Privacy Policy

General Information

This Privacy Policy explains how Mediterranean Hospital of Cyprus (“the Hospital”, “we”, “our”, or “us”) collects, uses, stores, and protects information that directly or indirectly identifies you (“personal data” or “personal information”).

As the data controller of your personal data, Mediterranean Hospital of Cyprus respects your right to privacy and is committed to protecting your personal information through appropriate technical and organisational measures.

We process your personal data in accordance with applicable data protection legislation, including the General Data Protection Regulation (EU) 2016/679 (GDPR) and the Processing of Personal Data (Protection of the Individual) Law of Cyprus, Law 125(I)/2018.

 

Personal Data We Process

Where necessary and appropriate, the Hospital may process the following categories of personal data:

• Identity and contact information, including your name, photograph, address, email address, telephone number, and date of birth.
• Medical history relating to you or, where necessary, your family members, as provided by you, through medical referrals, or by other authorised third parties.
• Information relating to your nationality and entitlement to healthcare within the Republic of Cyprus, including information required for cross-border healthcare services.
• Information relating to the healthcare services you receive, including medical and nursing records, surgical procedures, laboratory investigations, radiological examinations, and other diagnostic tests.
• Financial and payment information relating to your treatment and care.
• Information relating to enquiries, complaints, or claims.
• Information regarding your family status, next of kin, dependants, and emergency contacts.
• Information relating to your physical and mental health, including disabilities, allergies, dietary requirements, or other conditions requiring reasonable adjustments by the Hospital.

 

Why We Process Your Personal Data

We process your personal data only where there is an appropriate legal basis under the GDPR, including:

• Your consent, where you have freely agreed to specific processing activities. For example, receiving marketing communications or accessing your test results through a mobile application.
• Performance of a contract, where processing is necessary to provide healthcare services or administer payments.
• Compliance with legal obligations, including obligations arising under the Private Hospitals Law, the General Healthcare System (GeSY) legislation, tax legislation, and other applicable laws.
• Protection of vital interests, where processing is necessary in emergency situations to protect your life or that of another individual.
• Legitimate interests, where processing is necessary for the Hospital’s legitimate operational interests, provided these do not override your rights and freedoms. Examples include clinical governance, patient safety, facility and information security, operational management, and communicating important information regarding your care.

 

Processing of Special Category Data

As a healthcare provider, Mediterranean Hospital of Cyprus routinely processes special category personal data, particularly health information.

Such processing is carried out for purposes including:

• Preventive and occupational medicine
• Medical diagnosis
• Provision of healthcare and treatment
• Management of healthcare services and systems
• Ensuring high standards of healthcare quality and patient safety
• Compliance with applicable European Union or Cyprus legislation and contractual obligations with healthcare professionals

 

Disclosure of Personal Data

Where necessary and lawful, the Hospital may disclose your personal data to authorised recipients, including:

• Ministry of Health and its services (including the Ambulance Service)
• State Health Services Organisation (SHSO)
• Cyprus Tax Department
• Cyprus Medical Association
• Insurance companies
• Referring or consulting doctors
• External medical centres and diagnostic laboratories, including radiology and pathology laboratories

Where appropriate, we may also disclose personal data to trusted professional advisers and service providers acting on our behalf, including lawyers, auditors, security consultants, debt recovery agencies, and IT service providers, where such disclosure is required by law or is necessary to protect our legitimate interests.

 

International Transfers

In certain circumstances, personal data may be transferred outside the European Economic Area (EEA).

Where such transfers take place, Mediterranean Hospital of Cyprus ensures that appropriate safeguards are implemented in accordance with the GDPR and the applicable provisions of Cyprus data protection legislation.

Examples include transfers to healthcare professionals or medical centres located outside the EEA or to approved service providers supporting the Hospital’s clinical or technological infrastructure.

Wherever possible, transferred information is anonymised or pseudonymised.

 

Data Security

Mediterranean Hospital of Cyprus is committed to maintaining the highest standards of information security to ensure the confidentiality, integrity, and availability of personal data.

We implement appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or unauthorised access.

Through ongoing risk assessments, continuous monitoring, and incident response procedures, we strive to identify, investigate, and resolve any information security incidents promptly while minimising any potential impact on the privacy of our patients.

All Hospital employees receive regular training regarding confidentiality obligations and information security. Access to patient information is strictly limited to authorised personnel who require such access to perform their duties, in accordance with the principle of least privilege.

 

Data Retention

The Hospital retains personal data only for as long as necessary to fulfil the purposes described in this Privacy Policy or to comply with applicable legal, regulatory, and professional obligations.

Retention periods may also be determined by guidance issued by the Office of the Commissioner for Personal Data Protection of Cyprus or other competent authorities.

 

Your Rights

Subject to applicable law, you have the right to:

• Be informed about how your personal data is processed.
• Access your personal data.
• Request correction of inaccurate or incomplete information.
• Request the erasure of your personal data where legally applicable.
• Request restriction of processing in certain circumstances.
• Object to processing based on the Hospital’s legitimate interests.
• Receive your personal data in a structured, commonly used, and machine-readable format and request its transfer to another healthcare provider or data controller where technically feasible.
• Not be subject solely to automated decision-making, including profiling.
• Withdraw your consent at any time where processing is based on consent.
• Lodge a complaint with the Office of the Commissioner for Personal Data Protection of Cyprus if you believe your data protection rights have been infringed.

Please note that these rights are not absolute and may be subject to legal limitations or exemptions depending on the circumstances and the legal basis for processing.

We aim to respond to all valid requests as soon as reasonably practicable and, in any event, within 30 days, unless an extension is permitted under applicable law.

 

Contact Details

If you have any questions regarding this Privacy Policy or the processing of your personal data, please contact the Hospital’s Data Protection Officer (DPO):

Email: dpo@medihospital.com.cy

Telephone: +357 25 200052