Privacy and Data Register Notice

Customer Register

DoctusPlus Oy (auxiliary trade name: MESQ) maintains a customer register that is jointly used by DoctusPlus Oy (MESQ) and the professionals working there who provide services either as independent practitioners or through separate companies.

In its operations, DoctusPlus Oy (MESQ) complies with the EU General Data Protection Regulation, applicable legislation and the authorities’ guidelines on the processing of personal data, and meets the requirements of the General Data Protection Regulation (GDPR).

DoctusPlus Oy (MESQ) respects the privacy of its customers, partners and employees.

Purposes related to the use of health data

• planning, arranging, providing and monitoring customers’ examinations, treatment and preventive measures
• providing services and reporting on them to companies, organisations and private individuals
• monitoring treatment for the purposes of professional development and to ensure and measure the quality and effectiveness of treatment
• planning, developing and compiling statistics on the controller’s own operations; invoicing and debt collection; audits; and other tasks required for the exercise of the controller’s rights and fulfilment of its obligations
• assessing appropriate examinations and treatment procedures for the customer and providing information about them (with the customer’s consent)
• communications between customers and the customer service centre (such as telephone calls) may be recorded to ensure the quality of the service provided by customer service staff and to verify the service interaction

Information about and marketing of new services

• communications and marketing related to the products and services of the controller or its partners
• targeting communications, marketing and services to the customer
• using customer and health data to inform and remind the customer about matters related to their health and about the controller’s services
• assessing examinations that may be suitable for the customer and providing information about them (with the customer’s consent)
• developing the controller’s business and the related customer service
• collecting, monitoring and analysing information about customers’ interests and their choices and preferences regarding services and service locations, and developing the related customer service
• registering and marketing activities and benefits under the benefits programme
• taking customers’ preferences into account, developing customer service and targeting the service offering
• registering benefits offered by partner companies participating in the benefits programme
• conducting market research and opinion surveys

Feedback, official requests for information and adverse events

• processing customer feedback
• processing formal complaints or complaints submitted to a supervisory authority
• processing other official requests for information based on EU or Finnish legislation, such as the General Data Protection Regulation
• processing adverse event reports when a person has been involved in an event concerning customer safety

What information is collected

• basic information (name, personal identity code, contact details, occupation, the next of kin named by the customer / guardians of a customer who is a minor, and other identifying information, such as a copy of a passport); the information may be verified against the Population Information System
• consents and prohibitions
• health data
• appointment information
• invoicing information
• information related to feedback, official requests for information and adverse events (the feedback or request for information and the responses provided; a description of the adverse event and the explanation provided to the person concerned)
• other information related to the service (information about satisfaction with the service and comments on the controller’s services; information concerning preferences and choices, and the services requested by the user; contact history; information obtained from third-party registers and stored with the user’s express consent; loyalty customer information)

How long information is retained

• As a general rule, we retain information for 12 years after death. If no information about the person’s death is available, we retain it for 120 years from the person’s birth.
• Information related to feedback is retained for 5 years.
• Information related to official requests for information is retained for 12 years.
• Information related to adverse events is retained for 5 years.

Who processes personal data and to whom personal data is disclosed

• Based on the consent you have given for the joint register, your personal data may be processed by the various healthcare professionals treating you at DoctusPlus Oy (MESQ).
• Kanta Archive: Where necessary, your health data is archived in the Kanta Services archive maintained by Kela, pursuant to the Act on the Electronic Processing of Client Data in Social and Health Care (159/2007) (the “Client Data Act”). Further information: www.kanta.fi.
• In addition, where necessary, your customer data may be disclosed under Chapter 8 of the Act on the Processing of Client Data in Healthcare and Social Welfare (703/2023) as follows:
  • Another healthcare unit, organisation, place of treatment or healthcare professional
    • For the purpose of arranging treatment, necessary information may be disclosed to another healthcare unit specified by you, in accordance with your oral or written consent or consent otherwise apparent from the context and recorded in the customer record.
  • Insurance companies
    • Statutory motor liability and accident insurance: Necessary information is disclosed to the insurance company without consent (on the basis of law)
    • Voluntary insurance: Necessary information is disclosed in accordance with the consent you have given
  • An authority or organisation with a statutory right to receive information
    • Information may be disclosed to a court, another authority or an organisation with a statutory right to receive it. As a general rule, information is provided on the basis of a written and specific request, in the form of statements and to the extent required by the matter in question.
  • The customer’s next of kin or another person close to the customer
    • If you are receiving treatment while unconscious or for another comparable reason, your next of kin or another person close to you may be informed about you and your state of health, unless there is reason to believe that you would have prohibited this.
  • Research use
    • Any other use of health data for research purposes requires your consent.
  • Your personal data will be disclosed outside the EU only with your consent.

How personal data is protected

DoctusPlus Oy (MESQ) uses appropriate physical, technical and administrative safeguards to protect data against misuse. These include controlling and filtering network traffic, using encryption technologies and secure equipment facilities, appropriate access control, controlled granting of access rights and monitoring their use, providing instructions to personnel involved in the processing of personal data, and managing risks in the design, implementation and maintenance of our services. DoctusPlus Oy (MESQ) carefully selects the subcontractors it uses and, through contractual and other arrangements, ensures that they also process data in accordance with legislation and good data protection practices.

Your rights

• Right of access to personal data
  • You may submit a written request to inspect your personal data to a DoctusPlus Oy (MESQ) clinic (using the register data inspection request form).
• Right to rectification
  • You may submit a written request for rectification to a DoctusPlus Oy (MESQ) clinic.
• Right to erasure
  • Information you have provided yourself may be deleted at your request.

In other respects:

• The retention period for health data is determined in accordance with the decree of the Ministry of Social Affairs and Health. The data is deleted when the retention period expires.
• Other data is deleted when the period specified under “How long information is retained” expires.

• Right to restriction of processing
  • You have the right to request that DoctusPlus Oy (MESQ) restrict processing when you contest the accuracy of your personal data. In this case, processing will be restricted for the period required for us to verify its accuracy. The restriction is implemented by encrypting the customer data.
• Right to data portability
  • If the processing is based on your consent, you may withdraw your consent at any time. Consent may be withdrawn through the clinic’s customer service.
• Right to lodge a complaint with a supervisory authority
  • If you consider that the processing of your personal data has infringed the General Data Protection Regulation, you have the right to lodge a complaint with a supervisory authority.
  • You may also lodge a complaint in the Member State where you have your habitual residence or place of work.

Who can you contact?

Data Protection Officer: Alice Dansson, alice.dansson@mesq.fi

Customer Ombudsperson: Alice Dansson, alice.dansson@mesq.fi