MENU
GESR Privacy Policy
Last updated: 29.10.2026
1. Company Information
This Privacy Policy explains how GESR Clinic processes the personal data of clients, patients and website visitors.
The controller responsible for processing personal data is SIA VIALS, registration number 55403058461, VAT registration number LV55403058461, registered address Kaivas iela 50 k.4-21A, Riga, LV-1021.
Clinic address: Citadeles iela 6 - 23, Riga, LV-1010. Healthcare institution code: 001000029. Telephone: +371 29115248. Email: info@gesrclinic.lv. Website: www.gesrclinic.lv.
Bank details: Citadele Bankas AS, IBAN LV42PARX0023238950001, SWIFT PARXLV22.
Head of the institution / contact person: Karina Brio.
For enquiries regarding the processing of personal data, please contact info@gesrclinic.lv.
2. General Information
GESR processes personal data for the purposes of booking patient appointments, providing medical and aesthetic services, communicating with clients, maintaining records, fulfilling legal obligations, handling enquiries and ensuring the operation of the website.
This Policy applies to clinic patients, website visitors, individuals who submit enquiries through the website, book services or contact the clinic by telephone, email, messaging applications or social media, as well as individuals who provide reviews, photographs or videos, or consent to receiving information from the clinic.
The purpose of this Policy is to provide patients and website visitors with clear information about which personal data GESR may process, for what purposes and on what legal grounds, to whom the data may be disclosed, how long they are retained, and what rights patients have.
3. Applicable Laws and Regulations
When processing personal data, GESR complies with the legislation of the European Union and the Republic of Latvia, including requirements relating to personal data protection, patients' rights, the maintenance of medical records, accounting, consumer protection and other applicable laws and regulations.
GESR processes personal data lawfully, fairly and transparently, and only to the extent necessary for a specific processing purpose.
4. Purposes of Personal Data Processing
GESR may process personal data to book patients for consultations or procedures, confirm appointments, send appointment reminders, reschedule or cancel bookings, communicate with patients, conduct consultations, select appropriate procedures, assess contraindications and safely provide medical and aesthetic services.
Personal data may also be processed to maintain patient records, prepare medical and internal documentation, process payments, maintain accounting records, handle complaints and enquiries, improve service quality, ensure the safety of patients and staff and the security of clinic property, operate the website, conduct analytics and advertising, and comply with legal requirements.
Where any data are processed on the basis of the patient's consent, the patient has the right to withdraw that consent in accordance with this Policy.
5. Legal Grounds for Data Processing
GESR processes personal data for the provision of services or in preparation for providing services, to fulfil legal obligations, on the basis of the patient's consent, on the basis of the clinic's legitimate interests, and to safely perform medical and aesthetic procedures.
Data relating to a patient's health are subject to a higher level of protection. Such data are processed only to the extent necessary to assess the patient's condition, select a procedure, check for contraindications, maintain records and safely provide a service.
6. Personal Data Collected
GESR may process the patient's first name and surname, telephone number, email address, personal identity number where required for documentation or service provision, address where required for documentation or compliance with legal obligations, appointment date and time, selected service, patient comments, appointment history, payment information, correspondence with the clinic, complaints, enquiries, reviews, patient consents, and photographs and videos where required for medical documentation or used with the patient's separate consent.
GESR processes only the data necessary for a specific purpose: booking appointments, consultations, providing services, communicating with patients, processing payments, complying with the law, handling enquiries, operating the website or another lawful purpose.
7. Health Data
As GESR provides medical and aesthetic services, the clinic may process patients' health data. Such data may include patients' complaints and symptoms, skin condition, contraindications, allergies, pregnancy or breastfeeding, medications taken, chronic illnesses, previous procedures, information about earlier injections, laser, device-based or cosmetic procedures, reactions to previous procedures, specialist recommendations and other information necessary to perform a procedure safely.
Patients must provide truthful and complete information about their health, medications, contraindications and other circumstances that may affect the safety of a procedure and its outcome.
If a patient withholds important information or provides incorrect data, this may affect whether the procedure can be performed, the patient's safety and the expected outcome.
8. Photographs and Videos
GESR may take photographs and videos before and after a procedure, photograph the condition of the skin, or create other images needed for medical documentation, assessment of results and archival storage.
Photographs or videos of a patient may be published on the website, social media, in advertising or in other public materials only with the patient's separate consent.
If a patient has consented to the publication of photographs or videos, they may withdraw that consent by contacting GESR at info@gesrclinic.lv. Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.
9. Processing and Protection of Personal Data
GESR processes personal data lawfully, fairly and only for specific purposes. Access to personal data is limited to employees and specialists who need the data to perform their duties.
Such access may be granted to clinic administrators, doctors and specialists, accounting staff, technical contractors where necessary to operate the website or the clinic's systems, and other authorised persons where necessary for service provision or compliance with the law.
GESR takes reasonable technical and organisational measures to protect data against unauthorised access, loss, alteration, unlawful use or disclosure to third parties.
10. Contractors and Data Processors
To provide services and organise the clinic's operations, GESR may engage contractors and service providers. These may include appointment booking and client database systems, accounting services, banks and payment services, website developers and technical contractors, hosting providers and data centres, marketing and advertising contractors, analytics and advertising services, email and communication services, as well as public authorities where disclosure of data is required by law.
Analytics and advertising services may include Google Analytics, Google Ads, Meta Pixel and other tools, where these are used on the website.
Data are disclosed to contractors only to the extent necessary and solely for a specific purpose. Contractors are required to process data in accordance with applicable personal data protection laws.
11. Use and Disclosure of Data to Third Parties
GESR does not sell patients' personal data to third parties.
Personal data may be disclosed to third parties where necessary to provide a service, where the patient has given consent, where required by law, where necessary to protect GESR's legitimate interests, or where data are provided to an authorised contractor to carry out a specific task.
When disclosing data, GESR seeks to ensure that only the necessary data are provided and only to recipients who genuinely need them for the relevant purpose.
12. Data Retention Periods
GESR retains personal data for as long as necessary to achieve the purposes of processing or as required by law.
Appointment and communication data are retained for as long as necessary to organise appointments and communicate with patients. Medical records are retained in accordance with statutory retention periods.
Accounting documents, including invoices, receipts and payment confirmations, are retained for 10 years.
Patient consent records and photographic and video materials are retained for as long as necessary for the relevant processing purpose, taking into account applicable legal requirements. Cookie data are retained in accordance with the GESR Cookie Policy.
After the applicable retention periods have expired, personal data are deleted or anonymised unless there are other lawful grounds for retaining them.
13. Video Surveillance
Video surveillance is carried out on the premises of GESR Clinic to ensure the safety of patients and staff and to protect clinic property.
The retention period for video surveillance recordings is 6 months.
14. Patients' Rights
Patients have the right to obtain information about the personal data processed by GESR, request access to their data, obtain a copy of their data, request correction of inaccurate or outdated data, request deletion where permitted by law, restrict processing, object to processing, withdraw consent where processing is based on consent, and lodge a complaint regarding the processing of personal data.
Certain data cannot be deleted immediately if the clinic is required to retain them by law, for medical records, accounting purposes or to protect its rights.
15. How Patients Can Contact Us About Their Data
Patients may contact GESR regarding their personal data by email at info@gesrclinic.lv.
The request should state the patient's first name and surname, contact telephone number or email address, the nature of the request, and the data or consent to which the request relates.
To protect personal data, GESR may ask the patient to verify their identity.
Response time: 14 days.
16. Withdrawal of Consent
Where the processing of data is based on a patient's consent, the patient may withdraw that consent. This may relate to marketing messages, mailings, photographs and videos, the publication of a review and cookies.
Consent may be withdrawn by contacting GESR at info@gesrclinic.lv. Consent to cookies may be changed through the cookie settings on the website, if this feature is available.
Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.
17. Complaints
If a patient believes that GESR is processing their personal data improperly, they may contact GESR by email at info@gesrclinic.lv.
If the matter is not resolved, the patient has the right to lodge a complaint with the Latvian Data State Inspectorate.
18. Website Visits and Cookies
The GESR website uses cookies and similar technologies. Cookies may be used to operate the website, ensure its security, save user preferences, perform analytics and advertising, support forms and appointment booking, and enable embedded third-party services.
Google Analytics, Google Ads, Meta Pixel and other advertising or analytics tools may be used on the website.
Users may manage cookies through the website or browser settings. More detailed information is provided in the GESR Cookie Policy.
19. Links to Third-Party Websites
The GESR website may contain links to third-party websites, social media, maps, videos or other external resources.
GESR is not responsible for the content or privacy policies of third-party websites.
Users are advised to review the terms and privacy policies of third-party websites before using them.
20. Changes to This Privacy Policy
GESR may update this Privacy Policy.
The current version of this Policy is always available on the website.
Changes take effect upon publication on the website unless otherwise stated in the new version.