This statement informs you, in accordance with Art. 13 and 14 GDPR, which personal data we process at Diagnosezentrum Hietzing and on our website, why we do so and what rights you have.

1. Controllers

The following are joint controllers for data processing at Diagnosezentrum Hietzing and on this website (Art. 26 GDPR):

• Diagnosezentrum Hietzing Ges.m.b.H., FN 250555p, Commercial Court Vienna

• Radiologie Czerveniak & Partner OG

Both: Hietzinger Kai 131, 1130 Vienna, Austria · Phone +43 1 804 62 25 · office@dzh.at · www.dzh.at

The two companies jointly determine the purposes and means of processing. They have agreed which of them fulfils which obligations under the GDPR: Diagnosezentrum Hietzing Ges.m.b.H. provides information to data subjects and handles requests concerning your rights. Regardless of this, you may exercise your rights against either controller (Art. 26(3) GDPR).

2. Data Protection Officer

You can reach our Data Protection Officer at judit.szabo@dzh.at or by post at the address above, marked “Attn: Data Protection Officer”.

Requests do not have to take any particular form: you can contact us in writing, by email, by phone or in person. To protect your data, we may ask you to prove your identity before we provide information.

3. Data processing for examination and treatment

Purposes. We process your data to carry out radiological examinations and treatments (X-ray, CT, MRI, ultrasound, mammography, bone density measurement, dental CT, X-ray pain therapy, breast biopsy). We also prepare and transmit reports, manage appointments, bill our services and fulfil our legal obligations regarding documentation, radiation protection and storage (ELGA).

Categories of data.

• Master data: name, date of birth, sex, address, phone number, email address

• Insurance data: social security number, insurance provider, supplementary insurance if applicable

• Referral data: referring physician, clinical question

• Health data: medical history, previous findings, laboratory values (e.g. kidney function before contrast administration), image data, reports, information on contrast agents and radiation dose

• Billing data: services provided, payment data

Source of the data. We receive data from you, from referring or previously treating physicians and hospitals, via the e-card system (eligibility check) and from ELGA (previous findings, unless you have opted out).

Obligation to provide data. Without these data, we cannot examine or treat you or bill your insurance provider.

4. Legal bases

• Treatment contract: Art. 6(1)(b) GDPR

• Health data: Art. 9(2)(h) in conjunction with Art. 9(3) GDPR (health care provided by medical staff bound by professional secrecy under § 54 Physicians Act 1998)

• Legal obligations: Art. 6(1)(c) GDPR, in particular the duty to keep medical records (§ 51 Physicians Act 1998), billing with the social insurance providers (General Social Insurance Act (ASVG) and collective agreements with the health insurance funds), radiation protection law (Radiation Protection Act 2020, Medical Radiation Protection Ordinance), the ELGA storage obligation (Health Telematics Act 2012) and retention obligations under tax and commercial law (BAO, UGB)

• Consent: Art. 6(1)(a) and Art. 9(2)(a) GDPR, for example for sending reports by email or passing them on to private insurers or relatives

• Legitimate interests: Art. 6(1)(f) and Art. 9(2)(f) GDPR – establishing, exercising or defending legal claims, collecting outstanding payments and keeping our IT systems secure

5. Recipients

We only pass on your data where this is necessary for your treatment, required by law or where you have given your consent. Possible recipients are:

• referring and treating physicians and hospitals, including via secure electronic transmission of reports

• ELGA (see section 6)

• social insurance providers and health care funds (Krankenfürsorgeanstalten) (eligibility check, billing)

• pathology and laboratory institutes, e.g. to examine tissue samples after a biopsy

• the responsible bodies of the Austrian Breast Cancer Early Detection Programme (documentation and quality assurance)

• private health and supplementary insurers, only at your request or with your consent

• authorities and courts, where there is a legal obligation

• tax advisers, auditors and legal representatives, who are themselves bound by professional secrecy

• banks and payment service providers for processing payments

Processors. Some service providers process data exclusively on our behalf and according to our instructions, under a contract pursuant to Art. 28 GDPR:

• providers of our radiology information and image archiving software (RIS/PACS) and of our reporting and speech recognition software

• MiraNext GmbH, Austria (online appointment booking)

• IT service providers and data centres

• manufacturers and service companies of our medical equipment (maintenance, including remote maintenance)

• email and telecommunications providers

• Wix.com Ltd. (hosting of this website, see section 8)

• Usercentrics GmbH, Germany (cookie banner and consent management, see section 8)

Third countries. We generally process patient data within the EEA. If data are exceptionally processed in a third country (e.g. for website hosting), this is done only on the basis of an adequacy decision of the European Commission or appropriate safeguards under Art. 44 et seq. GDPR.

6. ELGA – Austrian electronic health record

As a radiology institute, we are legally required to store reports from diagnostic imaging and the associated images in ELGA (Health Telematics Act 2012). You and the physicians and hospitals treating you can access them there. eReports remain available in ELGA for ten years.

Objection in individual cases. You can object to us storing individual reports or images in ELGA. Please let us know, if possible before or during the examination.

General objection and management. You can opt out of ELGA as a whole or of individual parts of it via the ELGA portal at www.gesundheit.gv.at or through the ELGA objection office (ELGA-Widerspruchsstelle). In the portal you can also hide or delete eReports. The ELGA Ombudsman Office can help with any questions.

7. Retention period

• Treatment records including images and reports: at least 10 years (§ 51(3) Physicians Act 1998); longer where this is necessary to preserve evidence, at most until the statutory limitation periods expire (§ 1489 Austrian Civil Code, ABGB)

• Billing and accounting records: 7 years (§ 132 Federal Fiscal Code, BAO)

• Appointment bookings without an examination and general enquiries: until they have been dealt with; they are then deleted unless a retention obligation applies

Once the applicable period has expired, the data are deleted.

8. Website: hosting, log files and cookies

Hosting. This website is operated by Wix.com Ltd., 40 Namal Tel Aviv St., Tel Aviv 6350671, Israel, as our processor. The European Commission has issued an adequacy decision for Israel. Where Wix processes data in the USA, the company is certified under the EU-US Data Privacy Framework. Details: wix.com/about/privacy

Server log files. When you visit the website, technical data are processed automatically: IP address, date and time, page visited, browser and operating system, and the previously visited page. This is necessary to provide the website securely and without errors (Art. 6(1)(f) GDPR). The data are stored only for as long as operation and security require.

Cookies. We use technically necessary cookies without consent (§ 165(3) Telecommunications Act 2021; Art. 6(1)(f) GDPR). All other cookies and similar technologies, for example for statistics or embedded third-party content, are loaded only after you have consented via our cookie banner (Art. 6(1)(a) GDPR, § 165(3) Telecommunications Act 2021). The banner is operated on our behalf by Usercentrics GmbH, Munich. Your choice and its time are stored so that we can prove your consent (Art. 6(1)(c) GDPR). You can change or withdraw your consent at any time via the cookie settings icon on the website. You can also delete or block cookies in your browser.

Encryption. The website uses TLS encryption, recognisable by “https://” and the padlock symbol in your browser.

9. Appointment booking, contact and third-party content

Online appointment booking. “Book an appointment” takes you to the booking portal at patient-portal.miranext.ai. The data you enter there (e.g. name, date of birth, contact details, requested examination) are processed on our behalf by MiraNext GmbH, Austria. We use them to schedule and manage your appointment (Art. 6(1)(b) GDPR; health information: Art. 9(2)(h) GDPR).

Contact by email or phone. If you contact us, we process your details to handle your enquiry (Art. 6(1)(b) or (f) GDPR; health information: Art. 9(2)(h) GDPR). Unencrypted emails can be read by third parties. Please do not send reports or images by unencrypted email; bring them to your appointment instead.

Google Maps. Our home page includes an embedded map from Google Maps (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). The map is only loaded once you consent in the cookie banner. Your browser then transmits, among other things, your IP address to Google, including to the USA; Google is certified under the EU-US Data Privacy Framework. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.

External links. Our website links to third-party services such as Google Maps, openPetition or media reports. Data are transferred to the respective provider only when you click such a link; that provider's privacy policy then applies.

10. Your rights

You have the following rights:

• Access to the data stored about you (Art. 15 GDPR)

• Rectification of inaccurate or incomplete data (Art. 16 GDPR)

• Erasure (Art. 17 GDPR), unless a statutory retention obligation applies – we must keep medical records for at least 10 years

• Restriction of processing (Art. 18 GDPR)

• Data portability (Art. 20 GDPR)

• Withdrawal of consent at any time with effect for the future; this does not affect the lawfulness of processing carried out before the withdrawal (Art. 7(3) GDPR)

Right to object (Art. 21 GDPR). Where we process your data on the basis of legitimate interests, you may object at any time on grounds relating to your particular situation. We will then stop processing the data unless we can demonstrate compelling legitimate grounds or the processing serves to establish, exercise or defend legal claims.

Complaints. If you believe that we are processing your data unlawfully, you can lodge a complaint with the Austrian Data Protection Authority: Barichgasse 40–42, 1030 Vienna, dsb@dsb.gv.at, www.dsb.gv.at

11. Data security and last update

We protect your data through technical and organisational measures such as access restrictions, encryption and regular backups. All staff are bound by confidentiality.

There is no exclusively automated decision-making, including profiling (Art. 22 GDPR). Even where we use software to help analyse images, the diagnosis is always made by a physician.

Last updated: November 2026

This English version is provided for information only. The German version is legally binding.