1. Controller
Pharmacare Plus s. r. o.
Registered office: Bellova 2/K, 831 01 Bratislava – mestská časť Nové Mesto
Premises: Apollo Nivy, Prievozská 2/A, 821 09 Bratislava
Company ID (IČO): 55 850 332 · Tax ID (DIČ): 2122103544 · VAT ID (IČ DPH): SK2122103544
Registered in the Commercial Register Mestský súd Bratislava III, section Sro, vl. č. 173401/B
E-mail: info@lekarenapolka.sk · Tel: +421 911 384 665
We have not appointed a Data Protection Officer. For all matters concerning the protection of personal data you can contact us at info@lekarenapolka.sk.
2. Scope of processed data
We process the following categories of personal data:
- eRecept: name, phone, e-mail, preferred pickup date and time, note, and birth number. We use the birth number solely to identify the electronic prescription and prepare the medication; we do not use it for marketing, profiling or any other unrelated purpose. We store the full value encrypted only to process the booking operationally; after 30 days it is removed and only a technical hash and the last 4 digits remain, for traceability and to evidence that the request was handled.
- Consultation booking: name, phone, e-mail, chosen slot, and the reason for the consultation if you provide it.
- Contact form: name, e-mail, message text.
- Form security: IP address, technical identifiers and security signals processed to protect against spam and automated abuse.
We obtain personal data directly from you when you fill in the relevant form; when dispensing a medicine on an eRecept, also from the National Health Information System (electronic health record).
E-prescription reservation: through the reservation you can book online the dispensing of a medicine, medical device or dietary food on an electronic prescription. As a provider of pharmaceutical care, when dispensing we are connected to the National Health Information System under Act No. 153/2013 Coll., which enables us to obtain your personal data from your electronic health record.
3. Purposes and legal bases of processing
Preparing medication for an eRecept
Legal basis: Art. 6(1)(b) and (c), and for health data Art. 9(2)(h) GDPR and Act No. 153/2013 Coll. on the National Health Information System – provision of health and pharmaceutical care
Retention: the full birth number for an eRecept for at most 30 days; the hash, last 4 digits and other data for as long as needed to evidence that the request was handled, generally at most 3 years; longer only where required by a specific law
Consultation booking
Legal basis: Art. 6(1)(b), and where applicable Art. 9(2)(h) GDPR if you provide health data
Retention: generally 3 years
Replying to a contact message
Legal basis: Art. 6(1)(f) – legitimate interest in handling your request
Retention: 1 year
Form protection, security and abuse prevention
Legal basis: Art. 6(1)(f) – legitimate interest in operating the website securely
Retention: for as long as necessary for the security verification
Legal obligations (accounting, inspections, pharmacy records)
Legal basis: Art. 6(1)(c) – legal obligation
Retention: in line with the applicable legal regulations
4. Data recipients
- Supabase Inc. – database hosting (EU region, Frankfurt).
- Resend and the SMTP e-mail provider – sending transactional and service e-mails.
- Cloudflare Turnstile – protecting forms against spam and automated abuse.
- Vercel Inc. – hosting platform and operational website logs.
- Google Ireland Ltd. – displaying the “Where to find us” map only after you click (transfer of your IP address to Google Maps).
- National Health Information Center (NCZI) – operator of the National Health Information System (NZIS); when dispensing a medicine on an eRecept the pharmacy accesses the electronic prescription in the NZIS.
- public authorities, health insurers or other bodies where disclosure is required by law.
Some technology providers may be established or run infrastructure outside the EU/EEA. In such cases we use these providers only with appropriate safeguards under the GDPR, in particular on the basis of an adequacy decision, standard contractual clauses or another lawful transfer mechanism.
5. Your rights
As a data subject you have the right to:
- access to your data (Art. 15),
- rectification (Art. 16),
- erasure – the „right to be forgotten“ (Art. 17),
- restriction of processing (Art. 18),
- data portability (Art. 20),
- object to processing (Art. 21),
- withdraw consent at any time without retroactive effect,
- lodge a complaint with the Office for Personal Data Protection of the Slovak Republic, Galvaniho Business Centrum II, Galvaniho 7/B, Bratislava.
We handle requests within 30 days. In justified cases (in particular due to the complexity or number of requests) we may extend this period by up to two further months, of which we will inform you in advance. Contact us at info@lekarenapolka.sk.
6. Cookies
Details about the cookies we use are on the Cookies page. Without your consent we process only technically necessary cookies.
7. Security
Data is transmitted encrypted (TLS) and stored in a database with active Row-Level Security and access restrictions. For an eRecept we store the full birth number encrypted only for the time needed to handle the booking, at most 30 days; afterwards the full value is removed and only a technical hash and the last 4 digits remain, so a record can be traced without storing the full birth number again. Access is limited to authorised professional pharmacy staff and system administrators.
8. Automated decision-making and profiling
When processing your personal data, no automated individual decision-making, including profiling within the meaning of Art. 22 GDPR, takes place.
9. Changes
We may update this policy. We will publish material changes on this page together with the date of the last update.