Poliklinika Estera d.o.o., with its registered office in Zagreb, Trpinjska 7, registered with the Commercial Court in Zagreb under the court register number (MBS): 081392382, personal identification number (OIB): 13936192149 (hereinafter: “Poliklinika Estera”), respects the privacy of its users and visitors when using the website www.dermatologijaestera.hr.
Through this Privacy Policy, we would like to inform you which personal data we collect, the purposes for which we process such data, the legal basis for processing, how long we retain it, with whom we may share it, and what rights you have in relation to your personal data.
This Privacy Policy applies to personal data that we process through our website, at Poliklinika Estera’s premises, and in connection with the provision of healthcare and other services.
We may disclose your personal data to competent authorities or use it to protect Poliklinika Estera’s rights only where there is an appropriate legal basis for doing so and only to the extent necessary for the specific purpose.
Poliklinika Estera has appointed a Data Protection Officer. The contact details are as follows: Telephone: +385 (0)1 2230 463, E-mail: privatnost@de.hr
Depending on how you communicate with us and use our services, we may process the following categories of personal data: first and last name; residential address and email address; telephone or mobile phone number; information you provide to us in a message or inquiry; information necessary for arranging and organizing appointments; information relating to examinations, procedures, and healthcare services provided; health data and other information contained in medical records; photographs and photographic documentation related to the provision of healthcare services, where necessary; information relating to invoices, payments, and other business transactions; information necessary to comply with legal and regulatory obligations; information you provide when subscribing to our notifications, news, promotions, or educational content; technical data related to your use of the website, including your IP address and information about your device, browser, and use of the website, to the extent such data is collected; information related to the use of cookies and similar technologies, in accordance with your settings and applicable regulations; and data collected through video surveillance.
The Clinic does not collect more personal data than is necessary to achieve the specific purpose of the processing.
As part of the provision of healthcare services, the Clinic processes patients’ health data. Health data constitute a special category of personal data, and we process such data using appropriate technical and organizational safeguards.
We process health data primarily for the following purposes: examination and assessment of the patient’s health condition; establishing a diagnosis; planning and providing appropriate therapy and treatment; performing dermatological and other healthcare procedures; monitoring the patient’s health condition and treatment outcomes; maintaining medical records; photographic documentation where necessary for healthcare purposes and monitoring treatment outcomes; communicating with the patient in connection with the provision of healthcare services; fulfilling legal and other obligations applicable to healthcare institutions.
Health data will not be used for purposes unrelated to the provision of healthcare, unless there is an appropriate legal basis for such processing.
Through the contact form on our website, you may be asked to provide information such as: first and last name; email address; telephone or mobile phone number; the content of your message.
The information you provide through the contact form is used primarily to respond to your inquiry, communicate with you and, where applicable, arrange or organize the provision of services.
The Clinic enables communication with users by telephone, mobile phone and WhatsApp. If you contact us via WhatsApp, we process the information you provide during the communication for the purpose of responding to your inquiry, arranging appointments and communicating with you in connection with the provision of our services.
WhatsApp is a third-party service, and in addition to our obligations as the data controller, the processing of data through this platform may also be subject to the privacy policies and terms of service of the service provider.
To protect your privacy, we recommend that you do not send extensive medical documentation or other health data via WhatsApp unless this is necessary.
Poliklinika Estera d.o.o. uses a video surveillance system in certain areas where video surveillance has been implemented for the purpose of protecting persons and property, controlling access, and preventing and detecting unlawful activities. Areas subject to video surveillance are appropriately marked with a video surveillance notice before entering the monitored area, in accordance with applicable regulations.
Video surveillance is used for the following purposes: protecting the life and safety of patients, employees, and other persons present on the Clinic’s premises; protecting the property of the Clinic, patients, employees, and other persons; preventing and detecting unlawful activities; protecting and enforcing legal claims; ensuring the security of the premises and controlling access.
Video surveillance is not used to monitor employee performance or for any other purposes unrelated to the protection of persons and property, unless there is a specific legal basis for such processing.
The video surveillance system may collect recordings of persons present in areas covered by cameras. Such recordings may contain images and behavior of individuals, as well as other information visible in the recording. Video surveillance is not aimed at collecting patients’ health data, nor are the recordings used for the purposes of providing healthcare.
The processing of personal data through video surveillance is carried out on the basis of the Clinic’s legitimate interest in protecting persons and property.
When implementing and operating the video surveillance system, the Clinic observes the principle of proportionality and seeks to ensure that only areas where video surveillance is necessary and justified in view of its purpose are recorded.
Access to recordings is limited to authorized persons who require such access for the purposes of video surveillance and the performance of their work duties. Recordings may be made available to competent public authorities, the police, courts, or other authorized bodies where there is a legal basis or an official request to do so.
Where it is necessary to engage an external service provider to maintain or manage the video surveillance system, such provider may have access to personal data only to the extent necessary to provide the contracted service and subject to appropriate safeguards.
Video surveillance recordings are retained for 30 days from the date on which they are made. If a particular recording is required as evidence in legal or other proceedings, it may be retained for longer than the standard retention period, namely until the conclusion of the proceedings or until the reason requiring its continued retention ceases to apply.
We may process your personal data for the following purposes: provision of healthcare services; scheduling and organizing appointments; communication with patients and users; responding to inquiries; administrative and business purposes; compliance with legal obligations; protection of rights and legitimate interests; marketing and providing information.
Depending on the specific purpose, the processing of personal data may be based on one or more of the following legal bases: performance of a contract or taking steps at your request prior to entering into a contract; compliance with the Clinic’s legal obligations; protection of your vital interests; provision of healthcare and management of healthcare systems and services, where the conditions prescribed by applicable legislation are met; your consent, where the processing is based on consent; our legitimate interests, where such processing is permitted and your interests or fundamental rights and freedoms do not override those interests.
When processing health data, additional conditions prescribed by applicable data protection and healthcare legislation apply.
Where the processing of personal data is based on your consent, such consent must be freely given, specific, informed, and unambiguous. You may withdraw your consent at any time.
The withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
You may request the withdrawal of your consent by sending a request to privatnost@de.hr, estera@de.hr or in person at the Clinic’s reception desk.
Withdrawing your consent to receive marketing or educational communications will not affect the provision of healthcare services.
If you have subscribed to receive our notifications, news, promotions, special offers, or educational content, we may use your contact details to send you such communications in accordance with your consent and applicable regulations. You may request to stop receiving such communications at any time.
Unsubscribing from marketing communications does not mean that other personal data we are required or authorized to retain for other purposes will be deleted, for example, for the provision of healthcare services or compliance with legal obligations.
When using the website, certain technical data may be processed automatically, depending on the configuration of the website, the technologies used, and your settings.
Such data may include: IP address; device type; operating system; browser type and version; time of access; pages you visit; technical data necessary for the operation of the website.
We may use such data for the purposes of ensuring security, proper operation, maintenance, and improvement of the website and, where applicable, for analyzing website usage.
The Clinic’s website may use cookies and other similar technologies.
Cookies may be necessary for the basic functioning and security of the website and for providing certain functionalities, while others may be used for analytics, improving the user experience, or other purposes.
The website may also contain content or technologies provided by third parties, including Google services and embedded YouTube content.
Where prior consent is required for the use of certain cookies or technologies, such technologies will not be used before consent has been obtained, unless otherwise permitted by applicable regulations.
Detailed information about cookies, their types, purposes, retention periods, and options for managing consent is available in the Clinic’s Cookie Policy.
The website uses Google Tag Manager to manage certain tags and technologies that may be used on the website. The manner in which individual technologies are loaded through Google Tag Manager may depend on the current configuration of the website. If analytical, marketing, or other technologies requiring consent are activated through Google Tag Manager, they are used in accordance with users’ consent preferences and applicable regulations.
The website may contain embedded videos or other content from the YouTube platform. When such content is displayed or interacted with, certain technical data may be processed depending on how the embedded content is configured and in accordance with the policies of the service provider.
The use of such services may involve the transfer of data to the service provider outside the European Economic Area, in accordance with the rules and safeguards applied by the service provider.
We do not sell your personal data or disclose it to third parties for their own marketing purposes.
Depending on the purpose of processing, personal data may be accessible to: authorized employees and healthcare professionals of the Clinic; persons authorized to participate in the provision of healthcare; providers of accounting and administrative services; providers of IT, hosting, maintenance, and other technical services; providers of communication services; providers of services related to the website, analytics, cookies, or embedded content, where their use is permitted; competent public authorities, healthcare institutions, and other authorized recipients where there is a legal obligation or other appropriate legal basis for such disclosure; other healthcare professionals or healthcare institutions where this is necessary for the provision of healthcare and where there is an appropriate legal basis for such processing.
Where third parties process personal data on behalf of the Clinic, the Clinic regulates such relationships through appropriate agreements and requires the implementation of appropriate measures to protect personal data.
If personal data are transferred outside the European Economic Area, the Clinic will carry out such transfers only where permitted under applicable data protection legislation.
Depending on the circumstances, the transfer may be based on a European Commission adequacy decision, appropriate safeguards, including Standard Contractual Clauses, or another legally permitted basis.
We retain personal data only for as long as necessary to achieve the purpose for which they were collected, or for as long as necessary to comply with legal, regulatory, accounting, or other obligations.
Data forming part of medical records are retained for the periods prescribed by laws and other regulations governing healthcare and medical records — 10 years after the completion of treatment, pursuant to Article 23 of the Medical Practice Act, after which they are handled in accordance with regulations governing documentary and archival material.
Data relating to accounting documents are retained for at least 11 years from the end of the relevant financial year.
Data collected through video surveillance are retained for a maximum of 6 months, except where such recordings are subject to evidentiary proceedings.
Data processed on the basis of consent are retained until consent is withdrawn, unless there is another appropriate legal basis or legal obligation for continued processing or retention.
Data collected through contact forms may be retained for as long as necessary to process the inquiry and conduct related communication, after which they are deleted or anonymized, unless there is another legal basis or obligation requiring their retention.
Once the applicable statutory retention period has expired, data are deleted, destroyed, or anonymized, unless there is a specific legal obligation or other documented legal basis for continued retention. In such cases, the data will be limited to the necessary scope and retained for a predetermined period.
The Clinic implements appropriate technical and organizational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or unauthorized access.
Security measures include, where appropriate, access controls, management of user permissions, protection of information systems, backups, training of persons who process personal data, and other measures appropriate to the risks associated with the processing.
Despite the measures implemented, no method of transmitting or storing data over the internet can be considered absolutely secure.
Depending on the circumstances and applicable legal requirements, you have the right to: request access to your personal data; request the correction of inaccurate or incomplete data; request the deletion of personal data where the applicable conditions are met; request restriction of processing; object to the processing of personal data where the applicable conditions are met; request data portability where the statutory requirements are met; withdraw your consent at any time where the processing is based on consent; lodge a complaint with the competent supervisory authority.
To exercise your rights, you may contact us using the contact details provided in this document.
When processing your request, we may ask you to provide additional information necessary to verify your identity, particularly where health data are concerned.
If you believe that your personal data are being processed in violation of applicable regulations, you have the right to lodge a complaint with the competent supervisory authority.
In the Republic of Croatia, the competent supervisory authority is:
Croatian Personal Data Protection Agency (AZOP)
Selska cesta 136
10000 Zagreb
Republic of Croatia
Email: azop@azop.hr
Website: azop.hr
If a user of our services is a minor, we process personal data in accordance with applicable regulations and the rules governing the provision of healthcare to minors.
Where necessary, communication and the exercise of rights shall be carried out by parents, guardians, or other authorized persons in accordance with the law.
The Clinic may periodically amend or supplement this Privacy Policy, for example, due to changes in the way personal data are processed, changes to our services, or changes in relevant legislation.
The current version of the Privacy Policy will always be published on this website.
Date of last amendment: 6th October 2026
