PRIVACY POLICY & GDPR

Last Updated: August 15, 2026

1. Data Controller & Scope

Viva Medical ("the Company", "we", "us", "our"), operating as a Data Controller in accordance with the General Data Protection Regulation (EU 2016/679 - "GDPR") and applicable data protection laws, is dedicated to maintaining the highest standards of data security, confidentiality, and integrity.

2. Categories of Data We Process

In providing our home healthcare and medical services, we collect only strictly necessary data:

• Identity & Contact Information: Full name, telephone number, email address, and residential address for home health visits, provided directly via our contact form or phone correspondence.
• Special Categories of Data (Health Data - Article 9 GDPR): Medical history, diagnoses, medication details, and specific care instructions. These are processed exclusively by licensed healthcare professionals bound by medical secrecy.
• Technical & Browsing Data: IP address, device/browser details, operating system, and anonymous analytics collected via functional cookies.

3. Legal Bases & Purposes of Processing

We process personal and health data under the following legitimate grounds:

• Performance of Contract / Pre-contractual Steps (Art. 6(1)(b) GDPR): To respond to inquiries and coordinate tailored in-home medical care.
• Provision of Healthcare & Medical Assessment (Art. 9(2)(h) GDPR): For administering medical treatments, nursing procedures, and healthcare management by certified personnel.
• Compliance with Legal Obligations (Art. 6(1)(c) GDPR): Mandatory health records archiving, billing, and regulatory compliance.
• Consent (Art. 6(1)(a) GDPR): For non-essential cookies and explicit communication opt-ins.

4. Data Security & Medical Confidentiality

We employ state-of-the-art technical and organizational measures (including SSL/TLS encryption, restricted access controls, and secure data backups) to prevent unauthorized access, loss, or disclosure. All medical staff and administrators are legally bound by strict confidentiality and professional secrecy obligations.

5. Data Retention

Contact inquiries are retained only for the duration required to handle the request. Patient medical records are retained in compliance with statutory medical archiving regulations (typically 10 to 20 years).

6. Cookie Policy

We use strictly necessary cookies to ensure correct website operation and remember your preferences (such as language and theme). No third-party profiling or advertising cookies are deployed without your prior explicit consent. Preferences can be updated at any time via our Cookie Banner.

7. Your Rights Under GDPR

Pursuant to Articles 15–22 of the GDPR, you have the right to:

• Right of Access: Obtain confirmation and copies of your personal data.
• Right to Rectification: Request correction of inaccurate information.
• Right to Erasure ("Right to be Forgotten"): Subject to statutory medical record retention laws.
• Right to Restriction of Processing & Right to Object.
• Right to Data Portability.
• Right to Lodge a Complaint: With the competent Data Protection Supervisory Authority.

8. Contact & Data Protection Inquiries

To exercise your rights or request further clarification regarding our data practices, please contact us via our contact page or email us directly.