"Medical Center Vision and Hearing" Ltd. is a company registered under the laws of the Republic of Bulgaria and entered in the Commercial Register and the Registry of Legal Entities at the Registry Agency with UIC 207208237, with registered office and management address: Sofia, Lozenets district, 1A Plachkovitsa Street, represented by the manager Polina Vancheva Marinova, telephone: 0884 46 11 33 e-mail: office@zrenieisluh.com and website: https://zrenieisluh.com/, listed below. abbreviation MC Vision and Hearing

"Medical Center Vision and Hearing" Ltd. operates as a medical institution, providing specialized outpatient medical care and medical expertise within the meaning of the Medical Institutions Act and the Health Act.

MC Vision and Hearing is is a personal data controller pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the “Regulations”), Personal Data Protection Act ("PDPA") and other applicable legislation in the field of personal data protection and this policy is fully consistent with them.

As the controller of a special category of data for the purposes of medical diagnosis/expertise and on the basis of Article 37(1)(c), subjects may contact the designated data protection officer by email: office@zrenieisluh.com , as well as at the registered address of the administrator: Sofia, Lozenets district, 1A Plachkovitsa Street.

I. POLICY OBJECTIVES AND SCOPE

• Article 1 This Privacy and Personal Data Protection Policy aims to provide you with comprehensive information in clear and accessible language about:
• Who is the administrator of your personal data?
• Which individuals' personal data is processed by the company?
• For what purposes and on what legal basis are personal data processed?
• To whom is personal data transferred or disclosed?
• The periods for storing personal data;
• Measures to ensure data security;
• The rights of individuals and the manner of their exercise.

II. TERMS AND DEFINITIONS USED

• Article 2 For the purposes of this Policy:
• Personal data administrator – a natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data. For the patients of the Vision and Hearing Center, the personal data controller is "Medical Center Vision and Hearing" Ltd. is a company registered under the laws of the Republic of Bulgaria and entered in the Commercial Register and the Register of Legal Entities at the Registry Agency with UIC 207208237, with its registered office and management address: Sofia, Lozenets district, 1A Plachkovitsa Str., represented by the manager Polina Vancheva Marinova. For patients who have purchased a hearing aid, the administrator of their data will also be “ZRENIE I SLUH” EOOD, UIC 206933663, with its registered office and management address: Sofia 1164, Lozenets district, 1A Plachkovitsa Str., tel.: +359 884 46 11 33, email address: contact@zrenieisluh.com, represented by Stanimir Evgeniev Tomov – manager, which is the company selling the devices;
• Personal data is any information relating to an identified or identifiable natural person / "data subject"; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
• Processing of personal data is any operation or set of operations which is performed upon personal data or upon sets of personal data, whether or not by automatic means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;
• Subject consent data subject means any freely given, specific, informed and unambiguous indication of the data subject's wishes, by which he or she, by a statement or by a clear affirmative action, signifies agreement to personal data relating to him or her being processed;4. Personal data administrator is a natural or legal person, public authority, agency or other body which alone or jointly with others determines the purposes and means of the processing of personal data;
• Personal data processor is a natural or legal person, public authority, agency or other body that processes personal data on behalf of MC Sight and Hearing;
• Recipient is a natural or legal person, public authority, agency or other body to whom the personal data are disclosed, whether a third party or not, where a third party is a controller or processor of personal data and persons who, under the direct authority of the controller or processor of personal data, are authorised to process the personal data;
• Health data are personal data related to the physical and mental health of an individual, including the provision of health services that provide information about their health status.

III. PERSONAL DATA PROCESSED IN "SCIENCE AND HEARING CENTER"

• Article 3 (1) "MC Vision and Hearing" as a personal data controller processes categories of personal data structured in registers maintained by a data protection officer in accordance with the requirements of the General Data Protection Regulation.

(2) MC Sight and Hearing processes personal data of the following entities:

1. Patients, and when necessary – their relatives;
2. Personnel – current and former employees of the company, job applicants, as well as trainees;
3. Visitors to the medical facility;
4. Counterparties or potential counterparties of the company and their employees.

• Article 4 The categories of personal data processed by the "Sight and Hearing Center" are data related to:

1. physical identity – name, personal identification number, address, telephone, e-mail, and others such as age, height, weight, as well as in certain cases an identification insurance number, and in the case of hospital care and the address of relatives;
2. physiological identity – blood type, blood count, plasma, ECG, as well as others related to the functions of the human body and requested and/or necessary for the subject to provide the health service;
3. genetic identity – DNA, chromosomes and/or others related to the provision of a healthcare service;
4. cultural identity – hobbies and/or other data related to lifestyle and the specific disease necessary for diagnosis;
5. social identity – education, habits, work activity, citizenship, place of work, profession/position, as well as in certain cases category of work;
6. family identity, marital status, kinship ties, etc.;
7. personal data relating to health;
8. others related to identifying risk factors in the environment and necessary for the purposes of providing a health service, medical history identification number, and others.

IV. PROCESSING OF PERSONAL DATA

• Article 5 As a personal data controller, MC Vision and Hearing processes personal data through a set of operations that can be performed on personal data by automatic or other non-automatic means, such as collection, recording, organization, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination, making available, updating or combining, blocking, erasure and destruction, in compliance with the following principles:

1. legality, good faith and transparency;
2. appropriateness of the processing of personal data;
3. proportionality and data minimization;
4. accuracy/up-to-dateness of the processed personal data;
5. storage restriction;
6. integrity and confidentiality of the processed personal data.

• Article 6 MC Vision and Hearing processes personal data independently or by assigning it to data processors, determining the purposes and scope of the obligations assigned by the controller to the data processor, in the presence of a relevant legal basis, in accordance with the requirements of the General Data Protection Regulation.

1. PURPOSE OF PROCESSING PERSONAL DATA

• Article 7 (1) The purpose of processing personal data is to uniquely identify individuals, current and future patients of the "MC Vision and Hearing" for healthcare purposes.

(2) Data processing is most often a consequence of the execution of statutory obligations of the personal data administrator arising from the specifics of the requirements of the legislation, including filling in the data required according to the approved templates for the provision of healthcare services, as well as those related to financial and accounting activities, pension, health and social security activities, human resources management activities, health policies, pandemic risk, insurance.

(3) In rare cases, it is possible to process the personal data of the subjects for the purposes of legitimate interests; such processing could be necessary to establish the objective truth related to establishing the professional responsibility of the medical personnel employed at the "MC Vision and Hearing" and/or other administrative or civil responsibility of the Administrator.

(4) The Administrator does not engage in automated decision-making, including profiling within the meaning of Article 22 of the General Data Protection Regulation.

• Article 8 (1) Depending on the specific health service requested, "MC Vision and Hearing" processes the personal data of the subjects - its patients under the conditions of various grounds, pursuant to Art. 9, paragraph 2 of the General Data Protection Regulation, but mainly for the purposes of preventive medicine and medical diagnosis, the provision of health care or treatment, as well as for the purposes of managing health care services and systems.

(2) Personal data are processed by or under the supervision of professional workers who are bound by the obligation of confidentiality under the power and meaning of the Health Act and the rules established by the competent state authorities.

• Article 9 When personal data are processed for purposes other than those specified in this policy, outside of cases of consent or statutory basis, the Administrator should ensure that the processing for other purposes is compatible with the original purpose, taking into account:

1. The relationships between goals;
2. The context/ground on which the personal data was collected;
3. The nature/character of the data;
4. Possible consequences of the intended further processing for the data subject;
5. Availability of appropriate guarantees.

VI. PERIOD FOR PROCESSING PERSONAL DATA

• Article 10 (1) "MC Vision and Hearing" processes personal data from accounting and tax documentation for a period of up to 50 years, taking a differentiated approach to the individual types of documents, namely:

a) personal data, part of documents related to payrolls, are processed for 50 years in accordance with the Accountancy Act;

b) personal data, part of accounting registers and financial statements, including documents for tax control, audit and subsequent financial inspections – 10 years, starting from January 1 of the reporting period following the reporting period to which they relate;

c) all other carriers of accounting information – three years, starting from January 1 of the reporting period following the reporting period to which they relate;

d) personal data, part of documents for tax and social security control – 5 years after the expiration of the limitation period for repayment of the public obligation to which they are related;

e) all other documents – 5 years.

(2) Personal data, part of medical documents, in accordance with the Health Act, the Ordinance on Medical Expertise, Ordinance No. 8 on Professional Examinations and Medical Check-ups and Ordinance No. 1 on the Provision of Medical and Statistical Information and Information on the Medical Activities of Medical Institutions, as well as other relevant subordinate regulations of the Ministry of Health and the Council of Ministers:

a) personal data, part of medical history documentation – up to 25 years;

b) personal data, part of documentation for epicrisis reports and other related to hospital medical care – up to 10 years;

c) outpatient lists, sick lists, including canceled ones, as well as expert decisions on occupational diseases - up to 10 years, if necessary to monitor the disease;

d) others - up to 5 years.

(3) Personal data, part of other documentation outside the previous paragraphs – up to 5 years, in connection with the general statute of limitations under the Obligations and Contracts Act.

(4) Video surveillance recordings, recordings of conversations in the "registrar's office" and visitor registers are stored for a period of 60 (sixty) days in accordance with the Private Security Activities Act.

VII. CONSEQUENCES OF REFUSAL TO PROVIDE PERSONAL DATA

• Article 11 Explicit consent of the individuals whose data is being processed is not always necessary if the Administrator has another legal basis for processing personal data - for example, a statutory obligation in connection with the Health Act or a contractual basis for processing personal data - a service requested by the patient.

(2) The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

(3) Informed consent within the meaning of the Health Act does not constitute consent within the meaning of the General Data Protection Regulation.

• Article 12 In case of refusal to voluntarily provide the requested personal data, "MC Vision and Hearing" will not be able to provide its services.

VIII. DISCLOSURE OF PERSONAL DATA

• Article 13 (1) "MC Vision and Hearing", as a personal data administrator, has the right to disclose the processed personal data only to the following exhaustively listed categories of recipients:

1. individuals to whom the data relates;
2. persons for whom the right of access is provided for in a regulatory act
3. to persons to protect the life and health of the natural person to whom the data relates;
4. persons for whom the right arises under a contract, including co-administrators and processors of personal data.

(2) The MC does not transfer and does not intend to transfer the personal data of its patients to a third country or an international organization. In the event that a patient has made an explicit request, the MC Vision and Hearing may transfer personal data to third countries. In these cases, in order to protect the rights and interests of the patient, he is asked for his explicit prior consent for the transfer of data.

• Article 14 Art. 16. The processed personal data of patients of the "MC Vision and Hearing" may be provided to other commercial companies - personal data administrators, under the conditions of Art. 13, b. "d", in connection with the performance of specific tasks jointly or upon instruction and on behalf of the "MC Vision and Hearing" - under the conditions of joint administration or in compliance with the minimum requirements for agreement and control of personal data processors (for example: specialized health service, purchase of devices, maintenance of archives, etc.).

IX. RIGHTS OF DATA SUBJECTS

• Article 15 Data subjects whose personal data are processed have the following rights:

1. Right to information, concerning the data identifying the controller, its representative and the data protection officer, the purposes, grounds and duration of the processing of personal data, the recipients or categories of recipients to whom the data may be disclosed, the mandatory or voluntary nature of the provision of the data and the consequences of refusing to provide them, as well as the rights of data subjects and others pursuant to Art. 13 and Art. 14 of the General Data Protection Regulation;
2. Right of access to data concerning them – upon request, the data subject may receive information about the processing, his/her rights, as well as a copy of his/her personal data that is being processed. In cases where granting the right of access to the individual may disclose personal data about a third party, the controller is obliged to provide partial access to them without disclosing data about the third party;
3. Right to rectification of personal datathat are inaccurate or incomplete;
4. Right to erasure / right to be forgotten, when the personal data are no longer necessary for the purposes for which they were collected or processed; consent has been withdrawn, a ground for their lawful processing; processing is objected to pursuant to Art. 21 of the General Data Protection Regulation, the processing is unlawful and/or the erasure is for compliance with a legal obligation. The right to be forgotten does not apply when the Administrator complies with a legal obligation, performs a task of public interest or exercises official authority of the Administrator, as well as for reasons of public interest in the field of public health, archiving in the public interest, scientific or statistical purposes, as well as for the purposes of establishing, exercising or defending legal claims.
5. Right to restriction of processing – the right applies when the accuracy of the data is contested; the processing is unlawful, but the subject does not want them to be deleted by the Administrator, but only to restrict their use; the Administrator no longer needs them for the purposes of the processing, but the subject requires them for the establishment, exercise or defence of legal claims; there is an objection to the processing pursuant to Art. 21, paragraph 1 of the General Data Protection Regulation and a verification of the legitimate grounds and interests of the subject is expected. When this right is exercised, these data are processed, except in cases of their storage, on the basis of the consent of the subject or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural person or for important reasons of public interest.
6. Right to data portability – the right is exercised when the subject has provided his/her personal data in a structured, widely used and machine-readable format and accordingly has the right to transfer these data to another administrator without hindrance to “MC Vision and Hearing”. “MC Vision and Hearing” does not have such an established practice of collecting personal data. The Administrator does not have the technical ability / it is not technically feasible / to directly transfer the personal data of the subjects to another Administrator at the request of the subject.
7. Right to object to processing at any time to the administrator on grounds of public interest and/or official authority, as well as legitimate interests, including profiling based on these provisions, as well as for direct marketing purposes. Processing shall not be terminated if the Administrator has compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.
8. Right to protection– personal data subjects have the right to file a complaint, both before the data protection officer and the administrator, as well as before the CPDP and in court.

• Article 16 (1) MC Vision and Hearing shall communicate the fulfillment of any request of a patient, such as the right to rectification, erasure or restriction, to any recipient to whom the data has been disclosed, unless this is impossible or requires disproportionate effort.

(2) In connection with the implementation of para. 1, with this policy, the Administrator notifies the subjects that the data are disclosed to the recipients specified in Art. 28 of the Health Act, as they process the personal data on their own grounds for the purposes specified in the legal norm, regardless of the MC Vision and Hearing, in view of which the subject should exercise its rights also towards the specified recipients, in their capacity as separate administrators.

(3) Upon request, the Administrator shall inform the subject about these recipients.

X. PROCEDURE FOR EXERCISING RIGHTS

• Article 17 (1) Data subjects may submit a written application to the MC Vision and Hearing, in which they should indicate: name, address and other data for identifying the relevant individual, description of the request, preferred form for providing the information, signature, date of submission of the application and address for correspondence. When the request is submitted by a proxy, the power of attorney shall be attached to it.

(2) The request may be submitted to the Administrator's address or by email.

• Article 18 The period for considering the request and sending a written response to it is 14 days from the day of its submission, respectively - 30 days, when more time is needed to collect the requested data, in view of possible difficulties in the Administrator's activities.

• Article 19 MC Vision and Hearing may deny access to data when the data does not exist or its provision is prohibited by law.

• Article 20 In the event that the Administrator does not respond to the request for access to personal data within the stipulated time frame or the applicant is not satisfied with the response received and/or believes that his rights related to the protection of personal data have been violated, he has the right to exercise his right to protection by filing a complaint with the Personal Data Protection Commission.