1. Introduction
Budacare Medical Kft. respects the privacy of its patients, clients, website visitors and other data subjects. This privacy notice explains, in a clear and transparent way, what personal data Budacare Medical Kft. processes, for what purposes, on what legal basis, for how long, who may access the data, and what rights data subjects may exercise. Budacare Medical Kft. provides outpatient internal medicine specialist care, with related telemedicine services. At its premises it performs level 0 laboratory activity, in particular blood sampling; all further laboratory tests are provided through external partners.
2. Data controller details
Controller name: Budacare Medical Kft.
Registered office: 2314 Halásztelek, Bánki Donát utca 6. 1. ajtó
Premises: 1016 Budapest, Hegyalja út 7-13. 2. emelet
Tax number: 29266333-2-13
Company registration number: 13 09 223276
Statistical number: 29266333 4690 113 13
Representative: Pócs Róbert, managing director
Electronic contact: robert@budacaremedical.hu
3. Scope and applicable law
This notice applies to all processing by Budacare Medical Kft. involving personal data of natural persons, including patients, clients, enquirers, website visitors and persons entering the clinic. The processing is governed in particular by Regulation (EU) 2016/679 (GDPR), Act CXII of 2011 on Informational Self-Determination and Freedom of Information, Act CLIV of 1997 on Health, Act XLVII of 1997 on the processing and protection of health and related personal data, and other applicable healthcare, accounting and tax rules.
4. Data protection principles
Budacare Medical Kft. processes personal data lawfully, fairly and transparently. Processing is always carried out for specified, explicit and legitimate purposes. The scope of processed data is limited to what is necessary for the relevant purpose, the Controller keeps the data accurate and up to date, and stores it only for the required period. The Controller applies appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, transfer, disclosure, erasure, destruction, loss or damage.
5. Purposes of processing, processed data, legal bases and
retention periods
5.1 Contact, enquiries, appointment coordination and system messages
Purpose
Contact, answering enquiries, appointment coordination and sending system messages.
Legal basis
Performance of a contract or steps prior to contract under GDPR Article 6(1)(b); legitimate interest under Article 6(1)(f); consent under Article 6(1)(a) for optional data.
Data processed
Name, email address, telephone number and other information provided in the message.
Retention
Up to 5 years, or until expiry of the limitation period in case of a dispute.
Note
Newsletters or advertising communications are sent only on the basis of the data subject’s prior consent.
5.2 Healthcare provision and medical documentation
Purpose
Outpatient internal medicine care, blood sampling, infusion therapy, keeping medical documentation, establishing diagnoses, preparing treatment plans, documenting care, meeting legal obligations, EESZT reporting and document upload, and fulfilling financial and accounting obligations.
Legal basis
For health data: GDPR Article 9(2)(h); legal obligation under Article 6(1)(c); contract performance under Article 6(1)(b); accounting documents under Article 6(1)(c).
Data processed
Identification data (name, place and date of birth, mother’s name), contact details, address, invoicing data, Hungarian social security number (TAJ) or document number, copy of the identity document shown for identification (ID card or passport), medical history and condition, diagnoses, findings, therapy data, referrals, test results and clinic administration data.
Retention
Outpatient documentation: 30 years. Diagnostic findings: 30 years. Discharge summary, if created: 50 years. Referral, medicine, medical aid and care data: 5 years or until the end of the use period if longer. Invoices and accounting documents: 8 years.
5.3 Copies of identity documents
Purpose
Confirming the patient’s identity, accurate identification necessary for healthcare, patient safety and completeness of medical documentation.
Legal basis
Legal obligation under GDPR Article 6(1)(c), legitimate interest under Article 6(1)(f), and, in relation to medical documentation, Article 9(2)(h).
Data processed
Paper copy of the identity card and/or passport and the identification data shown on the document.
Data subjects
All patients treated by Budacare Medical Kft.
Storage
On paper, as part of the patient documentation.
Access
Only authorised staff working on site.
Retention
According to the retention period applicable to medical documentation.
5.4 Medical documents submitted by the data subject
Purpose
Providing healthcare, reviewing medical history, supporting diagnosis and therapy decisions, and keeping medical documentation.
Legal basis
For health data: GDPR Article 9(2)(h); GDPR Article 6(1)(b) and (c).
Data processed
Medical documents, findings, medical records, referrals, discharge summaries, test results and the personal and health data contained in them, submitted electronically or otherwise by the data subject.
Start of processing
When the documents are received by Budacare Medical Kft.
Retention
According to the retention period applicable to medical documentation.
5.5 Telemedicine
Purpose
Remote consultation, medical advice and healthcare via telemedicine.
Platform
Telemedicine is provided exclusively through the Medio system.
Legal basis
For health data: GDPR Article 9(2)(h); GDPR Article 6(1)(b) and (c).
Data processed
Identification data, contact details, address and invoicing data, TAJ number or document number, medical history and condition, diagnoses, findings, therapy data, referrals, test results, clinic administration, and technical and metadata of the video connection.
Retention
According to the retention periods applicable to medical documentation. If the call is not recorded, only administrative and medical documentation data remain.
5.6 Appointment booking via web interface, mobile phone and the Medio
application
Purpose
Appointment booking, managing, changing and cancelling bookings, and contact.
Legal basis
Consent under GDPR Article 6(1)(a); when healthcare is used, Article 6(1)(b) and (c).
Data processed
Mandatory data: surname, first name, email address, telephone number. Optional administrative data: mother’s name, place of birth, date of birth, TAJ number, ID document number.
Data transfer
The data subject consents to Budacare Medical Kft. transferring the necessary personal data to its current healthcare partners for the purpose of appointment booking and arranging healthcare. Such partners include laboratory, diagnostic and specialist medical service providers.
Retention
Immediately after registration deletion, with a maximum of 1 year for quality assurance. After healthcare has been provided, data are retained according to the retention periods applicable to medical documentation.
5.7 EESZT reporting and document upload
Purpose
Statutory health data reporting to the Electronic Health Service Space (EESZT), uploading health documents and documenting care events.
Legal basis
Legal obligation under GDPR Article 6(1)(c); for health data Article 9(2)(h) and (i).
Data processed
Identification and health data, care events, findings, outpatient records and other medical documents to be sent to EESZT under the law.
Recipient
EESZT and organisations specified by law in connection with its operation.
Retention
According to the statutory retention periods applicable to EESZT and medical documentation.
5.8 Newsletter and direct marketing
Purpose
Sending newsletters and direct marketing communications.
Legal basis
Consent under GDPR Article 6(1)(a).
Data processed
Name and email address.
Retention
Until withdrawal of consent.
Note
Consent may be withdrawn at any time; withdrawal does not affect the lawfulness of processing before withdrawal.
5.9 Website operation and cookies
Purpose
Ensuring website operation, preparing visitor statistics and improving user experience.
Cookies used
Essential cookies and Google Analytics analytical cookies.
Legal basis
For essential cookies: legitimate interest under GDPR Article 6(1)(f). For Google Analytics and other analytical cookies: consent under Article 6(1)(a).
Data processed
Device and browser data, IP address, session ID, page usage data and cookie identifiers.
Retention
Session cookies until the end of the session; persistent cookies for the period set in the browser or cookie banner; analytical cookies until consent is withdrawn or for the period set in the cookie.
Note
Analytical cookies require consent, which the data subject may withdraw at any time.
5.10 Camera system
Purpose
Property protection, personal and patient safety, and investigation of possible extraordinary events.
Number of cameras
5 cameras.
Monitored area
Only the clinic corridors and passage areas. No camera operates in examination rooms, treatment rooms, toilets, changing rooms or other areas with a higher expectation of privacy.
Audio
The camera system does not record sound.
Legal basis
Legitimate interest under GDPR Article 6(1)(f). The Controller’s legitimate interest is ensuring the safety of persons on the premises, property protection, and the ability to investigate complaints, incidents and legal claims. The Controller prepares and keeps a legitimate interest assessment for the camera processing.
Data processed
Image and movement of persons entering the camera field of view, and the place and time of the recording.
Storage
Stored on an internal storage device in a closed system.
Access
Only the managing director may access the recordings.
Retention
20 days. The reason for this retention period is that the Controller works to a significant extent with foreign patients, so a complaint, investigation or legal claim may arise or be reported only after the patient has returned home. Depending on available storage, the camera system automatically overwrites or deletes recordings after no more than 20 days, unless the recording is needed for a legal claim, official procedure or investigation of an extraordinary event.
Information
Persons entering the clinic must be informed of camera surveillance by a clearly visible pictogram and short notice referring to the full notice.
5.11 Payment and invoicing data
Purpose
Managing payments, issuing invoices and complying with accounting and tax obligations.
Legal basis
Contract performance under GDPR Article 6(1)(b); legal obligation under Article 6(1)(c).
Data processed
Name, billing address, payment data, bank account or card data at the payment service provider, invoice data.
Recipients
Payment service provider, accounting or invoicing service provider, competent authority under the law.
Retention
Accounting documents: 8 years.
6. Source of personal data
As a rule, personal data are obtained from the data subject, for example during appointment booking, contact, provision of care or document submission. In the case of a corporate order, the source may be the company acting as an independent controller. During healthcare, data may also come from other healthcare providers, laboratories, diagnostic partners, EESZT or previous documentation submitted by the data subject.
7. Processors and service providers
The Controller may use external service providers and processors, especially for hosting, web development, appointment booking systems, payment services, laboratory, diagnostic and other healthcare services. The Controller selects providers carefully and requires them by contract to keep data confidential and comply with applicable laws. Service
Provider
Hosting
DigitalOcean LLC, 101 Avenue of the Americas, 10th Floor, New York, NY 10013, United States. Physical storage location: EU / Frankfurt am Main. privacy@digitalocean.com, digitalocean.com
Web development and support
Calvus Communications Kft., 1134 Budapest, Róbert Károly krt. 41., calv.us
Appointment booking and telemedicine system
Medio Medtech Zrt., 1095 Budapest, Lechner Ödön fasor 2. 7th floor 13., info@mymedio.hu, mymedio.hu
Payment service provider
SimplePay Zrt., 1138 Budapest, Váci út 135-139. B. ép. 5. em., simplepay.hu
Service
Provider
Laboratory service provider
SYNLAB Hungary Kft., 1211 Budapest, Weiss Manfréd út 5-7., synlab.hu
Laboratory service provider
CORDEN INTERNATIONAL /Magyarország/ Kft., 1117 Budapest, Fehérvári út 84/a., corden.hu
Specialist medical partner
Emineo Kft., 1117 Budapest, Nádorliget utca 8. B. ép. fszt. 1.; sites: 1016 Budapest, Hegyalja út 7. and 1016 Budapest, Hegyalja út 9.; emineo.hu
Diagnostic partner
Margit Medical Center / Üromed Diagnosztika Kft., registered office: 1065 Budapest, Podmaniczky utca 1-3. 2nd floor 19.; site: 1027 Budapest, Henger utca 2. B. ép. fszt.; margitmedical.hu
8. Data transfers to other controllers
The Controller transfers personal data to other controllers where necessary for contract performance, arranging or providing healthcare, where required by law, where the Controller or a third party has a legitimate interest, or where the data subject has consented. When arranging healthcare, the Controller may transfer necessary data to its current healthcare partners, especially laboratory, diagnostic and specialist providers. Such partners may also act as independent controllers for their own activities and process data under their own privacy notices. On the basis of legal obligation, data may be transferred to EESZT, authorities, courts, health insurance bodies or other statutory organisations.
9. Transfers outside the EEA
As a rule, the Controller processes and stores personal data within the European Economic Area. If a transfer outside the EEA occurs through a service provider or subcontractor, the Controller ensures that the transfer is made with GDPR-compliant safeguards, such as an adequacy decision, standard contractual clauses or another lawful safeguard.
10. Log files
When the website is used, the browser sends certain technical information that the Controller may store in log files. Log files are used to ensure website operation, investigate errors, detect abuse and attack attempts and fulfil IT security purposes. The log files may include the device IP address, referring page address, internet service provider, names of accessed files or information, date and time of access and its duration, amount of data transferred, operating system and browser data, and HTTP status codes. The Controller retains log files for a maximum of 30 days, unless further retention is necessary due to a security incident, legal claim or official procedure.
11. External links
The website may contain links to websites operated by external service providers. After opening such links, the Controller has no influence over the processing of personal data by the external provider. Such processing is governed by the privacy notice of that external provider.
12. Data security
The Controller’s employees, contributors and service providers are subject to confidentiality obligations. The Controller applies appropriate technical and organisational measures to protect personal data, especially against unauthorised access, disclosure, alteration, erasure, destruction, loss or damage. The Controller designs security measures proportionately to the risks and reviews them where necessary.
13. Rights of data subjects
The data subject may exercise the following rights through the Controller’s contact details. Before fulfilling a request, the Controller may ask the data subject to prove their identity. • • •
• •
• •
Right to information and access: the data subject may request information on whether the Controller processes their personal data and may request access to the data. Right to rectification: the data subject may request correction of inaccurate personal data and completion of incomplete data. Right to erasure: the data subject may request erasure of personal data if the legal conditions are met. This does not affect data that must be retained by law, for example medical or accounting documentation. Right to restriction: the data subject may request restriction of processing if the legal conditions are met. Right to object: the data subject may object to processing based on legitimate interest. The Controller may then process the data only if it proves compelling legitimate grounds overriding the interests, rights and freedoms of the data subject. Right to withdraw consent: if processing is based on consent, consent may be withdrawn at any time. Withdrawal does not affect the lawfulness of processing before withdrawal. Right to data portability: where processing is based on consent or contract and is automated, the data subject may request the data provided by them in a structured, commonly used, machinereadable format.
14. Right to lodge a complaint
The data subject may lodge a complaint with the supervisory authority if they consider that the processing of their personal data infringes applicable data protection laws.
Authority
Hungarian National Authority for Data Protection and Freedom of Information
Registered office
1055 Budapest, Falk Miksa utca 9-11.
Postal address
1363 Budapest, Pf. 9.
Telephone
+36 (1) 391-1400
ugyfelszolgalat@naih.hu
Website
www.naih.hu
15. Contact
If the data subject wishes to contact the Controller or exercise their rights relating to data processing, they may do so through one of the contact details specified in Section 2 of this notice. Dated: Budapest, 13 May 2026