Poliklinika i dnevna bolnica IMEDPoliklinika i dnevna bolnica IMED

Book an Appointment

Legal Information

CookiesPrivacy PolicyTerms of Use

Privacy Policy

PRIVACY POLICY FOR WEBSITE VISITORS www.imed.hr

 

The company I-MED d.o.o. (hereinafter: the “Controller” or “I-MED Polyclinic”) is committed to protecting the privacy and personal data of visitors to the website www.imed.hr and users of the services provided by the Controller through the website (hereinafter: the Data Subject/Data Subjects).

We process your personal data in accordance with the General Data Protection Regulation (hereinafter: GDPR), the Act on the Implementation of the General Data Protection Regulation, and other applicable regulations in this legal area. This Privacy Policy explains which categories of your personal data we process, for what purposes and on what legal basis, how your personal data are used, and what rights you have as a Data Subject.

Personal data includes all information that enables you to be identified as a Data Subject, either directly or indirectly. The processing of personal data includes any operation performed on personal data – collection, organization, storage, adaptation, use, transfer, erasure, or destruction – whether by automated or non-automated means.

1. Controller Information

Company: I-MED d.o.o.

Registered office: Selska cesta 90A, 10000 Zagreb

MBS: 080626368

OIB: 68891266197

Contact:

e-mail: info@imed.hr

Data Protection Officer:

Ms. Sanja Bach

Email: bach@imed.hr

2. Description of the Categories of Data Subjects and Categories of Personal Data We Process

The Controller processes personal data in accordance with the principles of data minimization, lawfulness, and transparency. Below is an overview of the categories of Data Subjects and types of personal data that we collect and process:

  • Website user data collected through the web form: We collect your first and last name, email address, telephone number, and other information you provide to us through the form.
  • User data collected when subscribing to the newsletter: Email address.
  • Website user data: When you visit our website, we collect location data, your IP address, and other technical data necessary for the functioning of the website.
  • User data collected through registrations for educational programs and courses: First and last name, contact number, email address, information about the type of education or course for which you are registering, and payment records.
  • User data collected when applying for a job vacancy: First and last name, contact details, CV, cover letter, information about qualifications, previous experience, skills, and other relevant information you provide in your application.

3. Purposes and Legal Bases for the Processing of Personal Data

The processing of your personal data is carried out exclusively for the purposes specified below and is based on the appropriate legal bases:

  • Communication, appointment scheduling, and responding to other inquiries – this includes responding to your questions and comments, processing your requests, receiving and sending messages via the contact form, and exchanging documents that you upload yourself. For this purpose, we process data such as your first and last name, email address, telephone number, and the content of your message and attached documents. Legal basis: taking steps at the request of the Data Subject prior to entering into a contract.

  • Sending notifications and marketing communications – if you have subscribed to our newsletter, we process your email address in order to regularly provide you with information about news, educational programs, services, and other content related to the activities of I-MED Polyclinic. Legal basis: consent of the Data Subject.

  • Direct marketing – for the purpose of promoting our services, informing you about developments in the profession, and maintaining and improving relationships with existing users, we may occasionally contact you by email, SMS, or WhatsApp with information about new services, special offers, educational programs, or other relevant information that may be of interest to you. Legal basis: legitimate interest of the Controller.

  • Promotion of the Polyclinic – photographs of patients, which may include depictions of treatment results, are published on our website and social media exclusively with the patient's prior explicit consent. Legal basis: consent of the Data Subject.

  • Organization of educational programs and professional courses – for the purpose of processing registrations for participation in educational programs and professional courses that we organize, we process the personal data of persons who register via the web form or by telephone. This data includes first and last name, contact number, and email address. Legal basis: taking steps at the request of the Data Subject prior to entering into a contract.

  • Processing of job applications – if you apply for an advertised position or submit an unsolicited job application, we process your data, including your first and last name, contact details, CV, qualifications, and other information you provide. Legal basis: taking steps at the request of the Data Subject prior to entering into a contract.

  • System security and protection – in order to prevent fraud, unauthorized access, security threats, or other malicious activities, we may process website user data, including IP addresses and device information. Legal basis: legitimate interest of the Controller.

Providing personal data for the above purposes is voluntary. However, if you refuse to provide data that is necessary for a particular purpose (e.g. responding to an inquiry, subscribing to the newsletter, participating in an educational program), we may not be able to provide you with the requested service or information.

4. Retention Period for Personal Data

We will process your personal data only for as long as necessary to achieve the purposes described above, unless otherwise specified in this Privacy Policy for particular cases.

5. Your Rights as a Data Subject

(I) RIGHT OF ACCESS TO PERSONAL DATA

You have the right to request confirmation as to whether your personal data are being processed, as well as access to such data and information about the processing, including the purpose, categories of data, recipients, retention period, and source of the data if they were not collected directly from you. The request should be submitted in the manner described in Section 8 of the Privacy Policy.

(II) RIGHT TO RECTIFICATION/COMPLETION OF PERSONAL DATA

You may request that the Controller rectify inaccurate personal data concerning you and, taking into account the purposes of the processing, complete incomplete personal data at any time, in the manner specified in Section 8 of the Privacy Policy.

(III) RIGHT TO ERASURE OF PERSONAL DATA (“RIGHT TO BE FORGOTTEN”)

You have the right to request the erasure of your personal data if one of the following conditions applies:

  • the personal data are no longer necessary in relation to the purposes for which they were collected or processed,
  • you have withdrawn your consent on which the processing is based and there is no other legal basis for the processing,
  • you have objected to the processing and there are no overriding legitimate grounds for the processing,
  • the data have been unlawfully processed,
  • the data must be erased to comply with a legal obligation.

The right to erasure is not absolute and applies in accordance with Article 17 of the GDPR. The request should be submitted in the manner described in Section 8 of the Privacy Policy.

(IV) RIGHT TO RESTRICTION OF PROCESSING

You may request that the Controller restrict the processing of your personal data at any time, in the manner specified in Section 8 of the Privacy Policy. In such a case, the Controller will restrict processing if one of the following conditions is met:

• the Data Subject contests the accuracy of the personal data, in which case processing will be restricted for the period necessary for the Controller to verify the accuracy of the data;

• the processing is unlawful and the Data Subject opposes the erasure of the personal data and requests the restriction of their use instead;

• the Controller no longer needs the personal data for the purposes of processing, but the Data Subject requires them for the establishment, exercise, or defense of legal claims;

• the Data Subject has objected to the processing and is awaiting verification as to whether the Controller's legitimate grounds override those of the Data Subject.

(V) RIGHT TO DATA PORTABILITY

You may request from the Controller, at any time and in the manner specified in Section 8 of the Privacy Policy, that the personal data you have provided to the Controller be provided to you in a structured, commonly used, and machine-readable format. You also have the right to transmit those data to another controller without hindrance from the Controller. Where the processing is not based on a contract/consent or data portability is technically impossible, there is no obligation to comply with the right to data portability.

(VI) RIGHT TO OBJECT

You may object to the processing by the Controller at any time, in the manner specified in Section 8 of the Privacy Policy, in accordance with Articles 21 and 22 of the General Data Protection Regulation.

(VIII) RIGHT TO LODGE A COMPLAINT WITH A SUPERVISORY AUTHORITY

If you believe that the processing of your data violates applicable law, you may also contact the competent data protection authority (Croatian Personal Data Protection Agency) directly or the competent court in order to exercise your rights.

Contact details of the competent authority:

Croatian Personal Data Protection Agency

Ulica grada Vukovara 54, 10 000 Zagreb

e-mail: azop@azop.hr

Tel. 00385 (0)1 4609-000

Web: www.azop.hr

(IX) RIGHT TO WITHDRAW CONSENT

You have the right to withdraw your consent at any time by means of a simple statement. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

6. Exercising Your Rights

To exercise your rights referred to in Section 7, you may contact us in writing at Selska cesta 90A, 10000 Zagreb, or by email at bach@imed.hr.

In order to ensure that the request is submitted by an authorized person, we may carry out an identity verification procedure before processing the request, which may include requesting additional information or documentation. This verification procedure is solely intended to protect your data and will not affect your rights.

We will respond to your request to exercise your rights without undue delay and, at the latest, within one month of receiving the request. If the request is particularly complex or if we have received a large number of requests within a short period of time, this period may be extended by a maximum of two additional months. In the event of an extension, you will be informed in a timely manner, together with an explanation of the reasons for such a decision.

Please note that exceptions to the exercise of the above rights may apply in accordance with the GDPR.

7. Sharing Data with Third Parties

We share your personal data with third parties only when necessary to provide our services, fulfill legal obligations, or protect legitimate interests. All third parties with whom we cooperate are required to comply with high standards of personal data protection, and we enter into appropriate data processing agreements with them in accordance with the GDPR. In the event of a transfer of personal data outside the European Economic Area, we implement appropriate safeguards, such as the use of Standard Contractual Clauses, to ensure the security and rights of Data Subjects.

Access to the personal data we process as the Controller may be granted, among others, to the following persons and entities:

  1. External partners and service providers: In specific situations, we engage external partners or service providers (e.g. accounting services and IT support) who may have access to personal data in order to ensure the smooth provision of our services.

  2. Third parties: We may also use certain software solutions provided by third parties (e.g. cloud services or other data storage platforms), and such third parties, as our contracted partners, may have access to your data for the purpose of storing and maintaining such software.

  3. Competent authorities: In accordance with applicable laws, personal data may be made available to competent authorities or institutions where necessary to fulfill legal obligations or protect the rights and interests of the Polyclinic.

8. Data Security

The Controller implements appropriate technical and organizational measures to ensure an appropriate level of security for the processing of personal data, in accordance with the type, scope, context, and purposes of the processing, as well as the risks to the rights and freedoms of Data Subjects.

As part of our security measures, we implement the following:

  • We adhere to strict security protocols to reduce the risk of unauthorized access to, disclosure, alteration, or loss of personal data and other data security breaches.
  • We use technical security measures such as antivirus software, firewalls, regular system updates, strong and unique passwords, and, where applicable, data encryption and pseudonymization.
  • Access to personal data is granted exclusively to authorized employees, in accordance with the principle of need-to-know access, and all employees are required to maintain the confidentiality of the data they access in the course of their work.
  • The processing and protection of personal data are governed by internal policies and procedures that ensure compliance with applicable legislation and data protection standards.
  • We regularly provide employee training and education in the field of personal data protection.
  • When engaging external processors, we enter into data processing agreements with them, clearly defining their obligation to implement an appropriate level of technical and organizational protection.

9. Use of Cookies

Our website uses cookies to ensure proper functioning and improve the user experience. More information about the types of cookies we use and how to manage them is available in our Cookie Policy.

10. Updates to the Privacy Policy

The Controller reserves the right to amend and supplement this Privacy Policy in order to comply with applicable regulations and improve the protection of personal data. All changes will be published on our website in a timely manner.

Date of last update: October 7, 2026.