Privacy Statement for Terhikki
The Privacy Statement for Central Register of Health Care Professionals (Terhikki) has been updated 3.5.2023.
The controller responsible for processing your personal data is National Supervisory Authority for Welfare and Health (Valvira).
Purpose of processing personal data
The National Supervisory Authority for Welfare and Health maintains the Central Register of Health Care Professionals for the purpose of discharging its supervisory duties under the Act on the National Supervisory Authority for Welfare and Health (669/2008).
We process personal data when dealing with professional rights matters, in the supervision of professionals and in the management of data on professional rights and supervision. Furthermore, the Regional State Administrative Agencies process personal data in the register for the purpose of the steering and supervisory duties undertaken by them in their respective regions.
Valvira will not use your personal data for automated decision-making or profiling.
Personal data processed
The data entered in the Central Register of Health Care Professionals are the data specified in section 24 of the Act on Health Care Professionals.
In the matter of an application for the right to practise in a profession in health care that is regulated by law in Finland, the applicant’s following data will be processed: personal data and contact details, data on completion of training required for the right to practise, and possibly additional reports from educational institutions, employers or another public authority.
The following data will be entered for each professional in the Central Register of Health Care Professionals: name; personal ID; home address; registration number; and information on the right to practise and on the education and training qualifying the individual for the right to practise.
The following will also be entered into the Register: any decisions made by Valvira and/or a Regional State Administrative Agency concerning the discovery of errors, negligence or reprehensible conduct in the professional activities of the individual; any warnings, criminal convictions involving a fine or imprisonment, removal from a post or suspension from duty received by the individual; and any restriction or revoking of the right to practise of the individual.
We process personal data in order to comply with statutory requirements and to carry out tasks that are in the public interest, and also to exercise the public authority vested by law in Valvira and in the Regional State Administrative Agencies.
- EU General Data Protection Regulation (EU 2016/679), Article 6(1) subparagraphs c) and e).
- Data Protection Act (1050/2018), section 4(1)2.
We process data in special categories of personal data and data pertaining to crimes and misdemeanours in order to carry out tasks that are in the public interest and to exercise the public authority vested by law in Valvira.
- EU General Data Protection Regulation (EU 2016/679), Article 10.
- Data Protection Act (1050/2018), section 6(1)2 and section 7(1)2.
The duties of Valvira and of the Regional State Administrative Agencies and the processing of personal data in matters related to the right to practise a profession in health care are provided for in:
- Act on the National Supervisory Authority for Welfare and Health (669/2008), sections 2 and 3.
- Act on Health Care Professionals (559/1994).
- Decree of the Ministry of Social Affairs and Health on Health Care Professionals (564/1994).
- The publi information service of the register is provided for in the Act on Health Care Professionals (559/1994), section 24c.
Valvira and the Regional State Administrative Agencies discharge their supervisory duties jointly: the Regional State Administrative Agencies undertake supervision in their respective regions, while Valvira steers and supervises the activities of health care and social welfare professionals at the national level.
The deletion of register data is provided for in detail in section 24a of the Act on Health Care Professionals.
The retention periods for personal data are determined according to the Archives Act (831/1994), other legislation, orders and decisions issued by the National Archives, recommendations of the Information Management Board and the Valvira information management plan (eAMS); the retention periods confirmed in the eAMS are based on the screening decision of the National Archives (AL/18145/ 07.01.01.03.01/2011).
Data subjects themselves, the Population Information System of the Digital and Population Data Services Agency, the VIRTA education and training data service of the Ministry of Education and Culture, the National Registry and Data Transfer Service for Study Rights and Completed Studies (Koski) of the National Agency for Education, and the Regional State Administrative Agencies. Valvira may also receive information from other public authorities on request.
Data may be disclosed, or processing of personal data outsourced, only as allowed in currently valid legislation. Valvira enforces through agreements that any partners employed in the outsourcing of the processing of personal data (personal data processors) comply with data protection legislation.
The disclosure of register data is provided for in section 24b of the Act on Health Care Professionals.
Data are regularly disclosed on the basis of a data disclosure agreement to: Finnish Dental Association, Finnish Medical Association, Finnish Medical Society Duodecim and Tehy ry.
Data are regularly disclosed as required by law to other public authorities: Regional State Administrative Agencies, Digital and Population Data Services Agency, Social Insurance Institution (Kela), Finnish Medicines Agency Fimea, Finnish Defence Forces, Statistics Finland and National Institute for Health and Welfare.
As per section 24c of the Act on Health Care Professionals, Valvira discloses data in the public information service of the register (Julkiterhikki). The data to be disclosed in the information service are transferred from the source system once a day.
Documents and register data deemed to be retained indefinitely pursuant to the Archives Act are delivered to the National Archives for storage when no longer needed for Valvira’s own purposes as described in the present Privacy Policy. (AL/18145/ 07.01.01.03.01/2011)
Data are disclosed to parties requesting them, in accordance with the Act on the Openness of Government Activities (621/1999). Data and documents are public unless they have been specifically classified as confidential.
No data are disclosed for direct marketing, opinion polls or market research, unless disclosure for this purpose is specifically provided for by law.
Transfer of personal data to outside of the European Union or the European Economic Area
The statutory public information service of the register on the Valvira website allows access to personal data from outside the EU/EEA. Personal data will not otherwise be transferred out of the EU/EEA.
A. Right of access to data: You have the right to know whether Valvira is processing personal data concerning you. If we are, you have the right to receive a copy of such data, unless we have a legal basis for refusing to allow you to exercise this right.
B. Right to request rectification: If the personal data concerning you that we are processing are incorrect, inaccurate or outdated, you may request us to correct your data.
C.Right to restrict processing: You may have the right to restrict the processing of your personal data in cases outlined in legislation. Such restricting may be possible for instance in any of the following cases:
- you consider that the personal data concerning you are incorrect,
- the data are being processed unlawfully,
- Valvira no longer requires your personal data for the purposes described in the present Privacy Policy but you need them in order to prepare, file or defend a legal claim, or
- you have objected to the processing of your personal data.
Valvira will restrict processing of your personal data while we respond to your request(s) concerning the correcting of your personal data or to your objection to the processing of your personal data. If we restrict the processing of your personal data, we are still allowed to process your personal data:
- with your consent,
- in order to prepare, file or defend a legal claim,
- if it is in the public interest, or
- in order to safeguard the rights of another individual.
We will also notify you when the restriction on the processing of your personal data is discontinued.
D. Right to object: You have the right to object, on grounds relating to your particular situation, at any time to the processing of your personal data by Valvira for carrying out a task in the public interest, for exercising the public authority vested in the controller, or for exercising the justified interests of the controller or of a third party.
Please send requests concerning any of the above rights to the Valvira registry by e-mail ([email protected]) or by mail (Valvira, PO Box 43, FI-00521 HELSINKI). In order to ensure your privacy, we may ask you to verify your identity. We will respond to you generally within one month of receiving your request.
Right to lodge a complaint with the competent supervisory authority
If you consider that data protection legislation has been violated in the processing of your personal data, you have the right to lodge a complaint with the Office of the Data Protection Ombudsman.
Further information on the rights of data subjects can be found on the website of the Office of the Data Protection Ombudsman.
Phone (switchboard): 029 566 6700
E-mail: [email protected]
Mail address: PO Box 800, FI-00531 Helsinki, Finland