This notice explains how personal information is processed when you visit healthwaymalta.com, send a message or request an appointment. It covers this public website and the handling of those requests. Clinical records, laboratory results, health screening submissions and care delivered through separate patient systems involve additional processing; ask the clinic for the information relevant to your care.
1. Who is responsible?
Healthway Medical Centre, operated by Dr. Miloš Rakić, is responsible for the website processing described here (the data controller). Our address is 9 Mdina Road, Ħaż-Żebbuġ ZBG 9015, Malta. For privacy questions or to exercise a right, email info@healthwaymalta.com, telephone +356 2033 1155, or write to the clinic. Please mark your request “Privacy”.
2. Information we collect
- Appointment requests: name, telephone number and, if provided, email address, requested service, preferred date/time and message. The website also records the submission time, request status and IP address.
- Contact messages: name, email address, optional telephone number, message, submission time, status and IP address.
- Technical information: website/server logs may contain your IP address, requested URL, date/time, response status, browser information and referring website. Essential session information supports forms, request validation, abuse prevention and the administrator login.
- Information you choose to share: a message or the service you request may reveal health information. Please provide only what is needed to arrange contact. Do not send identity documents, detailed medical histories or test results through these public forms.
Fields marked with an asterisk are required to handle the relevant online request. Other form fields are optional. If you prefer, contact reception by telephone. A website request is not a confirmed appointment. The forms are not an emergency service; for an emergency call 112.
3. Why we process information and our legal bases
| Purpose | Legal basis under the GDPR |
|---|---|
| Arrange an appointment or respond to a request for a clinical service. | Article 6(1)(b): take steps at your request before providing a service or perform the service arrangement. |
| Respond to general questions and manage correspondence. | Article 6(1)(f): our legitimate interest in communicating with people who contact the clinic and keeping a record of the response, balanced against their privacy rights. |
| Operate and secure the website, prevent abuse and investigate faults. | Article 6(1)(f): our legitimate interest in maintaining a reliable and secure service. |
| Meet applicable legal obligations and respond to data protection requests. | Article 6(1)(c): compliance with the relevant legal obligation. |
| Load an optional YouTube player after you request it. | Article 6(1)(a): your consent to the optional website connection. The external provider also explains its own processing in its privacy notice. |
Where health information is necessary for arranging or providing healthcare, Article 9(2)(h) applies alongside the relevant Article 6 basis, with the professional confidentiality requirements in Article 9(3). A website checkbox acknowledges this notice; it does not replace the legal basis for healthcare or authorise marketing.
We do not make automated clinical decisions or decisions with legal or similarly significant effects about you through this website. Educational calculators and information are not an assessment of your individual fitness or treatment needs.
4. Who receives information?
Authorised clinic staff handle enquiries and bookings. Form submissions are stored in the website administration database and sent as email notifications to the clinic. Hosting, email and technical support providers may process information needed to provide their services. Access should be limited to the purpose and governed by the applicable confidentiality and data protection arrangements.
If your request proceeds to care, relevant information may become part of the clinical record and be shared with healthcare professionals or other recipients as necessary for that care or a legal obligation. A public website form does not itself submit a government health screening application or automatically create a record in an external patient portal.
5. Cookies, fonts and external content
Essential sessions: contact and appointment pages use a first-party session cookie to protect and process forms; the administration area uses it for authentication. It is a session cookie, normally removed when the browser session ends, although some browsers restore sessions. Disabling it can prevent forms or login from working. Browsing ordinary information pages does not require an optional analytics or advertising cookie.
Fonts: the website serves its fonts from Healthway's own website. Loading the page does not require a connection to Google Fonts.
Google Maps
Google Maps in the website footer, including on the Contact page, loads automatically when you open a page. Your browser connects to Google and sends information such as your IP address and browser details. Google may use cookies or similar technologies in accordance with its own privacy settings and policies. There is no click-to-load step. You can block third-party content or cookies through your browser settings; this may prevent the embedded map from displaying. Leaving the page does not undo earlier processing or delete cookies already stored by Google. The clinic address and external Maps link remain available if the embedded map is blocked.
YouTube health videos
The video player loads only after you choose “Play video”. Your browser then connects to YouTube, and Google receives information needed to provide the video, including your IP address and browser details. The player uses YouTube's privacy-enhanced mode, which limits certain personalisation but does not prevent all data sharing. You can browse titles and source details without loading a player. To stop an embedded connection, reload or leave the page; this does not undo earlier processing.
Your video-player choice applies to the current page; the website does not remember video-player consent for future visits. Google's Privacy Policy explains its services. You can manage stored cookies through your browser and Google account settings.
Links to other services
WhatsApp, Facebook, Google reviews, external booking services and linked medical publishers have their own privacy arrangements. Following a link takes you to that provider. If you message the clinic through WhatsApp or email, the selected communication provider also handles that communication. For sensitive information, ask reception about an appropriate route.
6. International transfers
External providers, including Google/YouTube and communication providers, may process data outside Malta and the European Economic Area. Where we arrange a transfer subject to the GDPR, it must use a lawful transfer mechanism, such as an applicable adequacy decision or standard contractual clauses with any necessary additional safeguards. Contact us for information about the recipients, processing locations and safeguards relevant to your request, including how to obtain a copy. The external providers' privacy notices describe transfers for their own services.
7. How long information is kept
We retain website enquiries and appointment requests for the time needed to respond, arrange and follow up the request, and address any related complaint or legal claim. The appropriate period depends on whether the request led to treatment, outstanding follow-up, applicable legal duties and whether information needs to form part of a clinical record. Unnecessary duplicate website and email copies should be removed when that purpose ends. Clinical records may require longer retention than a general website enquiry.
Technical/security logs are kept for the period needed to investigate faults or abuse and meet applicable obligations. Backup copies follow the relevant hosting/email backup cycle and may remain until that cycle expires; they are not a reason to reuse information for a new purpose. This website does not promise automatic deletion on a fixed number of days. Contact us for the retention information applicable to your records.
8. Security
We use HTTPS, restricted administration access and measures intended to protect forms and stored information. Access is limited to people who need it for their duties. No website or email service can guarantee absolute security. Please do not send passwords or unnecessary sensitive information in a form message.
9. Your rights and choices
Depending on the circumstances, you can request access to your data, correction, erasure, restriction or portability. You can object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it at any time without affecting processing that was lawful before withdrawal. Some information must be retained to meet healthcare or legal obligations, so erasure is not absolute.
Contact us using the details above. We may need proportionate information to verify your identity; please do not send an identity document unless requested through an appropriate channel. We normally respond within one month. If a permitted extension is needed because a request is complex or numerous, we will explain this within that month.
You can also complain to Malta's Information and Data Protection Commissioner (IDPC), or to the competent data protection authority where you live or work. You do not have to contact the clinic before doing so.
10. Requests for children and updates to this notice
A parent or other authorised representative may contact the clinic about a child. Please share only information needed for the request; reception may check your authority before discussing confidential records. We may update this notice when processing changes. The update date above identifies the current version.