Privacy Notice

concerning the data processing of THE DENTALIST DR. MORHAF Kft.

This notice describes the data processing of THE DENTALIST DR. MORHAF Kft. (the “Controller”) under Regulation (EU) 2016/679 (GDPR), Act CXII of 2011 on informational self-determination and freedom of information (Infotv.), Act CLIV of 1997 on Health (Eütv.), and Act XLVII of 1997 on the processing and protection of health and related personal data (Eüak.).

It applies to individuals using the Controller’s services (“patients” or “data subjects”). It does not cover data processing related to employment at the Controller.

Controller and contact details

Name: THE DENTALIST DR. MORHAF Korlátolt Felelősségű Társaság (THE DENTALIST DR. MORHAF Kft.)
Registered office: 1134 Budapest, Angyalföldi út 30-32. B. lház. ground floor, door 6, Hungary
Company registration number: 01-09-444308 (Company Registry Court of the Budapest-Capital Regional Court)
Tax number: 32819735-1-41
Represented by: Dr. Al Hassan Morhaf, managing director
Email: info@thedentalist.hu (appointments and general enquiries); privacy requests: thedentalist.hu@gmail.com
Phone: +36 30 252 5092

Purpose and legal basis of processing

The Controller processes health and identification data for the purposes set out in Section 4 of the Eüak., in particular to preserve and improve health, to provide treatment, to monitor the data subject’s state of health and to enforce patients’ rights. In further cases defined by law (for example, administrative or court proceedings) the Controller is entitled or obliged to process data.

Health data are special categories of personal data; they are processed under Article 9(2)(h) GDPR and the Eüak.

Details of each processing activity

Contact and appointment arrangement

  • Purpose: responding to enquiries received by phone or email, arranging appointments and keeping in touch.
  • Legal basis: steps taken at the data subject’s request before entering into a contract (Article 6(1)(b) GDPR); where a message contains health data, Article 9(2)(h) GDPR and the Eüak.
  • Data: name, phone number, email address, message content, requested treatment. Please do not send unnecessary health information or records by email.
  • Consequence of not providing data: without these data we cannot contact you or arrange an appointment.

Online appointment request on the website

  • Purpose: receiving and reviewing appointment requests submitted through the website, confirming, changing or declining the appointment, and keeping in touch with you. An online request is not an automatic booking: the appointment is valid only once the clinic has confirmed it by phone or email. The Controller receives an email notification of each request and a member of staff reviews it personally; no automated decision-making takes place.
  • Legal basis: steps taken at the data subject’s request before entering into a contract (Article 6(1)(b) GDPR). Before submitting, you confirm by ticking a box that you have read this notice; the processing is not based on consent.
  • Data: selected time slot, full name, phone number, email address if provided, and form language. We do not ask for any health information in the form; please do not enter any. The website sends form data directly to Formspark (Trampoline Software SRL, Belgium), which receives and stores it in the EU on the Controller’s behalf and emails a notification to the clinic. When you submit the form, Formspark also automatically collects your IP address and browser data (user agent and referring page). The form is intended for adults; for patients under 18, a parent or legal representative should submit the request with their own details.
  • Consequence of not providing data: without the mandatory fields the request cannot be sent; you can still request an appointment by phone or email.
  • Retention: if no appointment results or you do not attend, the notification stored in the clinic’s mailbox is kept for at most 30 days after the matter is closed. If care takes place, the data are kept under the rules for healthcare records. The Controller deletes submissions in Formspark within 30 days after the matter is closed; Formspark keeps deleted submissions recoverable for a further 30 days and keeps the submitter’s IP address for 12 months.

Provision of healthcare

  • Purpose: dental care provided as outpatient specialist care, examinations, keeping the related records, fulfilling statutory reporting obligations and keeping in touch with the patient.
  • Legal basis: performance of the healthcare service contract and compliance with legal obligations (Article 6(1)(b) and (c) GDPR); for health data, Article 9(2)(h) GDPR and the Eüak.
  • Data: identification and contact details, medical history, anamnesis, examination and treatment data, dental records and, where necessary, imaging and digital intraoral scans.
  • Consequence of not providing data: without these data we cannot provide healthcare.

Data processing and transfer via EESZT

  • Purpose: under Sections 35/A–35/N of the Eüak., the Controller must send the health documents and data listed in the Act, generated during care, to the Electronic Health Service Space (EESZT).
  • Legal basis: compliance with a legal obligation, with regard to the data subject’s right of self-determination; under Section 35/H(1) of the Eüak., a patient may declare to what extent other healthcare providers may access their data in EESZT.
  • Data: identification data and health documentation.

Invoicing and retention of invoices

  • Purpose: issuing and retaining invoices for the services provided.
  • Legal basis: compliance with a legal obligation (Article 6(1)(c) GDPR; accounting and tax law).
  • Data: name, address and email of the patient and invoice recipient, and treatment-related details.

Complaint handling

  • Purpose: investigating complaints about healthcare services.
  • Legal basis: compliance with a legal obligation (Section 29 of the Eütv.).
  • Data: identification data of the complainant or patient and the personal data concerned by the complaint.

Dental laboratory work

  • Purpose: producing dental technical work needed for care.
  • Legal basis: performance of the healthcare service contract; for health data, Article 9(2)(h) GDPR.
  • Data: the patient’s name and the digital intraoral scan or impression needed for the work.

Website operation

  • Purpose: secure operation of the website. GitHub, Inc., the GitHub Pages hosting provider, may process technical data (e.g. IP address, time, page requested) to operate and secure the website; see GitHub’s privacy statement for details. The website does not use cookies or tracking tools of its own (no analytics or marketing), and it loads its fonts and code libraries from its own server. The map on the contact page is a picture stored on our own server (map data © OpenStreetMap contributors), so no data are sent to a map provider when you view it. If you follow a link to a third-party site (for example “Open in Google Maps”, Instagram or Facebook), that provider’s own privacy notice applies.
  • Legal basis: legitimate interest (Article 6(1)(f) GDPR).

Gallery photographs

  • Purpose: presenting the clinic’s work.
  • Legal basis: the data subject’s signed written consent (Article 6(1)(a) GDPR and, as the images show teeth and oral areas, explicit consent under Article 9(2)(a) GDPR), which may be withdrawn at any time via the privacy contact above.
  • Data: images of teeth and oral areas.

Google reviews on the homepage

  • Purpose: showing excerpts of patients’ public reviews to inform prospective patients.
  • Legal basis: legitimate interest (Article 6(1)(f) GDPR).
  • Data and source: the reviewer’s public display name, rating and the text of the review. The data come from reviews the reviewers themselves published on Google Maps.
  • Your rights: you may object to this use or ask for your review to be removed from our website at any time via the privacy contact above; we will act on it without delay. This does not affect your review on Google itself.

Retention

Health data (Section 30 of the Eüak.): health records must be retained for at least 30 years from data collection and the discharge report for at least 50 years. Diagnostic imaging must be retained for 10 years from its creation and the report for 30 years. After the mandatory period, data may continue to be kept for treatment or scientific research where justified.

Accounting documents (Section 169 of Act C of 2000 on Accounting): at least 8 years.

Gallery photographs: until you withdraw your consent. Google reviews: until you object or ask for removal.

Online appointment requests: the Controller keeps requests until reviewed, then for at most 30 days after the matter is closed, unless care takes place. Submissions stored in Formspark are deleted by the Controller within 30 days after the matter is closed; Formspark keeps deleted submissions recoverable for a further 30 days and the submitter’s IP address for 12 months. Appointment correspondence: until the matter is resolved, then only as long as necessary. For other data, the period set by the relevant law, or as long as processing rests on a legitimate interest.

Recipients and processors

The Controller uses contributors in providing care, who may learn some of the personal data in the course of their work. We conclude contracts with them, as processors, that comply with the law to protect personal data. The providers used:

  • Flexi Medical Cloud Zrt. (Tölgyfa utca 28., 1027 Budapest) – provider of the Flexi-Dent clinic system: hosting, IT operation and maintenance. The cloud infrastructure operates in Budapest data centres. Some data are also stored locally on computers and on paper.
  • Számlázz.hu – invoicing; and the clinic’s accountant – accounting services.
  • GitHub Pages / GitHub, Inc. – the website’s hosting provider. Privacy statement.
  • Formspark (Trampoline Software SRL, Rue de Marsannay-la-Côte 16, 5032 Mazy, Belgium) – receiving, storing and emailing online appointment requests. Submission data are stored in the EU (Ireland and Germany). Formspark’s Data Processing Agreement forms part of its Terms of Service. Privacy Policy | Data Processing Agreement.
  • Google (Gmail) – receiving messages sent to info@thedentalist.hu (including notifications of online appointment requests).
  • Dental technician – data needed for the laboratory work (name, digital intraoral scan or impression).

The website is hosted by GitHub Pages (GitHub, Inc., United States). Online appointment request data are stored in the EU by Formspark. Formspark states that some of its own sub-processors process data outside the EU, relying on adequacy decisions, Standard Contractual Clauses or the EU-US Data Privacy Framework (see its sub-processor list). You can request a copy of these safeguards via the privacy contact above. Any processing outside the EU by other providers is described in their own privacy notices. Hungarian law in some cases requires mandatory data transfers (for example, in the epidemiological interest); in these cases, and where we receive an official decision, we comply in accordance with the rules on medical confidentiality.

Your rights

  • Right of access and information: you may request information on the data we hold about you, access and a copy, including access to your health records and copies of them under the Eüak. We provide information in writing, in plain language, as soon as possible and within 30 days at the latest. It is free of charge unless you have already submitted a request for the same data this year, in which case a fee may be charged.
  • Rectification, erasure and restriction: you may request rectification of inaccurate or incomplete data, erasure of your data or restriction of processing, under the conditions of the GDPR.
  • Right to object: on grounds relating to your particular situation, in the cases set out by law, you may object to the processing of your personal data at any time.
  • Data portability: where the legal conditions are met, you may request your data in a machine-readable format.
  • Withdrawal of consent: where processing is based solely on your consent (for example, gallery photographs), you may withdraw it at any time. Withdrawal does not affect the lawfulness of earlier processing.

Some rights may be restricted by legal obligations applying to us as a healthcare provider: if the law requires us to retain your personal data, we cannot erase it.

To exercise your rights or ask a question, email thedentalist.hu@gmail.com or write to our registered office. After examining the matter, we will reply within 30 days at the latest. No automated decision-making or profiling takes place.

Complaints and judicial remedy

If you believe your rights have been infringed, you may:

  • contact the Controller directly using the details above; under Section 29 of the Eütv. you may complain about healthcare orally or in writing, and we will investigate and reply in writing within 30 working days at the latest; you may also turn to the patient rights representative, Szécsiné Fazekas Márta (phone: +36 20 489 9506), to have a complaint investigated;
  • go to court in case of unlawful processing or breach of data-security requirements; court details are at birosag.hu;
  • lodge a complaint with the supervisory authority, the Hungarian National Authority for Data Protection and Freedom of Information (NAIH; 1055 Budapest, Falk Miksa utca 9-11.; postal address: 1363 Budapest, Pf. 9; phone: +36 1 391 1400): www.naih.hu, email: ugyfelszolgalat@naih.hu. You may also complain to the data protection authority of the EU member state where you live or work.

Amendments

The Controller reserves the right to amend this notice; the current version is always available on this page.

Last updated: 26 October 2026.