Privacy Notice for
Patient Records

← Back to privacy policy

1. Data Controller

Foundation Health Finland Oy ("Foundation" or "FHF")
Business ID: 3466230-1
Ratakatu 29 A 4, 00120 Helsinki

2. Purposes of Processing and Legal Basis

When you use services at Foundation, the processing of your patient data is based primarily on applicable national social- and health-care legislation, including the Act on the Status and Rights of Patients (785/1992), the Client Data Act (703/2023), and the Patient Documents Decree (94/2022).

Patient data are used for organising, planning, delivering and monitoring care, for patient administration, and for other purposes permitted by law and based on given consents.

3. Categories of Personal Data

• Patient's name, personal identity code, contact information
• Health data generated in examinations or treatment
• Records of any consents or data-sharing permissions
• Data relating to customer service events
• Billing and payment data
• Laboratory, radiology, and cardiac examination results

4. Disclosure of Patient Data

Patient data are confidential and protected by professional secrecy obligations. Patient data may only be disclosed with the patient's consent, or based on legal obligations under applicable law.

5. Transfers Outside the EU/EEA

We process all patient data primarily within the European Union or European Economic Area. Any transfers outside the EU/EEA comply with data-protection legislation.

6. Retention Period

Patient data are retained in accordance with applicable statutory retention periods. Normally patient records are stored for 12 years after the patient's death, or 120 years from the date of birth.

7. Rights of the Data Subject

You have the right to access your personal data, request rectification of inaccurate data, and in certain cases, request erasure or restriction of processing. You also have the right to lodge a complaint with the Office of the Data Protection Ombudsman.

8. Contact Information

Data Protection Officer: Fredrik Sannholm
privacy@foundation.clinic