1. Controller
The controller of personal data is MeditaPass s.r.o., U garáží 1434/2, 170 00 Praha 7, Company ID 23069783. For questions about data protection, write to daniel@meditapass.cz.
We pass the data needed for the insurance to the insurer Colonnade Insurance S.A., which is an independent controller in respect of that data and follows its own personal data protection policy.
2. What data we process
Insurance order
- Policyholder: first name, surname, date of birth, email, phone and address.
- Insured persons: first name, surname and date of birth.
- Insured service: what you’re insuring, who you bought it from, the price, the date of payment and the start date.
- The confirmations you give when ordering (having read the documents, requirements and needs).
Claim notification
Claim documents, such as confirmation of the cancellation, a medical report, a death certificate or a Police of the Czech Republic report. We process health data only to the extent necessary to assess the claim, and we pass it on to the insurer.
Enquiries and email communication
Name, company, contact details and the content of your message if you write to us or send an enquiry.
3. Why and on what legal basis
- Arranging and administering the insurance, handling claims — performance of a contract and steps prior to entering into it (Art. 6(1)(b) GDPR).
- Obligations of an insurance intermediary — for example, keeping records under the Insurance Distribution Act (Art. 6(1)(c) GDPR).
- Answering questions, protecting forms against misuse — legitimate interest (Art. 6(1)(f) GDPR).
- Tips and news by email, measuring traffic and advertising on social media and Google (including showing ads to people who have visited our website) — only with your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.
4. How long we keep data
- Orders that did not result in a contract: up to 6 months.
- Concluded contracts and settled claims: for the duration of the contract and then for the period required by law.
- Enquiries and emails: for the duration of the communication and up to 1 year after it ends.
- Marketing consent: until it is withdrawn.
5. Who we share data with
- Colonnade Insurance S.A. — the insurer, to conclude the contract and handle claims.
- Processors who provide website operation (hosting), the order database and email sending for us. They process data only on our instructions under a data processing agreement.
- Google Ireland Ltd. (Google Analytics, Google Ads) — only if you consent to analytics or marketing cookies respectively.
- Meta Platforms Ireland Ltd. (Meta Pixel — advertising on Facebook and Instagram) — only if you consent to marketing cookies. For the collection of data by the pixel, we and Meta are joint controllers; Meta is responsible for further processing under its own policies.
If some providers process data outside the EU, this is done on the basis of an adequacy decision (EU-US Data Privacy Framework) or standard contractual clauses.
We do not sell personal data.
6. Your rights
You have the right to access your data, have it corrected or erased, restrict its processing, data portability and to object to processing based on legitimate interest. You can withdraw your consent at any time. Write to daniel@meditapass.cz — we’ll reply within 30 days at the latest.
7. Cookies and browser storage
- Essential: the website remembers your order in progress (until you close the window) and your cookie choice in your browser. We don’t need consent for this.
- Analytics: Google Analytics 4 measures traffic (cookies
_ga,_ga_*, valid for up to 2 years). It loads only after you consent. - Marketing: Meta Pixel (cookies
_fbp,_fbc, up to 90 days) and Google Ads (_gcl_*, up to 90 days) — they make it possible to show Meditapass ads to people who have visited the website and to measure whether the ads helped. The pixel only receives information about the pages visited and about a submitted order (without names, emails or other personal data). We don’t send the claim notification page to the pixel. They load only after you consent.
Consent is valid for 12 months, and you can change or withdraw it at any time using the “Cookie settings” link in the website footer. Once you withdraw it, we delete the measurement and advertising cookies.
8. Security
Communication with the website is encrypted (HTTPS), only authorised people have access to orders, and we protect forms against automated misuse.
9. Complaints
If you believe we are processing data in breach of the regulations, you can lodge a complaint with the Office for Personal Data Protection (uoou.gov.cz). But we’d be glad to resolve it with you directly first — see contacts.