Privacy Policy

Sairaala KL Oy patient data register

Sairaala KL Oy maintains and protects its patient data register in accordance with applicable legislation.

Respecting and protecting patient privacy is an extremely important matter in 

Sairaala KL Oy's business operations. Operations comply with laws and regulations that concern

private healthcare. Patient data collected by Sairaala KL Oy

is processed in accordance with the privacy policy.

Updated September 30, 2026

1. Data controller

Sairaala KL Oy (3424148-6)

2. Contact person

Elina Salmi

elina.salmi@sairaalakl.fi

Uudenmaankatu 38 E

00120 Helsinki

+358 20 766 9390

3. Name of the register

Centralized patient data register of Sairaala KL Oy and its professionals

4. Purpose of processing personal data

• planning of patient examinations and treatment, as well as the implementation and documentation of treatment.
• planning, statistics, monitoring, and evaluation of health care operations, as well as scientific research.
• billing and collection.

5. Sources of information in the register

• the individual themselves or the guardian of a minor.
• health care professional; information, responses, and opinions arising in connection with examinations and treatment.
• documents obtained from other care units with the consent of the person or the guardian of a minor.

6. Data content of the register

• the patient's name, social security number, and contact information.
• a contact person or guardian designated by the patient.
• Preliminary information and health records necessary for the patient's care.
• laboratory and research data.
• Appointment and billing information.
• Information about the author or reader of the annotation.
• information on the arrival, source, and transfer of documents.

7. To whom the data is disclosed

• Patient information is primarily disclosed with the patient's written consent.
• If the patient is unable to assess the significance of consent on their own, the information may also be disclosed to the patient’s legal representative.
• In accordance with the law, information may be disclosed to government agencies, research institutions, and insurance companies.
• Generally, data will not be transferred outside the EU or EEA.

8. Protection of patient data registers and grounds for data processing

• Patient information may be processed only by healthcare professionals involved in the patient’s care and their assistants. The information is processed only to the extent required by the procedures.
• Data is processed using a unique username and password.
• Paper records are stored in lockable filing cabinets located in secure facilities.
• Patient data is stored in Sairaala KL Oy’s centralized patient data registry based on written consent.
• An individual has the right to prohibit the storage of their data for shared use. In such a case, only the attending physician associated with the visit has the right to view and make entries in the patient record. Billing information, appointment details, and notes regarding test results remain visible.
• A patient has the right to request that their information be marked as confidential.
• Digitally stored data can be viewed and processed only using Sairaala KL Oy's unique user IDs.
• Patient data systems are actively monitored by tracking log data.

9. Right to review and correct data

• Patients have the right to review their own medical records and log data once a year at no charge.
• A patient has the right to request the correction of inaccurate information. The request must include a justification. Corrections to patient records are made in accordance with the law, so that both the correction and the original entry are reflected in the patient record.
• The request must be submitted in writing to Sairaala KL Oy, Elina Salmi, Uudenmaankatu 38 E, 00120 Helsinki.
• The requested information will be provided in writing. The patient's identity will be verified before the information is disclosed.

10. Retention period for personal data in patient records

• Patient information is stored in accordance with the Ministry of Social Affairs and Health’s Decree on Patient Records (94/2022).
• Log data is retained for at least 12 years from the date it is generated.
• Other information related to the patient data register is stored for as long as necessary for data processing (billing and collection) or as required by accounting legislation.

‍