Privacy Policy

Update date 2025-09-01

We care about your privacy and the security of your personal data. When processing your personal data, we comply with the General Data Protection Regulation No. 2016/679 (EU) (hereinafter – GDPR), the requirements of the laws of the Republic of Lithuania, and the instructions of supervisory authorities. In this Privacy Policy (hereinafter – Privacy Policy), we provide detailed information on how we collect, use, and protect your personal data, what rights you have, and what obligations we follow as an institution.

Please read this Privacy Policy carefully. If you do not agree with it, we will not be able to provide you with all or part of our services or the information you require.

This Privacy Policy may change, so please visit our website from time to time and read the latest version published there.

The term “Personal Data” used in this Privacy Policy means any information or set of information by which we can directly or indirectly identify your identity, for example, by your name, surname, email address, IP, phone number, and/or similar.

The Privacy Policy applies when you use our institution’s healthcare services, visit our website at www.telesante.lt (hereinafter – Website), our social media accounts on Facebook, LinkedIn, YouTube, and Instagram (hereinafter – Social Accounts), apply for a job position offered by us, etc.

I. Data Controller

When you use our services, the controller of your personal data is:

UAB TELESANTE, legal entity code 305917454, registered office address Didžioji Riešė, Mėtų g.2, LT-14261 Vilnius district, email: info@telesante.lt, data is collected and processed in the Register of Legal Entities administered by the State Enterprise Centre of Registers (hereinafter – Telesante or Institution).

II. How we obtain your personal data

We obtain your personal data in the following ways:

You provide us with your personal data when registering for our services, visiting our specialists, contacting us by phone, email, video call, concluding contracts with us, browsing our website, etc.
Your personal data is provided to us by other persons, institutions, and/or organizations (your relatives, employers, other healthcare institutions, insurance companies, the e-health data portal E_sveikata, our partners administering payments, etc.)

IMPORTANT!

When providing us with your personal data, you are responsible for the accuracy, completeness, and relevance of such data.
When providing us with your relative’s personal data, you are responsible not only for the accuracy, completeness, and relevance of this data but also ensure that you have the consent of the person whose data you are providing. This provision does not apply to legal representatives (Power of Attorney). If necessary, we may ask you to confirm that you have the right to provide or receive another person’s data.

III. Data we process

Personal data: Name, surname; personal identification number, gender, date of birth, email address, residential address, payment data for services, data on registration at a healthcare institution, kinship relations (the relationship of the data subject with the related person, the related person’s name and surname, date of birth, gender), and other data.

Special categories of personal data: Choices of healthcare professionals and institutions; patient’s height, weight, body measurements; body mass index; blood group and rhesus factors; risk factors; lifestyle (harmful habits); harmful and dangerous environmental factors; disability level; work capacity level; general primary special needs; preventive health check data; applied vaccination data; names and codes of past diseases or conditions; names and codes of allergic reactions; diagnosis codes of hereditary or genetic diseases of close relatives; fact of patient’s arrival at the healthcare institution; prepared electronic medical documents (including the data and metadata they contain); electronic medical certificates (including the data and metadata they contain); complaints and anamnesis data; provided healthcare services (statistical accounting forms used to collect data on healthcare services provided, in the required format); outpatient treatment summaries (visit statuses, diaries, epicrises, extracts, and others); names and codes of diagnosed diseases or conditions; treatment methods used; performed procedures and operations (interventions); long-term monitoring data; treatment with medicinal products; use of medical aids; referrals for consultations, examinations, treatment, sampling, tests performed; insurance status for healthcare services at the time of registration; issued electronic incapacity certificates and electronic maternity leave certificates (personal code, name, surname); reasons for incapacity; periods of incapacity, pregnancy, and maternity leave, delivery dates); issued permits for issuing incapacity and maternity leave certificates in cases not provided for by the Rules for the Issuance of Electronic Certificates of Incapacity and Electronic Maternity Leave Certificates (personal code, name, surname, healthcare institution to which the permit was granted (personal code, name), incapacity period), except for data constituting a state or service secret; data on e-prescriptions (series (reimbursed medicine pass number), number, and link to patient data); data on medical images and link to patient data.

Website visitor data, unique identifiers, and other tracking tools that collect information about newsletter subscription, (non)receipt, opening, link clicking, cancellation, which application/program is used to read the email, IP address, and the country assigned to it, as well as information provided by visitors on social networks – recommendations, complaints, opinions, suggestions, and other data.

IMPORTANT!

According to the General Data Protection Regulation (GDPR), sensitive personal data, such as health, biometric, or genetic data, may be processed only in exceptional cases and with a clear legal basis. They are collected and used only to the extent necessary for the specific purpose, and the person must be informed about the processing conditions. The provision of healthcare services is a licensed, legally regulated activity that is inseparable from the processing of sensitive personal data.

IV. Legal grounds for data processing

PURPOSE OF DATA PROCESSING	DATA PROCESSED	DATA RETENTION	LEGAL BASIS
Provision of healthcare services and their accounting	Name, surname, date of birth, patient ID number, other identity information, address, phone number, email, profession, education, marital status, guardian’s data, services provided, registration and visit information, paid service data, health insurance coverage, nationality/citizenship, permanent LT resident status. Special categories of personal data: a detailed list is provided in section III of this policy.	Data is stored according to internal data, information, and document retention procedures, and where no term is set – for the entire service provision period and 15 years after the end of service provision.	Contract conclusion and performance GDPR Art. 6(1)(b) Legal obligation GDPR Art. 6(1)(c)
Pre-registration for services, reminders about the need/possibility to perform services	Name, surname, date of birth, personal ID code, address, phone number, email, data of a minor’s representative or person under guardianship, health data, health insurance coverage, website login data, registration information and data.	Data is stored according to internal data, information, and document retention procedures. Data processed on the basis of consent is stored as stated above unless the person withdraws the given consent.	Consent GDPR Art. 6(1)(a)
Administration of inquiries, feedback, responses about our activities and services	Name, surname, publicly visible information from social media accounts, phone number, email, address, message content, response content.	Data is stored for the entire communication period and 1 year after its end, and in remote communication programs – according to their settings, but no longer than 1 year from the end of communication. Data processed on the basis of consent is stored as stated above unless the person withdraws the given consent.	Consent GDPR Art. 6(1)(a)
Conclusion and performance of agreements necessary for our activities, internal administration	Name, surname, date of birth, personal ID code (if required), phone number, email, address, represented legal entity, relation to legal entity, position, workplace, individual activity certificate number, qualification data, payment details, payment information, VAT code, image (if necessary), other data necessary for cooperation and results of cooperation	Data is stored according to internal data, information, and document retention procedures, and where no term is set – for the duration of the agreement/relationship and 5 years after the end of the agreement/relationship.	Contract conclusion and performance GDPR Art. 6(1)(b)
Examination of requests, complaints, claims, disputes, inquiries in judicial and non-judicial order, handling of patient complaints under the Law on the Rights of Patients and Compensation for Damage	Name, surname, email, phone number, patient ID code, represented legal entity, relation to represented person, address, content of the claim or similar document, information/documents related to the dispute/claim, paid service payment information	Data is stored according to internal data, information, and document retention procedures, and where no term is set – for the duration of request/complaint/claim examination in non-judicial order and 3 years after such examination, judicial dispute documents are stored for the duration of the dispute and 10 years after the final decision comes into force	Contract conclusion and performance GDPR Art. 6(1)(b) Legal obligation GDPR Art. 6(1)(c)
Execution of financial operations, accounting, management of payments and debts, fulfillment of tax obligations	Name, surname, date of birth, personal ID code (if mandatory), patient identification code, country (if required), guardian’s data, VAT code, email, phone number, address, position, represented legal entity, relation to represented person, bank account number, credit institution, payment, debt, insurance service usage, leasing service usage, compensation, tax document information	Data is stored according to internal data, information, and document retention procedures and where no term is set – according to legal acts regulating financial operations and accounting, General Document Retention Schedule approved by the Chief Archivist of Lithuania, or for the entire contract/relationship period and 5 years after its end.	Contract conclusion and performance GDPR Art. 6(1)(b) Legal obligation GDPR Art. 6(1)(c)

IMPORTANT!

You have the right to object to or withdraw your consent to the processing of your data at any time when the data is processed based on your consent.

On Social Accounts, we post information about ourselves and our activities. In addition to this Privacy Policy, users of Social Accounts are also subject to the privacy policies and rules of the social networks where the Social Accounts are hosted. When you contact us on Social Accounts, we may see certain information from your account, depending on your chosen social network privacy settings. If you publish information when communicating with us on Social Accounts, depending on your privacy settings, the published information may be made public (e.g., your posted comments, reviews, etc.).

In some cases, we may send you messages or call you related to our services, for example, to remind you about an appointment, changes related to the visit or service provision, the possibility to access your test results, etc. Such messages are necessary for the proper provision of services and are not considered marketing messages.

V. Principles of data processing

We collect and process only such Personal Data as is necessary to achieve the purposes of Personal Data processing specified by us.

When processing your Personal Data we:

Comply with applicable laws, including the GDPR;
Process your Personal Data lawfully, fairly, and transparently;
Collect your Personal Data for specified, clearly defined, and legitimate purposes and do not process it in ways incompatible with those purposes, except as permitted by law;
Take all reasonable measures to ensure that Personal Data that is inaccurate or incomplete, considering the purposes of their processing, is promptly corrected, supplemented, its processing suspended, or destroyed;
Keep it in a form that allows your identity to be determined no longer than necessary for the purposes for which the Personal Data is processed;
Do not provide Personal Data to third parties and do not disclose it otherwise than specified in the Privacy Policy or required by law;
Ensure that your Personal Data is processed securely.

The Institution follows ENISA guidelines, good information security practices, and the guidelines of the State Data Protection Inspectorate to ensure the security of your data.

IMPORTANT!

Information transmission over the Internet is not completely secure. Although we make every effort to protect your personal data, we cannot guarantee data security when you transmit data during remote consultations – you assume the risk associated with data transmission.
When using video transmission platforms (e.g., Zoom, Teams), please note that these sites and the services accessible through them have their own separate privacy policies. We are not responsible or liable for these policies or for the personal data collected by these platforms, such as contact or location data. Review these policies before submitting personal data on these sites or using any of their services.
If we become aware of a breach of your personal data security that may pose a high risk to your rights or freedoms, we will immediately inform you as soon as we learn about it and identify which personal data has been accessed.

VI. Data transfer to third parties

We may transfer your Personal Data only as specified in this Privacy Policy or in accordance with legal requirements.

We may transfer your Personal Data to our partners or consultants, e.g., healthcare service partners, auditors, lawyers, legal service providers, insurance companies, other institutions, companies, persons, and organizations with whom we work or cooperate.

To our engaged data processors, such as:

External and internal information system and software providers;
Accounting and HR software providers;
IT and telecommunications, remote communication program providers;
Debt collection companies;
Advertising, marketing, news delivery, market research service providers;
Office software and data storage, processing, and exchange service providers;
Archiving service providers.

Social network platform operators (LinkedIn Ireland Unlimited Company (Ireland) and LinkedIn Corporation (USA), Facebook Ireland Ltd. (Ireland) and Facebook, Inc. (USA), Google Ireland Ltd. (Ireland) and YouTube Inc. (USA), and Google Inc. (USA)) which we use for mutual communication.

IMPORTANT!

We also provide your data to state or local government authorities and institutions, law enforcement and pre-trial investigation bodies, courts and other dispute resolution institutions, and other persons performing functions assigned to them by law.

VII. Your rights as a data subject

Under the General Data Protection Regulation (GDPR), you, as a data subject, have the following rights:

Right of access. You have the right to know whether the Institution processes your personal data, and if so – to access the processed data, its source, processing purposes, retention period, and to whom it may be disclosed.

Right to rectification. If you believe your data is inaccurate or incomplete, you have the right to request correction or completion.

Right to erasure (“right to be forgotten”). In certain cases (when data is no longer necessary for the purposes it was collected, or if you withdraw your consent), you have the right to request deletion of your personal data.

IMPORTANT!

The Institution has no right to delete your personal data related to the provision of healthcare services, as the Institution is legally obliged to process and store this data.

Right to restriction of processing. In certain circumstances, you have the right to request restriction of your data processing, e.g., when you contest the accuracy of the data or the processing is unlawful.

Right to data portability. You have the right to receive your submitted personal data in a structured, commonly used, and machine-readable format and to transmit it to another data controller, if technically possible.

Right to object. In certain cases, you have the right to object to the processing of your data (e.g., for direct marketing purposes or performing a task in the public interest).

IMPORTANT!

The Institution may not be able to provide you with healthcare services if you refuse to provide necessary personal data.

Right to withdraw consent. If data is processed based on your consent, you have the right to withdraw it at any time, without affecting the lawfulness of processing prior to withdrawal.

Right to lodge a complaint with a supervisory authority. If you believe your personal data is being processed unlawfully, you have the right to contact the State Data Protection Inspectorate (www.vdai.lrv.lt). We aim to hear and resolve all patient complaints, so we encourage you to contact the Institution first.

IMPORTANT!

We will strive to ensure the implementation of your rights as a data subject and create all conditions for their effective exercise, however, your rights as a data subject are not absolute and may be restricted in cases provided for by law.

VIII. Procedure for exercising rights

You may submit requests related to the exercise of your rights to us in person, by mail, or by electronic communications. Upon receiving your request, we may ask you to provide identity documents as well as other necessary information related to the request.

Upon receiving your request, we will respond to you no later than 30 calendar days from the date of receiving the request and all documents required for a response. If we deem it necessary, we will suspend the processing of your data, except for storage, until your request is resolved. If you lawfully withdraw your consent, we will immediately, but no later than 30 calendar days, terminate processing of your personal data, except where we are obliged to continue processing under applicable laws, legal obligations, court decisions, or mandatory instructions of authorities. If we refuse to fulfill your request, we will clearly indicate the reasons for such refusal.

If you disagree with our actions or response to your request, you may lodge a complaint with the competent state authority – the State Data Protection Inspectorate. www.vdai.lrv.lt

IX. Cookies

A cookie is a small text file that a website stores in your computer or mobile device browser when you visit. Because of it, the website can “remember” your actions and preferences for some time (e.g., registration name, language, font size, and other display preferences), so you don’t have to re-enter them every time you visit and browse the site.

The information collected by cookies allows us to ensure more convenient browsing for you, learn more about user behavior, analyze trends, and improve the website.

If you click the “I agree” button on the website, you consent to the use of cookies. You have the option to agree or not agree to the use of cookies, or before expressing consent or refusal, to use the active “cookies” link which directs to the Cookie Policy providing information about cookies and to review information about the cookies used on the website. More information about the cookies we use can be found here: https://telesante.lt/en/cookies-policy/.

X. Contacts

If you have questions, suggestions, complaints, or wish to withdraw or clarify your given consent, and also if you no longer wish your personal data to be processed for direct marketing purposes, including profiling, you may send an email to info@telesante.lt or send a registered letter to D. Riešė, Mėtų g. 2, LT-14261 Vilnius district, and object to your data being processed for direct marketing and/or automated processing including profiling. You can prohibit this without providing reasons.

Upon receiving such a request or instruction, Telesante will provide a response and carry out the actions specified in the request or refuse to do so no later than one month from the date of receipt. If necessary, the period may be extended by two more months, considering the complexity and number of requests. In such a case, within one month from the receipt of the request, Telesante will inform about the extension, stating the reasons for the delay.