Dubai Dental Service Limited Liability Company
Our policy is effective from February 21, 2026.
Dubai Dental Service Limited Liability Company provides high-quality care in the field of aesthetic and cosmetic dentistry and implantation, offering a wide range of treatments. We operate as a private provider, not financed by the National Health Insurance Fund. In our clinic, we not only aim to guarantee high-quality care by using the most modern diagnostic and treatment procedures and equipment, but we also want to assure our patients that their data will receive the highest level of protection. Our dental clinic wishes to inform patients about the facts relating to data processing, in particular the purpose, legal basis and duration of data processing, by means of this data processing information sheet before commencing data processing. The information contained in the Data Processing Notice also covers the rights and legal remedies of our patients and other individuals who use our services (i.e., patients and their relatives, if their data is also provided, e.g., in the case of minors) in relation to our data processing activities. We would like to inform you that Dubai Dental Service Limited Liability Company, the service provider, is considered a Data Controller under current regulations. As a Data Controller, we must strive for lawfulness and fairness in the processing of personal data. We must process your data in a way that is transparent to you, and you must be aware at every point of data processing how we collect your personal data, where and how we use it, and how and for how long we process your data and whether we transfer it to anyone.
The principles of fairness and transparency require that you be informed about the circumstances of data processing, so we would like to share Dubai Dental Service Limited Liability Company's data protection and data processing practices with you in this notice. The healthcare-related data of our patients (data subjects) who use our services is stored in the patient documentation software provided by Dubai Dental Service Limited Liability Company. The principles and practical solutions set out in this data processing notice govern the processing of their data. Your data protection questions will be handled at the contact details specified in this notice.
DATA CONTROLLER'S DETAILS
Details of Dubai Dental Service Limited Liability Company:
Dubai Dental Service Limited Liability Company
Clinic:
1028 Budapest, Hidegkúti út 237.
Company registration number: 01-09-397064
Tax number: 27764495-2-43
Registered office: 1201 Budapest, Erkel Ferenc utca 5. 1.
Managing Director: Márta Bognár
Contact details of data protection officer: iroda@drweidinger.hu
Name of data protection officer: Dr. Kinga Weidinger
When drafting the provisions of this Notice, particular attention was paid to the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council (the "General Data Protection Regulation" or "GDPR"), Act CXII of 2011 on the right to self-determination in relation to information and freedom of information ("Infotv.") and the "special" sectoral regulations on the processing of health data.
DEFINITIONS
(1) Personal data: Any data or information on the basis of which a natural person ("Data Subject") can be identified, either directly or indirectly.
(2) Data subject: Any natural person who is identified or can be identified, directly or indirectly, on the basis of specific personal data.
(3) Consent of the Data Subject: A specific act of will by the data subject (unambiguous and clear), based on specific and adequate information, whereby he or she gives his or her consent to the processing of personal data relating to him or her.
(4) Health data: Personal data relating to the physical or mental health of a natural person, including data relating to health services provided to a natural person, which contain information about the health status of that natural person.
(5) Data breach: A breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored or otherwise processed.
(6) Medical confidentiality: health and personal identification data that come to the attention of the Data Controller during medical treatment, as well as other data relating to necessary or ongoing or completed medical treatment and other data learned in connection with medical treatment.
(7) Medical documentation: records, registers or any other data recorded in any form, regardless of its medium or format, containing health and personal identification data that come to the knowledge of the healthcare provider during medical treatment.
(8) Treating physician: the physician who treats or participates in the treatment of the data subject.
(9) Consent of the data subject: A specific act (unambiguous and clear) of the data subject's free will, based on specific and adequate information, whereby he or she gives his or her consent to the processing of personal data concerning him or her.
(10) Healthcare Provider: Dubai Dental Service Limited Liability Company. The clinic where you receive healthcare, where the patient is examined and treated.
(11) Data Processing: Any operation or set of operations performed on personal data, regardless of the procedure used, in particular the collection, recording, organization, structuring, storage, adaptation, alteration, use, retrieval, consultation, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction of personal data.
(12) Data controller: The person who determines the purposes and means of data processing, either alone or jointly with others.
(13) Data processor: A natural or legal person who processes personal data on behalf of and on the instructions of the data controller.
(14) Data processing: Data processors do not make independent decisions, but are only entitled to act in accordance with the contract concluded with the data controllers and the instructions received.
(15) Recipient: The natural or legal person to whom personal data is disclosed.
(16) Restriction of processing: Marking stored personal data for the purpose of restricting its future processing.
(17) Close relative: spouse, direct relative, adopted child, stepchild, foster child, adoptive parent, stepparent, foster parent, and sibling.
(18) Relative: close relative, partner, spouse of a direct relative, direct relative and sibling of a spouse, and spouse of a sibling.
WHAT DATA DO WE PROCESS?
Patients voluntarily visit the private practice of Dubai Dental Service Limited Liability Company and choose the care they wish to receive. In the event that the person being treated voluntarily visits our Dental Clinic, their consent to the processing of their health and personal identification data related to the treatment shall be deemed to have been given, unless they state otherwise. At our dental clinic, we collect natural identification data from the data subject. Our employees examine the documents solely for the purpose of verifying the accuracy of the data, but do not make copies of them, unless a modified contract is accepted.
1. Processing of data related to healthcare
Purpose of the planned processing of personal data: The purpose of data processing is to promote the preservation, improvement, and maintenance of health, to facilitate effective medical treatment, including professional supervision. Another purpose is to monitor the health status of the Data Subject and to enforce patient rights.
Legal basis for data processing: Legal obligation (Act CLIV of 1997 on healthcare; Act LXXXIII of 1997 on compulsory health insurance benefits).
Categories of data subjects: Anyone who uses our services.
Personal data processed: Data necessary for identification and care: name, birth name, social security number (if a prescription is required), address, place and date of birth, data related to care, photographs and videos, if required for care and planning, but these are treated as part of the medical documentation.
Recipient: (in some cases) Electronic Health Service Space (EESZT), National Health Insurance Fund Administration (NEAK).
Data processor: iStoma and FelxiDent
Storage location: Some of our documentation is created on paper, while other parts are created electronically.
Planned duration of data processing: For the period specified in the referenced legislation, i.e. 30 years from the date of data collection, 50 years in the case of final reports, and 10 years in the case of diagnostic imaging records.
Failure to process data: We will be unable to provide care.
2. Data processing related to the preparation of a treatment plan
Purpose of the planned processing of personal data: To inform patients about their treatment based on preliminary examinations, X-rays, and model evaluations. The treatment plan includes the costs incurred and any possible side effects. The completed documentation is part of the healthcare specified in point 1, and we process the data as part of that.
Legal basis for data processing: Contractual legal basis.
Categories of data subjects: Patients initiating the use of healthcare services.
Data processor: iStoma and FelxiDent
Planned duration of data processing: 30 years from the date of data collection, 50 years in the case of final reports, and 10 years in the case of diagnostic imaging records. If treatment does not commence, we will store the treatment plan for the same period as the care documentation, as documentation of the healthcare services on which the treatment plan is based, or as an appendix thereto.
3. Processing of data related to images used for publication purposes in connection with healthcare
Purpose of the planned processing of personal data: We would like to use photo/video documentation to follow and document the treatment process and show you the results achieved and the changes that have taken place compared to the initial condition. The photo and video documentation is provided to Dubai Dental Service Limited Liability Company so that it can present the photos thus created at scientific lectures, as well as on the dental clinic's website and social media platforms. The published photo/video documentation serves as a "before and after" case study to help visitors to the website learn about the special and spectacular treatments performed at the Dubai Dental Service Limited Liability Company Clinic.
Legal basis for data processing: Your consent as a patient, which you give us in writing in the form of a statement when you register.
Categories of data subjects: Patients receiving treatment.
Personal data processed: Name, photos/videos of care, date of treatments
Planned duration of data processing: as part of the medical documentation, for the same period of time.
4. Inquiry and registration
Purpose of the planned processing of personal data: Data related to registration is processed when our patients make an appointment at our clinic. You can register for our services by phone, email, contact form, or in person. We only record telephone conversations with your consent.
Legal basis for data processing: Contractual legal basis.
Categories of data subjects: Patients initiating the use of healthcare services.
Personal data processed: Name, telephone number, email address, selected care, appointment time. We process your telephone number and email address to facilitate communication.
Data processor: iStoma and FelxiDent
Storage location: In documentation software, in our calendar.
Planned duration of data processing: We destroy paper records of appointments after the end of the financial year, but we also delete them at the request of the data subject.
Please note that if you provide the data of a relative or other person (as a third party), you are required to ensure that you have the consent of the third party! We are not in a position to verify this! If you are booking an appointment for your minor child as a parent/guardian, you must obtain consent for the processing of your child's data.
5. Processing of data related to filling out contact forms on the website
Purpose of the planned processing of personal data: You can contact the Dubai Dental Service Limited Liability Company's clinic and send a message via the website www.zeeddentclinicbudapest.hu. Sending inquiries or informational materials prior to healthcare provision.
Legal basis for data processing: your consent as a patient.
Categories of data subjects: persons who send messages to our dental clinic via the website.
Personal data processed: name, email address, telephone number.
Planned duration of data processing: We destroy electronic inquiries once a year, but we also delete them at the request of the data subject.
6. Processing of data related to invoices
Purpose of the planned processing of personal data: After providing private treatment, the Dental Clinic issues an invoice, so we will continue to process your billing data. At our Dental Clinic, you can pay in cash, by bank card, or by bank transfer. Financial settlement, receipt system.
Legal basis for data processing: Legal obligation (Act C of 2000 on Accounting; Act CXXVII of 2007 on Value Added Tax; Decree 23/2014 NGM on the tax identification of invoices and receipts, and the tax authority inspection of invoices stored in electronic form).
Categories of data subjects: All data subjects in whose name an invoice has been issued.
Personal data processed: Name and billing address of the invoice payer, in some cases Health Fund Membership ID, type of care, total amount.
Recipient of personal data: National Tax and Customs Administration; in the case of Health Fund membership, the contracted Health Fund as specified in the contract.
Data processor: Our accounting partner: Tax-Band Kft. (1023, Budapest, Bécsi út. 3.-5.)
Storage location: Current account books are stored in a locked cabinet at the Data Controller's office and at the accounting firm's office, in the iStoma and FelxiDent dental software, and in the szamlazz.hu system.
Planned duration of data processing: 8+1 years, in accordance with Act C of 2000 on Accounting and Act CXXVII of 2007 on Value Added Tax.
Please note that if you display the data of a relative or other person (as a third party), you are obliged to ensure that you have the consent of the third party! We are not in a position to verify this.
WHAT ARE YOUR RIGHTS?
The data subject has the right to receive information about the processing of data in connection with their treatment, to access their health and personal identification data, to inspect their medical records, and to obtain copies of them at their own expense. In accordance with Act XLVII of 1997 on the processing and protection of health and related personal data, no substantive information about the patient's treatment may be provided over the phone. If necessary, health data may be sent by post in a sealed envelope, with a return receipt, or, at the patient's request, to the electronic address provided by them, in an encrypted electronic letter (e-mail). The healthcare provider has access to the medical records, and the patient has access to the data contained therein.
1. Information regarding the processing of personal data: this may include the data processed by the Data Controller, the source of the data, the purpose of data processing, the legal basis, the duration, the data of recipients in connection with any data transfers, and activities related to data processing.
2. You have the right to rectify your data: you can modify your registration data.
3. You may request the deletion of your data: you may request the deletion of your data processed by us at any time. You may not request the deletion of your data if the legal basis for data processing is based on a legal obligation. An example of such a legal basis for data processing is when you have received an invoice for a service as a private individual; we are required to retain this for the period specified by law and cannot delete it.
4. You can restrict data processing: You can request that we restrict the processing of your personal data if you dispute the accuracy of the personal data processed. In this case, the restriction applies for a period that allows the Data Controller to verify the accuracy of the personal data.
5. Right to data portability: In the case of automated data processing based on a contract or consent, you may request the portability of your data processed by us.
6. Right to object to data processing: The Data Subject has the right to object at any time, on grounds relating to his or her particular situation, to the processing of personal data necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Data Controller, or processing necessary for the purposes of the legitimate interests pursued by the Data Controller or a third party, including profiling based on those provisions. In this case, the Data Controller may no longer process the personal data unless the Data Controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defense of legal claims.
Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing, which includes profiling to the extent that it is related to such direct marketing. If the data subject objects to the processing of personal data for direct marketing purposes, the personal data shall no longer be processed for such purposes.
HOW DO WE PROCESS DATA PROTECTION REQUESTS AND COMPLAINTS?
1. If Dubai Dental Service Limited Liability Company receives a request at its office, we will inform you in writing as soon as possible, but no later than within 30 days, of the measures taken in response to the request. If justified by the complexity of the request or other objective circumstances, the above deadline may be extended once, by a maximum of 60 days. We will notify you in writing of the extension of the deadline, together with the relevant justification for the extension.
2. The first notification is provided free of charge, unless:
-
the Patient repeatedly requests information or action on essentially the same subject matter;
-
the request is clearly unfounded;
-
the request is excessive.
3. If the applicant requests the transfer of data on paper or electronic media (CD or DVD), the Data Controller shall provide a copy of the data concerned free of charge in the manner requested (unless the chosen platform would pose a disproportionate technical difficulty). An administrative fee may be charged for each additional copy requested, of which the applicant will be informed in advance.
4. Dubai Dental Service Limited Liability Company will respond to the request in electronic form, unless:
-
the Data Subject expressly requests a different form of response and this does not cause unreasonably high additional costs for our Dental Clinic;
-
our Dental Clinic does not know the electronic contact details of the Data Subject.
If you have not been able to satisfactorily resolve your objection, complaint or request regarding your personal data, or if you believe at any time that your personal data has been infringed or is at immediate risk of infringement, you are entitled to file a report with the National Authority for Data Protection and Freedom of Information. You can submit your complaint regarding data processing directly to the National Authority for Data Protection and Freedom of Information:
National Authority for Data Protection and Freedom of Information
Headquarters: 1055 Budapest, Falk Miksa utca 9-11.
Postal address: 1363 Budapest, Pf.: 9.
Phone: +36 (1)391-1400
Email ugyfelszolgalat@naih.hu
If Dubai Dental Service Limited Liability Company receives an official request from the competent authorities, it is obliged to disclose the specified personal data. We only disclose data that is strictly necessary to achieve the purpose specified by the requesting authority.
HOW DO WE PROTECT YOUR DATA, WHAT DATA SECURITY MEASURES DO WE HAVE IN PLACE?
The data processed by Dubai Dental Service Limited Liability Company is stored in paper and electronic form at its premises and headquarters. In order to protect electronically processed data, we use solutions that provide an appropriate level of security in accordance with the current state of technology. During the compliance review, particular emphasis is placed on the level of risk arising from data processing at our dental clinic.
Our clinic does everything in its power to ensure the security of the data of patients using our services, and also takes the necessary technical and organizational measures and establishes the procedural rules necessary to enforce the Regulation and other data protection and confidentiality rules. Only employees of our dental clinic with express authorization may access the data stored in our dental clinic's database, to the extent of their access levels. We ensure that the data recorded, stored, and processed is protected, and we prevent its accidental loss, unlawful destruction, unauthorized access, unauthorized use, unauthorized alteration, and unauthorized dissemination. In order to fulfill this obligation, our Dental Clinic calls on all third parties to whom personal data is transferred.
Our IT system is protected by a firewall against unauthorized access.
As Data Controllers and, where applicable, Data Processors, we ensure protection against fraud, espionage, viruses, intrusions, vandalism, and natural disasters targeting our IT systems at all times. The Dental Clinic, as Data Controller, and our Data Processors also use server-level and application-level security procedures. Our Data Processors assure our Dental Clinic of these security procedures in a statement or agreement.
The Data Controller and Data Processors transfer the personal data of Data Subjects and all documents containing such data to each other in a secure manner, i.e. via an SFTP server.
The devices used to store data are password-protected, and access levels are strictly regulated in accordance with our policies.
The website uses SSL encryption.
For paper-based documents, we use closed storage to prevent unauthorized access. Access to paper-based documents is controlled by our Dental Clinic's built-in authorization levels.
The Data Controller guarantees that all persons handling the personal data of the Data Subject will be instructed to comply with all applicable data protection laws and will sign a confidentiality agreement.
Messages sent to our dental clinic via the internet, in any form, are particularly vulnerable to network threats that could lead to the modification of information, unauthorized access, or other illegal activities. However, Dubai Dental Service Limited Liability Company does everything that is reasonably possible and expected of it, according to the current state of technology, to avert such dangers. To this end, the systems used are monitored to record security deviations, obtain evidence of security incidents, and assess the effectiveness of precautions.
We have an information security policy that also covers the processing of personal data.
WHAT HAPPENS IN THE EVENT OF A DATA PROTECTION INCIDENT AT ?
In the event of a data protection incident, Dubai Dental Service Limited Liability Company will, without undue delay, but no later than 72 hours after becoming aware of the incident, unless the data breach is unlikely to result in a risk to the rights and freedoms of natural persons.
If the data breach is likely to pose a high risk to the rights and freedoms of natural persons, our Private Practice shall inform you, the Data Subject (Patient), of the data breach without undue delay and take the measures specified in the internal regulations.
If Dubai Dental Services Limited receives an official request from the competent authorities, it is required by law to disclose certain personal data. We only disclose data that is strictly necessary to achieve the purpose specified by the requesting authority.
GOVERNING LAW
(1) Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation; hereinafter: "GDPR")
(2) Act LXXXVIII of 2014 on insurance activities
(3) Act V of 2013 on the Civil Code
(4) Act CXII of 2011 on the right to self-determination in relation to information and freedom of information
(5) Act CXXVII of 2007 on Value Added Tax
(6) Act C of 2000 on Accounting
(7) Act CLIV of 1997 on Health Care
(8) Act LXXXIII of 1997 on compulsory health insurance benefits
(9) Act XLVII of 1997 on the processing and protection of health and related personal data
(10) Decree 23/2014 of the Ministry of National Economy on the tax identification of invoices and receipts and the inspection of invoices stored in electronic form by the tax authorities
(11) Decree 62/1997. (XII. 21.) NM on certain issues concerning the processing of health and related personal data
USE OF DATA PROCESSORS
The Data Processor uses additional data processors in the course of its activities, a list of which is available on the website under the "Our Sub-processors" menu item. The list may change depending on contracts concluded or to be concluded by the Data Controller in the future.
Dubai Dental Service Limited Liability Company reserves the right to modify or update this Notice at any time without prior notice and to publish the updated version. Any changes will only apply to personal data collected after the publication of the modified version.
Please check our Notice regularly to keep track of any changes and to find out how they affect you.
Dubai Dental Service Limited Liability Company