In brief
- The controller of your personal data is UAB „Baltijos ir Amerikos terapijos ir chirurgijos klinika“ (Baltic American Clinic). For questions write to [email protected].
- We process data to register you, provide health care, meet our legal obligations and – only with your consent – send news and measure our advertising.
- We ask for your personal code only when it is needed: for medical records and to book your visit in the clinic’s system. We never publish it or use it for marketing.
- We keep medical records for the periods set by law, website requests for 12 months and video recordings for 30 days.
- You can access and correct your data, withdraw consent and use your other rights, and you may complain to the State Data Protection Inspectorate.
1. Who processes your data
The controller is UAB „Baltijos ir Amerikos terapijos ir chirurgijos klinika“ (the Clinic, we), company code 110580798, VAT code LT105807917, registered office Nemenčinės pl. 54a, LT-10103 Vilnius, Lithuania, tel. +370 5 234 2020, e-mail [email protected].
This policy applies to the Clinic’s patients and their representatives, to people who book a visit or contact the Clinic, visit its premises or use the website bak.lt. We process data under the General Data Protection Regulation (EU) 2016/679 (GDPR), the Lithuanian Law on Legal Protection of Personal Data (ADTAĮ), the Law on the Rights of Patients and Compensation for Damage to Their Health and other legislation.
2. Where we get data from
- From you – when you book a visit online, by phone, by e-mail or at the Clinic, fill in documents or contact us.
- From your representative (e.g. a child’s parent or an authorised person).
- From the Clinic’s doctors and other specialists who treat you, laboratories, other health care institutions and the national e-health system (ESPBI IS) – when needed for your care and allowed by law.
- From insurance companies – when you ask your insurer to pay for the services.
- Automatically – when you browse our website (cookies, technical logs) or visit the Clinic’s premises under video surveillance.
3. Purposes and legal bases
3.1. Health care and medical records
| Data | name, surname, personal code (or date of birth if you have none), contact details, address, health information (complaints, test results, diagnoses, treatment), insurance information. |
|---|---|
| Legal basis | entering into and performing the service contract (GDPR Art. 6(1)(b)), legal obligations of the Clinic (Art. 6(1)(c)); health data are processed for the purposes of health care (Art. 9(2)(h)). |
| Must you provide it | yes. Without these data we cannot provide services or keep the medical records required by law. |
| Retention | for the periods set by law. Outpatient health records (form No. 025/a) are kept for 15 years after your last visit (Order No. 515 of the Lithuanian Minister of Health of 29 November 1999, as amended). |
3.2. Booking a visit (online, by phone, by e-mail or at the Clinic)
| Data | name, surname, phone number, e-mail address, chosen doctor or service, preferred time, whether you have supplementary health insurance; when you choose a free time – also your personal code (see section 4). Together with the booking we keep technical information about where it came from: how you arrived at the website (e.g. search, an advert, a social network – only the website address and campaign name), the first page you viewed, and your device and browser type; if you consented to analytics cookies, also the source of your first visit and how many pages you viewed. To recognise repeat bookings we create an encrypted token from your phone number and e-mail address from which they cannot be recovered. |
|---|---|
| Legal basis | steps taken at your request before entering into a contract (GDPR Art. 6(1)(b)); insofar as the chosen doctor or service reveals information about health – Art. 9(2)(h); statistics on booking sources and devices – our legitimate interest (Art. 6(1)(f)) in knowing how patients find us and improving the website; remembering the source between visits – only with your consent (Art. 6(1)(a)) given in the cookie settings. |
| Must you provide it | name, surname, phone number and e-mail address – yes, otherwise we cannot contact you, register you and send you a confirmation. When you choose a free time online, your personal code is also required – without it we cannot book the visit in the Clinic’s system. If you do not want to give your personal code or do not have one, please book by phone: +370 5 234 2020. |
| How it works | the form data are sent to the Clinic’s reception by e-mail and stored on the website. When you choose a free time, the visit is registered with your personal code in the Clinic’s registration and medical information system MEDIS. We send you a confirmation by e-mail (and by SMS where this service is in place). |
| Retention | requests sent through the website’s booking and contact forms are kept for 12 months from receipt and then deleted automatically. Data of a visit booked in the Clinic’s system are kept together with your medical records (section 3.1). |
3.3. Payments, accounting and insurers
| Data | name, surname, services provided and their price, payment information, invoices; if an insurer pays – the insurer, policy or card number and the services it pays for. |
|---|---|
| Legal basis | performance of the contract (GDPR Art. 6(1)(b)), accounting and tax legislation (Art. 6(1)(c)). We pass data to an insurer only when you want it to pay for the services. |
| Retention | accounting documents – 10 years, as required by accounting legislation. |
3.4. Enquiries, requests and complaints
| Data | name, surname, contact details, content of the enquiry or complaint, our reply. |
|---|---|
| Legal basis | the legal obligation to handle patients’ complaints and requests (GDPR Art. 6(1)(c)); otherwise our legitimate interest in replying (Art. 6(1)(f)). |
| Retention | 1 year after our reply, unless the law requires longer. |
3.5. Video surveillance of the Clinic’s premises and grounds
| Data | your image, date, time and place of the recording. |
|---|---|
| Purpose and legal basis | safety of patients, staff and visitors and protection of property – the Clinic’s legitimate interest (GDPR Art. 6(1)(f)). Signs inform about video surveillance. |
| Retention | 30 days. If a recording is needed to investigate an incident, it is kept until the investigation ends. |
3.6. Newsletters and offers
| Data | e-mail address, name, your preferences (e.g. services of interest), newsletter open and click statistics. |
|---|---|
| Legal basis | your consent (GDPR Art. 6(1)(a)). You can withdraw it at any time with the “Unsubscribe” link in every e-mail or by writing to [email protected]. Not giving or withdrawing consent does not affect your health care. |
| What we do not do | we never use health data or your personal code for marketing and make no automated decisions about you. |
| Retention | until you withdraw consent, but no longer than 3 years after you last confirmed it or contacted us. |
3.7. Website operation, security and analytics
| Data | IP address, browser and device information, pages visited and time; cookie data (see section 9). |
|---|---|
| Legal basis | running the website and protecting it from bots and attacks – legitimate interest (GDPR Art. 6(1)(f)); analytics and advertising measurement – your consent (Art. 6(1)(a)) given in the cookie settings. |
| Retention | server logs – 90 days; the record of your cookie choice (without IP address) – 12 months; cookie periods are listed in section 9. |
3.8. Job applicants
| Data | CV, contact details, education, work experience, qualification documents. |
|---|---|
| Legal basis | steps at your request before an employment contract (GDPR Art. 6(1)(b)); keeping your data for future openings – your consent (Art. 6(1)(a)). |
| Retention | until the end of the selection; with your consent – 12 months. |
4. Personal code
We process your personal code when it is needed to identify you accurately – so that medical records, test results and visits are assigned to you and mistakes are avoided – and when the law requires it (e.g. in medical records or data submitted to ESPBI IS).
When booking online with a free time, giving your personal code is required: without it we cannot book the visit in the Clinic’s MEDIS system or reserve the chosen time for you. If you do not want to give your personal code or do not have one (e.g. you are a foreign citizen), please book by phone: +370 5 234 2020. The website does not store your personal code: it is sent only to the Clinic’s system over an encrypted connection and is not included in e-mails to reception or to you.
In line with Article 3 of ADTAĮ, we never publish your personal code, never use it for direct marketing and never use it as a password or the only means of identifying you remotely.
5. Who receives your data
We share data only as far as needed for the specific purpose:
- Public authorities and registers where required by law: ESPBI IS, the National Health Insurance Fund and territorial health insurance funds (when services are paid from the Compulsory Health Insurance Fund), the National Public Health Centre, courts, law enforcement and other competent authorities.
- Other health care institutions and laboratories when needed for your care (e.g. tests or referrals).
- Insurance companies – when you want them to pay for the services.
- Processors that provide services to us under contract and act only on our instructions:
- the supplier of the Clinic’s information system MEDIS – for system maintenance;
- the website hosting (server) provider in Lithuania and the website maintenance and development provider;
- Cloudflare, Inc. – website traffic delivery and protection against attacks. Website requests, including data submitted in registration forms, pass through this service;
- e-mail service providers (the Clinic’s mailboxes, website e-mails) and the SMS service provider where used;
- Google Ireland Limited – website analytics (Google Analytics), advertising measurement (Google Ads), bot protection (reCAPTCHA) and maps (Google Maps);
- Meta Platforms Ireland Limited – advertising measurement (Meta Pixel), only with your consent;
- UAB „Omnisend“ – newsletters and marketing measurement, only with your consent;
- accounting, legal and audit service providers – where needed for their services.
We do not sell personal data.
6. Transfers outside the European Economic Area
Data in the Clinic’s medical information system are stored in Lithuania. Website requests, including registration form data, pass through the Cloudflare network. Some providers (Google, Meta, Microsoft, Cloudflare) may transfer data to the USA or other third countries. In that case the EU–U.S. Data Privacy Framework (European Commission adequacy decision of 10 July 2023) or standard contractual clauses approved by the European Commission apply. For more information write to [email protected].
7. How we protect your data
We apply organisational and technical measures: access to medical data is given only to staff who need it for their work and who are bound by confidentiality; data are transmitted over encrypted connections; servers are protected by firewalls and access control; backups are made regularly. Website forms are protected from bots, and analytics and marketing cookies are enabled only with your consent.
If a personal data breach is likely to result in a high risk to your rights, we will inform you without undue delay and notify the State Data Protection Inspectorate as required by law.
8. Your rights and how to use them
You have the right to:
- be informed about how we process your data and access them;
- access your medical records and receive copies (Article 7 of the Law on the Rights of Patients and Compensation for Damage to Their Health);
- have inaccurate data corrected and incomplete data completed;
- have data erased when they are no longer needed or processed unlawfully, except where we must keep them (e.g. medical records);
- restrict processing;
- object to processing based on legitimate interest, and object to direct marketing at any time;
- receive the data you provided in a structured, machine-readable format and have them transmitted to another controller (data portability), where processing is based on consent or contract and carried out by automated means;
- withdraw consent at any time – this does not affect the lawfulness of processing before withdrawal.
How to make a request. Send it to [email protected] from the e-mail address you gave us, in writing at the Clinic’s reception, or by post to Nemenčinės pl. 54a, LT-10103 Vilnius. To avoid disclosing data to someone else, we may ask you to confirm your identity – e.g. by showing an identity document at the Clinic. We reply within 1 month; if requests are numerous or complex, this may be extended by 2 more months, and we will tell you so within the first month. Information is provided free of charge except where the law provides otherwise.
Complaints. If you believe your data are processed unlawfully, please contact us first – we will do our best to resolve it. You also have the right to lodge a complaint with the State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija): L. Sapiegos g. 17, LT-10312 Vilnius, e-mail [email protected], tel. +370 5 271 2804, vdai.lrv.lt.
9. Cookies and website analytics
Cookies are small files stored on your device. Necessary cookies are required for the website to work. We use analytics and marketing cookies only with your consent: until you choose, they are not set and Google tags run in a limited mode (Google Consent Mode). You can change your choice at any time via “Cookie settings” at the bottom of the website.
| Cookie | Provider | Purpose | Duration |
|---|---|---|---|
| Necessary (always on) | |||
| bak_consent | bak.lt | remembers your cookie choice | 180 days |
| _GRECAPTCHA | Google (reCAPTCHA) | protects forms from bots | 6 months |
| Analytics (only with consent) | |||
| _ga, _ga_2XYGJGP23Y | Google Analytics | visit statistics: how many visitors, which pages | up to 400 days |
| bak_src (browser local storage) | bak.lt | remembers how you arrived at the website (search, an advert, another website) and how many pages you viewed, so that booking statistics show their source | 90 days |
| Marketing (only with consent) | |||
| _gcl_au | Google Ads | advertising (conversion) measurement | 90 days |
| _fbp | Meta (Facebook) | advertising measurement and more relevant ads | 90 days |
| Omnisend cookies | Omnisend | newsletter and offer measurement | as set by the provider |
Cloudflare is used to protect the website. When a security check takes place, it may set the necessary cf_clearance cookie to remember the result. More information: Cloudflare cookies.
The map on the contacts page (Google Maps) loads only when you allow it; once loaded, Google may set its own cookies. You can also delete or block cookies in your browser settings, but some website features may then not work.
10. Registering other people and children
If you register someone else (e.g. a child or a relative), provide only the data you are entitled to provide and make this policy known to them. The health care rights of children under 16 are exercised by their legal representatives. Consent to newsletters online can be given by a person aged at least 14 (Article 6 of ADTAĮ).
11. Changes to this policy
We review this policy when our processing or the law changes. The current version is always published on this page, and material changes will also be highlighted on the website. This version applies from 12 October 2026.