1. Data controller
This privacy policy describes how SIA “SMART DIAGNOSTIC” (Grand Medical medical centre) processes personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) and the laws of the Republic of Latvia.
Data controller:
SIA “SMART DIAGNOSTIC”
Reg. No.: 40203603384
Registered address: Dzelzavas iela 75-4, Riga, LV-1084, Latvia
Actual address: Stirnu iela 8, Riga, LV-1082, Latvia
E-mail: [email protected]
Phone: +371 255 89 505
2. Personal data we process
- Identification data: first name, surname, date of birth or personal identity number.
- Contact details: phone number, e-mail address, postal address.
- Health data (special category data): complaints, medical history, examination results, diagnoses, doctors’ conclusions and referrals — only within the provision of healthcare services.
- Insurance data, if the service is covered in full or in part by an insurer.
- Billing data: services received, amounts, the fact of payment. We do not store payment card details — these are processed by the payment service provider.
- Communication data: requests sent through forms on the website, e-mail and chat correspondence, phone calls.
- Technical data: IP address, device and browser data, cookies.
3. Purposes and legal basis
- Providing healthcare services and keeping medical records — Article 6(1)(b) and (c) GDPR together with Article 9(2)(h), and the Latvian Medical Treatment Law and Patients’ Rights Law.
- Appointment booking and communication with the patient — performance of a contract (Article 6(1)(b)).
- Billing and accounting — compliance with a legal obligation (Article 6(1)(c)).
- Compliance with regulatory requirements and reporting to state authorities — Article 6(1)(c).
- Service quality and website security — our legitimate interests (Article 6(1)(f)).
- News and marketing messages — only with your consent (Article 6(1)(a)), which you may withdraw at any time.
4. Recipients of data
Personal data is accessible only to those employees and medical practitioners who need it to perform their duties; all of them are bound by a duty of confidentiality.
Data may be shared with:
- payment service providers and banks;
- insurance companies — if the patient chooses to settle through an insurance policy;
- laboratories and partner medical institutions, where this is necessary to carry out an examination;
- IT and website maintenance providers acting as data processors under a written agreement;
- state authorities in the cases laid down by law.
Payment processing is provided by the payment platform https://makecommerce.lv/, therefore our company transfers the personal data required to execute the payment to the owner of the platform, Maksekeskus AS.
We do not sell personal data and do not pass it to third parties for marketing purposes.
5. Transfers outside the EEA
As a rule we do not transfer personal data outside the European Economic Area. If an individual IT service provider is located outside the EEA, we apply the safeguards set out in Article 46 GDPR, including the standard contractual clauses approved by the European Commission.
6. Retention periods
- Medical records — for the periods laid down by the regulations on the keeping of medical documentation.
- Accounting documents — for the period laid down by the Latvian Accounting Law.
- Requests and correspondence — no longer than needed to resolve the matter and handle any possible claims.
- Marketing consent — until the consent is withdrawn.
- Cookies — for the periods stated in the cookie policy.
7. Your rights
You have the right to:
- access your data and receive a copy of it;
- request the correction of inaccurate data;
- request erasure of your data, to the extent permitted by law;
- restrict or object to the processing;
- receive your data in a structured, machine-readable format (data portability);
- withdraw your consent at any time — this does not affect the lawfulness of processing carried out before the withdrawal;
- lodge a complaint with the supervisory authority.
To exercise your rights, write to [email protected] or come to the clinic in person with an identity document. We reply within one month.
8. Complaints
If you believe your data is being processed unlawfully, please contact us first. You also have the right to lodge a complaint with the Data State Inspectorate (Datu valsts inspekcija, www.dvi.gov.lv).
9. Data security
We apply technical and organisational measures to protect data: an encrypted connection on the website, restricted access rights, confidentiality obligations for staff and regular system updates.
10. Cookies
The cookies used on the website and how to manage them are described in our cookie policy.
11. Changes to this policy
SIA “SMART DIAGNOSTIC” may supplement or amend this privacy policy. The current version is always available on the website.
This version is effective from 26 October 2026.
