The Centre Hospitalier Emile Mayrisch (hereinafter “CHEM”), a foundation subject to the law of 21 April 1928 on non-profit associations and foundations, established and having its registered office at rue Emile Mayrisch, L-4005 Esch-sur-Alzette, registered with the Trade and Companies Register of Luxembourg under number G197, assumes the role of Controller.

2. Scope

Notwithstanding its obligation to comply with applicable data protection legislation, the CHEM has an obligation of information concerning the processing that is made of your personal data when you use the services of the “MyCHEM” application, responding (if applicable) to requests that you may make in order to exercise your rights relating to your information. This Data Protection Policy applies to the processing of your personal data (collection, use, storage, disclosure, etc.) that the CHEM carries out as Data Controller.

3. Definitions

The definitions specified in the General Terms of Use of the “MyCHEM” app apply as part of the present Data Protection Policy.

As part of the present Data Protection Policy, and unless the context specifies another definition:

The reference to a document is a reference to that document, whether it has been modified or replaced at any time;
The reference to a person may relate to a natural person as well as to a company, a corporation or any other corporate body which is part of it;
The singular and plural are interchangeable regardless of how a term is written and should be treated in the same way;
The headings, subtitles and section headings contained in the present Data Protection Policy have only a practical functionality: they do not define and do not explain the sections or provisions that follow them.

4. Data Controller

The CHEM – which acts as Data Controller – defines the purposes and means of processing your personal data.

5. Data protection governance

The CHEM has appointed a Data Protection Officer, one of whose duties is to inform and advise the CHEM on how to protect your personal data and privacy. The Data Protection Officer may be contacted on the following contact details:

Data Controller: General Manager, Centre Hospitalier Emile Mayrisch, BP 436 L-4005 Esch-sur-Alzette

Data Protection Officer: Data Protection Officer, Information Security Unit, Centre Hospitalier Emile Mayrisch, BP 436 L-4005 Esch-sur-Alzette, dpo@chem.lu

6. Categories of personal data collected and processed

6.1. Categories of personal data collected directly

In order to provide you with access to and use of the services of the “MyCHEM” app, the CHEM acts as its own data controller and collects the following data:

Surname, first name: identification of the patient in order to allow the creation of your appointments;
Date of birth: the date of birth is a strict identification feature, so the collection of this data is necessary;
Mobile phone number: allowing two-factor authentication/OTP SMS;
Email address: allows both the identification of your “MyCHEM” account and the communication (including any reminders) between the CHEM and the beneficiary of this email address.
CNS (National Health Fund) number (optional): to enable matching with the patient where possible. This data is also referred to as “Luxembourg national identifier or identification number for natural persons” whose number is 13 digits;
User language: allows customisation of the language used by the app;
Your appointment details:
1. Date of appointment;
2. Appointment site;
3. Type of medical examination
  1. In response to a medical questionnaire;
4. Documents related to your appointment at the CHEM (prescription, etc.)
In addition, you may be asked to provide additional personal data when (among others) you request assistance, send information to the CHEM to report a problem or analysis, you participate in a survey or other activities or when you wish to establish any other communication with the CHEM.

6.4. Use of cookies and other similar technologies

The “MyCHEM” app does not use cookies. However, there is local storage for your authentication and account data, which is stored on your smartphone, is linked to the application and is not shared with third parties. This data stored locally on your smartphone is only used to authenticate you and keep your usage settings (language, user name of the “MyCHEM” application, etc.).

6.5. Possible considerations if you refuse to provide your personal information

Please note that if you do not provide all the personal data requested, the “MyCHEM” app and the CHEM departments that are recipients of this data may not be able to process your request for an appointment.

Refusal to provide the information requested by CHEM via the “MyCHEM” app can therefore prevent you from using the services of the app and negatively affect your appointment request.

7. The purposes of the processing

The CHEM processes your personal data as Data Controller for its own purposes for:

Making appointments and sending the associated documents with the aim of ensuring the best possible care;

8. Legal bases for processing your data

8.1. You have explicitly consented to the collection and processing of your personal data as described and justified in this Data Protection Policy prior to any collection and processing of your personal data by the CHEM. As a result, the collection and processing of your personal data in the context of the services offered by the “MyCHEM” application is lawful.

8.2. The collection and processing of your personal data in the context of the services offered by the “MyCHEM” application is also lawful insofar as these procedures are an essential prerequisite for your care by the CHEM.

8.3. The processing of your personal data in the context of the services offered by the “MyCHEM” application is also lawful insofar as it is necessary for the legitimate interests pursued by the CHEM.

9. Maintenance of your personal data’s storage systems

The CHEM only consults your personal data when necessary in order to ensure the maintenance and security of its information system.

10. Your consent: conditions in force

Please note that you have the right to withdraw your consent at any time. The withdrawal of your consent will not, however, affect the lawfulness of the processing that was carried out on your data prior to such withdrawal.

11. Your data protection rights

11.1. General

You can exercise your data protection rights by contacting the Data Protection Officer by e-mail at dpo@chem.lu .

Please clearly indicate in your request the personal data concerned and what you wish to do (access, rectify, erase, restrict processing).

Please understand that all your data protection rights are not absolute and that, under applicable data protection laws, they may be suspended. In this case, you will receive a notification explaining why we have not responded to your request.

Your request will be processed as soon as possible and the CHEM will inform you of the action(s) taken in a reasonable period and no later than one month (1 month) following receipt of your request. This period may be extended by two months (2 months) if necessary, depending on the complexity and the number of your requests. In this case, the extension will be communicated to you within one month (1 month) of receipt of your request, as well as the reasons for this extension.

In the event that your request is refused or not processed within the period defined above, you have the possibility to lodge a complaint with the national supervisory authority (as defined in point 18 of this Data Protection Policy).

11.2. Your right of access, rectification, restriction of processing and erasure of your personal data and your right to data portability

If applicable and within the limits of the applicable data protection laws, you can exercise your right of access to the personal data processed and to request their rectification or erasure, or to restrict the processing that is made of it.

Within the limits of the applicable data protection laws, you have the right (1) to request to receive your personal data in a structural format, commonly used and readable by a machine, and (2) to transmit these personal data to another Data Controller.

11.3. Your right to object

If applicable and in accordance with the applicable data protection laws, you have at any time and for reasons which depend on your situation specifically the right to object to the processing of your personal data, except:

If this processing is motivated by compelling and legitimate reasons that outweigh your interests, your rights and your liberties; or
If this processing is necessary in the context of legal proceedings.

12. Transfer of your personal data to other countries

In the context of using the “MyCHEM” app, there is no question that your personal data will be communicated outside of the CHEM.

13. Disclosure of personal data

The CHEM in its capacity as Data Controller may be required to communicate your personal data in accordance with applicable laws and regulations, in particular in the context of the pursuit of the objectives defined in point 7 of this Privacy Policy.

13.1. General principles

The CHEM in its capacity as Data Controller does not communicate your personal data (hereinafter referred to as “communication ” or “disclosure “) to third parties for their own marketing purposes. However, this principle shall not prevent CHEM from disclosing your personal data to third parties (public authorities, law enforcement agencies, data protection authorities, regulatory bodies, government officials, authorised third parties, etc.), in accordance with applicable laws and regulations, in particular in the context of the pursuit of the objectives defined in point 7 of this Data Protection Policy, if:

This is necessary for the conclusion or execution of a contract or in the context of the services offered by the “MyCHEM” application;
It is required by law or public interest;
Your vital interest demands it;
This is necessary in order to pursue CHEM’s legitimate interests;
You have given your consent;
Other legal reasons authorise it.

13.2. Use of a service provider

The CHEM in its capacity as Data Controller uses a service provider for the development of this application. However, under no circumstances will this vendor have access to your personal data.

13.3 Agents likely to receive your personal data

The CHEM in its capacity as Data Controller may communicate your personal data to its various employees who are in charge of processing and following up your request, in accordance with the purposes defined in point 7 of this document.

14. Security of your personal data

Security is central to CHEM’s concerns in order to protect your personal data and privacy. For this reason, we offer two-factor authentication when using our “MyCHEM” application.

Nevertheless, please understand that the absolute protection of the processing, transfer or storage of information (personal data) cannot be guaranteed today, even in high-security environments and despite appropriate security measures, and therefore your personal data may be subject to hacking and/or attacks.

With regard to the documents that you may be required to send to the CHEM via the “MyCHEM” application, we ask you beforehand to ensure that the identity of the person concerned by the appointment coincides with the identity on the document you are going to send to us.

If you have reason to believe that your personal data are no longer secure, please contact us immediately by sending an email to dpo@chem.lu.

15. Storage of your personal data

Your data is stored on the servers physically located at CHEM’s premises which are located in the territory of the Grand Duchy of Luxembourg.

16. How long your data will be stored

By default, all data that has been entered by you in the “MyCHEM” app is retained until you decide to delete your account.

17. Updates to this Data Protection Policy

This Data Protection Policy was brought to your attention before you could access the services offered by the “MyCHEM” application (and more specifically before you could make an appointment), this Data Protection Policy remains available on the CHEM website (www.chem.lu).

The CHEM reserves the right to revise, change, update and supplement this Data Protection Policy and to add or remove provisions at any time. CHEM will notify you of any changes by making the new version of its Data Protection Policy available on its website and elsewhere. As soon as a new version of our data protection policy is available, we will ask you to accept the conditions in our application in order to be able to continue the services offered by our application.

18. Questions or complaints

If you have any questions or queries about this Data Protection Policy or for further information about the CHEM’s processing activities, please contact CHEM’s Data Protection Officer ( dpo@chem.lu).

If you are not satisfied with CHEM’s response, you can directly contact the National Commission for Data Protection (the authority in charge of data protection in Luxembourg), located at 15, Boulevard du Jazz, L-4370 Belvaux (Luxembourg).

GDPR English version

Content

Comments

Leave a Reply Cancel reply

More posts

GDPR Lu Version

GDPR English version

Hello world!