Privacy Notice

MDExpert Clinic Kft. – mdexpertclinic.hu
In force from: 9 September 2026 · Version: 1.2

1. Introduction

MDExpert Clinic Korlátolt Felelősségű Társaság (hereinafter: the Controller or the Clinic) attaches particular importance to processing the personal data of visitors to the mdexpertclinic.hu website (hereinafter: the Website), as well as of its patients, clients and enquirers, in a lawful, secure and transparent manner.

The purpose of this notice is to give data subjects clear and plain information, before they provide any personal data, about what data the Controller processes, for what purpose, on what legal basis, for how long, to whom it discloses that data, and what rights data subjects may exercise.

This notice has been prepared having regard to the following legislation:

• Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR);
• Act CXII of 2011 on Informational Self-Determination and Freedom of Information (Infotv.);
• Act XLVII of 1997 on the Processing and Protection of Health and Related Personal Data (Eüak.);
• Act CLIV of 1997 on Healthcare (Eütv.);
• Act V of 2013 on the Civil Code (Ptk.);
• Act C of 2000 on Accounting (Accounting Act);
• Act XLVIII of 2008 on the Basic Requirements of and Certain Restrictions on Commercial Advertising Activity (Grt.);
• Act CVIII of 2001 on Certain Issues of Electronic Commerce Services and Information Society Services (Ektv.);
• Act CLV of 1997 on Consumer Protection (Fgytv.).

2. Details of the Controller

2.1. Data Protection Officer (DPO)

As a healthcare provider processing health data on a large scale, the Controller has designated a Data Protection Officer pursuant to Article 37 GDPR, whom data subjects may contact directly on any matter relating to the processing of their personal data and the exercise of their rights:

3. Definitions

Personal data: any information relating to an identified or identifiable natural person (the "data subject"), such as name, e-mail address, telephone number or IP address.

Health data: personal data related to the physical or mental health of the data subject, including information on the use of healthcare services (for example the type of treatment requested, complaints, previous interventions, allergies, photographs of the treated area). This is a special category of data under Article 9 GDPR and enjoys enhanced protection.

Processing: any operation performed on personal data (collection, recording, storage, transmission, erasure, etc.).

Controller: the party determining the purposes and means of the processing, in this case the Clinic.

Processor: a party processing personal data on behalf of and on the instructions of the Controller (for example a hosting provider, a booking system or a newsletter platform).

Consent: a freely given, specific, informed and unambiguous indication of the data subject's wishes.

4. Principles of processing

The Controller processes personal data lawfully, fairly and transparently, exclusively for specified, explicit and legitimate purposes (purpose limitation); requests only the data necessary to achieve that purpose (data minimisation); ensures the accuracy of the data; stores it only for as long as necessary (storage limitation); and safeguards the confidentiality, integrity and availability of the data by appropriate technical and organisational measures (integrity and confidentiality).

When processing health data, the Controller also fully complies with the Eüak.: health data is processed solely for the purpose of healthcare provision, to the extent necessary for that purpose, and is made accessible only to the treating physician and to the persons involved in the care who are bound by professional secrecy.

5. Individual processing activities

5.1. Appointment and consultation requests on the Website

Through the forms available on the Website, enquirers may request an appointment or a consultation for the Clinic's services.

5.2. Online appointment booking via the MyMedio system

From the Website, users may proceed to the online booking interface available at mdexpertclinic.mymedio.hu, where the data subject may independently select an available appointment.

5.3. Contact by e-mail, telephone or social media

The Controller does not record telephone calls.

5.4. Newsletter and marketing communications

Data subjects may subscribe to the Clinic's newsletter by ticking the "I would like to receive news from the clinic" checkbox on the Website's forms, or by signing a paper declaration at the Clinic.

5.5. The Clinic's social media pages (Facebook, Instagram)

The Controller operates a Facebook page and an Instagram page. Content published by visitors to those pages (comments, messages, likes) is processed by the Controller for the purposes of contact and information, on the legal basis of Article 6(1)(f) GDPR (legitimate interest). With regard to the visitor statistics of the pages ("Page Insights"), the Controller and Meta Platforms Ireland Ltd. qualify as joint controllers; the arrangement determining their respective responsibilities is available at https://www.facebook.com/legal/terms/page_controller_addendum. The Clinic asks that no one publicly share information concerning their state of health on social media platforms; such matters may be raised with the Clinic at clinic@mdexpert.hu or by telephone.

5.6. Data processed in the course of healthcare provision (at the Clinic)

Following a booking made on the Website, in the course of the healthcare service used at the Clinic the Controller maintains medical records with the content prescribed by law (medical history, examination findings, treatment plan, consent declarations, photographic documentation of the treated area, products used, data of follow-up examinations). Data subjects receive a separate, detailed patient information notice on this processing at the Clinic upon their first attendance, which supplements this notice.

5.7. Invoicing

5.8. Complaint handling

5.9. Electronic surveillance system (CCTV) at the Clinic

The Controller operates a camera surveillance system at the reception, in the corridor and at the entrance of the Clinic for property protection purposes. No camera operates in treatment rooms. Legal basis: Article 6(1)(f) GDPR – the legitimate interest of the Controller (protection of property and persons). In the absence of any use, the Controller erases the recordings after 3 days from recording and in any event within 30 days. Information on the camera surveillance is provided by a pictogram and a detailed notice displayed at the entrance.

5.10. Cookies, consent management and website analytics

In addition to the cookies strictly necessary for its operation, the Website – solely with the prior consent of the data subject – uses website analytics, user-behaviour analysis and social media content tools. Consent may be given via the cookie notice displayed on the first visit; non-essential tools are technically prevented from running and do not set any cookies before consent is given.

Cookies used on the Website

Visitors may also block or delete cookies in their browser settings, and may opt out of Google Analytics measurement using Google's browser add-on. The cookie settings can be reopened at any time via the “Cookie settings” link in the footer.

6. Processors and recipients

The Controller uses the processors listed below, who process personal data exclusively on the written instructions of the Controller, under a processing agreement (Article 28 GDPR), and who may not use that data for their own purposes.

Beyond the above, the Controller discloses personal data to third parties solely on the basis of a statutory obligation (for example upon the request of an authority, a court, the tax authority or the EESZT). Physicians and healthcare professionals involved in care at the Clinic who are not employees of the Controller access patient data on behalf of the Controller, under a contract for professional collaboration concluded with the Clinic and subject to an obligation of professional secrecy.

7. Transfers to third countries

The Controller processes data primarily within the European Economic Area (EEA). However, when using Google services (Google Fonts, Google Analytics), the Meta social media pages and Instagram content, and Microsoft 365 and Microsoft Clarity, personal data may also be transferred to the United States. The legal basis for such transfers is the adequacy decision of the European Commission on the EU–U.S. Data Privacy Framework (Article 45 GDPR) – Google LLC, Meta Platforms, Inc. and Microsoft Corporation being certified participants of the Framework – supplemented by the standard contractual clauses adopted by the European Commission (Article 46(2)(c) GDPR). The provider of the Instagram feed widget, Elfsight PTE. LTD., operates in Singapore; transfers to it – which take place only with the data subject's marketing consent – are based on the standard contractual clauses adopted by the European Commission (Article 46(2)(c) GDPR). Data subjects may request a copy of the appropriate safeguards from the Controller.

8. Data security

In accordance with Article 32 GDPR, the Controller applies technical and organisational measures proportionate to the risks, in particular: the Website and its forms operate over an encrypted (HTTPS/TLS) connection; health data is accessible only to authorised staff bound by professional secrecy, using individual identifiers and passwords; access within the systems is logged; paper documentation is stored in a lockable location; regular backups are made; staff receive data protection training; and processing agreements are concluded with processors. In the event of a personal data breach, the Controller acts in accordance with Articles 33–34 GDPR and, in the case of a high-risk breach, also informs the data subjects.

9. Rights of data subjects

Data subjects may exercise the following rights vis-à-vis the Controller, using the contact details given in Section 2 or through the Data Protection Officer:

• Access (Article 15 GDPR): to obtain confirmation as to whether the Controller processes their personal data and, if so, information about that data and the circumstances of the processing; and to request a copy of the data. Data subjects may inspect their medical records and obtain a copy thereof pursuant to Section 24 of the Eütv.
• Rectification (Article 16): to request the rectification of inaccurate data and the completion of incomplete data.
• Erasure – the "right to be forgotten" (Article 17): to request the erasure of their data where the processing is no longer necessary, where consent has been withdrawn, or where the processing is unlawful. This right cannot be exercised where processing is necessary for compliance with a legal obligation; in particular, medical records and accounting documents may not be erased during the mandatory retention period.
• Restriction of processing (Article 18): to request that the Controller process the data only by storing it, for example while the accuracy of the data is being verified or pending a decision on an objection.
• Data portability (Article 20): to receive data processed by automated means on the basis of consent or a contract in a structured, commonly used, machine-readable format, or to request its transmission to another controller.
• Objection (Article 21): to object at any time, on grounds relating to their particular situation, to processing based on legitimate interest; in such a case the Controller may continue processing only where compelling legitimate grounds so justify. Data subjects may object to processing for direct marketing purposes without giving reasons.
• Withdrawal of consent (Article 7(3)): consent may be withdrawn at any time; this does not affect the lawfulness of processing carried out before the withdrawal.
• Automated decision-making (Article 22): the Controller does not take decisions based solely on automated processing which produce legal effects concerning the data subject, and does not carry out profiling.

9.1. Exercising these rights

The Controller complies with a request without undue delay and in any event within one month of its receipt, or informs the data subject of the reasons for non-compliance; this period may be extended by a further two months taking into account the complexity of the request. Information and action are provided free of charge, unless the request is manifestly unfounded or excessive by reason of its repetitive character. In the case of requests concerning health data, and having regard to the sensitivity of that data, the Controller verifies the identity of the data subject by appropriate means before complying.

10. Remedies

If a data subject considers that the processing of their personal data infringes the law, we ask that they first contact the Controller or its Data Protection Officer so that the matter may be resolved directly. In addition, the data subject may:

• lodge a complaint with the supervisory authority:
  Hungarian National Authority for Data Protection and Freedom of Information (NAIH)
  Registered office: 9–11 Falk Miksa Street, 1055 Budapest · Postal address: 1363 Budapest, P.O. Box 9
  Telephone: +36 1 391 1400 · E-mail: ugyfelszolgalat@naih.hu · Web: https://www.naih.hu
• bring an action before the courts (Article 79 GDPR, Section 23 of the Infotv.): at the choice of the data subject, proceedings may also be brought before the regional court having jurisdiction over their place of residence or stay.

11. Amendment of this notice

The Controller reserves the right to amend this notice unilaterally in the event of changes to the legal environment, to the services used or to its processing practices. The notice in force at any given time is available on the Website; in the event of a material change, the Controller informs data subjects by a notice published on the Website and informs newsletter subscribers by e-mail as well. Earlier versions of the notice may be requested from the Controller.

MDExpert Clinic Kft. · 5 Rétköz Street, 1118 Budapest, Hungary · clinic@mdexpert.hu · +36 70 676 5885
English translation of the Hungarian original; in the event of any discrepancy, the Hungarian text prevails.