The purpose of the privacy policy (hereinafter – the Policy) of SIA "INSESO" (hereinafter – Crystal Dent and/or we) is to provide a natural person – the data subject – with information regarding the purpose, scope, and protection of personal data processing, as well as other information when processing the data subject's personal data. When processing personal data, Crystal Dent complies with the requirements of Regulation (EU) 2016/679 of the European Parliament and of the Council (27 April 2016) on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), hereinafter referred to as the Regulation.
In this Policy, you will find information about what personal data we collect and process, for what purposes we use it, and other information regarding the processing of your data. Please read the Policy carefully, and if you have any additional questions, we invite you to contact us using the contact information provided in this Policy.
We inform you that Crystal Dent may amend this Policy, so please check it to ensure that you are informed and familiar with its changes.
We respect your privacy, which is why the security of your personal data is our priority. We use appropriate organizational and technical measures to ensure the continuous security of your personal data and the compliance of data processing with the requirements of personal data protection laws and regulations, as well as our internal rules.
We comply with the requirements of personal data protection laws and regulations and take care in each data processing workflow to collect only the information necessary to achieve the goals set out in this Policy.
Personal Data Processing Workflows
1.Provision of Medical Services
When applying to receive medical services, you must provide us with your data; Crystal Dent will also obtain and process your data during the provision of medical services. Depending on the service and the type of personal data required, if you do not provide the requested information, you might not be able to receive the service. We want to provide you with high-quality medical services, so we need to receive comprehensive, true, and complete information about your health condition, and in exceptional cases, other sensitive matters, to ensure appropriate specialists, etc.
Required Data | Descriptions / Types |
Data Types | General identification and communication data: name, surname, date of birth, personal identity number (ID code), email address, gender, place of residence, mobile phone number, guardian identification data and their contact information. Insurance policy data. Special categories of personal data: health data (depends on the medical service received; disability data; information confirming the diagnosis; examinations and their justification; treatment methods, treatment results, etc.). Genetic data (if applicable). |
Purpose of Processing | Provision of dental services. |
Legal Basis for Processing | Article 6(1)(e) of the Regulation (processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller), in compliance with the requirements of the Medical Treatment Law; |
Data Retention Period | Data is stored in accordance with the retention periods specified in laws and regulations (no longer than 40 years after the end of the provision of health care services). |
2.Circulation of Contracts, Correspondence, and Accounting Documents
Required Data | Descriptions / Types |
Data Categories | Name, surname, personal identity number and/or date of birth, payment information, account number, information about the bank used, information provided in your applications, Guardian identification data and their contact info. |
Purpose of Processing | Performance of the contract, payment administration, ensuring accounting, communication with the client, exercising data subject rights. |
Legal Basis for Processing | Article 6(1)(b) of the Regulation (processing is necessary for the performance of a contract to which the data subject is party); |
Data Retention Period | Data is stored in accordance with the retention periods specified in laws and regulations and according to the document classification scheme of Crystal Dent. |
3.Management and Execution of Financial Matters
Required Data | Descriptions / Types |
Data Categories | Name, surname, personal identity number, address, contact information, data related to the transaction. |
Purpose of Processing | Management of financial matters with the client/patient. |
Legal Basis for Processing | Article 6(1)(b) of the Regulation (processing is necessary for the performance of a contract to which the data subject is party). |
Data Retention Period | Data is stored in accordance with the retention periods specified in laws and regulations and according to the document classification scheme of Crystal Dent. |
4.Management of Documentation and Other Information
Required Data | Descriptions / Types |
Data Types | Name, surname, phone number, email address, information provided in your applications. |
Purpose of Processing | We process personal data obtained within the framework of providing services in accordance with the requirements specified in regulatory enactments, as well as to ensure communication with you and fulfill your requests as a data subject, for example, to provide customer support, consultations, technical assistance, or to resolve various issues and disputes arising from the receipt of the service. |
Legal Basis for Processing | Article 6(1)(c) of the Regulation (processing is necessary for compliance with a legal obligation to which the controller is subject); |
Data Retention Period | Data is stored in accordance with the retention periods specified in laws and regulations and according to the document classification scheme of Crystal Dent. |
5.Recording of Telephone Conversations
Required Data | Descriptions / Types |
Data Categories | Name, surname, personal identity number, description of the situation. |
Purpose of Processing | We constantly make every effort to improve the services we provide, therefore we record call center conversations for customer service quality purposes. |
Legal Basis for Processing | Article 6(1)(f) of the Regulation (processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party). |
Data Retention Period | Data is stored for up to 6 calendar months. |
6.Video Surveillance
Required Data | Descriptions / Types |
Data Categories | Visual image of a natural person and sound recording. |
Purpose of Processing | To ensure the protection of property, employees, patients, and other persons against illegal actions of third parties, preventing infringement of property rights, careless use, damage, theft, and other threats to property rights, as well as protecting the vital interests of persons, including life and health; to ensure the preservation and use of evidence for the review, submission, implementation, or defense of potential incidents, complaints, disputes, or legal claims. |
Legal Basis for Processing | Article 6(1)(f) of the Regulation (processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party). |
Data Retention Period | Video surveillance recordings are stored for 30 calendar days. |
7.Review of Objections, Claims, Complaints, Suggestions, Notices, and Other Applications
Required Data | Descriptions / Types |
Data Categories | Name, surname, personal identity number, contact information, and the included information. |
Purpose of Processing | Review and processing of objections, claims, complaints, suggestions, notices, and other applications. |
Legal Basis for Processing | Article 6(1)(c) of the Regulation (processing is necessary for compliance with a legal obligation to which the controller is subject); |
Data Retention Period | Data is stored in accordance with the retention periods specified in laws and regulations and according to the document classification scheme of Crystal Dent. |
8.Website https://crystaldent.lv
Required Data | Descriptions / Types |
Data Types | Cookies. |
Purpose of Processing | Cookies are used to collect data on website usage and thereby improve it. Technical information, such as IP address and the URL visited, is processed by Crystal Dent to identify and prevent criminal offenses. Crystal Dent does not link the user's IP address with data that allows identifying this person. This means that each user session is recorded, but the website user remains anonymous. |
Legal Basis for Processing | Article 6(1)(a) of the Regulation (the data subject has given consent to the processing of his or her personal data for one or more specific purposes); |
Data Retention Period | Data is stored in accordance with the information about the specific cookie. |
9.Debt Collection
Required Data | Descriptions / Types |
Data Categories | Name, surname, personal identity number, contact information, information about the ground and amount of the debt. |
Purpose of Processing | Debt recovery. |
Legal Basis for Processing | Article 6(1)(f) of the Regulation (processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party). |
Data Retention Period | Data is processed until the debt is recovered. To ensure the protection of Crystal Dent's legitimate interests (review of claims, complaints), we may store information about the performed data processing for a longer period. |
10.Provision of the Recruitment Process
Required Data | Descriptions / Types |
Data Types | Name, surname, email, phone number, information about education, CV/career history. |
Purpose of Processing | To ensure the personnel recruitment process. |
Legal Basis for Processing | Article 6(1)(a) of the Regulation (the data subject has given consent to the processing of his or her personal data for one or more specific purposes). |
Data Retention Period | Data is stored in accordance with the retention periods specified in laws and regulations and according to the document classification scheme of Crystal Dent. |
The list of data processing purposes contained in this Policy is not exhaustive; the personal data of natural persons may also be processed for other purposes not mentioned in this Policy.
Duration of Personal Data Retention
Crystal Dent stores personal data according to the defined purposes of personal data processing and the legal bases of personal data processing, as long as at least one of these criteria exists:
there is a legal obligation to store the data;
it is necessary to realize its legitimate interests;
it is necessary to fulfill the assumed contractual obligations;
the data subject's consent to the respective processing of personal data is valid.
Recipients of Personal Data
We may disclose your health data only in cases specified in the Law on Patients' Rights or based on your consent.
We may transfer your data for processing to doctors and medical institutions who need this data for your medical treatment process.
If the payment for your medical services is made by an insurance company, your data may be transferred to this insurer.
Crystal Dent may use data processors for the processing of personal data. In such cases, Crystal Dent takes the necessary measures to ensure that such personal data processors process personal data in accordance with the instructions of the Controller and according to the applicable regulatory enactments, and requires appropriate security measures.
Your personal data may be provided to other data recipients only if there is a basis specified in regulatory enactments.
Our involved data processors may process your personal data only according to our instructions and may not use them for other purposes or transfer them to other persons without our consent. Furthermore, they must ensure the protection of your data in accordance with the requirements of applicable regulatory enactments and the written agreement concluded with us, which, among other things, provides for the irreversible deletion of any of your data after the fulfillment of our task or the termination of cooperation.
In accordance with the procedure specified in regulatory enactments, Crystal Dent may transfer your personal data to competent institutions, for example, an insurance joint-stock company or broker (if a property claim is filed) or an independent inspector (if an accident has occurred).
To ensure our rights, the safety of third parties, and property, data may also be transferred to other competent institutions or law enforcement authorities, but only if necessary.
From What Sources Do We Collect Your Personal Data?
We may obtain your personal data:
from you personally, for example, when applying for a service by phone, email, providing us with information about yourself;
from medical institutions, receiving personal data and samples for performing analyses with a referral;
from the electronic Health Information System of the National Health Service in accordance with the procedure specified in regulatory enactments.
In Which Territories and Jurisdictions Do We Process Your Personal Data?
We process your personal data within the territory of the European Union.
What Rights Do Data Protection Regulatory Enactments Grant to You and How Can You Use Them?
Data protection regulatory enactments grant you rights that you can freely use by contacting us. We commit to ensuring opportunities for you to exercise your rights.
The right to obtain information on whether we process your personal data, and if so, which ones: You have the right to receive our confirmation as to whether we process your personal data, as well as the right to familiarize yourself with your personal data that we process, information about the purposes of data processing, the category of data being processed, the category of data recipients, the data processing period, the sources of data acquisition, automated decision-making, including profiling, as well as their significance and consequences. We provide most of this information to you in this Policy. If the information specified in this Policy is not sufficient for you, you can always contact us in the ways specified in the section "In what ways can you contact us?" of this Policy.
The right to request rectification of personal data: If the data at our disposal has changed or you see that the information we process about you is inaccurate or incorrect, you have the right to request this information to be changed, specified, or corrected.
The right to withdraw consent: In those cases where we process your data based on your consent, you have the right to withdraw your consent at any time in the same way it was given, and the data processing for the specific purpose based on your consent will be terminated. Such processing will not be terminated if its performance is specified in law or by an order of a competent authority, or if, given the nature of the processing, it is not possible. By withdrawing consent, data processing performed on other legal bases cannot be terminated. In any situation, we may store your consent and proof thereof for a longer period if necessary to protect our rights in relation to claims or objections expressed against us.
The right to submit a complaint: If you believe that we process your data in violation of the requirements of personal data protection regulatory enactments, we invite you to contact us directly. If you are not satisfied with the solutions we offer or if, in your opinion, we do not take the necessary actions, you have the right to submit a complaint to the supervisory authority, which in the Republic of Latvia is the Data State Inspectorate (http://www.dvi.gov.lv/).
The right to object to data processing if the processing is based on legitimate interests: You have the right to object to the processing of personal data if the personal data is processed based on our legitimate interests
.
The right to request erasure of data (right to be forgotten): In the presence of relevant circumstances mentioned in the personal data processing regulatory enactments, for example, if personal data is processed unlawfully, the legal basis for data processing is lost, you have the right to ask us to delete your personal data. If you wish to exercise this right, please submit a written request to us. In the event that the personal data we process is usable for other purposes mentioned in this Policy, and the legal basis for its processing is not consent, we may retain the relevant information to ensure the achievement of other purposes.
The right to request restriction of data processing: In the presence of relevant circumstances mentioned in the data processing regulatory enactments, for example, if personal data is processed unlawfully, you dispute the accuracy of the data, or you submit objections to data processing based on our legitimate interests, you have the right to restrict the processing of your data.
The right to data portability: You have the right to request the portability of such data that you have submitted to us in electronic form. Upon receiving your request for data portability, we will ensure the realization of your rights by issuing the data in a widely used and machine-readable format or we will send your requested data in electronic form to the recipient of your choice, in accordance with the information specified in your request.
Procedure for Reviewing Requests
Striving to protect all our data from unlawful disclosure, we, upon receiving your request to provide data or exercise other rights of yours, will have to verify your identity. For this purpose, we may ask you to present an identity document, as well as, if the request relates to your legally represented person - a birth certificate, power of attorney, or another document certifying representation, except if the situation allows fulfilling your request without such verification. If you do not prove your identity and/or representation, we will reject your request.
Upon receiving confirmation that you are entitled to fulfill your request, we commit to providing you with information about the progress of your request immediately, but no later than within one month from the receipt of your request and the end of the verification procedure.
If your request is submitted by electronic means of communication, we will also provide the answer to you by electronic means of communication, except in cases where it will not be possible, for example, due to a large volume of information or if you ask us to answer in another way.
If we are forced to reject your request due to circumstances specified in regulatory enactments, we will inform you in writing about the refusal, justifying it accordingly.
In What Ways Can You Contact Us?
For all personal data processing issues, you can contact us in the following ways:
By writing to the email address: info@crystaldent.lv
By writing to the legal address of Crystal Dent.
Our Requisites as Data Controller:
SIA “INSESO”
Registration number: 40103876612
Legal address: Ādažu iela 2, Rīga, LV-1034
Phone: +371 25441199, +371 25441190
Email: info@crystaldent.lv
How is the Security of Your Data Ensured?
We use various security technologies and procedures to protect your personal information from unauthorized access, use, or disclosure. Personal data is accessible only to those persons who need it for the performance of work duties and only to the extent necessary. All employees who have access to the data of physical persons sign confirmations on the appropriate processing and protection of physical persons' data, and these persons are informed about personal data protection rules and are regularly trained.
Our chosen service providers are carefully selected; we require them to use appropriate means that protect the confidentiality of your data and ensure the security of your personal information.
Profiling
Profiling is any form of automated processing of personal data to analyze or predict you. Crystal Dent does not do this.
This Policy is effective from October 5, 2026.