PERSONAL DATA PROCESSING

Protecting your privacy is as important to us as caring for your health. On this page we explain what personal data we process when you visit the laserplastic.cz website, write to us, book online or subscribe to our newsletter, why we do so, how long we keep the data and what rights you have.

1. Who processes your data

The data controller is LaserPlastic s. r. o., Company ID 03769402, VAT ID CZ03769402, with its registered office at Platnéřská 89/11, 110 00 Prague 1 – Old Town (hereinafter the “clinic” or “we”).

For matters concerning personal data, you can contact us by e-mail at laserplastic@laserplastic.cz, by phone on +420 724 860 082 or in writing at our registered address.

This policy applies to the clinic’s website and online services. Data arising from the provision of healthcare itself (medical records) is processed in accordance with Act No. 372/2011 Coll., on Health Services, and we will be happy to provide details at the clinic.

2. Contact form and enquiries

• What data: first name, surname, e-mail, phone number, area of interest, the text of your message and any promo code.
• Why: so that we can answer your enquiry, recommend a suitable treatment and arrange a consultation.
• Legal basis: steps taken at your request prior to providing a service (Art. 6(1)(b) GDPR) and our legitimate interest in responding to enquiries (Art. 6(1)(f) GDPR). If you share information about your health in your message, we process it on the basis of your explicit consent, which you give by ticking the box in the form (Art. 9(2)(a) GDPR).
• How long: no longer than 3 years from our last contact, unless a contractual relationship arises between us or the law requires us to keep the data for longer.

3. Online appointment booking

• What data: first name, surname, phone number, e-mail, the chosen service and doctor, the date and time of the appointment, and any code and selected add-on service.
• Why: so that we can book your consultation, send you a confirmation by e-mail and contact you if anything changes.
• Legal basis: the conclusion and performance of a contract for the provision of a service (Art. 6(1)(b) GDPR). Because the choice of service alone may reveal information about your health, we also ask for your explicit consent when you book (Art. 9(2)(a) GDPR).
• How long: we keep website booking data for 2 years from the appointment date, after which it is automatically anonymised. If the consultation takes place, the data becomes part of your medical records, which we keep for the period required by law.
• When displaying available appointments, the website checks the availability of the doctor’s calendar kept in Google Calendar. Your personal data is not passed to Google in the process.

4. Newsletter

• What data: e-mail address.
• Why: so that we can send you the clinic’s news, special offers and expert articles.
• Legal basis: your consent (Art. 6(1)(a) GDPR). You confirm your subscription by clicking the link in the confirmation e-mail.
• How long: until you withdraw your consent. You can unsubscribe at any time via the link in every e-mail or by writing to laserplastic@laserplastic.cz.

5. Website security and spam protection

To protect the website and forms against misuse, we process technical data about your visit (IP address, browser type, time and page visited) in server logs, which are automatically deleted, usually within a few weeks. For submitted forms and bookings, instead of the IP address we keep only its irreversibly encrypted fingerprint (a so-called hash), which allows us to detect repeated misuse.

The forms are protected by Google reCAPTCHA, which assesses from behaviour on the page whether a form is being filled in by a person or by an automated program. It only loads once you start filling in a form. The legal basis is our legitimate interest in website security (Art. 6(1)(f) GDPR). You can find details in Google’s privacy policy.

6. Cookies and website analytics

We use analytics and marketing tools (e.g. Google Analytics or Meta Pixel) only with your consent, which you can change at any time. You can find details on the Cookie Policy page.

7. Who we share data with

We do not sell your data or pass it on to third parties for their own purposes. It may only be accessed by our carefully selected suppliers (processors) who provide technical operations for us and are bound by contract and confidentiality:

• the provider of the server on which the website runs (a server located in the Czech Republic),
• Microsoft (e-mail communication via Microsoft 365),
• Google (reCAPTCHA form protection, doctors’ calendars and, with your consent, website analytics),
• Meta Platforms (only with your consent to marketing cookies),
• the provider of the practice management software in which we keep appointments and medical records.

Some of these suppliers may also process data outside the European Union, particularly in the USA. In such cases, the transfer is safeguarded by a European Commission adequacy decision (EU-US Data Privacy Framework) or by standard contractual clauses approved by the European Commission.

We may also share data with public authorities where required to do so by law.

8. Your rights

In connection with the processing of your personal data, you have the right to:

• request information on what data we process about you and obtain a copy of it,
• request the correction of inaccurate data or the completion of incomplete data,
• request the erasure of data if it is no longer needed or its processing is not justified,
• request the restriction of processing,
• receive the data you have provided to us in a machine-readable format (portability),
• object to processing based on our legitimate interest,
• withdraw your consent at any time, without affecting the lawfulness of processing before its withdrawal,
• lodge a complaint with the supervisory authority – the Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Prague 7, uoou.gov.cz.

You can exercise your rights by e-mail, by phone, in writing or in person at the clinic. We will respond without undue delay and within one month at the latest. To make sure we do not disclose your data to an unauthorised person, we may ask you to verify your identity.

9. Further information

• We do not carry out automated decision-making or profiling that would have legal or similarly significant effects on you. reCAPTCHA protection only filters out clearly automated form submissions – if this happens to you, please contact us by phone.
• The forms and online booking are intended for persons over 18 years of age. Minors are represented by their legal guardian.
• We protect data with an encrypted connection (HTTPS), by restricting access to authorised staff only with two-factor authentication, and with regular backups.

This policy is effective from 13. 10. 2026. If we change it, we will publish the current version on this page.