Patient privacy at KEIT Day Hospital: protecting personal data, health information and photographs

1 What personal and health data does KEIT Day Hospital process?

During consultations, preparation for surgery and postoperative follow-up, KEIT Day Hospital collects and processes information necessary to provide medical care, organise services and fulfil legal obligations.

This information includes:

• Identification and contact details: First name, surname and information required for patient identification, registration, communication and the organisation of consultations and services.

• Health data: Medical history, health questionnaires, laboratory test results, diagnostic examinations and information about medical conditions, used for medical assessment and treatment safety.

• Clinical and surgical documentation: Medical records, information about surgical procedures, treatments performed, recommendations and postoperative check-ups, necessary for documenting and ensuring continuity of care.

• Clinical photographs: Images taken, when necessary, to plan surgical procedures, document the patient's condition and assess the progression of results.

• Financial and administrative data: Information required to prepare quotations, service agreements, invoices and fulfil tax obligations.

KEIT Day Hospital processes data in accordance with the purposes for which it was collected, respecting the principle of limiting information to what is necessary for the relevant services and obligations.

2 How are patients informed about the processing of personal data?

KEIT Day Hospital processes personal data in accordance with Albanian Law No. 124/2024 "On the Protection of Personal Data", which has been aligned with the European Union's General Data Protection Regulation (GDPR). Health information falls within the special categories of personal data and is subject to specific requirements regarding its processing and protection.

Before surgery, patients are provided with a privacy notice explaining the categories of information collected, the purposes and legal bases for processing, data retention periods and the rights they may exercise. Patients are also informed about how to request clarification or submit an enquiry concerning their personal data.

The processing of information necessary for medical care and compliance with legal obligations is distinct from uses that require the patient's separate consent, such as publishing photographs for informational or promotional purposes. These uses are managed separately, in accordance with legal requirements.

3 Who can access patient data and how is it protected?

Patients' personal and health information is not publicly accessible and is treated confidentially. Access is restricted to healthcare professionals involved in medical care and authorised administrative personnel, including coordinators and departments that require the information to organise and provide services.

KEIT Day Hospital implements organisational and technical measures to restrict unauthorised access and protect patient documentation:

• Medical record storage: Medical records and physical documents are stored in secured archives, with access restricted to authorised personnel.

• Electronic information management: Patient communications and data are managed through protected systems and a customer relationship management (CRM) system with controlled access based on staff responsibilities.

• Staff training: Personnel receive training on maintaining confidentiality and protecting personal data while performing their duties.

• Confidentiality obligations: Protecting personal and health information forms part of the professional responsibilities and contractual commitments associated with providing services.

KEIT Day Hospital has also appointed a Data Protection Officer (DPO), who oversees compliance of data processing activities with the relevant legal requirements.

Data is retained for the periods necessary to fulfil the purposes of processing and in accordance with obligations established by applicable legislation. Information may be disclosed to other parties only where a valid legal basis exists, while respecting confidentiality and data protection requirements.

4 Patient photographs: medical documentation and consent for publication

Clinical photographs are an important part of documenting cosmetic surgery procedures. When necessary, they are taken before, during or after treatment to assess the patient's initial condition, plan the procedure and monitor results. Photographs taken for these purposes are managed as part of the patient's medical records.

However, taking photographs for clinical documentation does not constitute authorisation for their publication. Using images on the website, social media or in informational or promotional materials requires the patient's separate written consent. This consent is distinct from the informed consent provided for the surgical procedure. Patients have the right to refuse the publication of their photographs without affecting the medical care they receive.

When patients authorise publication, KEIT Day Hospital uses the material according to the purposes and conditions for which consent was given. Where appropriate, measures may be used to reduce identifiability, such as concealing certain facial features, while recognising that these measures do not always guarantee complete anonymity.

Patients may withdraw their consent for the publication of photographs at any time. Withdrawal does not affect the lawfulness of any use carried out on the basis of consent before its withdrawal. Requests concerning previously published materials are handled according to the specific circumstances and applicable legal obligations.

5 What rights do patients have regarding their personal data?

Every patient has the right to be informed about how their personal data is processed and to exercise the rights established by applicable legislation.

Depending on the relevant legal conditions, these include:

• Right of access: Request information about the personal data being processed and obtain copies, including medical documentation, subject to applicable legal requirements.

• Right to rectification: Request the correction of inaccurate data or the completion of incomplete information.

• Right to erasure: Request the deletion of personal data where the legal conditions are met, taking into account obligations to retain medical and administrative documentation.

• Right to restriction of processing: Request restrictions on data processing in circumstances provided for by law.

• Right to object: Object to certain types of personal data processing where this right applies, including processing for direct marketing purposes.

• Right to withdraw consent: Withdraw consent at any time for processing activities based on consent, without affecting the lawfulness of processing carried out before withdrawal.

• Right to lodge a complaint: Submit a complaint to the Albanian Commissioner for the Right to Information and Protection of Personal Data if you believe your rights have been violated.

To exercise these rights or request information about the processing of your personal data, you may contact KEIT Day Hospital at info@keit.al. Requests are handled within the time limits established by law, with a standard response period of 30 days.