that case the controller will stop such processing unless it demonstrates compelling legitimate grounds that override the data subject's interests, or grounds necessary for the defense of legal claims. Upon objection to direct marketing, the controller stops that processing immediately.

Obligation to provide personal data

Providing personal data is voluntary. However, without it, the agreement to arrange the requested service cannot be concluded or performed — it is entirely up to the data subject whether to enter into a contractual relationship with the controller.

Identity verification

The controller is entitled to request proof of identity from a data subject to prevent unauthorized persons from accessing their personal data.

Data security

Personal data is protected by standard technical and organizational measures — only authorized users have access, electronic data is protected by login credentials and a firewall, and paper records are kept in secured premises. The measures in place are updated regularly. Absolute data security cannot be objectively guaranteed, but the controller does everything reasonable to protect it.

Cookies and third-party tools

mediccareconcierge.com currently uses only technically necessary cookies. If a booking/CRM tool or another third-party service that processes personal data is introduced in the future, this policy will be updated in advance to describe that tool and its recipient, and separate consent will be requested via a cookie banner where required.