KEIT Day Hospital
privacy policy

Date of update: __/__/2026

1. Introduction

KEIT DAY HOSPITAL, through the company SOMBRERO sh.p.k., in its capacity as the controller of personal data, is committed to respecting and protecting the privacy of every individual who contacts the Clinic, uses its services or visits the official website.

This Privacy Policy explains how we collect, use, store, communicate and protect the personal data of patients, potential patients, website visitors, job applicants and other persons who communicate with the Clinic.

The processing of personal data is carried out in accordance with Law no. 124/2024 “On the Protection of Personal Data”, the applicable legislation in the field of healthcare and other laws and bylaws in force.

Where and to the extent that the conditions for the territorial application of European Union legislation are met, the processing is also carried out in accordance with the relevant requirements of the GDPR.

2. Identity of the controller

The controller of personal data is:

SOMBRERO sh.p.k.
NIPT: L21410040N
Address: Rruga "Dritan Hoxha", Pallati "Green Construction" No. 1, Staircase II, Floor II, Tirana, Albania
Telephone: +355 68 200 0622
E-mail: info@keit.al

Data Protection Officer (DPO)

Name/Surname: Besforta Lipa
E-mail: besforta.lipa@keit.al

The DPO serves as a point of contact for matters related to the processing of personal data and the exercise of the rights of data subjects.

3. Principles of personal data processing

SOMBRERO sh.p.k. processes personal data in accordance with the principles of:

lawfulness, fairness and transparency;
purpose limitation;
data minimization;
accuracy;
storage limitation;
integrity and confidentiality;
accountability.

Personal data are collected and processed only for specified, explicit and legitimate purposes and only to the extent necessary for the achievement of these purposes.

4. Categories of persons and data that we process

Depending on the relationship with the Clinic, different categories of personal data may be processed.

4.1 Patients and potential patients

The following may be processed:

name and surname;
date of birth;
identification data;
contact details;
address, where necessary;
health data;
medical history;
diagnoses;
analyses and results;
information on treatments and procedures;
medical documentation;
clinical photographs;
financial and payment data;
other data necessary for the provision and administration of the service.

Health data are sensitive data and are processed only when the conditions provided for by Article 9 of Law no. 124/2024 are met. For the provision, treatment and management of healthcare services, Article 9(2)(ë) applies, under the conditions set out in this provision.

4.2 Persons who contact the Clinic

When a person contacts the Clinic by telephone, e-mail, website forms or social networks, the following may be processed:

name and surname;
telephone number;
e-mail address;
information included in the request;
other data necessary to respond to the request.

4.3 Website visitors

Technical data may be collected automatically, such as:

IP address;
device type;
operating system;
browser type;
date and time of access;
pages visited;
technical and statistical data on the use of the website.

For cookies and similar technologies, the Cookie Policy published separately on the website applies.

4.4 Job applicants

The data included in the following may be processed:

CV;
cover letter;
identification and contact details;
education and qualifications;
professional experience;
professional licences and certifications;
other documents submitted during the recruitment process.

5. Purposes and legal bases of processing

SOMBRERO sh.p.k. processes personal data only where an appropriate legal basis exists under Article 7 of Law no. 124/2024. Legal bases may include consent, performance of a contract or pre-contractual steps, compliance with a legal obligation, protection of vital interests, performance of a task carried out in the public interest or legitimate interest, as applicable.

5.1 Provision of medical and aesthetic services

The data are processed for:

registration and identification of the patient;
creation and administration of the medical record;
consultations;
diagnosis;
planning and carrying out treatment;
procedures and interventions;
patient follow-up;
documentation of treatment results.

The processing of personal data is based, as applicable, on Article 7(1)(b) of Law no. 124/2024, where the processing is necessary for the performance of a contract or for taking steps prior to entering into a contract with the data subject.

For health data, Article 9(2)(ë) of Law no. 124/2024 applies, since the processing is necessary for medical diagnosis, the provision, treatment or management of healthcare services, provided that the processing is carried out by persons who are subject to professional secrecy or under their responsibility, in accordance with the conditions established by law.

5.2 Financial administration and invoicing

The data are processed for:

invoicing;
payments;
financial administration;
compliance with tax and other legal obligations.

Where the processing is necessary for compliance with a legal obligation, Article 7(1)(c) applies.

5.3 Consultation booking and communication

The data necessary for booking consultations or for taking steps prior to entering into a contract are processed in accordance with Article 7(1)(b), where this basis is applicable.

5.4 Security and protection of the Clinic's interests

The data may be processed for:

ensuring security;
preventing abuse;
protecting systems;
protecting property and persons;
exercising or defending legal rights and claims.

Where applicable, the processing may be based on legitimate interest under Article 7(1)(dh).

5.5 Marketing

The processing of data for marketing purposes is carried out only where an appropriate legal basis exists.

Where the processing is based on consent, consent is obtained freely, specifically, informed and clearly and may be withdrawn at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

6. Health data

Due to the nature of the Clinic's activity, health data may be processed.

These data:

are processed only for specified and lawful purposes;
are accessed only by authorized persons;
are protected by appropriate technical and organizational measures;
are handled in accordance with confidentiality and professional secrecy obligations;
are not used for other purposes incompatible with the initial purpose.

7. Photographs and visual materials

The Clinic may create and retain clinical photographs where they are necessary for the documentation, assessment and follow-up of the patient's treatment.

Photographs created for clinical documentation are distinguished from photographs used for marketing purposes.

The use of photographs or videos for:

website;
social networks;
advertisements;
promotional materials;
marketing;
public presentations;
scientific or professional materials,

is carried out only where the relevant legal basis exists and, where required, on the basis of the patient's express and documented consent.

Consent for marketing use is separate from the legal basis supporting medical treatment.

Refusal to use photographs for marketing does not affect the provision of treatment or the quality of the service.

8. Data of job applicants

Applicants' data are used for:

assessment of the candidacy;
communication with the candidate;
administration of the recruitment process;
compliance with legal obligations related to employment.

The data of unsuccessful candidates are retained for the period established in the procedures and data retention matrix of SOMBRERO sh.p.k., taking into account the purpose of the processing, legal obligations and the need to protect the rights of the Controller.

9. Source of data

In principle, personal data are obtained directly from the data subject.

Where personal data are obtained from other sources, in cases where required by law, the data subject is informed about the categories of data and the source from which they were obtained.

10. Is the provision of data mandatory?

Depending on the process, the provision of personal data may be:

necessary for the provision of the service;
necessary for entering into or performing a contract;
necessary for compliance with a legal obligation;
or optional, where the processing is based on consent.

Where the provision of data is mandatory or necessary, the data subject is informed of the possible consequences of not providing them, in accordance with Article 13 of Law no. 124/2024.

11. Recipients and communication of data

Personal data may be communicated, to the extent necessary and in accordance with the law, to:

authorized medical personnel;
authorized administrative personnel, only to the extent necessary for the performance of their duties and in accordance with confidentiality obligations;
specialist doctors;
laboratories and other healthcare institutions;
providers of IT, hosting and system maintenance services;
payment service providers, where necessary;
legal advisers, auditors and professional consultants;
public authorities and competent bodies, where required by law.

Where a party processes personal data on behalf of SOMBRERO sh.p.k., the relationship with such party is regulated in accordance with the legal requirements applicable to processors.

12. International transfers

If personal data are transferred to a country outside the Republic of Albania or to an international organization, the transfer is carried out in accordance with the requirements of the legislation in force on international transfers.

Where required by law, the data subject is informed about the country of transfer and the safeguards used.

13. Cookies and similar technologies

The KEIT website uses cookies and similar technologies for operation, security, storage of preferences and, as applicable, for analytical and marketing purposes.

The use of cookies and the manner in which they are managed are determined in the Cookie Policy, published separately on the website.

For cookies that require consent, the user may give, refuse or withdraw consent through the cookie management mechanism.

14. Data retention periods

Personal data are retained only for the period necessary to achieve the purpose for which they were collected, to comply with legal obligations or to protect the lawful rights and interests of the Clinic.

The retention period is determined taking into account:

the category of data;
the purpose of processing;
applicable legislation;
legal obligations for retaining documentation;
the need to protect or exercise legal claims.

Specific retention periods are determined, according to the category of data, in the Data Retention Matrix of SOMBRERO sh.p.k.

After the expiry of the relevant retention period, the data are deleted, destroyed or anonymized, as applicable.

The law requires the data subject to be informed of the envisaged period for which the data will be stored or, where this is not possible, of the criteria used to determine it.

15. Data security

SOMBRERO sh.p.k. implements appropriate technical, organizational and physical measures to protect personal data from:

unauthorized access;
unlawful use;
loss;
destruction;
alteration;
unauthorized disclosure.

Access to personal data is restricted according to role and need for access.

Persons who have access to personal data are required to respect confidentiality and to process the data only in accordance with the relevant authorizations and instructions.

16. Video surveillance (CCTV)

For the purpose of ensuring the security of persons and property, KEIT uses a video surveillance system (CCTV) in designated areas of its premises. The processing of images is carried out in accordance with the legislation in force on the protection of personal data and for specified security purposes. The processing is carried out on the basis of the legitimate interest of the Controller, in accordance with Article 7(1)(dh) of Law no. 124/2024. Access to CCTV recordings is restricted only to authorized persons. CCTV recordings are retained for a period not exceeding 30 days, in accordance with the purpose of the processing and the requirements of the legislation in force, and are deleted after the expiry of this period. Data subjects may exercise their rights in accordance with the law by contacting the DPO at: besforta.lipa@keit.al.

17. Automated decision-making and profiling

SOMBRERO sh.p.k. does not currently use decision-making based solely on automated processing of personal data or profiling that produces legal effects or similarly significant effects on data subjects.

If this practice changes, this Policy will be updated and data subjects will be informed in accordance with the requirements of Article 13 and Article 20 of Law no. 124/2024.

18. Your rights

In accordance with Law no. 124/2024, data subjects have, subject to the conditions and limitations provided by law, the right:

a. to information – Article 13;
b. to access personal data – Article 14;
c. to rectification and erasure of data – Article 15;
d. to be forgotten, in the cases provided by law – Article 16;
e. to restriction of processing – Article 17;
f. to data portability – Article 18;
g. to object to processing – Article 19;
h. not to be subject to decisions based solely on automated processing, in the cases provided by law – Article 20;
i. to withdraw consent, where the processing is based on consent – Article 8(3);
j. to lodge a complaint with the Commissioner – Article 86.

The law provides for these rights in Articles 13–20, while the right to withdraw consent is provided for in Article 8(3) and the right to lodge a complaint with the Commissioner is provided for in Article 86.

19. How you can exercise your rights

Requests for the exercise of rights may be sent to:

DPO – Besforta Lipa
E-mail: besforta.lipa@keit.al

or:

SOMBRERO sh.p.k.
E-mail: info@keit.al
Telephone: +355 68 200 0622
Address: Rruga "Dritan Hoxha", Pallati "Green Construction" No. 1, Staircase II, Floor II, Tirana, Albania.

Where necessary, the Clinic may request additional information to verify the identity of the requester.

Requests are handled free of charge, except in cases where the law permits the imposition of a reasonable fee or the refusal of a request that is clearly unfounded or excessive.

SOMBRERO sh.p.k. informs the data subject of the fulfilment of the request or the reasons for refusal as soon as possible and, in any event, no later than 30 days from the date of receipt of the request. This period may be extended by up to 60 days where necessary, taking into account the complexity and number of requests, provided that the data subject is informed of the reasons for the extension within 30 days.

20. Complaints

If the data subject considers that their rights have not been respected, they may first contact SOMBRERO sh.p.k. or the DPO.

The data subject also has the right to lodge a complaint with:

The Commissioner for the Right to Information and Protection of Personal Data.

The information and complaint form are available on the official website of the Commissioner.

21. Links to other websites

The KEIT website may contain links to websites or platforms of third parties.

SOMBRERO sh.p.k. does not control the privacy policies or the manner in which personal data are processed by these third parties.

For information on how these third parties process personal data, we recommend that you consult their respective privacy policies.

22. Changes to the Privacy Policy

SOMBRERO sh.p.k. may review and update this Privacy Policy when necessary, due to legal, technological, organizational changes or changes in the manner in which services are provided.

The latest version of the Privacy Policy will be available on the official KEIT website.