PRIVACY POLICY
General Regulation for the Protection of Personal Data
INDEX
A. General part
Introduction
Definitions
Collection and processing of personal data
Subcontracted Entities
Data collection channels
General principles applicable to the Processing of Personal Data of the data subject
Use and purposes of the data processing of the data subject
Technical, organizational and security measures implemented
Transfer of data outside the Union
B. Rights of data subjects
Right to Information
Right of access to personal data
Right to rectify personal data
Right to erase personal data ("right to be forgotten")
Right to limit the processing of personal data
Right to portability of personal data
Right to object to treatment
Procedures for the exercise of rights by the data subject
Breaches of personal data
C. Final part
Changes to the Privacy Policy
Applicable law and jurisdiction
A. GENERAL PART
INTRODUCTION
This document is an integral part of the regulatory body for the protection of personal data from the Pharmacy, taking into account the General Regulation on Data Protection (2016/679), hereinafter referred to as GDPR.
Whenever this document is updated, a new version will be made available immediately after its approval.
Monitoring of compliance with this standard will be ensured by measuring the indicators for evaluating controls and / or audits (internal or external), at regular time intervals or when significant changes occur.
Scope and objective
This Privacy Policy was implemented with the purpose of demonstrating the commitment and respect for the rules of privacy and protection of personal data.
Why this Privacy Policy?
This Privacy Policy arises because we intend to make public the general rules of privacy and treatment of your personal data, which we collect and treat in strict respect and compliance with national and community legislation on the protection of personal data.
The Pharmacy is committed to respecting best practices in the field of security and protection of personal data, having approved a demanding program for this purpose, capable of safeguarding the protection of the data made available to us by all those who in some way relate with the Pharmacy.
What does this Privacy Policy cover?
This Privacy Policy applies exclusively to the collection and processing of personal data carried out by the Pharmacy.
Recipients
This Privacy Policy is intended for the general public and Pharmacy users in particular and establishes obligations for all employees of the organization.
Definitions
Personal Data - All information relating to an identified or identifiable natural person; an identifiable individual is a person who can be identified, directly or indirectly, such as a name, an identification number, location data, identifiers by electronic means or one or more specific elements of physical, physiological, genetic, mental identity , economic, cultural or social status of that natural person.
Special Categories of Personal Data - Personal data that reveals racial or ethnic origin, political opinions, religious or philosophical beliefs, or the union membership of a natural person, as well as the processing of genetic data, biometric data to identify a person of unequivocally, health-related data or data on sexual life or sexual orientation.
Treatment - It is the operation or a set of operations carried out on personal data or on personal data sets, by automated or non-automated means, such as the collection, registration, organization, structuring, conservation, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, diffusion or any other form of availability, comparison or interconnection, limitation, erasure or destruction.
Responsible for Processing - It is the natural or legal person, the public authority, the agency or other body that, individually or in conjunction with others, determines the purposes and means of processing personal data; where the purposes and means of such treatment are determined by Union or Member State law, the controller or the specific criteria applicable to his appointment may be provided for by Union or Member State law.
Violation of Personal Data - It is a breach of security that causes, accidentally or unlawfully, the destruction, loss, alteration, disclosure or unauthorized access to personal data transmitted, preserved or subject to any other type of treatment.
Subcontractor - It is a natural or legal person, the public authority, agency or other body that processes personal data on behalf of the person responsible for processing them.
Third - It is a natural or legal person, the public authority, the service or body that is not the data subject, the controller, the subcontractor and the persons who, under the direct authority of the controller or processor, are authorized to process personal data.
DATA COLLECTION AND PROCESSING OF THE HOLDER
Within the scope of the Pharmacy activity, the collection, registration, organization, conservation, use and consultation of personal data takes place. There may also be other operations or set of operations that, under the terms of the General Data Protection Regulation, are referred to as "processing of personal data".
The personal data collected concerns not only employees but also suppliers, candidates and customers / users.
The Pharmacy collects personal data, namely, the data required for invoicing and data contained in medical prescriptions.
When collecting Personal Data, Pharmacies provide data holders with detailed information about the nature of the data collected and about the purpose and treatment that will be carried out in relation to personal data, as well as the information mentioned in the right clause. access to personal data.
SUBCONTRACTED ENTITIES
Within the scope of the treatment of the data of the holder, the Pharmacy uses or may use third parties, subcontracted by itself, to, in the name of the Pharmacy, and in accordance with the instructions given by it, proceed with the treatment of the data of the holder, in strict compliance with the provisions of the law and this Privacy Policy.
These subcontracted entities will not be able to transmit the data of the holder to other entities without the Pharmacy having previously given written authorization to do so, and they are also prevented from hiring other entities without prior authorization from the Pharmacy.
The Pharmacy is committed to subcontracting only entities that present sufficient guarantees for the execution of the appropriate technical and organizational measures, in order to ensure the defense of the rights of the holder. All entities subcontracted by the Pharmacy are linked to the latter through a written contract which regulates, in particular, the object and duration of the treatment, the nature and purpose of the treatment, the type of personal data, the categories of data subjects and the rights and obligations of the parties.
When collecting personal data, the Pharmacy provides the data subject with information about the categories of subcontracted entities that, in the specific case, can carry out data processing on behalf of the Pharmacy.
DATA COLLECTION CHANNELS
The Pharmacy can collect data directly (i.e., directly from the holder) or indirectly (i.e., through partner entities or third parties). Collection can be done through the following channels:
Direct collection: in person, by phone or by e-mail;
Indirect collection: through partners or companies of the Pharmacy and official entities.
GENERAL PRINCIPLES APPLICABLE TO THE HOLDER'S DATA PROCESSING
In terms of general principles relating to the processing of personal data, the Pharmacy is committed to ensuring that the data of the holder processed by them are:
ü Subject to lawful, fair and transparent treatment in relation to the data subject;
ü Collected for specific, explicit and legitimate purposes, not later being treated in a way incompatible with those purposes;
ü Adequate, relevant and limited to what is necessary in relation to the purposes for which they are treated;
ü Accurate and updated whenever necessary, taking all appropriate measures so that the inaccurate data, taking into account the purposes for which they are processed, are erased or rectified without delay;
ü Kept in a way that allows the data subject to be identified only for as long as necessary for the purposes for which the data is processed;
ü Treated in a way that guarantees your safety, including protection against its unauthorized or unlawful treatment and against its loss, destruction or accidental damage, taking appropriate technical or organizational measures.
Data processing carried out by the Pharmacy is lawful when at least one of the following situations occurs:
® The data subject has given his explicit consent to the processing of the data subject's data for one or more specific purposes;
® Processing is necessary for the performance of a contract to which the data subject is a party, or for pre-contractual steps at the request of the data subject;
® Treatment is necessary to fulfill a legal obligation to which the Pharmacy is subject;
® Processing is necessary to defend the vital interests of the data subject or another natural person;
® Processing is necessary for the purpose of legitimate interests pursued by the Pharmacy or by third parties (unless the interests or fundamental rights and freedoms of the data subject that require the protection of personal data prevail).
The Pharmacy undertakes to ensure that the data processing of the holder is only carried out under the conditions listed above and with respect for the principles mentioned above.
When the data subject's treatment is carried out by the Pharmacy based on the data subject's consent, the data subject has the right to withdraw his consent at any time. The withdrawal of consent, however, does not compromise the lawfulness of the treatment carried out by the Pharmacy based on the consent previously given by the data subject.
The period of time during which the data is stored and preserved varies according to the purpose for which the information is processed.
In fact, there are legal requirements that require data to be kept for a minimum period of time. Thus, and whenever there is no specific legal requirement, the data will be stored and preserved only for the minimum period necessary for the purposes that motivated its collection or its further treatment, after which they will be eliminated.
USE AND PURPOSES OF THE HOLDER'S DATA PROCESSING
In general terms, the Pharmacy uses the data subject's data for various purposes, namely billing and collection to the data subject, for the purposes of Marketing and for the management of human resources and recruitment of employees.
The data of the holder collected by the Pharmacy are not shared with third parties without the consent of the holder, with the exception of the situations referred to in the following paragraph. However, in the event that the holder contracts with the Pharmacy services that are provided by other entities responsible for the processing of personal data, the data of the holder may be consulted or accessed by those entities, insofar as this is necessary for the provision of the aforementioned. services.
Under applicable legal terms, the Pharmacy may transmit or communicate the data of the holder to other entities in the event that such transmission or communication is necessary for the performance of the contract established between the holder and the Pharmacy, or for pre-contractual steps at the request of the holder , in case it is necessary for the fulfillment of a legal obligation to which the Pharmacy is subject or in case it is necessary for the purpose of pursuing legitimate interests of the Pharmacy or of a third party. In the event of a transmission of data from the holder to third parties, reasonable efforts will be made to ensure that the transferee uses the data of the holder transmitted in accordance with this Privacy Policy.
TECHNICAL, ORGANIZATIONAL AND SECURITY MEASURES IMPLEMENTED
In order to guarantee the security of the data of the holder and the maximum confidentiality, the Pharmacy treats the information it has provided to us in an absolutely confidential manner, in accordance with its internal security and confidentiality policies and procedures, which are periodically updated according to the needs, as well as as per the legally provided terms and conditions.
Depending on the nature, scope, context and purposes of the data processing, as well as the risks arising from the treatment for the rights and freedoms of the data subject, the Pharmacy undertakes to apply, both when defining the means of treatment as at the moment of the processing itself, the technical and organizational measures necessary and adequate to protect the data of the holder and to comply with legal requirements.
It also undertakes to ensure that, by default, only the data that is necessary for each specific purpose of treatment are processed and that these data are not made available without human intervention to an undetermined number of people.
In terms of general measures, the Pharmacy adopts the following:
Regular audits with a view to assessing the effectiveness of the technical and organizational measures implemented;
Awareness and training of staff involved in data processing operations;
Mechanisms capable of ensuring the confidentiality, availability and permanent resilience of information systems;
Mechanisms that ensure the restoration of information systems and access to personal data in a timely manner in the event of a physical or technical incident;
TRANSFER OF DATA OUTSIDE THE EUROPEAN UNION
The personal data collected and used by the Pharmacy are not made available to third parties established outside the European Union. If, in the future, this transfer takes place, the Pharmacy undertakes to ensure that the transfer complies with the applicable legal provisions, namely regarding the determination of the suitability of that country with regard to data protection and the requirements applicable to such transfers.
B. RIGHTS OF DATA HOLDERS
RIGHT TO INFORMATION
Information provided to the data subject by the Pharmacy (when data is collected directly from the data subject):
The identity and contact details of the Pharmacy, responsible for the treatment and, if applicable, of its representative;
The purposes of the processing for which the personal data are intended, as well as, if applicable, the legal basis for the processing;
If the processing of the data is based on legitimate interests of the Pharmacy or of a third party, indication of such interests;
If applicable, the recipients or categories of recipients of personal data;
If applicable, an indication that personal data will be transferred to a third country or an international organization, and whether or not there is an adequacy decision taken by the Commission or reference to appropriate or appropriate transfer guarantees;
Period of retention of personal data;
The right to ask the Pharmacy for access to personal data, as well as its rectification, erasure or limitation, the right to object to the processing and the right to data portability;
If the processing of the data is based on the consent of the holder, the right to withdraw the consent at any time, without compromising the lawfulness of the treatment carried out based on the consent previously given;
The right to file a complaint with CNPD or another supervisory authority;
Indication whether or not the communication of personal data constitutes a legal or contractual obligation, or a necessary requirement to conclude a contract, as well as whether the data subject is obliged to provide personal data and the possible consequences of not providing such data;
If applicable, the existence of automated decisions, including profiling, and information regarding the underlying logic, as well as the importance and expected consequences of such processing for the data subject.
If the data of the data subject are not collected directly by the Pharmacy from the data subject, in addition to the information referred to above, the data subject is additionally informed about the categories of personal data being processed and, as well, about the origin of the data and eventually come from sources accessible to the public.
If the Pharmacy intends to proceed with the further processing of the data of the holder for a purpose other than that for which the data were collected, before this treatment the Pharmacy will provide the holder with information about that purpose and any other pertinent information, under the terms referred to above.
Procedures and measures implemented to fulfill the right to information:
The aforementioned information is provided in writing (including by electronic means) by the Pharmacy to the holder prior to the processing of the personal data in question. Under the terms of the applicable law, the Pharmacy has no obligation to provide the holder with this information when and to the extent that the holder is already aware of it.
The information is provided by the Pharmacy free of charge.
RIGHT OF ACCESS TO PERSONAL DATA
The Pharmacy guarantees the means that allow access, by the data owner, to your personal data.
The data subject has the right to obtain confirmation from the Pharmacy that the personal data concerning him or her are or are not subject to treatment and, if applicable, the right to access their personal data and the following information:
ü The purposes of data processing;
ü The categories of personal data in question;
ü The recipients or categories of recipients to whom the personal data have been or will be disclosed, namely recipients established in third countries or belonging to international organizations;
ü The period of retention of personal data;
ü Right to ask the Pharmacy to rectify, erase or limit the processing of personal data, or the right to object to such treatment;
ü Right to file a complaint with CNPD or another supervisory authority;
ü If the data has not been collected from the holder, the available information on the source of that data;
ü The existence of automated decisions, including the definition of profiles, and information related to the underlying logic, as well as the importance and expected consequences of such treatment for the data subject;
ü Right to be informed about the appropriate guarantees associated with the transfer of data to third countries or international organizations.
Upon request, the Pharmacy will provide the data holder, free of charge, with a copy of their data that are in the treatment phase. The supply of other copies requested by the holder may incur administrative costs.
RIGHT TO RECTIFY PERSONAL DATA
The data subject has the right to request, at any time, the rectification of his Personal data and, as well, the right to have his incomplete personal data completed, including by means of an additional declaration.
In case of rectification of the data, the Pharmacy communicates to each recipient to whom the data has been transmitted the respective rectification, unless such communication proves to be impossible or implies a disproportionate effort for the Pharmacy.
RIGHT TO DELETE PERSONAL DATA ("RIGHT TO BE FORGOTTEN")
The data subject has the right to obtain, on the part of the Pharmacy, the erasure of his data when one of the following reasons applies:
ü The data of the holder is no longer necessary for the purpose that motivated its collection or treatment;
ü The holder withdraws the consent on which the processing of the data is based and there is no other legal basis for said processing;
ü The holder opposes the treatment under the right of opposition and there are no prevailing legitimate interests that justify the treatment;
ü If the data of the holder is processed illegally;
ü If the data of the holder has to be erased in order to comply with a legal obligation to which the Pharmacy is subject;
Under applicable legal terms, the Pharmacy has no obligation to delete the data of the holder to the extent that the treatment proves necessary to fulfill a legal obligation to which the Pharmacy is subject or for the purposes of declaring, exercising or defending a right Pharmacy in a judicial process.
In case of data deletion, the Pharmacy communicates to each recipient / entity to whom the data has been transmitted the respective deletion, unless such communication proves impossible or involves a disproportionate effort for the Pharmacy.
When the Pharmacy has made the data of the holder public and is obliged to delete them under the right to erase, the Pharmacy undertakes to ensure that the measures are reasonable, including technical measures, taking into account the available technology and the application costs, to inform those responsible for the effective processing of personal data that the holder has requested that the links to such personal data be deleted, as well as copies or reproductions thereof.
RIGHT TO LIMIT THE PROCESSING OF PERSONAL DATA
The data subject has the right to obtain, from the Pharmacy, a limitation on the processing of the data of the data subject, if one of the following situations applies (the limitation is to insert a mark in the kept personal data with the aim of limiting its treatment in the future):
ü If you dispute the accuracy of personal data, for a period that allows the Pharmacy to verify its accuracy;
ü If the processing is illegal and the data subject opposes the deletion of the data, requesting, on the other hand, the limitation of its use;
ü If the Pharmacy no longer needs the data subject's data for processing purposes, but these data are required by the data subject for the purpose of declaring, exercising or defending a right in a judicial process;
ü If the holder has opposed the treatment, until it is verified that the legitimate reasons of the Pharmacy prevail over those of the holder.
When the data of the data subject are subject to limitation, they may, with the exception of conservation, only be processed with the consent of the data subject or for the purpose of declaring, exercising or defending a right in a judicial proceeding, defending the rights of another natural person or collective action, or for reasons of public interest provided for by law.
The data subject who has obtained the limitation in the treatment of his data in the cases referred to above will be informed by the Pharmacy before the limitation to treatment is canceled.
In case of limitation in the processing of data, the Pharmacy will communicate to each recipient to whom the data has been transmitted the respective limitation, unless such communication proves impossible or implies a disproportionate effort for the Pharmacy.
RIGHT TO PORTABILITY OF PERSONAL DATA
The data subject has the right to receive the personal data that concerns him and that he has provided to the Pharmacy, in a structured format, in common use and automatic reading, and the right to transmit this data to another controller, if:
ü Treatment is based on consent or a contract to which the holder is a party;
and
ü The treatment is carried out by automated means.
The portability right does not include inferred data or derived data, i.e., personal data that is generated by the Pharmacy as a consequence or result of the analysis of the data being processed.
The data subject has the right to have personal data transmitted directly between controllers, whenever technically possible.
RIGHT OF OPPOSITION TO TREATMENT
The holder has the right to object at any time, for reasons related to his particular situation, to the processing of personal data concerning him based on the exercise of legitimate interests pursued by the Pharmacy or when the treatment is carried out for purposes other than whether those for which personal data were collected, including the definition of profiles, or when personal data are processed for statistical purposes.
The Pharmacy will stop processing the data of the holder, unless it presents compelling and legitimate reasons for such treatment that prevail over the interests, rights and freedoms of the holder, or for the purposes of declaring, exercising or defending a right of the Pharmacy in a judicial process.
When the data subject's data is processed for the purposes of direct marketing (marketing), the data subject has the right to object at any time to the processing of data concerning him for the purposes of said marketing, which covers the definition of profiles to the extent that it is related to direct marketing. If the holder opposes the processing of his data for the purpose of direct marketing, the Pharmacy stops processing the data for that purpose.
The data subject also has the right not to be subject to any decision taken exclusively on the basis of automated processing, including the definition of profiles, which has an effect on its legal sphere or which significantly affects it in a similar way, unless the decision:
It is necessary for the conclusion or execution of a contract between the holder and the Pharmacy;
It is authorized by legislation to which the Pharmacy is subject; or
It is based on the explicit consent of the data subject.
PROCEDURES FOR THE EXERCISE OF RIGHTS BY THE HOLDER
The right of access, the right to rectification, the right to erase, the right to limitation, the right to portability and the right to object can be exercised by the data subject by contacting the Pharmacy and filling out the respective form.
The Pharmacy will respond in writing (including by electronic means) to the holder's request within a maximum period of one month from receipt of the request, except in cases of special complexity, in which this period may be extended up to two months.
If the requests submitted by the holder are manifestly unfounded or excessive, namely due to their repetitive nature, the Pharmacy reserves the right to charge administrative costs or to refuse to proceed with the request.
PERSONAL DATA BREACHES
In the event of a data breach and insofar as such breach is likely to imply a high risk to the holder's rights and freedoms, the Pharmacy undertakes to report the breach of personal data to CNPD within 72 hours of knowledge of the incident.
Under legal terms, communication to the holder is not required in the following cases:
If the Pharmacy has applied appropriate protection measures, both technical and organizational, and these measures have been applied to the personal data affected by the personal data breach, especially measures that make the personal data incomprehensible to any unauthorized person to access that data, such as encryption;
If the Pharmacy has taken subsequent measures to ensure that the high risk to the holder's rights and freedoms is no longer likely to materialize; or
If the communication to the holder implies a disproportionate effort for the Pharmacy. In this case, the Pharmacy will make a public communication or take a similar measure through which the holder will be informed.
C. FINAL PART
CHANGES TO THE PRIVACY POLICY
The Pharmacy reserves the right to change this Privacy Policy at all times. In case of modification of the Privacy Policy, the date of the last change, available at the top of this page, is also updated.
APPLICABLE LAW AND JURISDICTION
The Privacy Policy, as well as the collection, processing or transmission of the data of the holder, are governed by the provisions of Regulation (EU) 2016/679, of the European Parliament and of the Council, of 27 April 2016 and by the applicable laws and regulations in Portugal.
