1. CONTROLLER
The controller of the patient register is OVUMIA OY.
Contact information: Biokatu 12, 33520 Tampere, tel. +358 20 747 9312
OVUMIA TAMPERE, Biokatu 12, 33520 Tampere, tel. +358 20 747 9312
OVUMIA HELSINKI, Eteläranta 12, 00130 Helsinki, tel. +358 20 747 9314
OVUMIA JYVÄSKYLÄ, Väinönkatu 30, 40100 Jyväskylä, tel. +358 20 747 9313
OVUMIA KUOPIO, Ajurinkatu 16, 70110 Kuopio, tel. +358 17 263 1700
2. CONTACT DETAILS FOR MATTERS CONCERNING PATIENT DATA
Please direct any queries or requests for information relating to the patient register directly to the clinic that treated you.
You can contact Ovumia’s data protection officer at privacy@ovumia.fi for information on data protection matters relating to the patient register.
If necessary, Ovumia may ask the data subject to specify their request in writing and the identity of the data subject may, if necessary, be verified before taking any other action.
3. NAME OF THE REGISTER
The name of the register is the OVUMIA OY PATIENT REGISTER.
Ovumia maintains separate privacy policies for patient data and customer data. With regard to the processing of customer data, Ovumia’s privacy policy on customer data can be found here www.ovumia.fi/en/privacy-policy/.
In this privacy policy, the natural person whose patient or other personal data is processed is referred to as the patient or data subject in accordance with data protection legislation.
4. THE GROUNDS FOR KEEPING THE REGISTER AND THE PURPOSES FOR WHICH PERSONAL DATA IS PROCESSED
The processing of patient data is based on law (the Data Protection Act (1050/2018), the Act on the Status and Rights of Patients (785/1992), the regulation on patient documents (94/2022), the Medical Research Act (488/1999), the act on the secondary use of health and social data (552/2019), the Act on Assisted Fertility Treatments (1237/2006) and the Act on the Medical Use of Human Organs, Tissues and Cells (101/2001) or the patient’s consent. The processing complies with the European Union General Data Protection Regulation (2016/679; “GDPR” for short). The Customer Data Act (703/2023) will also apply from 1 January 2024. The patient register has been created for the use of Ovumia Oy. The register enables Ovumia Oy to perform its tasks in the examination and treatment of patients and in ensuring the traceability of gametes as required by the Act on Assisted Fertility Treatments and the Act on the Medical Use of Human Organs, Tissues and Cells.
The patient register is used for the purposes of
– organising the examination and treatment of patients, planning, implementing and monitoring patient care
– ensuring the safety and traceability of donated and patient-derived gametes
– invoicing for patient treatment and examinations
– patient management
– utilising patient data for statistical and monitoring purposes and for developing the quality of operations and services, regulatory supervision and data management of Ovumia Oy’s operations
– monitoring activities and settlement of any claims for compensation
– possible use of patient data for scientific research purposes, subject to specific agreements
– other possible uses in accordance with the law and consent
5. CONTENT OF THE REGISTER
The patient register consists of medical records and technical records containing personal data necessary for the identification of the person (name, date of birth, personal identification number, municipality of residence and contact details, next of kin), data necessary for the treatment of infertility or other Ovumia services related to the treatment of the other party of a couple (if applicable), as well as data generated or received in connection with the patient’s treatment and the organisation of treatment.
The patient register also contains information on any disclosures and the grounds for such disclosures.
Information on the healthcare staff involved in the patient’s care and the patient’s appointment details are stored in the patient register.
The patient register also records the patient’s declarations of consent and refusals of consent concerning the disclosure of their patient data.
The data content of the patient register also includes, among other things:
– data recorded by psychologists and psychotherapists, to which only the psychologist or psychotherapist concerned has access, unless otherwise agreed with the patient; for persons undergoing infertility treatment, data on semen samples, oocytes collected during treatment and the number and quality of embryos, the number and quality of embryos transferred to the uterus and transferred to storage, pregnancies that have started, miscarriages, abortions, birth records and the health of children born; data in the medical record
– data contained in the ultrasound imaging system
6. REGULAR SOURCES OF INFORMATION
Patient management information is collected from the patient or their relatives.
Data on medical treatment is collected from the information generated by examinations and treatments carried out in Ovumia Oy’s clinics and, with the patient’s consent, from other care units and the patient’s relatives.
With the patient’s consent, data can also be obtained from other health care services or professionals, for example through the Kanta digital services for the social welfare and healthcare sector.
Data related to outsourcing contracts is collected separately on the basis of these contracts.
7. RETENTION PERIOD
The retention periods for personal data stored in the patient register are governed by the current regulations on the retention periods of patient data.
The storage period for medical records is laid down in the Ministry of Social Affairs and Health regulation on patient documents (94/2022). As a general rule, the retention period is at least 12 years after the death of the patient or 120 years after the birth of the patient.
8. DISCLOSURE OF DATA
Patient data is confidential, and Ovumia Oy’s staff are bound by confidentiality obligations with regard to all information obtained in connection with the patient’s treatment. Patient information may be disclosed outside Ovumia only with the patient’s written consent or as expressly permitted by law.
Prescription centre of the Social Insurance Institution of Finland (Kela)
The patient’s electronic prescriptions are stored in the prescription centre of the Social Insurance Institution of Finland (Kela). The controller is Kela, www.kanta.fi.
Kanta archives
Ovumia has joined the Kanta archive, where patient records are stored. The patient can manage this information through the MyKanta system.
If the patient has given consent to the use of the patient data stored in the Kanta services, different service providers can use the data in their care of the patient. Without a release authorisation, the data can only be used by the healthcare provider who recorded it. You can give your consent in MyKanta or when you visit a health centre. The transfer is valid until further notice. You can withdraw your consent at any time, either in MyKanta or at the health service. If consent is withdrawn, data will no longer be transferred from the Kanta services to other service providers. It is also possible to limit the scope of the consent to transfer by setting separate prohibitions.
National health care registers
Data from Ovumia Oy’s patient register is disclosed annually to the national register of fertility treatment of the Finnish Institute for Health and Welfare for research, planning and statistical purposes, as required by law, without the possibility of identifying individuals.
9. TRANSFER OF DATA OUTSIDE THE EU OR EEA
Ovumia aims to keep patient and other personal data within the European Economic Area (EEA) and the European Union (EU). However, personal data may be transferred outside the EU or EEA, if necessary, in accordance with data protection legislation. If data is transferred outside the EU or EEA, Ovumia will ensure an adequate level of protection of personal data by, amongst other means, agreeing on matters related to the processing of personal data as required by data protection legislation, such as using standard contractual clauses adopted by the European Commission or based on an adequacy finding by the European Commission.
We will provide further information on transfers of personal data upon request.
10. PRINCIPLES OF REGISTER PROTECTION
Patient data is covered by confidentiality rules. Patient data must not be disclosed to third parties without the patient’s consent.
Patient data may only be used for the treatment of the patient concerned or for related tasks. Ovumia personnel can access company computers with a personal username and associated password. Ovumia’s senior management decides on organisational arrangements and grants employees access to patient record data to the extent required by their work duties and by regulations.
The computers are located on the company’s premises in locked rooms protected by an alarm system, to which only company staff have access.
Non-electronically stored (manual) confidential medical records are kept on the company’s premises in locked, alarmed rooms to which only company personnel have access.
The use of patient data is monitored by tracking logs.
11. THE DATA SUBJECT’S RIGHT OF ACCESS
Patients have the right to view and check their medical records. The right of inspection may be refused on the grounds laid down by law. The information requested is provided by the physician or other health professional designated by the healthcare service, who makes an entry in the patient’s medical record indicating that the right of inspection has been exercised. The information is given to the patient in writing. In principle, the right of inspection is free of charge.
Patients also have the right to check the log of the processing of their medical records. Inspection once a year is free of charge. The logs show who has processed the data, the time of processing, and the reason for the processing. Please contact Ovumia if you wish to check your log information.
The logs for the national patient record database are available in the kanta.fi web service.
12. RECTIFICATION, DELETION AND RESTRICTION OF PERSONAL DATA
The controller, i.e. Ovumia, must, without undue delay, on its own initiative or at the patient’s request, correct, delete or complete any personal data in the patient’s file that is inaccurate, unnecessary, incomplete or outdated in relation to the purpose of the processing (purpose of the patient file).
The data subject, i.e. the patient, also has the right to require Ovumia, as the controller, to restrict the processing of the data subject’s personal data, for example when the data subject is waiting for a response to a request for rectification or erasure of their data.
13. Any incorrect entries will be corrected in such a way that the original and corrected entries are subsequently legible. The name, position, date and reason for the correction must be entered in the medical records. If data that is unnecessary for treatment is deleted, the medical records will be annotated with the correction, the person who made the correction and the date of the deletion in accordance with the regulation on patient documents (94/2022). PATIENT ADVOCATE (formerly the Patient Ombudsman)
Information on patient advocates can be found on the websites of the respective wellbeing services counties. From 1 January 2024, the role of patient advocates has changed and will be organised entirely as a public service.
14. THE DATA SUBJECT’S RIGHT TO LODGE A COMPLAINT WITH A SUPERVISORY AUTHORITY
The data subject, i.e. the patient, has the right to lodge a complaint with the competent supervisory authority if Ovumia, as the controller, has not complied with the applicable data protection legislation.