Introductory provisions

RehaGym, s.r.o., Company ID (IČO) 17248434, registered office V jehličí 2121/8, Prague 4 – Krč (hereinafter also the "controller"), as a controller of personal data and in connection with its business activity of operating the RehaGym centre at V Jehličí 2121/8, Prague 4 – Krč, processes the personal data of its clients, i.e. persons using the services provided at the RehaGym centre (hereinafter also the "data subjects").

With the exception of selected personal data of clients who use the supplementary service "visual monitoring of the set exercise plan", whose personal data are, with their consent, transferred for processing to the operator of the OnForm fitness application, OnForm, Inc., 1998 Pleasant Glen Lane, Bellvue, CO 80512, USA, the controller does not transfer any personal data it processes to a third country (i.e. a country outside the European Union) or to any international organisation.

The controller's processing of personal data does not involve any decision-making based solely on automated processing, including profiling.

Rights of data subjects

Data subjects have the following rights in relation to the controller:

• the right of access to their personal data (i.e. the right to request information about the processing of their personal data)
• the right to rectification or completion of their personal data (i.e. the right to request the correction of inaccurate personal data concerning the data subject, or the right to request the completion of incomplete personal data concerning the data subject)
• the right to erasure – the so-called right to be forgotten (i.e. the right to request the erasure of personal data concerning the data subject where the data are processed unlawfully, are no longer necessary, or where the data subject has objected to the processing and there are no overriding legitimate grounds for the controller to process them)
• the right to restriction of processing (i.e. the right to request that the controller restrict the processing of the data subject's personal data to storage only, where the processing is unlawful or no longer necessary, where the data subject contests the accuracy of the data, or where the data subject has objected to the processing)
• the right to object to processing (i.e. the data subject's right, on grounds relating to their particular situation, to object to the processing of their personal data based on legitimate interest, unless the controller demonstrates compelling legitimate grounds for the processing which override the interests of the data subject, or grounds for the establishment, exercise or defence of legal claims)

Data subjects may exercise these rights electronically by e-mail to "info@rehagym.cz" or in writing by letter delivered to the RehaGym centre at V jehličí 2121/8, Prague 4 – Krč. As the processing of personal data is not fully automated, data subjects do not have the right to data portability.

If a data subject believes that the processing of their personal data is in any way improper, they have the right at any time to lodge a complaint with the controller's statutory body or to lodge a complaint with the supervisory authority, which is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů; more at www.uoou.cz).

Purpose and legal basis of processing

The purposes of processing personal data are:

• the proper provision of services within the operation of the RehaGym centre, i.e. in particular in the fields of fitness, nutrition counselling, psychological counselling and diagnostics, and the provision of health and related services in the fields of rehabilitation and physical medicine, physiotherapy and occupational therapy, as well as the exercise and enforcement of the related rights and obligations,
• the fulfilment of the controller's legal obligations, in particular in the area of keeping medical records (pursuant to Section 53 of Act No. 372/2011 Coll., on Health Services and the Conditions of Their Provision) and in the area of providing health services under the applicable legislation,
• marketing and promotion of the RehaGym centre and the services provided there,
• protection of the property of the controller and third parties, ensuring the safety of persons within the operation of the RehaGym centre, prevention of incidents and obtaining evidence for dealing with any insurance claims, offences or other unlawful conduct in relation to the operation of the RehaGym centre.

The specific purposes of processing for the individual groups of data subjects are set out in the table that forms Annex No. 1 to this notice (in Czech).

The legal bases for processing personal data are:

• processing is necessary for the performance of a contract to which the data subject is party, or in order to take steps at the request of the data subject prior to entering into a contract;
• processing is necessary for compliance with a legal obligation to which the controller is subject;
• processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party;
• processing is based on consent given by the data subject.

In the case of personal data concerning health, the legal basis for processing is also:

• processing is necessary for the purposes of preventive medicine, medical diagnosis or the provision of health services;
• processing is necessary for the establishment, exercise or defence of legal claims.

Details are set out in the table attached as Annex No. 1 to this notice (in Czech).

Where processing is based on consent given by the data subject, the data subject may withdraw this consent in whole or in part at any time by written notice delivered to the controller at info@rehagym.cz or to the address RehaGym, s.r.o., V jehličí 2121/8, Prague 4 – Krč. In such a case the controller will cease processing the relevant personal data without undue delay, unless another legal ground for their processing applies.

Scope of the data processed

In accordance with the principle of data minimisation, the scope of personal data processing is derived from the specific purpose of processing. The scope of personal data processed for the individual purposes of processing is set out in the table that forms Annex No. 1 to this notice (in Czech).

Recipients of personal data

Personal data contained in medical records may be made available only under the conditions laid down by the Health Services Act.

Data of data subjects may be transferred, in connection with the fulfilment of the controller's legal or contractual obligations, to the following recipients:

• the controller's auditors, tax or legal advisers (to the extent strictly necessary for the provision of services to the controller),
• persons cooperating with the controller, i.e. persons through whom the controller provides services within the operation of the RehaGym centre (to the extent strictly necessary for the provision of the relevant service),
• the controller's insurers or insurance intermediaries in connection with the settlement of insurance claims,
• the Police of the Czech Republic, tax administration authorities or other public authorities of the Czech Republic (within the exercise of their powers or in connection with it).

The controller may entrust the processing of data subjects' personal data to the following processors:

• persons cooperating with the controller, i.e. persons through whom the controller provides services within the operation of the RehaGym centre (to the extent strictly necessary for the provision of the relevant service),
• suppliers of database or other information systems or applications used by the controller,
• providers of accounting services and related reporting,
• providers of data storage services,
• providers of archiving services.

Retention period

The personal data of data subjects are generally processed for the duration of the contractual relationship between the controller and the data subject, and thereafter for as long as any claims relating in any way to the services provided may be asserted or enforced.

Personal data embodied in documents for which specific legislation prescribes longer archiving periods are retained for those longer periods.

Specific information on the retention (processing) period of personal data is set out in the table that forms Annex No. 1 to this notice (in Czech).

Requirement to provide personal data

To the extent that the processing of personal data is necessary for the fulfilment of the controller's legal obligation, or for the preparation, conclusion and performance (including enforcement) of the contract under which the client is provided with the services of the RehaGym centre, the provision of the data subject's personal data is a statutory or contractual requirement. If the personal data are not provided, the relevant contractual relationship cannot be established and the services cannot be used.