Skip to content
Johanna Dental
HU / EN

Privacy Notice

Johanna Dental Kft. · Version 2.0 — effective from 14 November 2026

Contents

  1. The Controller
  2. Processing activities
  3. CCTV and call recording
  4. Recipients and processors
  5. Transfers outside the EEA
  6. Data security
  7. Your rights
  8. Remedies
  9. Final provisions

Johanna Dental Kft. (the “Controller”) is committed to protecting the personal data of its patients and website visitors. This notice has been prepared in accordance with Regulation (EU) 2016/679 (GDPR), Act CXII of 2011 on informational self-determination, Act CLIV of 1997 on Health Care and Act XLVII of 1997 on the processing of health data (Hungary).

1. The Controller

  • Name: Johanna Dental Kft.
  • Registered seat: Attila utca 105, 1039 Budapest, Hungary
  • Clinic: Hűvösvölgyi út 52, 1021 Budapest, Hungary
  • Company reg. no.: 01-09-287239
  • Tax no.: 25752704-2-41
  • E-mail: info@johannadental.com
  • Phone: +36-1-701-2900
  • Representative, privacy contact: Jenő Malita, managing director

The Controller is not required to appoint a data protection officer; privacy requests are handled by the contact person above.

2. Processing activities

Dental care and mandatory health records

  • Data processed: name, place and date of birth, mother’s name, address, social security (TAJ) number, phone, e-mail; medical history, dental status, treatment plan and notes, X-ray and clinical photographs
  • Legal basis: GDPR Art. 6(1)(c) and 9(2)(h); Hungarian Healthcare Acts
  • Retention: 30 years for health records, 50 years for discharge summaries, 10 years for diagnostic images (reports 30 years) – Act XLVII of 1997, s. 30

Appointments and contact

  • Data processed: name, phone, e-mail
  • Legal basis: GDPR Art. 6(1)(b) – performance of contract
  • Retention: for the duration of the patient relationship; data forming part of the health record for its retention period

Invoicing and accounting

  • Data processed: name, address, billing data
  • Legal basis: GDPR Art. 6(1)(c); Hungarian VAT and Accounting Acts
  • Retention: 8 years (Act C of 2000, s. 169)

Website contact / quote request form, enquiries from health professionals

  • Data processed: name, e-mail, phone, subject and content of the message, preferred way of reply (e-mail, phone, WhatsApp), whether you have a large CBCT scan to share, and the page you came from if you reached the form through a link; for an enquiry from a health professional also the purpose of the enquiry (discuss a question, arrange an assessment, coordinate care), the speciality or role, the name of the practice or organisation and the planned date; if you provide it: information about your health described in the message or sent in an attached file (for example an X-ray)
  • Legal basis: GDPR Art. 6(1)(b) – steps prior to entering into a contract; for health data Art. 9(2)(h)
  • Retention: 1 year after the enquiry is closed; if treatment follows, data that becomes part of the health record for its retention period
  • How it is sent: the message is forwarded to our e-mail address by Cloudflare's e-mail service and is not stored on the website.

Contact via WhatsApp

  • Data processed: phone number, the name and picture set in your WhatsApp profile, the content and time of the messages, photographs and documents you send
  • Legal basis: GDPR Art. 6(1)(b) – steps prior to entering into a contract and performance of contract; for health data Art. 9(2)(h)
  • Retention: 1 year after the matter is closed; data that becomes part of the health record (for example an X-ray) for its retention period

Remote pre-assessment; records of check-ups and care received elsewhere

  • Data processed: name, contact details; X-rays and CBCT scans, photographs, dated findings issued by another dentist and the invoice for that examination or care, sent by you by e-mail, WhatsApp or the website form
  • Legal basis: GDPR Art. 6(1)(b) – planning your treatment and evidencing the warranty conditions (Warranty Terms and Conditions, sections 8.5 and 9.2); for health data Art. 9(2)(h)
  • Retention: as part of the health record, for its retention period (Act XLVII of 1997, s. 30)

Warranty: warranty certificate, recording and assessing warranty claims

  • Data processed: name, contact details; the details of the warranted items (tooth number, item and material, for an implant the manufacturer and the batch (LOT) number, value of the item, invoice number, warranty start and end, check-up and cleaning interval, individual conditions); the notice of the failure, the examination record, photographs and X-rays, the decision and the chosen solution, credits
  • Legal basis: GDPR Art. 6(1)(b) – performance of the warranty; for the accounting records of credits Art. 6(1)(c); for health data Art. 9(2)(h) and (f)
  • Retention: 5 years after the end of the warranty period or after the last warranty claim is closed (Hungarian Civil Code, s. 6:22); data forming part of the health record (examination record, images) for its retention period; accounting records 8 years

Filing a manufacturer’s warranty claim

  • Data processed: the removed implant; the implant’s manufacturer, type and batch (LOT) number; the relevant dates (placement, failure); X-rays and photos; some health information (for example smoking, teeth grinding, diabetes); without your name: we use a code or your initials
  • Legal basis: GDPR Art. 6(1)(a) and 9(2)(a) – your prior explicit consent (Warranty Terms and Conditions, section 6.3)
  • Retention: with us, for the same period as the warranty claim record; with the manufacturer, under the manufacturer’s own data protection rules

Complaint handling

  • Data processed: name, contact details, the content of the complaint, the investigation file and our reply
  • Legal basis: GDPR Art. 6(1)(c) – Act CLIV of 1997 on Health Care, s. 29; for health data Art. 9(2)(h)
  • Retention: 5 years (Act CLIV of 1997, s. 29)

CCTV at the clinic

  • Data processed: video footage
  • Legal basis: GDPR Art. 6(1)(f) – legitimate interest (safety and property protection)
  • Retention: maximum 15 days unless used, then automatically deleted

Recording of telephone calls (incoming and outgoing)

  • Data processed: voice recording, caller number, time and content of the call
  • Legal basis: GDPR Art. 6(1)(f) – legitimate interest (evidence of arrangements, complaint handling, legal claims); for health-related content Art. 9(2)(f)
  • Retention: 5 years from the recording; recordings related to a complaint, dispute or official proceeding are retained until the matter is finally closed

Displaying the website

  • Data processed: IP address, technical data of your browser and device, time of the request and the page viewed
  • Legal basis: GDPR Art. 6(1)(f) – legitimate interest (displaying the website securely and reliably)
  • Retention: until the hosting server’s logs are automatically deleted

Website visit statistics

  • Data processed: the pages viewed, the page you came from (referrer), your country, the type of your browser, operating system and device, and how fast the page loaded; collected without cookies and without tracking you across other websites; according to Cloudflare, visitors are not identified or tracked by their IP address
  • Legal basis: GDPR Art. 6(1)(f) – legitimate interest (knowing which pages visitors use, to improve the website)
  • Retention: we see only aggregated statistics that do not identify you; Cloudflare makes them available for up to 6 months
  • Provided by: Cloudflare, Inc., the website’s hosting provider (Cloudflare Web Analytics)

Facebook page

  • Data processed: profile data, reactions, comments, messages
  • Legal basis: GDPR Art. 6(1)(a); joint controllership with Meta Platforms Ireland Ltd. for page insights
  • Retention: as per Meta’s data policy

Please include health information in the website form or on WhatsApp only to the extent needed to answer your enquiry – detailed information concerning your health is recorded securely during your consultation.

The website does not use cookies and uses no advertising tools; the visit statistics described above are collected without cookies. On the Contact page the map is first shown as a static image; Google Maps (Google Ireland Ltd.) is loaded – and only then is your IP address sent to Google, which may also set its own cookies – only if you click “Open interactive map”. The buttons pointing to our social media pages (Facebook, Instagram, YouTube) and to WhatsApp are plain links: data reaches the provider concerned only if you click the link.

3. CCTV and call recording

An electronic surveillance system operates at the entrance, reception and waiting area of the clinic for the protection of persons and property; no cameras operate in treatment rooms. Signage at the entrance provides notice of the monitored area. You may request to view or obtain a copy of footage of yourself, request its preservation where you demonstrate a legal interest, and object to this processing.

Incoming and outgoing telephone calls are recorded for the purposes of evidencing arrangements made, investigating complaints and pursuing legal claims; notice of recording is given at the beginning of each call. If you do not wish your call to be recorded, you may contact us by e-mail (info@johannadental.com) or in person. On request you may listen to and obtain a copy of recordings of your own calls and object to this processing. Recordings are retained for 5 years; recordings related to a complaint, dispute or official proceeding are retained until the matter is finally closed.

4. Recipients and processors

Personal data is shared only to the extent necessary for providing our services, with the following categories of recipients:

  • dental laboratories and dental design partners (data necessary for producing restorations and surgical guides);
  • dentists acting on our behalf in our clinic, including visiting specialists, and subcontractors (data necessary for the care they provide);
  • at your request, the insurer, employer or other payer you name, if they pay the fee on your behalf (data necessary for invoicing);
  • our accounting service provider;
  • IT, e-mail and hosting providers (including Google Ireland Ltd. as e-mail provider and as the provider of the website’s map) and the provider of our practice-management software;
  • Cloudflare, Inc. (USA), which hosts the website, forwards the messages sent through the website forms to our e-mail address and provides the website’s visit statistics;
  • the operator of the WhatsApp messaging service (WhatsApp Ireland Ltd.), if you contact us through that channel;
  • the implant manufacturer (SDS, Zeramex, Nobel Biocare) when a manufacturer’s warranty claim is filed, only with your prior consent;
  • where required by law, public authorities and the Hungarian National eHealth Infrastructure (EESZT).

The current list of processors is available at the clinic reception or on request.

5. Transfers outside the EEA

Use of Google and Meta services (including WhatsApp) and of Cloudflare, Inc., the website's hosting provider, may involve transfers of personal data to the United States; such transfers are based on the EU–US Data Privacy Framework adequacy decision or standard contractual clauses.

When a manufacturer’s warranty claim is filed, the data is sent to the implant manufacturer. Where the manufacturer operates in Switzerland, the transfer is based on the European Commission’s adequacy decision for Switzerland.

6. Data security

Personal data is stored in password-protected, access-controlled IT systems, and paper records are kept locked away; our staff and contributors are bound by confidentiality in addition to medical secrecy rules. Contact details are recorded under a double-check procedure, and electronic transmission of patient documentation is subject to enhanced safeguards.

7. Your rights

You have the right to information and access, rectification, erasure, restriction of processing, data portability, to object to processing based on legitimate interest (for example CCTV, call recording, displaying the website), and to withdraw consent at any time. Please note that erasure of health records is limited during the statutory retention periods. Requests may be submitted using the contact details above and will be answered within one month.

8. Remedies

You may lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH): 1055 Budapest, Falk Miksa utca 9–11.; postal address: 1363 Budapest, Pf. 9.; phone: +36 1 391 1400; e-mail: ugyfelszolgalat@naih.hu; web: www.naih.hu. You may also bring the matter before the competent Hungarian regional court, including the court of your place of residence.

9. Final provisions

The Controller may amend this notice; the current version is available on the website and in printed form at the clinic reception. Patients receive this notice at their first visit and confirm having read it by signature.

Effective: 14 November 2026. Previous version: 1 August 2023.

Johanna Dental Kft. · Hűvösvölgyi út 52, 1021 Budapest, Hungary · info@johannadental.com · +36-1-701-2900