General Terms and Conditions
for Private Hospitals in Austria

The protection of your personal data is of particular importance to us. We therefore process your data exclusively in accordance with the applicable legal provisions (GDPR – General Data Protection Regulation, TKG – Telecommunications Act, DSG – Data Protection Act, DSFA-V – Data Protection Impact Assessment Regulation, DSFA-AV – Data Protection Impact Assessment Exemption Regulation). We have implemented technical and organisational measures when processing your personal data to protect it against loss, accidental alteration (data integrity) and misuse (e.g. unauthorised access). Access to your data is permitted for our staff only insofar as it is objectively necessary within the scope of their duties. Our staff are obliged to maintain strict confidentiality regarding your personal data, both due to legal requirements (various professional laws such as the Medical Practitioners Act, the Health and Nursing Act, and various other laws) and due to contractual obligations with our clinic. In this privacy notice, we inform you about the most important aspects of data processing in connection with your registration, admission and treatment at our clinic or when using our digital services (in particular when using our website).

Identification via ID Austria

To use certain services on our website (note: these services are exclusively for consultants practising at the Vienna Private Clinic), unique identification via ID Austria is required. When using these services, the “Privacy Policy_Identification_ID-Austria” applies in addition to this privacy policy.

Contacting us

If you contact us via the form on the website or by email, the data you provide will be stored by us for six months for the purpose of processing your enquiry and in the event of follow-up questions.

Your rights

You are generally entitled to the rights to information, access, rectification, erasure of your personal data, and restriction of processing.

You have the right to withdraw any consent you have given and to object (where permissible) to the processing of your data, as well as the right to data portability (where technically possible).

If you believe that the processing of your data violates data protection law or that your data protection rights have otherwise been infringed, you may lodge a complaint with the supervisory authority. In Austria, this is the Data Protection Authority.

Important contact details regarding data protection:

Data Protection Officer (GDPR)

Wiener Privatklinik Betriebs-Ges.m.b.H. & Co.KG, Pelikangasse 15 · A-1090 Vienna

Contacting the Data Protection Officer

You can contact our Data Protection Officer at datenschutz@wpk.at or by telephone on: +43140180-0

For general enquiries, you can contact us using the following details:
Corporate Communications Department
Pelikangasse 9-15
A-1090 Vienna

Austrian Data Protection Authority
Wickenburggasse 8
1080 Vienna
Telephone: +43 1 52 152-0
Email: dsb@dsb.gv.at

Important information regarding data protection in relation to registration, admission and accommodation as a patient at our clinic:

Registration:

If you decide to undergo treatment at our clinic and arrange for a booking for admission through the doctor of your choice (affiliated doctor), the data you have provided to your affiliated doctor and which is necessary for preparing your admission will be forwarded to us by your doctor during the registration process (name, date of birth, gender, contact details, planned admission date, date and time of surgery if applicable, admission diagnoses, planned treatment and further details regarding the planned treatment, insurance status).

We require this data prior to your admission for the following purposes:

• Bed and surgery planning
• Preparatory measures for your planned treatment in order to properly fulfil the contract (accommodation contract) that you will conclude with us as part of your admission
• Provided we also receive a valid telephone number, we will send you important information regarding your upcoming stay via text message shortly before your admission (e.g. time of your admission, link to the patient agreement on our website so that you can prepare for your admission)

Purpose of processing and legal basis: necessary pre-contractual measures pursuant to Article 6(1)(b) of the GDPR.

If no contract is concluded with you within 6 months of registration, this data will be automatically deleted after 6 months. If an admission contract is concluded, this data will be stored for 30 years in accordance with the statutory provisions (Vienna Hospitals Act).

Admission and Accommodation

As part of your admission, we collect (in writing -> see Patient Agreement) further data that is important for your accommodation, treatment and the clarification of cost coverage:

• Your personal contact details as a patient
• Contact details of the person you have designated as your representative
• Information regarding your insurance status

Purpose of processing and legal basis: performance of a contract within the meaning of Article 6(1)(b) of the GDPR

In the course of your accommodation and treatment, we collect, or are provided with by your attending physician and their agents, all medical and nursing data necessary for your treatment and accommodation, or which we are required to collect and process due to legal obligations.

The following legal provisions are specifically taken into account for the processing of your personal data:

• Austrian Hospitals and Sanatoriums Act
• Vienna Hospitals and Sanatoriums Act
• Medical Practitioners Act
• Health and Nursing Care Act
• MTD Act (Medical-Technical Services)
• Psychologists Act
• Medicines Act
• Medical Devices Act
• Narcotics Act etc.

Categories of personal data

In connection with your accommodation and treatment, we collect and process the following personal data in particular:

• Name, including title and form of address
• Address details
• Contact details (e.g. telephone number, email address)
• Maiden name, date of birth and place/country of birth, nationality
• Gender
• Social security details (name of the provider, social security number (SSN), type of insurance)
• Data relating to private insurance (insurer, policy number, etc.)
• Data relating to other funding bodies
• Current state of health
• Previous illnesses, as well as previous examinations/treatments and associated findings, diagnoses and documentation
• Information on notifiable diseases
• Specific risk factors, e.g. allergies, intolerances
• Prescription and dispensing of medicines, medical devices and aids
• Proof of immunity/vaccination status
• Medical test results (e.g. laboratory), medical findings from operations and consultant doctors, further necessary collection of medical and nursing data

Some of the data collected (e.g. data relating to your health, and where applicable genetic data, e.g. in the context of oncological treatments) constitutes particularly sensitive and specially protected data. We process this data on the basis of Article 9(2)(h) and (i) and Article 9(3) of the GDPR.

Use of your contact details for purposes other than those listed above:

For any use of your contact details for the purpose of sending newsletters, general information about our services, etc., your explicit consent is required, which you may give to us voluntarily upon admission (Patient Agreement, Section C) and which may be withdrawn at any time.

Recipients of the data you have provided or which we have collected in the course of your admission and treatment

Your personal data will be within our clinic to the relevant departments which need to receive this data in order to provide your treatment, care and support.

In some cases, your personal data may also be passed on to external institutions to the extent strictly necessary:

In particular, these include:

for the purpose of collecting further medical data on behalf of your attending consultant or their agents:

• external laboratories
• external radiologists
• other healthcare providers (e.g. other hospitals or GPs)

for the purpose of ensuring that costs are covered by any insurance companies and institutions you have informed us of during your admission (e.g. as part of the patient agreement you have completed)

• Social security providers
• Health insurance providers
• Private health insurance providers

For the purpose of complying with any applicable legal requirements

• ELGA (unless you object)
• Vaccination register
• Authorities
• Courts

Retention period

We store your

• health data (medical history) in accordance with the provisions of the Hospitals Act
  • for inpatient stays for a period of 30 years
  • for outpatient visits for a period of 10 years

• Billing data/financial data/payment data in accordance with the provisions of the Federal Tax Code (BAO) for a period of 7 years, unless pending proceedings necessitate a longer retention period

Important data protection information regarding the use of our digital services

Cookies

Our website uses so-called cookies. These are small text files that are stored on your device via your browser. They do not cause any harm.

We use cookies to make our website user-friendly. Some cookies remain stored on your device until you delete them. They enable us to recognise your browser on your next visit. Functional and strictly necessary cookies are required for the website to function correctly and cannot be disabled. To ensure we display information to you in the best possible way, we ask for your consent regarding cookies for statistics, preferences and marketing – however, these can be disabled at any time when you visit the website.

Newsletter

You have the option to subscribe to our newsletter. To do so, we require your email address and your consent to receive the newsletter. Please use the email address info@wpk.at

You can unsubscribe from the newsletter at any time. Please send your cancellation to the following email address: marketing@wpk.at or use the unsubscribe link in any of our newsletters.

Collection of access data

On the basis of our legitimate interests within the meaning of Article 6(1)(f) of the GDPR, we collect data on every access to the server on which this service is located (so-called server log files). Access data includes the name of the webpage accessed, the file, the date and time of access, the amount of data transferred, a notification of successful access, the browser type, the user’s operating system, the referrer URL (the previously visited page), the IP address and the requesting provider.

Google Analytics

On the basis of our legitimate interests (i.e. interest in the analysis, optimisation and economic operation of our online offering within the meaning of Article 6(1)(f) of the GDPR), we use Google Analytics, a web analytics service provided by Google Inc. (“Google”). Google uses cookies. The information generated by the cookie regarding users’ use of the online service is usually transmitted to a Google server in the USA and stored there.

Google is certified under the Trans-Atlantic Data Privacy Framework (TADPF) and thereby guarantees compliance with European data protection law. You can read more about this here: https://ec.europa.eu/commission/presscorner/api/files/attachment/872132/Trans-Atlantic%20Data%20Privacy%20Framework.pdf).

Google will use this information on our behalf to evaluate how users use our website, to compile reports on activity within the website, and to provide us with other services relating to the use of the website and internet usage. In doing so, pseudonymous user profiles may be created from the processed data.

We only use Google Analytics with IP anonymisation enabled. This means that users’ IP addresses are truncated by Google within Member States of the European Union or in other signatory states to the Agreement on the European Economic Area. Only in exceptional cases is the full IP address transmitted to a Google server in the USA and truncated there.

Use of the Meta Pixel

Based on our legitimate interest in the analysis, optimisation and economic operation of our online offering, we use the so-called Meta Pixel. This tool is operated by Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland – formerly known as Facebook.

The Meta Pixel enables us to assign visitors to our website to specific target groups on Facebook or Instagram (Meta Ads) and thus display interest-based advertising to them. Furthermore, we can track the effectiveness of our campaigns (e.g. whether users have performed a specific action on our website after clicking on an advert – so-called ‘conversions’).

Meta is certified under the EU-U.S. Data Privacy Framework (TADPF) and is therefore committed to complying with European data protection standards when transferring data to the USA. Further information can be found here: https://www.dataprivacyframework.gov/

Custom Audiences and Data Matching

As part of “Custom Audiences from File”, we may transmit encrypted data (e.g. email addresses of newsletter subscribers) to Meta in order to target users with relevant advertising. The upload is carried out exclusively in encrypted form and serves solely to enable targeted advertising on Meta platforms.

Data protection and opt-out options

The data collected by the pixel is anonymous to us and does not allow any conclusions to be drawn about your identity. However, Meta may link this data to your Facebook/Instagram profile. Further information on data processing by Meta can be found in Meta’s privacy policy:

https://www.facebook.com/policy.php

You can object to data collection via the Meta pixel at any time. Settings for interest-based advertising can be found here:https://www.facebook.com/settings?tab=ads

In addition, you can disable the collection of usage data via cookies on the following platforms:

http://optout.networkadvertising.org/

http://www.aboutads.info/choices

http://www.youronlinechoices.com/uk/your-ad-choices/

Your rights

You are generally entitled to the rights to information, access, rectification and erasure of your personal data, as well as to restriction of processing. You have the right to withdraw any consent you have given and to object to the processing of your data. If you believe that the processing of your data infringes data protection law or that your data protection rights have otherwise been infringed, you may lodge a complaint with the supervisory authority. In Austria, this is the Data Protection Authority.

Austrian Data Protection Authority
Wickenburggasse 8
1080 Vienna
Telephone: +43 1 52 152-0
Email: dsb@dsb.gv.at
You can contact us using the following details:
Corporate Communications Department
Pelikangasse 9-15
A-1090 Vienna

Whistleblower Platform

This platform has been set up to receive reports of breaches of our internal company guidelines, unethical behaviour or violations of laws and regulations.

These reports may be submitted either by name or completely anonymously.