Patient privacy policy

Ordoline cares about the privacy of its clients and patients, which is why we ensure a high level of protection when processing personal data. This privacy policy provides information on how Ordoline processes the personal data of clients/dentists and patients on Ordoline’s website, dr.Ordoline.com, and what rights you have concerning the processed data.

CONTROLLER

• The controller of the personal data is Ordoline LLC (hereinafter referred to as Ordoline), entity code: 305610551; address: A. Vivulskio str. 7-202, Vilnius, Lithuania.

PERSONAL DATA OF CLIENTS/DENTISTS PROCESSED BY ORDOLINE

• In the processes of ordering, producing, and supplying dental aligners, Ordoline processes the personal data of the ordering dentists, including (but not necessarily limited to) forename, surname, qualifications, workplace, email address, telephone number, and the dentist’s account login data.

Purposes and Legal Basis for Processing Personal Data

• The aforementioned personal data is necessary for the quality production and smooth delivery of dental aligners ordered by the dentist (i.e., for the fulfillment of the contract for the production of dental aligners).
  • Article 6(b) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter referred to as the GDPR), provides for the right to process personal data insofar as it is necessary for the fulfillment of a contract.
• Personal data of clients/dentists, such as an individual’s name, surname, and email address, may be processed for the purpose of direct marketing (sending newsletters or offers), provided that the client’s/dentist’s written consent is obtained prior to the processing of such data.
  • Article 6(a) of the General Data Protection Regulation gives the right to process such data with the consent of the data subject.

Term of Personal Data Storage

• The personal data of the dentist who placed the order for the dental aligners, processed for the purpose of fulfilling the contract for the production of the dental aligners, such as the dentist’s name, surname, qualifications, workplace, and account login data, shall be stored for 15 years from the time when the dental aligners were produced. This time limit is stipulated by the legislation of the Republic of Lithuania regulating the time limits for the storage of a patient’s medical records. The dentist’s telephone number shall be stored for 2 years after the last order for dental aligners.
  • Personal data of customers/dentists processed for the purpose of direct marketing shall be stored for two months from the date of withdrawal of consent or from the date of Ordoline’s decision to no longer process personal data for the purpose of direct marketing.

Provision of Personal Data

• The personal data of dentists who have placed orders for dental aligners may be provided to the competent authorities in accordance with the legislation of the Republic of Lithuania. Dentists’ personal data may also be provided to data processors selected by the Clinic to provide the Clinic with information system maintenance, transportation, advertising, and other similar services, as well as to Ordoline distributors. Data processors shall process data in accordance with the Clinic’s instructions and only to the extent necessary for the provision of services. All data processors are obliged to ensure the provisions governing the security of personal data.

PERSONAL DATA OF PATIENTS PROCESSED BY ORDOLINE

• During the process of ordering, producing, and supplying dental aligners, Ordoline shall process the personal data of the patients specified in the orders, such as name, surname, date of birth, and the personal data of special categories of patients, such as data on the patient’s dental and occlusal condition, the patient’s complaints, the orthodontic treatment applied, the patient’s medical images (X-rays), and the patient’s imaging data (photographs of the face and teeth). 

Purposes and Legal Basis for Processing Personal Data

• The above personal data is necessary for the quality production of dental aligners as ordered by the dentist, i.e., for high-quality provision of oral care services. The legislation of the Republic of Lithuania obliges companies, while providing oral health care services, to keep medical records of patients, identifying the individual patient.
  • Article 6© of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter referred to as the GDPR), provides for the right to process personal data insofar as it is necessary for the performance of an applicable legal obligation.
  • Article 9(h) of the General Data Protection Regulation gives the right to process special categories of personal data if such is necessary for the provision of healthcare services.
• Ordoline may process patients’ contact data, such as telephone numbers and email addresses, for the purpose of communication with the patient for the legitimate interests of Ordoline, i.e., for the purpose of contacting the patient regarding the delivery of dental aligners or for the purpose of obtaining any additional information necessary for the execution of the order.
  • Article 6(f) of the General Data Protection Regulation gives the right to process data for the purposes of the legitimate interests of the controller.

Term of Personal Data Storage

• Patients’ personal data processed for the purpose of providing oral care services shall be stored for the period prescribed by the legislation of the Republic of Lithuania (15 years). Patients’ contact details (telephone number and email) shall be stored for 5 years from the date of the order for dental aligners.

Provision of Personal Data

• Patients’ personal data may be provided to the competent authorities in accordance with the legislation of the Republic of Lithuania. Patients’ personal data may also be submitted to data processors selected by the Clinic to provide information system maintenance services to the Clinic, as well as to Ordoline distributors. Data processors shall process data in accordance with the Clinic’s instructions and only to the extent necessary for the provision of services. All data processors are obliged to ensure the provisions governing the security of personal data.

PERSONAL DATA SECURITY

• Patients’ personal data are processed through the implementation of appropriate organisational and technical security measures to protect personal data against accidental or unlawful destruction, alteration, disclosure, or any other form of unlawful processing.

DATA SUBJECTS’ RIGHTS REGARDING PROCESSING

• Data subjects have the right to request that Ordoline provide free access to and rectification or erasure of their personal data, to restrict processing, and to object to the processing of their data. Data subjects have the right to withdraw their consent to the processing of personal data at any time, provided that the personal data is processed on the basis of consent. Data subjects have the right to data portability.
• Data subjects have the right to request that Ordoline no longer process their personal data and that Ordoline delete their personal data in one or more of the following circumstances:
  • Personal data are no longer needed to achieve the purposes for which they were collected or otherwise processed.
  • The data subject’s consent on which the processing was based is withdrawn, and there is no other legal basis for processing the data.
  • Personal data was processed illegally.
  • An objection to the processing of personal data on the basis of Ordoline’s legitimate interest and the interests of the data subject prevails in the particular case.
• Data subjects have the right to request that Ordoline restrict the processing of personal data. After the restriction of personal data processing, Ordoline shall no longer perform any action on the personal data other than storing the personal data. A request for restriction of the processing of personal data may be made in at least one of the following circumstances:
  • Personal data are inaccurate (in this scenario, personal data processing operations shall be restricted while checking the accuracy of the data).
  • The personal data are unlawfully processed, but the data subject does not consent to the erasure of the personal data.
  • The Clinic no longer needs the personal data for the purposes set out above, but it is necessary for the data subject to assert, exercise, or defend legal claims.
  • The processing of personal data is subject to the data subject’s objection to such processing (processing on this basis is restricted until it has been verified that the reasons for processing the personal data override those of the data subject).
• The right to data portability means that the data subject shall be allowed to receive (in a structured, commonly used, computer-readable, and interoperable format) the personal data provided to him/her, which are processed by the Clinic by automated means and the processing of which is based on the data subject’s consent or on a contract with the data subject. Where technically feasible, such personal data may be transmitted directly to another controller indicated by the data subject and at the data subject’s request.
• Requests related to the protection of personal data can be made:
  • In person at: A. Vivulskio g. 7-202, Vilnius, Lithuania.
  • By post or through postal or other parcel delivery services to the following address: A. Vivulskio g. 7-202, Vilnius, Lithuania.
  • By email: info@ordoline.com
• The data subject or his/her representative must verify his/her identity at the time of the request.
• Data subjects who believe that their rights have been violated as a result of the processing of personal data have the right to lodge a complaint with the State Data Protection Inspectorate, L. Sapiegos str. 17, 10312 Vilnius, email: ada@ada.lt