Privacy Policy

As a client/patient of the limited liability company “VIKITAN” (hereinafter referred to as LINOVE or “we”), you entrust us with your personal data and grant us the right to process it in accordance with our Privacy Policy (hereinafter referred to as the “Policy”). LINOVE complies with Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), hereinafter referred to as the “Regulation.”

In this Policy, you will find information about what personal data we collect and process, the purposes for which we use it, how long we retain it, and other information regarding the processing of your data. Please read this Policy carefully, and if you have any additional questions, please contact us using the contact information provided in this Policy.

Please be advised that LINOVE may amend this Policy; therefore, please review this Policy to ensure that you are informed and familiar with any changes.

We respect your privacy, which is why the security of your personal data is our priority. We use appropriate organizational and technical measures to ensure the ongoing security of your personal data and that data processing complies with data protection laws and regulations, as well as our internal policies.

We comply with the requirements of personal data protection laws and regulations, and in every data processing operation, we ensure that we collect only the information necessary to achieve the purposes set forth in this Policy.

Upon receiving your personal data, we assume that this data is accurate and correct, and that all of your consents have been provided of your own free will, after thoroughly reviewing this Policy.

1. What personal data do we collect from you, and why?

1.1. Provision of Medical Services

When you apply for medical services, you must provide us with your personal data, and LINOVE will collect and process your data during the provision of medical services. Depending on the service and the type of personal data required, if you do not provide the requested information, you may not be able to receive the service. We want to provide you with high-quality medical services, so we need to receive comprehensive, accurate, and complete information about your health condition.

Required Data
Data Types	General identification and contact information: first name, last name, date of birth, personal identification number, email address, gender, place of residence, email address, mobile phone number. Insurance policy details. Specialcategories of personal data: health data (depending on the medical service received—information confirming the diagnosis; tests and their rationale; treatment methods, treatment outcomes, etc.)
Purpose of Personal Data Processing	Provision of healthcare services
Legal Basis for Data Processing	Article 6(1)(e) of the Regulation (processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller), in compliance with the requirements of the Medical Treatment Act; Article 9(2)(h) of the Regulation (processing is necessary for preventive or occupational medicine purposes, for the assessment of an employee’s fitness for work, for medical diagnosis, for the provision of health or social care or treatment, or for the management of health or social care systems and services, based on Union or Member State law or pursuant to a contract with a health professional and subject to the conditions and safeguards referred to in Article 9(3) of the Regulation); In certain cases, Article 6(1)(b) of the Regulation (processing is necessary for the performance of a contract to which the data subject is a party), Article 6(1)(a) of the Regulation (the data subject has given consent to the processing of his or her personal data for one or more specific purposes) and Article 9(2)(a) of the Regulation (the data subject has given explicit consent to the processing of such personal data for one or more specific purposes)
Data Retention Period	Data is retained in accordance with the retention periods specified in applicable laws and regulations (no longer than 40 years after the end of the provision of healthcare services).

1.2. Management of Documentation and Other Information

We process the personal data obtained in the course of providing our services in accordance with the requirements set forth in applicable laws and regulations, as well as to communicate with you and fulfill your requests as a data subject.

Required Data
Data Categories	First name, last name, personal identification number and/or date of birth, payment information, account number, information about the bank used, information provided in your submissions
Purpose of Personal Data Processing	Payment administration, accounting, communication with customers, and the exercise of data subjects’ rights
Legal Basis for Data Processing	Article 6(1)(c) of the Regulation (processing is necessary for compliance with a legal obligation to which the controller is subject); Article 6(1)(f) of the Regulation (processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party)
Data Retention Period	Data is stored as follows: Submissions/requests/complaints—in accordance with the LINOVE case classification system, subject to the time limits specified in regulatory enactments. For the administration of accounting documents—in accordance with the LINOVE case classification system, subject to the time limits specified in applicable laws and regulations. In certain cases, to protect LINOVE’s legitimate interests, information may be retained for a longer period.

1.3. Debt Collection

We may transfer personal data obtained in the course of providing our services to debt collection service providers. Please note that only the data necessary for debt collection may be transferred. Health data is not transferred to debt collection service providers.

Required Data
Data Categories	First name, last name, personal identification number, and date of birth; contact information (residential address, registered address, phone number, email address); information regarding the basis and amount of the debt.
Purpose of Personal Data Processing	Debt collection
Legal Basis for Data Processing	Article 6(1)(f) of the Regulation (processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party)
Data Retention Period	Data is processed until the debt is recovered. To ensure the protection of LINOVE’s legitimate interests (handling of claims and complaints), we will also retain information regarding the data processing activities for a longer period.

1.4. Video Surveillance

To ensure security, video surveillance is in operation on the LINOVE premises.

Required Data
Data Categories	Visual image of a natural person.
Purpose of Personal Data Processing	To ensure the protection of property against unlawful acts by preventing infringements of property rights, theft, and other threats to property rights.
Legal Basis for Data Processing	Article 6(1)(f) of the Regulation (processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party)
Data Retention Period	Video surveillance recordings are retained for 30 calendar days

1.5. Recording of Telephone Calls

We are constantly striving to improve the services we provide, which is why we record calls at our customer service center.

Required Data
Data Categories	First name, last name, personal identification number, description of the situation
Purpose of Personal Data Processing	To improve the quality of customer service
Legal Basis for Data Processing	Article 6(1)(f) of the Regulation (processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party)
Data Retention Period	Call recordings are retained for 30 calendar days

1.6. Order Management in the linove.eu Online Store

Required Data
Data Categories	First name, last name, address, order pickup location, phone number, email address, payment method information, and other information provided at the time of ordering.
Purpose of Personal Data Processing	Administration of purchases and payments; provision of services
Legal Basis for Data Processing	Article 6(1)(b) of the Regulation (processing is necessary for the performance of a contract to which the data subject is a party)

1.7. Processing of Personal Data for Marketing Purposes

To inform you about updates to the Services, price changes, and to send you personalized ads or other marketing communications.

Required Data
Data Categories	First name, last name, contact information (email, phone number)
Purpose of Personal Data Processing	Administration of purchases and payments; provision of services
Legal Basis for Data Processing	Article 6(1)(a) of the Regulation (the data subject has given consent to the processing of his or her personal data for one or more specific purposes).

1.8. LINOVE website linove.eu

To schedule an appointment

Required Data
Data Categories	First name, last name, contact information (email, phone number), desired service.
Purpose of Personal Data Processing	To manage scheduled visits and handle communications related to the scheduled visit.
Legal Basis for Data Processing	Article 6(1)(a) of the Regulation (the data subject has given consent to the processing of his or her personal data for one or more specific purposes).

2. From what sources do we collect your personal data?

We may collect your personal data in the following ways:

• From you personally, for example, when you sign up to receive medical services in person, by phone, by email, or on our website, by providing us with information about yourself;
• Upon receiving personal data and samples from medical institutions for testing via referral;

3. In what circumstances and to which recipients do we disclose your data?

We may disclose your health information only in the cases specified in the Patient Rights Act or based on your consent.

We may share your data with doctors and medical institutions that need this information as part of your treatment.

Your data may be disclosed to your relatives only with your authorization and consent.

If an insurance company covers the cost of your medical services, your data may be shared with that insurer.

To protect our rights and the safety of our employees, third parties, and property, data may also be disclosed to other competent authorities or law enforcement agencies, but only if necessary in accordance with the Patient Rights Act and other applicable laws and regulations, in the cases and in the manner specified in those laws and regulations.

To provide medical services, we may transfer your data to database software maintainers, database administration service providers, data center maintenance providers, and cloud computing service providers. In each case, we provide data processors only with the amount of data necessary to perform a specific task or provide a specific service.

Our data processors may process your personal data only in accordance with our instructions and may not use it for other purposes or disclose it to third parties without our consent. In addition, they must ensure the protection of your data in accordance with the requirements of applicable laws and regulations and the written agreement concluded with us, which, among other things, provides for the irreversible deletion of any of your data upon completion of the task we have assigned or upon termination of our cooperation.

4. In which territories and jurisdictions do we process your personal data?

We process your personal data within the European Union. Your personal data may be transferred outside the European Union or the European Economic Area only in accordance with applicable laws, including based on your consent.

5. What rights do data protection laws grant you, and how can you exercise them?

Data protection laws grant you certain rights, which you are free to exercise by contacting us. We are committed to ensuring that you are able to exercise your rights.

5.1. The right to obtain information about whether we process your personal data and, if so, what data we process

You have the right to receive confirmation from us as to whether we are processing your personal data, as well as the right to access your personal data that we process, information about the purposes of data processing, the categories of data being processed, the categories of recipients, the duration of data processing, the sources of the data, automated decision-making—including profiling—as well as its significance and consequences.

We provide you with most of this information in this Policy.

If the information provided in this Policy is not sufficient for you, you can always contact us using the methods listed in Section 6 of this Policy.

5.2. The Right to Request Correction of Personal Data

If the data we have on file has changed, or if you notice that the information we have processed about you is inaccurate or incorrect, you have the right to request that this information be changed, clarified, or corrected.

5.3. The Right to Withdraw Consent

In cases where we process your data based on your consent, you have the right to withdraw your consent at any time, and the processing of your data based on your consent will be discontinued. Such processing will not be discontinued if it is required by law or by an order of a competent authority, or if, given the nature of the processing, it is not possible to do so.

In any situation, we may retain your consent and proof thereof for a longer period if necessary to protect our rights in connection with claims made against us, or claims.

5.4. The Right to File a Complaint

If you believe that we are processing your data in violation of the requirements of personal data protection laws and regulations, we encourage you to contact us directly.

If you are not satisfied with the solutions we offer or if, in your opinion, we are not taking the necessary actions, you have the right to file a complaint with the supervisory authority, which in the Republic of Latvia is the State Data Inspectorate (www.dvi.gov.lv).

5.5. The right to object to data processing if the processing is based on legitimate interests

You have the right to object to the processing of your personal data if it is being processed based on our legitimate interests.

5.6. The Right to Request the Erasure of Data (the Right to Be Forgotten)

If the circumstances specified in the relevant laws and regulations governing the processing of personal data apply—for example, if personal data is being processed unlawfully— the legal basis for data processing ceases to exist, you have the right to request that we delete your personal data. If you wish to exercise this right, please submit a written request to us.

If the personal data we process can be used for other purposes specified in this Policy, and the legal basis for its processing is not consent, we may retain the relevant information to ensure that those other purposes are achieved.

5.7. The Right to Request Restriction of Data Processing

Where the circumstances specified in the relevant data processing regulations apply—for example, if personal data is processed unlawfully, you contest the accuracy of the data, or you object to the processing of your data based on our legitimate interests, you have the right to restrict the processing of your data.

5.8. Right to Data Portability

You have the right to request the portability of data that you have provided to us in electronic form. Upon receiving your request for data portability, we will ensure that your right is exercised by by providing the data in a widely used, machine-readable format or by sending the requested data electronically to the recipient of your choice, in accordance with the information specified in your request.

5.9. Procedure for Reviewing Requests

In an effort to protect all of our customers’ data from unauthorized disclosure, we will need to verify your identity when we receive your request to provide data or to exercise your other rights. For this purpose, we may ask you to present a form of identification, as well as—if the request concerns a person you legally represent— —a birth certificate, power of attorney, or other document proving representation—unless the circumstances allow us to fulfill your request without such verification. If you do not verify your identity and/or representation, we will reject your request.

Upon receiving confirmation that you are entitled to have your request fulfilled, we undertake to immediately, but no later than one month after receiving your request and completing the verification process, to provide you with information regarding the status of your request.

If your request is submitted via electronic means of communication, we will also provide you with a response via electronic means, except in cases where this is not possible—for example, due to the large volume of information or if you request a response by other means.

If we are forced to reject your request due to circumstances specified in the applicable laws and regulations, we will notify you in writing of the rejection, providing the appropriate justification.

6. How can you contact us?

For any questions regarding the processing of personal data, you can contact us in the following ways:

When writing to LINOVE’s official email address

By emailing: [email protected]

Call us at: +37124401084

When writing to LINOVE’s registered address

Our contact information as the data controller:

“VIKITAN” Limited Liability Company

Registration Number 45403050409

Registered address: Vienības gatve 109, Riga, LV-1058

7. How is the security of your data ensured?

We use various security technologies and procedures to protect your personal information from unauthorized access, use, or disclosure. Personal data is accessible only to those individuals who need it to perform their job duties and only to the extent necessary. All individuals with access to health data have signed confidentiality agreements, have been informed of the personal data protection rules, and receive regular training.

Our service providers have been carefully selected, and we require them to use appropriate measures to protect the confidentiality of your data and ensure the security of your personal information. However, since information transmitted via the Internet or mobile networks cannot be fully guaranteed to be secure, so you must independently assess the risks associated with the confidentiality of the information and assume those risks if you decide to provide us with any information in the specified ways.

8. Longer Data Retention

Upon expiration of the data processing and retention period specified in this Policy, or upon fulfillment of the purpose of personal data processing, we will destroy your data, but in the cases specified in this Policy, we will anonymize it as soon as possible, within a reasonable and justified period necessary to carry out such actions.

Your personal data specified in this Policy may be retained for a longer period only if:

• This is necessary so that we can protect our rights in connection with claims, complaints, or lawsuits;
• there are reasonable grounds to suspect illegal activities, which warrant an investigation;
• Your data is required to properly review a dispute or complaint.

9. Profiling

LINOVE does not make any automated decisions, nor does it engage in profiling of personal data.

10. Validity and Amendments to the Policy

This Policy is effective as of November 1, 2025