NCPeH CY - User contributions [en]

User Manuals - Providers

2025-11-21T15:03:19Z

Terspithea.kittou:

<pdf>File:Pharmacists Manual (en)-.pdf</pdf>
<pdf>File:Doctors Manual (en)- .pdf</pdf>

User Manuals - Providers

2025-11-21T15:01:23Z

Terspithea.kittou:

<pdf>File:Pharmacists Manual (en).pdf</pdf>
<pdf>File:Doctors Manual (en)- .pdf</pdf>

User Manuals - Providers

2025-11-21T14:56:58Z

Terspithea.kittou:

<pdf>File:Pharmacists Manual (en)-.pdf</pdf>
<pdf>File:Doctors Manual (en)- .pdf</pdf>

File:Doctors Manual (en)- .pdf

2025-11-21T14:55:54Z

Terspithea.kittou:

File:Pharmacists Manual (en)-.pdf

2025-11-21T14:52:55Z

Terspithea.kittou: Terspithea.kittou uploaded a new version of File:Pharmacists Manual (en)-.pdf

User Manuals - Providers

2025-11-21T14:24:32Z

Terspithea.kittou: Created page with "<pdf>File:Pharmacists Manual (en)-.pdf</pdf>"

<pdf>File:Pharmacists Manual (en)-.pdf</pdf>

File:Pharmacists Manual (en)-.pdf

2025-11-21T14:22:41Z

Terspithea.kittou:

User Manual - Citizen

2025-11-21T14:21:58Z

Terspithea.kittou: Created page with "<pdf>File:Beneficiary User Guide.pdf</pdf>"

<pdf>File:Beneficiary User Guide.pdf</pdf>

File:Beneficiary User Guide.pdf

2025-11-21T14:20:00Z

Terspithea.kittou:

Patient Information Notice

2025-11-13T10:30:19Z

Terspithea.kittou: /* (II) Summary of Member State-specific information */

= '''(I)General information about MyHealth@EU''' =

= Patient Information Notice regarding cross-border transfer of personal health data =

The following information is provided to fulfil the requirement of the EU General Data Protection Regulation to inform citizens about the processing of their personal data.

= What is the eHealth Digital Service Infrastructure? =

MyHealth@EU, also called the eHealth Digital Service Infrastructure (eHDSI), enables safe and easy access to your health data for healthcare professionals involved in your treatment and the provision of medicines - anytime and anywhere within the EU. This is done by electronic means through secure gateways provided by National Contact Points for eHealth (NCPeH) designated by each country.

Each country identifies which organization assumes the responsibility as a data controller for the processing of your data, as this is subject to the country's legislation.

See the last page for information specific to Cyprus.

= The categories of your personal health data concerned =

1)'''Patient Summary'''- It is a basic medical dataset that is transferred for the purpose of receiving treatment in another country. It includes important patient data such as allergies, current medication, previous illnesses and surgeries, that is necessary to treat the patient properly abroad. The Patient Summary includes:

*Name of the health professional - Name of the Health Professional that has been treating or taking responsibility for the patient,
*Role of the health professional - The health professional's role in the organisation (i.e., healthcare provider),
*Health professional's organisation - Name of the health professional's organisation (i.e., healthcare provider),
*Telephone no. - telephone number of the health professional at the organisation (i.e., healthcare provider),
*Email - Email of the health professional or organisation (i.e., healthcare provider),
*Network affiliation - the health professional's organization that is affiliated with a European network, e.g., the European Reference Networks (ERN),
*Related with - Identification of the entry or entries of this Patient Summary for which the health professional is the preferred contact.

2)'''Electronic prescription and dispensation''' - the patient can get a prescription for medicine from a healthcare provider in one country and receive medication through a pharmacy in another EU country. The electronic prescription contains essentially the same information as a regular paper prescription, i.e. identification of the prescriber, the patient and the medicine prescribed. The electronic dispensation includes information about the medicine dispensed. This information will be sent by the pharmacy back to the country that issued the prescription. ePrescribing is defined as prescribing medicines through the support of software by a health professional who is legally authorised to do so, so that the medicine can be dispensed by a pharmacy, and eDispensation (eDispensing) is defined as the act of electronically retrieving a prescription and reporting on the dispensation of the medicine to the patient as indicated in the corresponding ePrescription. Hence, the following information is included: a) data used to identify the health professional who is entitled (according to national law) to prescribe medicinal products, and b) data used to identify the health professionals/health care providers who are entitled (according to national law) to dispense medicinal products.

To identify the prescribing health professional, the following information is processed:

*Family name - The family name/surname/last name of the prescriber. This enables the prescriber to be traced in the event of questions or emergencies,
*Given name - The given name/first name of the prescriber. This enables the prescriber to be traced in the event of questions or emergencies,
*Professional qualifications - The professional title of the prescribing health professional, which may be used to prove the authority of the prescriber,
*Details for direct contact - Details for direct contact could be an email address and/or phone/fax number of the prescriber in order for the dispenser and/or patient to contact the prescriber. This might be necessary if problems arise with dosage, allergies, reimbursement etc.,
*Work address - This is the address of the hospital or the practice, etc. where the health professional normally works, meets patients and prescribes medication. Minimally, the country is specified,
*Signature - Digital signature or token as proof of the authenticity of the prescriber,
*Health care provider identifier - A unique number or code issued for the purpose of identifying a health care provider [ISO/TS 27527:2010]; this may be a license or registration number which can be used to trace the prescriber and to check whether a medicinal product was prescribed by the right person according to the law of the prescribing country.

3)'''Original Clinical Documents'''- containing your health information.

<ol type="I">
<li>laboratory results report:- clinical documents containing the results of laboratory tests, stored in the home Country.
<li>hospital discharge report:- clinical document generated by the healthcare provider where the patient was treated, both as an inpatient and an outpatient, which gathers the main findings, stored in the Country of Affiliation.
<li>medical imaging report:- clinical documents containing the reports on images studies.
</ol>
This personal health data is available in so far as it is already recorded in electronic form in your home country.

The source(s) of this data varies from country to country.

In a subsequent phase, regarding the exchange of clinical documents, the system will support not only the transmission of reports in PDF format but also the exchange of detailed medical images in higher resolution.

= What is the legal basis for the use of your personal data? =

The eHDSI services will become available for you only upon your explicit consent. Although emergency situations may justify the use of your data for your treatment without consent, if you don’t give explicit consent before travelling, your data will not be available through the eHDSI system when you are in another country, not even in case of emergency. When you are abroad in an actual care situation, your Patient Summary data or Electronic Prescriptions will be recorded in the country of treatment in accordance with the EU General Data Protection Regulation (GDPR), the laws of that country and the practices of the particular healthcare institution.

= What is the purpose of processing? =

Your medical data will only be used for your personal treatment or provision of medicine.
In Cyprus, the data collected for inclusion in your Patient Summary will not be used for secondary purposes, other than for statistical purposes after it has been completely anonymised. Information about the purposes of such further processing according to the laws of various countries is available at the eHDSI website.

= Who processes and has access to this data? =

Your Patient Summary data will be accessible only by authorised and identifiable health professionals involved in your treatment, under professional secrecy, in the country of treatment. These are health professionals in the healthcare organization where you receive your treatment or the pharmacy where you receive your prescribed medicine. Each country of treatment participating in the eHDSI system has undertaken to ensure that the participating health professionals and healthcare providers on their territory have adequate information and training about their duties. Please refer to the eHDSI website for details of the participating countries. The Patient Summary data and Electronic Prescriptions will be transferred through a secure gateway provided by the eHealth National Contact Point designated by each country.

= Where and how long is the personal data stored? =

The Patient Summary data may be stored for 15 years from the last update for permanent residents of Cyprus and is automatically deleted after this period. However, for visitors from other European countries, the Patient Summary is not stored at all. The retention period may vary in other countries that offer Electronic Cross-Border Health Services, with relevant information available on the eHDSI website. The storage period in other participating countries may vary. Information about the storage periods is available on the eHDSI website.

= Your access rights =

If you consent to the processing of your Patient Summary data by the eHDSI system, you must explicitly provide your consent.
You have the right to:
a) rectify any inaccurate data in your Patient Summary data, according to Article 16 of the GDPR.
b) obtain the erasure of your Patient Summary data, according to Article 17 of the GDPR.
c) object to the processing of your Patient Summary data on grounds relating to your particular situation, according to Article 21 of the GDPR.

= You have the right to withdraw your consent at any time. =

If you do not consent for your personal data to be processed by the eHDSI system, your data will not be available for you through this system when you are in another country, not even in case of emergency.

Finally, you have the right to lodge a complaint with a supervisory authority either in Cyprus or in the country of treatment, depending on the factual situation.

='''(II) Summary of Member State-specific information'''=

{| class="wikitable"
! Member State
! CYPRUS
|-
| Service(s) provided by country
|
* Patient Summary.
* Electronic Prescription and Dispensation.
|-
| Data that is exchanged
| Patient Summary:
* Identification of the patient/subject (National healthcare patient ID, Family name/surname, Given name, Date of birth, gender, Country of affiliation),
* Contact information (Patient address),
* Preferred HP to contact,
* Contact person/ Legal guardian,
* Insurance information,
* Document data,
* Author and Organisation (Author organisation, Legal authenticator),
* Additional information / Knowledge resources (External reference, Related with),
* Allergy, Medical alert information, Medical history (Vaccination/ Prophylaxis information, Resolved, closed or inactive problems, Medical history),
* Medical problems (Current problems, Medical devices and implants, Procedures, Functional status),
* Medication summary (Current and relevant past medicines),
* Social history,
* Pregnancy history (Current pregnancy status, History of previous pregnancies),
* Patient provided data,
* Results,
* Plan of Care.
Electronic prescription and dispensation:
* Patient administrative data (Family name/surname, Given name, Date of birth, Personal identifier, gender, Native language),
* Authentication of the prescription (Identifier of the Prescription, Issue date),
* Identification of the prescribing health professional (Family name, Given name, Professional qualifications, Details for direct contact, Work address, signature, Health care provider identifier),
* Identification of the prescribed product (Name of the medicinal product, Identifier of the medicinal product, Identifier(s) of the pharmaceutical product, Identifier(s) of the packaged medicinal product, Marketing authorisation holder, Active substance(s), Strength of the active substance(s), Product classification, Pharmaceutical dose form(s), Unit of presentation(s), Package type, Pack size),
* Prescription information (Quantity of prescribed product, Dose regimen, Number of units per intake, Frequency of intakes, Route of administration, Duration of treatment, Starting date of therapy, Directions for use, Prescription expiry date, Repeats, Reason for prescription, Substitution),
* Dispensation information (Identifier of the dispenser, Family name of the dispenser, Given name of the dispenser, Identifier of the pharmacy, Address of the pharmacy, Details of direct contact, Identifier of the prescription, Medicinal product, Dispensed quantity, Dispensation date, Substitution).
|-
| Role of the Country in the data exchange
|
* Accessing personal data from your home country.
(in case of electronic prescription, will also send dispensation details back to your home country).
* Providing access to your data to other health professionals in other countries.
|-
| Legal basis
|
* Your consent is needed before the service can be provided to you.
* In case of an emergency to the patient, access to your data may be available also without the consent of the patient.

Applicable law(s):

[https://www.neha.org.cy/wp-content/uploads/2022/10/%CE%9F-%CF%80%CE%B5%CF%81%CE%AF-%CE%97%CE%BB%CE%B5%CE%BA%CF%84%CF%81%CE%BF%CE%BD%CE%B9%CE%BA%CE%AE%CF%82-%CE%A5%CE%B3%CE%B5%CE%AF%CE%B1%CF%82-%CE%9D%CF%8C%CE%BC%CE%BF%CF%82-%CF%84%CE%BF%CF%85-2019.pdf Ο περί Ηλεκτρονικής Υγείας Νόμος του 2019 (neha.org.cy)]

[https://www.cylaw.org/nomoi/indexes/2013_1_149.html Ο περί Εφαρμογής των Δικαιωμάτων των Ασθενών στο πλαίσιο της Διασυνοριακής Υγειονομικής Περίθαλψης Νόμος του 2013 (cylaw.org)]

[https://www.cylaw.org/nomoi/enop/non-ind/2001_1_138/full.html Ο Περί Επεξεργασίας Δεδομένων Προσωπικού Χαρακτήρα (Προστασία του Ατόμου) Νόμος του 2001 - 138(I)/2001 (cylaw.org)]
|-
| Restriction of access to specific data
|
* You may restrict access to specific data.
Narcotic Drugs and Psychotropic Substances Regulations (Regulation 12).
 
More information about the restrictions you may set:

[https://www.moh.gov.cy/moh/phs/phs.nsf/crossborder_en/crossborder_en?OpenDocument Cross-border prescriptions | Pharmaceutical Services | (moh.gov.cy)]
|-
| Purpose of use
|
* Treatment purposes.
* Dispensation of medicinal products.
* Research, policy-making, and other secondary uses.
https://www.neha.org.cy/en/national-contact-point/
|-
| Storage of data
|Your data will be stored for:
1) PSA data will be stored for 15 years from the last reviewing.
2) PSB data will not be stored.
3) Log data will be stored forever.
* Data will be stored also for additional purposes.

Purpose: secondary use (anonymized databases). 
Storage period: will be deleted upon the receipt of patient’s request. 
Any restrictions that apply to the storage period: for secondary use all the data must be anonymized, all the data (for primary & secondary use) are stored encrypted. 
Conditions under which the data can be erased ("right to be forgotten"), e.g., the right only applies to data held at the time the request is received. It does not apply to data that may be created in the future. The right is not absolute and only applies in certain circumstances.
|-
| Data Protection Officer (DPO)

|
'''Name:''' Terpsithea Kittou 
'''Address:''' 67Α Limassol Avenue, Aglantzia, 2121, Nicosia, Cyprus 
'''Email:''' dpo@neha.org.cy 
'''Phone:''' +357 22436046 
|-
| Data Processor(s)
|
'''Name:''' National eHealth Authority 
'''Address:''' 67Α Limassol Avenue, Aglantzia, 2121, Nicosia, Cyprus 
'''Email:''' info@neha.org.cy 
'''Phone:''' +357 22436000 
|-
| Supervisory Authority
(You may need to contact the data protection officer for example in order to lodge a complaint)
|
'''Name:''' Office of the Commissioner for Personal Data Protection. 
'''Address:''' 15, Kypranoros Street, 1061 Nicosia, P.O. Box. 23378, 1682, Nicosia. 
'''Email:''' commissioner@dataprotection.gov.cy 
'''Phone:''' +357 22818456 
|}

='''(III) Link to Member State detailed health professional information notice'''=

{| class="wikitable"
! Member State
! CYPRUS
|-
| CYPRUS
|
* Patient Summary
* Electronic prescription and dispensation.
|}

Health Professional Information Notice (HPIN) about MyHealth@EU services

2025-11-13T10:29:09Z

Terspithea.kittou: /* (II) Summary of Member State-specific information */

='''(I) General information about MyHealth@EU'''=

==What is MyHealth@EU?==

MyHealth@EU, also called the eHealth Digital Service Infrastructure (eHDSI) enables the safe processing of your personal data, related to your role as a healthcare professional involved in the treatment of patients and the provision of medicines. This is done by electronic means through secure gateways provided by National Contact Points for eHealth (NCPeH) designated by each country.

Each country identifies which organization assumes the responsibility as a data controller for the processing of your data, as this is subject to the country's legislation.

See the last page for information specific to this country.

==Which categories of your data are exchanged?==

1) '''Patient summary''' – It includes critical information such as current medication, any allergies, and previous surgeries. This data is collected from the patient's country of origin and is utilized in case medical care is needed in another European Union country. Through the Summary Health Record, healthcare professionals abroad gain immediate and clear insight into the patient's health status, facilitating the provision of safe and appropriate medical care. This includes:

*Name of the health professional - Name of the Health Professional that has been treating or taking responsibility for the patient,
*Role of the health professional - The health professional's role in the organisation (i.e., healthcare provider),
*Health professional's organisation - Name of the health professional's organisation (i.e., healthcare provider),
*Telephone no. - telephone number of the health professional at the organisation (i.e., healthcare provider),
*Email - Email of the health professional or organisation (i.e., healthcare provider),
*Network affiliation - the health professional's organization that is affiliated with a European network, e.g., the European Reference Networks (ERN),
*Related with - Identification of the entry or entries of this Patient Summary for which the health professional is the preferred contact.

2) '''Electronic Prescription and Dispensation''' - the patient can get a prescription for medicine from a healthcare provider in one country and receive medication through a pharmacy in another EU country. The electronic prescription contains essentially the same information as a regular paper prescription, i.e. identification of the prescriber, the patient and the medicine prescribed. The electronic dispensation includes information about the medicine dispensed. This information will be sent by the pharmacy back to the country that issued the prescription. ePrescribing is defined as prescribing medicines through the support of software by a health professional who is legally authorised to do so, so that the medicine can be dispensed by a pharmacy, and eDispensation (eDispensing) is defined as the act of electronically retrieving a prescription and reporting on the dispensation of the medicine to the patient as indicated in the corresponding ePrescription. Hence, the following information is included: a) data used to identify the health professional who is entitled (according to national law) to prescribe medicinal products, and b) data used to identify the health professionals/health care providers who are entitled (according to national law) to dispense medicinal products.

To identify the prescribing health professional, the following information is processed:

*Family name - The family name/surname/last name of the prescriber. This enables the prescriber to be traced in the event of questions or emergencies,
*Given name - The given name/first name of the prescriber. This enables the prescriber to be traced in the event of questions or emergencies,
*Professional qualifications - The professional title of the prescribing health professional, which may be used to prove the authority of the prescriber,
*Details for direct contact - Details for direct contact could be an email address and/or phone/fax number of the prescriber in order for the dispenser and/or patient to contact the prescriber. This might be necessary if problems arise with dosage, allergies, reimbursement etc.,
*Work address - This is the address of the hospital or the practice, etc. where the health professional normally works, meets patients and prescribes medication. Minimally, the country is specified,
*Signature - Digital signature or token as proof of the authenticity of the prescriber,
*Health care provider identifier - A unique number or code issued for the purpose of identifying a health care provider [ISO/TS 27527:2010]; this may be a license or registration number which can be used to trace the prescriber and to check whether a medicinal product was prescribed by the right person according to the law of the prescribing country.

3) '''Original Clinical Documents''' – documents containing your health information.
<ol type="I">
<li>Laboratory Results - clinical documents containing the results of laboratory tests, stored in the home Country.</li>
<li>Imaging Reports - clinical documents containing the reports on images studies and, when requested, the images (e.g. in DICOM standard), stored in the home Country.</li>
<li>Discharge Reports - clinical document generated by the healthcare provider where the patient was treated, both as an inpatient and an outpatient, which gathers the main findings, stored in the Country of Affiliation.</li>
</ol>

This personal data is available in so far as it is already recorded in electronic form in your home country.
The source(s) of this data varies from country to country. In a subsequent phase, regarding the exchange of clinical documents, the system will support not only the transmission of reports in PDF format but also the exchange of detailed medical images in higher resolution.
See the last page for information specific to this country.

==What is the legal basis for the use of your personal data?==

The MyHealth@EU services will become available for you depending on the conditions set individually by each country.
When the patient receives treatment or medicine abroad, your data will be recorded in the country of treatment (or medicine dispensation) according to the EU General Data Protection Regulation, the national legislation of that country and the internal rules of the particular healthcare provider.
Emergency situations may justify the use of your data for the treatment of the patient without the patient’s consent.
See the last page for information specific to this country.

==What is the purpose of the processing?==
The primary purpose for processing your data is the medical treatment of your patient or the provision of medicine. However, due to the national legislation of each Member State, there may be additional purposes.
See the last page to check if such additional purposes are applicable to this country.

==Who processes and has access to this data? (recipients of personal data)==

Your personal data will be accessible by the National Contact Points for eHealth, i.e., entities that process your data to ensure its secure transmission to and from the specific healthcare organization or pharmacy, logging, or other related activities.
The list of data processors is indicated on the last page.

==Where and for how long is the personal data stored?==

The collected personal data may be stored in the information systems of the health institutions both in your home country and the country of treatment or dispensation of medicine.
The data shall be stored for no longer than is necessary for the purpose for which your personal data is processed. The Patient Summary data may be stored for 15 years from the last update for permanent residents of Cyprus and is automatically deleted after this period. However, for visitors from other European countries, the Patient Summary is not stored at all. The retention period may vary in other countries that offer Electronic Cross-Border Health Services, with relevant information available on the eHDSI website.

==What are your rights and how to exercise them?==

You have the right to access your personal data.
Apart from that, you can exercise the rights of rectification, erasure, restriction of the processing and data portability.
In order to exercise your rights, you may contact us.
Contact details are available on the last page.
Also, you have the right to lodge a complaint before the supervisory data protection authority.
 
The list of the national supervisory authorities can be found at https://edpb.europa.eu/about-edpb/about-edpb/members_en.

='''(II) Summary of Member State-specific information'''=

{| class="wikitable"
! Member State
! CYPRUS
|-
| Service(s) provided by country
|
* Patient Summary.
* Electronic Prescription and Dispensation.
|-
| Data that is exchanged
| Patient Summary:
* Identification of the patient/subject (National healthcare patient ID, Family name/surname, Given name, Date of birth, gender, Country of affiliation),
* Contact information (Patient address),
* Preferred HP to contact,
* Contact person/ Legal guardian,
* Insurance information,
* Document data,
* Author and Organisation (Author organisation, Legal authenticator),
* Additional information / Knowledge resources (External reference, Related with),
* Allergy, Medical alert information, Medical history (Vaccination/ Prophylaxis information, Resolved, closed or inactive problems, Medical history),
* Medical problems (Current problems, Medical devices and implants, Procedures, Functional status),
* Medication summary (Current and relevant past medicines),
* Social history,
* Pregnancy history (Current pregnancy status, History of previous pregnancies),
* Patient provided data,
* Results,
* Plan of Care.
Electronic Prescription and Dispensation:
* Patient administrative data (Family name/surname, Given name, Date of birth, Personal identifier, gender, Native language),
* Authentication of the prescription (Identifier of the Prescription, Issue date),
* Identification of the prescribing health professional (Family name, Given name, Professional qualifications, Details for direct contact, Work address, signature, Health care provider identifier),
* Identification of the prescribed product (Name of the medicinal product, Identifier of the medicinal product, Identifier(s) of the pharmaceutical product, Identifier(s) of the packaged medicinal product, Marketing authorisation holder, Active substance(s), Strength of the active substance(s), Product classification, Pharmaceutical dose form(s), Unit of presentation(s), Package type, Pack size),
* Prescription information (Quantity of prescribed product, Dose regimen, Number of units per intake, Frequency of intakes, Route of administration, Duration of treatment, Starting date of therapy, Directions for use, Prescription expiry date, Repeats, Reason for prescription, Substitution),
* Dispensation information (Identifier of the dispenser, Family name of the dispenser, Given name of the dispenser, Identifier of the pharmacy, Address of the pharmacy, Details of direct contact, Identifier of the prescription, Medicinal product, Dispensed quantity, Dispensation date, Substitution).
|-
| Role of the Country in the data exchange
|
* Accessing personal data from your home country.
(in case of electronic prescription, will also send dispensation details back to your home country).
* Providing access to your data to other health professionals in other countries.
|-
| Legal basis
|
* Your consent is needed before the service can be provided to you.
* In case of an emergency to the patient, access to your data may be available also without the consent of the patient.

Applicable law(s):

[https://www.neha.org.cy/wp-content/uploads/2022/10/%CE%9F-%CF%80%CE%B5%CF%81%CE%AF-%CE%97%CE%BB%CE%B5%CE%BA%CF%84%CF%81%CE%BF%CE%BD%CE%B9%CE%BA%CE%AE%CF%82-%CE%A5%CE%B3%CE%B5%CE%AF%CE%B1%CF%82-%CE%9D%CF%8C%CE%BC%CE%BF%CF%82-%CF%84%CE%BF%CF%85-2019.pdf Ο περί Ηλεκτρονικής Υγείας Νόμος του 2019 (neha.org.cy)]

[https://www.cylaw.org/nomoi/indexes/2013_1_149.html Ο περί Εφαρμογής των Δικαιωμάτων των Ασθενών στο πλαίσιο της Διασυνοριακής Υγειονομικής Περίθαλψης Νόμος του 2013 (cylaw.org)]

[https://www.cylaw.org/nomoi/enop/non-ind/2001_1_138/full.html Ο Περί Επεξεργασίας Δεδομένων Προσωπικού Χαρακτήρα (Προστασία του Ατόμου) Νόμος του 2001 - 138(I)/2001 (cylaw.org)]
|-
| Restriction of access to specific data
|
* You may restrict access to specific data.
Narcotic Drugs and Psychotropic Substances Regulations (Regulation 12).
 
More information about the restrictions you may set:

[https://www.moh.gov.cy/moh/phs/phs.nsf/crossborder_en/crossborder_en?OpenDocument Cross-border prescriptions | Pharmaceutical Services | (moh.gov.cy)]
|-
| Purpose of use
|
* Treatment purposes.
* Dispensation of medicinal products.
* Research, policy-making, and other secondary uses.
https://www.neha.org.cy/en/national-contact-point/
|-
| Storage of data
|Your data will be stored for:
1) PSA data will be stored for 15 years from the last reviewing.
2) PSB data will not be stored.
3) Log data will be stored forever.
* Data will be stored also for additional purposes.

Purpose: secondary use (anonymized databases). 
Storage period: will be deleted upon the receipt of patient’s request. 
Any restrictions that apply to the storage period: for secondary use all the data must be anonymized, all the data (for primary & secondary use) are stored encrypted. 
Conditions under which the data can be erased ("right to be forgotten"), e.g., the right only applies to data held at the time the request is received. It does not apply to data that may be created in the future. The right is not absolute and only applies in certain circumstances.
|-
| Data Protection Officer (DPO)

|
'''Name:''' Terpsithea Kittou 
'''Address:''' 67Α Limassol Avenue, Aglantzia, 2121, Nicosia, Cyprus 
'''Email:''' dpo@neha.org.cy 
'''Phone:''' +357 22436046 
|-
| Data Processor(s)
|
'''Name:''' National eHealh Authority 
'''Address:''' 67Α Limassol Avenue, Aglantzia, 2121, Nicosia, Cyprus 
'''Email:''' info@neha.org.cy 
'''Phone:''' +357 22436000 
|-
| Supervisory Authority
(You may need to contact the data protection officer for example in order to lodge a complaint)
|
'''Name:''' Office of the Commissioner for Personal Data Protection. 
'''Address:''' 15, Kypranoros Street, 1061 Nicosia, P.O. Box. 23378, 1682, Nicosia. 
'''Email:''' commissioner@dataprotection.gov.cy 
'''Phone:''' +357 22818456 
|}

='''(III) Link to Member State detailed health professional information notice'''=

{| class="wikitable"
! Member State
! CYPRUS
|-
| CYPRUS
|
* Patient Summary
* Electronic prescription and dispensation.
|}

Health Professional Information Notice (HPIN) about MyHealth@EU services

2025-11-13T06:27:31Z

Terspithea.kittou: /* (II) Summary of Member State-specific information */

='''(I) General information about MyHealth@EU'''=

==What is MyHealth@EU?==

MyHealth@EU, also called the eHealth Digital Service Infrastructure (eHDSI) enables the safe processing of your personal data, related to your role as a healthcare professional involved in the treatment of patients and the provision of medicines. This is done by electronic means through secure gateways provided by National Contact Points for eHealth (NCPeH) designated by each country.

Each country identifies which organization assumes the responsibility as a data controller for the processing of your data, as this is subject to the country's legislation.

See the last page for information specific to this country.

==Which categories of your data are exchanged?==

1) '''Patient summary''' – It includes critical information such as current medication, any allergies, and previous surgeries. This data is collected from the patient's country of origin and is utilized in case medical care is needed in another European Union country. Through the Summary Health Record, healthcare professionals abroad gain immediate and clear insight into the patient's health status, facilitating the provision of safe and appropriate medical care. This includes:

*Name of the health professional - Name of the Health Professional that has been treating or taking responsibility for the patient,
*Role of the health professional - The health professional's role in the organisation (i.e., healthcare provider),
*Health professional's organisation - Name of the health professional's organisation (i.e., healthcare provider),
*Telephone no. - telephone number of the health professional at the organisation (i.e., healthcare provider),
*Email - Email of the health professional or organisation (i.e., healthcare provider),
*Network affiliation - the health professional's organization that is affiliated with a European network, e.g., the European Reference Networks (ERN),
*Related with - Identification of the entry or entries of this Patient Summary for which the health professional is the preferred contact.

2) '''Electronic Prescription and Dispensation''' - the patient can get a prescription for medicine from a healthcare provider in one country and receive medication through a pharmacy in another EU country. The electronic prescription contains essentially the same information as a regular paper prescription, i.e. identification of the prescriber, the patient and the medicine prescribed. The electronic dispensation includes information about the medicine dispensed. This information will be sent by the pharmacy back to the country that issued the prescription. ePrescribing is defined as prescribing medicines through the support of software by a health professional who is legally authorised to do so, so that the medicine can be dispensed by a pharmacy, and eDispensation (eDispensing) is defined as the act of electronically retrieving a prescription and reporting on the dispensation of the medicine to the patient as indicated in the corresponding ePrescription. Hence, the following information is included: a) data used to identify the health professional who is entitled (according to national law) to prescribe medicinal products, and b) data used to identify the health professionals/health care providers who are entitled (according to national law) to dispense medicinal products.

To identify the prescribing health professional, the following information is processed:

*Family name - The family name/surname/last name of the prescriber. This enables the prescriber to be traced in the event of questions or emergencies,
*Given name - The given name/first name of the prescriber. This enables the prescriber to be traced in the event of questions or emergencies,
*Professional qualifications - The professional title of the prescribing health professional, which may be used to prove the authority of the prescriber,
*Details for direct contact - Details for direct contact could be an email address and/or phone/fax number of the prescriber in order for the dispenser and/or patient to contact the prescriber. This might be necessary if problems arise with dosage, allergies, reimbursement etc.,
*Work address - This is the address of the hospital or the practice, etc. where the health professional normally works, meets patients and prescribes medication. Minimally, the country is specified,
*Signature - Digital signature or token as proof of the authenticity of the prescriber,
*Health care provider identifier - A unique number or code issued for the purpose of identifying a health care provider [ISO/TS 27527:2010]; this may be a license or registration number which can be used to trace the prescriber and to check whether a medicinal product was prescribed by the right person according to the law of the prescribing country.

3) '''Original Clinical Documents''' – documents containing your health information.
<ol type="I">
<li>Laboratory Results - clinical documents containing the results of laboratory tests, stored in the home Country.</li>
<li>Imaging Reports - clinical documents containing the reports on images studies and, when requested, the images (e.g. in DICOM standard), stored in the home Country.</li>
<li>Discharge Reports - clinical document generated by the healthcare provider where the patient was treated, both as an inpatient and an outpatient, which gathers the main findings, stored in the Country of Affiliation.</li>
</ol>

This personal data is available in so far as it is already recorded in electronic form in your home country.
The source(s) of this data varies from country to country. In a subsequent phase, regarding the exchange of clinical documents, the system will support not only the transmission of reports in PDF format but also the exchange of detailed medical images in higher resolution.
See the last page for information specific to this country.

==What is the legal basis for the use of your personal data?==

The MyHealth@EU services will become available for you depending on the conditions set individually by each country.
When the patient receives treatment or medicine abroad, your data will be recorded in the country of treatment (or medicine dispensation) according to the EU General Data Protection Regulation, the national legislation of that country and the internal rules of the particular healthcare provider.
Emergency situations may justify the use of your data for the treatment of the patient without the patient’s consent.
See the last page for information specific to this country.

==What is the purpose of the processing?==
The primary purpose for processing your data is the medical treatment of your patient or the provision of medicine. However, due to the national legislation of each Member State, there may be additional purposes.
See the last page to check if such additional purposes are applicable to this country.

==Who processes and has access to this data? (recipients of personal data)==

Your personal data will be accessible by the National Contact Points for eHealth, i.e., entities that process your data to ensure its secure transmission to and from the specific healthcare organization or pharmacy, logging, or other related activities.
The list of data processors is indicated on the last page.

==Where and for how long is the personal data stored?==

The collected personal data may be stored in the information systems of the health institutions both in your home country and the country of treatment or dispensation of medicine.
The data shall be stored for no longer than is necessary for the purpose for which your personal data is processed. The Patient Summary data may be stored for 15 years from the last update for permanent residents of Cyprus and is automatically deleted after this period. However, for visitors from other European countries, the Patient Summary is not stored at all. The retention period may vary in other countries that offer Electronic Cross-Border Health Services, with relevant information available on the eHDSI website.

==What are your rights and how to exercise them?==

You have the right to access your personal data.
Apart from that, you can exercise the rights of rectification, erasure, restriction of the processing and data portability.
In order to exercise your rights, you may contact us.
Contact details are available on the last page.
Also, you have the right to lodge a complaint before the supervisory data protection authority.
 
The list of the national supervisory authorities can be found at https://edpb.europa.eu/about-edpb/about-edpb/members_en.

='''(II) Summary of Member State-specific information'''=

{| class="wikitable"
! Member State
! CYPRUS
|-
| Service(s) provided by country
|
* Patient Summary.
* Electronic Prescription and Dispensation.
|-
| Data that is exchanged
| Patient Summary:
* Identification of the patient/subject (National healthcare patient ID, Family name/surname, Given name, Date of birth, gender, Country of affiliation),
* Contact information (Patient address),
* Preferred HP to contact,
* Contact person/ Legal guardian,
* Insurance information,
* Document data,
* Author and Organisation (Author organisation, Legal authenticator),
* Additional information / Knowledge resources (External reference, Related with),
* Allergy, Medical alert information, Medical history (Vaccination/ Prophylaxis information, Resolved, closed or inactive problems, Medical history),
* Medical problems (Current problems, Medical devices and implants, Procedures, Functional status),
* Medication summary (Current and relevant past medicines),
* Social history,
* Pregnancy history (Current pregnancy status, History of previous pregnancies),
* Patient provided data,
* Results,
* Plan of Care.
Electronic Prescription and Dispensation:
* Patient administrative data (Family name/surname, Given name, Date of birth, Personal identifier, gender, Native language),
* Authentication of the prescription (Identifier of the Prescription, Issue date),
* Identification of the prescribing health professional (Family name, Given name, Professional qualifications, Details for direct contact, Work address, signature, Health care provider identifier),
* Identification of the prescribed product (Name of the medicinal product, Identifier of the medicinal product, Identifier(s) of the pharmaceutical product, Identifier(s) of the packaged medicinal product, Marketing authorisation holder, Active substance(s), Strength of the active substance(s), Product classification, Pharmaceutical dose form(s), Unit of presentation(s), Package type, Pack size),
* Prescription information (Quantity of prescribed product, Dose regimen, Number of units per intake, Frequency of intakes, Route of administration, Duration of treatment, Starting date of therapy, Directions for use, Prescription expiry date, Repeats, Reason for prescription, Substitution),
* Dispensation information (Identifier of the dispenser, Family name of the dispenser, Given name of the dispenser, Identifier of the pharmacy, Address of the pharmacy, Details of direct contact, Identifier of the prescription, Medicinal product, Dispensed quantity, Dispensation date, Substitution).
|-
| Role of the Country in the data exchange
|
* Accessing personal data from your home country.
(in case of electronic prescription, will also send dispensation details back to your home country).
* Providing access to your data to other health professionals in other countries.
|-
| Legal basis
|
* Your consent is needed before the service can be provided to you.
* In case of an emergency to the patient, access to your data may be available also without the consent of the patient.

Applicable law(s):

[https://www.neha.org.cy/wp-content/uploads/2022/10/%CE%9F-%CF%80%CE%B5%CF%81%CE%AF-%CE%97%CE%BB%CE%B5%CE%BA%CF%84%CF%81%CE%BF%CE%BD%CE%B9%CE%BA%CE%AE%CF%82-%CE%A5%CE%B3%CE%B5%CE%AF%CE%B1%CF%82-%CE%9D%CF%8C%CE%BC%CE%BF%CF%82-%CF%84%CE%BF%CF%85-2019.pdf Ο περί Ηλεκτρονικής Υγείας Νόμος του 2019 (neha.org.cy)]

[https://www.cylaw.org/nomoi/indexes/2013_1_149.html Ο περί Εφαρμογής των Δικαιωμάτων των Ασθενών στο πλαίσιο της Διασυνοριακής Υγειονομικής Περίθαλψης Νόμος του 2013 (cylaw.org)]

[https://www.cylaw.org/nomoi/enop/non-ind/2001_1_138/full.html Ο Περί Επεξεργασίας Δεδομένων Προσωπικού Χαρακτήρα (Προστασία του Ατόμου) Νόμος του 2001 - 138(I)/2001 (cylaw.org)]
|-
| Restriction of access to specific data
|
* You may restrict access to specific data.
Narcotic Drugs and Psychotropic Substances Regulations (Regulation 12).
 
More information about the restrictions you may set:

[https://www.moh.gov.cy/moh/phs/phs.nsf/crossborder_en/crossborder_en?OpenDocument Cross-border prescriptions | Pharmaceutical Services | (moh.gov.cy)]
|-
| Purpose of use
|
* Treatment purposes.
* Dispensation of medicinal products.
* Research, policy-making, and other secondary uses.
https://www.neha.org.cy/en/national-contact-point/
|-
| Storage of data
|Your data will be stored for:
1) PSA data will be stored for 15 years from the last reviewing.
2) PSB data will not be stored.
3) Log data will be stored forever.
* Data will be stored also for additional purposes.

Purpose: secondary use (anonymized databases). 
Storage period: will be deleted upon the receipt of patient’s request. 
Any restrictions that apply to the storage period: for secondary use all the data must be anonymized, all the data (for primary & secondary use) are stored encrypted. 
Conditions under which the data can be erased ("right to be forgotten"), e.g., the right only applies to data held at the time the request is received. It does not apply to data that may be created in the future. The right is not absolute and only applies in certain circumstances.
|-
| Data Protection Officer (DPO)

|
'''Name:''' Terpsithea Kittou 
'''Address:''' 67Α Limassol Avenue, Aglantzia, 2121, Nicosia, Cyprus 
'''Email:''' terpsithea.kittou@neha.org.cy 
'''Phone:''' +357 22436046 
|-
| Data Processor(s)
|
'''Name:''' Marios Neofytou 
'''Address:''' 67Α Limassol Avenue, Aglantzia, 2121, Nicosia, Cyprus 
'''Email:''' marios.neofytoui@neha.org.cy 
'''Phone:''' +357 22436038 
|-
| Supervisory Authority
(You may need to contact the data protection officer for example in order to lodge a complaint)
|
'''Name:''' Office of the Commissioner for Personal Data Protection. 
'''Address:''' 15, Kypranoros Street, 1061 Nicosia, P.O. Box. 23378, 1682, Nicosia. 
'''Email:''' commissioner@dataprotection.gov.cy 
'''Phone:''' +357 22818456 
|}

='''(III) Link to Member State detailed health professional information notice'''=

{| class="wikitable"
! Member State
! CYPRUS
|-
| CYPRUS
|
* Patient Summary
* Electronic prescription and dispensation.
|}

Patient Information Notice

2025-11-13T06:25:13Z

Terspithea.kittou: /* (II) Summary of Member State-specific information */

= '''(I)General information about MyHealth@EU''' =

= Patient Information Notice regarding cross-border transfer of personal health data =

The following information is provided to fulfil the requirement of the EU General Data Protection Regulation to inform citizens about the processing of their personal data.

= What is the eHealth Digital Service Infrastructure? =

MyHealth@EU, also called the eHealth Digital Service Infrastructure (eHDSI), enables safe and easy access to your health data for healthcare professionals involved in your treatment and the provision of medicines - anytime and anywhere within the EU. This is done by electronic means through secure gateways provided by National Contact Points for eHealth (NCPeH) designated by each country.

Each country identifies which organization assumes the responsibility as a data controller for the processing of your data, as this is subject to the country's legislation.

See the last page for information specific to Cyprus.

= The categories of your personal health data concerned =

1)'''Patient Summary'''- It is a basic medical dataset that is transferred for the purpose of receiving treatment in another country. It includes important patient data such as allergies, current medication, previous illnesses and surgeries, that is necessary to treat the patient properly abroad. The Patient Summary includes:

*Name of the health professional - Name of the Health Professional that has been treating or taking responsibility for the patient,
*Role of the health professional - The health professional's role in the organisation (i.e., healthcare provider),
*Health professional's organisation - Name of the health professional's organisation (i.e., healthcare provider),
*Telephone no. - telephone number of the health professional at the organisation (i.e., healthcare provider),
*Email - Email of the health professional or organisation (i.e., healthcare provider),
*Network affiliation - the health professional's organization that is affiliated with a European network, e.g., the European Reference Networks (ERN),
*Related with - Identification of the entry or entries of this Patient Summary for which the health professional is the preferred contact.

2)'''Electronic prescription and dispensation''' - the patient can get a prescription for medicine from a healthcare provider in one country and receive medication through a pharmacy in another EU country. The electronic prescription contains essentially the same information as a regular paper prescription, i.e. identification of the prescriber, the patient and the medicine prescribed. The electronic dispensation includes information about the medicine dispensed. This information will be sent by the pharmacy back to the country that issued the prescription. ePrescribing is defined as prescribing medicines through the support of software by a health professional who is legally authorised to do so, so that the medicine can be dispensed by a pharmacy, and eDispensation (eDispensing) is defined as the act of electronically retrieving a prescription and reporting on the dispensation of the medicine to the patient as indicated in the corresponding ePrescription. Hence, the following information is included: a) data used to identify the health professional who is entitled (according to national law) to prescribe medicinal products, and b) data used to identify the health professionals/health care providers who are entitled (according to national law) to dispense medicinal products.

To identify the prescribing health professional, the following information is processed:

*Family name - The family name/surname/last name of the prescriber. This enables the prescriber to be traced in the event of questions or emergencies,
*Given name - The given name/first name of the prescriber. This enables the prescriber to be traced in the event of questions or emergencies,
*Professional qualifications - The professional title of the prescribing health professional, which may be used to prove the authority of the prescriber,
*Details for direct contact - Details for direct contact could be an email address and/or phone/fax number of the prescriber in order for the dispenser and/or patient to contact the prescriber. This might be necessary if problems arise with dosage, allergies, reimbursement etc.,
*Work address - This is the address of the hospital or the practice, etc. where the health professional normally works, meets patients and prescribes medication. Minimally, the country is specified,
*Signature - Digital signature or token as proof of the authenticity of the prescriber,
*Health care provider identifier - A unique number or code issued for the purpose of identifying a health care provider [ISO/TS 27527:2010]; this may be a license or registration number which can be used to trace the prescriber and to check whether a medicinal product was prescribed by the right person according to the law of the prescribing country.

3)'''Original Clinical Documents'''- containing your health information.

<ol type="I">
<li>laboratory results report:- clinical documents containing the results of laboratory tests, stored in the home Country.
<li>hospital discharge report:- clinical document generated by the healthcare provider where the patient was treated, both as an inpatient and an outpatient, which gathers the main findings, stored in the Country of Affiliation.
<li>medical imaging report:- clinical documents containing the reports on images studies.
</ol>
This personal health data is available in so far as it is already recorded in electronic form in your home country.

The source(s) of this data varies from country to country.

In a subsequent phase, regarding the exchange of clinical documents, the system will support not only the transmission of reports in PDF format but also the exchange of detailed medical images in higher resolution.

= What is the legal basis for the use of your personal data? =

The eHDSI services will become available for you only upon your explicit consent. Although emergency situations may justify the use of your data for your treatment without consent, if you don’t give explicit consent before travelling, your data will not be available through the eHDSI system when you are in another country, not even in case of emergency. When you are abroad in an actual care situation, your Patient Summary data or Electronic Prescriptions will be recorded in the country of treatment in accordance with the EU General Data Protection Regulation (GDPR), the laws of that country and the practices of the particular healthcare institution.

= What is the purpose of processing? =

Your medical data will only be used for your personal treatment or provision of medicine.
In Cyprus, the data collected for inclusion in your Patient Summary will not be used for secondary purposes, other than for statistical purposes after it has been completely anonymised. Information about the purposes of such further processing according to the laws of various countries is available at the eHDSI website.

= Who processes and has access to this data? =

Your Patient Summary data will be accessible only by authorised and identifiable health professionals involved in your treatment, under professional secrecy, in the country of treatment. These are health professionals in the healthcare organization where you receive your treatment or the pharmacy where you receive your prescribed medicine. Each country of treatment participating in the eHDSI system has undertaken to ensure that the participating health professionals and healthcare providers on their territory have adequate information and training about their duties. Please refer to the eHDSI website for details of the participating countries. The Patient Summary data and Electronic Prescriptions will be transferred through a secure gateway provided by the eHealth National Contact Point designated by each country.

= Where and how long is the personal data stored? =

The Patient Summary data may be stored for 15 years from the last update for permanent residents of Cyprus and is automatically deleted after this period. However, for visitors from other European countries, the Patient Summary is not stored at all. The retention period may vary in other countries that offer Electronic Cross-Border Health Services, with relevant information available on the eHDSI website. The storage period in other participating countries may vary. Information about the storage periods is available on the eHDSI website.

= Your access rights =

If you consent to the processing of your Patient Summary data by the eHDSI system, you must explicitly provide your consent.
You have the right to:
a) rectify any inaccurate data in your Patient Summary data, according to Article 16 of the GDPR.
b) obtain the erasure of your Patient Summary data, according to Article 17 of the GDPR.
c) object to the processing of your Patient Summary data on grounds relating to your particular situation, according to Article 21 of the GDPR.

= You have the right to withdraw your consent at any time. =

If you do not consent for your personal data to be processed by the eHDSI system, your data will not be available for you through this system when you are in another country, not even in case of emergency.

Finally, you have the right to lodge a complaint with a supervisory authority either in Cyprus or in the country of treatment, depending on the factual situation.

='''(II) Summary of Member State-specific information'''=

{| class="wikitable"
! Member State
! CYPRUS
|-
| Service(s) provided by country
|
* Patient Summary.
* Electronic Prescription and Dispensation.
|-
| Data that is exchanged
| Patient Summary:
* Identification of the patient/subject (National healthcare patient ID, Family name/surname, Given name, Date of birth, gender, Country of affiliation),
* Contact information (Patient address),
* Preferred HP to contact,
* Contact person/ Legal guardian,
* Insurance information,
* Document data,
* Author and Organisation (Author organisation, Legal authenticator),
* Additional information / Knowledge resources (External reference, Related with),
* Allergy, Medical alert information, Medical history (Vaccination/ Prophylaxis information, Resolved, closed or inactive problems, Medical history),
* Medical problems (Current problems, Medical devices and implants, Procedures, Functional status),
* Medication summary (Current and relevant past medicines),
* Social history,
* Pregnancy history (Current pregnancy status, History of previous pregnancies),
* Patient provided data,
* Results,
* Plan of Care.
Electronic prescription and dispensation:
* Patient administrative data (Family name/surname, Given name, Date of birth, Personal identifier, gender, Native language),
* Authentication of the prescription (Identifier of the Prescription, Issue date),
* Identification of the prescribing health professional (Family name, Given name, Professional qualifications, Details for direct contact, Work address, signature, Health care provider identifier),
* Identification of the prescribed product (Name of the medicinal product, Identifier of the medicinal product, Identifier(s) of the pharmaceutical product, Identifier(s) of the packaged medicinal product, Marketing authorisation holder, Active substance(s), Strength of the active substance(s), Product classification, Pharmaceutical dose form(s), Unit of presentation(s), Package type, Pack size),
* Prescription information (Quantity of prescribed product, Dose regimen, Number of units per intake, Frequency of intakes, Route of administration, Duration of treatment, Starting date of therapy, Directions for use, Prescription expiry date, Repeats, Reason for prescription, Substitution),
* Dispensation information (Identifier of the dispenser, Family name of the dispenser, Given name of the dispenser, Identifier of the pharmacy, Address of the pharmacy, Details of direct contact, Identifier of the prescription, Medicinal product, Dispensed quantity, Dispensation date, Substitution).
|-
| Role of the Country in the data exchange
|
* Accessing personal data from your home country.
(in case of electronic prescription, will also send dispensation details back to your home country).
* Providing access to your data to other health professionals in other countries.
|-
| Legal basis
|
* Your consent is needed before the service can be provided to you.
* In case of an emergency to the patient, access to your data may be available also without the consent of the patient.

Applicable law(s):

[https://www.neha.org.cy/wp-content/uploads/2022/10/%CE%9F-%CF%80%CE%B5%CF%81%CE%AF-%CE%97%CE%BB%CE%B5%CE%BA%CF%84%CF%81%CE%BF%CE%BD%CE%B9%CE%BA%CE%AE%CF%82-%CE%A5%CE%B3%CE%B5%CE%AF%CE%B1%CF%82-%CE%9D%CF%8C%CE%BC%CE%BF%CF%82-%CF%84%CE%BF%CF%85-2019.pdf Ο περί Ηλεκτρονικής Υγείας Νόμος του 2019 (neha.org.cy)]

[https://www.cylaw.org/nomoi/indexes/2013_1_149.html Ο περί Εφαρμογής των Δικαιωμάτων των Ασθενών στο πλαίσιο της Διασυνοριακής Υγειονομικής Περίθαλψης Νόμος του 2013 (cylaw.org)]

[https://www.cylaw.org/nomoi/enop/non-ind/2001_1_138/full.html Ο Περί Επεξεργασίας Δεδομένων Προσωπικού Χαρακτήρα (Προστασία του Ατόμου) Νόμος του 2001 - 138(I)/2001 (cylaw.org)]
|-
| Restriction of access to specific data
|
* You may restrict access to specific data.
Narcotic Drugs and Psychotropic Substances Regulations (Regulation 12).
 
More information about the restrictions you may set:

[https://www.moh.gov.cy/moh/phs/phs.nsf/crossborder_en/crossborder_en?OpenDocument Cross-border prescriptions | Pharmaceutical Services | (moh.gov.cy)]
|-
| Purpose of use
|
* Treatment purposes.
* Dispensation of medicinal products.
* Research, policy-making, and other secondary uses.
https://www.neha.org.cy/en/national-contact-point/
|-
| Storage of data
|Your data will be stored for:
1) PSA data will be stored for 15 years from the last reviewing.
2) PSB data will not be stored.
3) Log data will be stored forever.
* Data will be stored also for additional purposes.

Purpose: secondary use (anonymized databases). 
Storage period: will be deleted upon the receipt of patient’s request. 
Any restrictions that apply to the storage period: for secondary use all the data must be anonymized, all the data (for primary & secondary use) are stored encrypted. 
Conditions under which the data can be erased ("right to be forgotten"), e.g., the right only applies to data held at the time the request is received. It does not apply to data that may be created in the future. The right is not absolute and only applies in certain circumstances.
|-
| Data Protection Officer (DPO)

|
'''Name:''' Terpsithea Kittou 
'''Address:''' 67Α Limassol Avenue, Aglantzia, 2121, Nicosia, Cyprus 
'''Email:''' terpsithea.kittou@neha.org.cy 
'''Phone:''' +357 22436046 
|-
| Data Processor(s)
|
'''Name:''' Marios Neofytou 
'''Address:''' 67Α Limassol Avenue, Aglantzia, 2121, Nicosia, Cyprus 
'''Email:''' marios.neofytoui@neha.org.cy 
'''Phone:''' +357 22436048 
|-
| Supervisory Authority
(You may need to contact the data protection officer for example in order to lodge a complaint)
|
'''Name:''' Office of the Commissioner for Personal Data Protection. 
'''Address:''' 15, Kypranoros Street, 1061 Nicosia, P.O. Box. 23378, 1682, Nicosia. 
'''Email:''' commissioner@dataprotection.gov.cy 
'''Phone:''' +357 22818456 
|}

='''(III) Link to Member State detailed health professional information notice'''=

{| class="wikitable"
! Member State
! CYPRUS
|-
| CYPRUS
|
* Patient Summary
* Electronic prescription and dispensation.
|}

Patient Clinical Data – Beneficiaries

2025-10-27T08:53:37Z

Terspithea.kittou: /* Τρέχοντα Προβλήματα / Διαγνώσεις */

__NOTOC__
<gallery widths="500px" heights="400px">
File: CD Generic (EN).png | Figure 4.2.4: Patient Data Preview.
</gallery>

==Παραδείγματα Συνοπτικού Ιστορικού Υγείας==

===Αλλεργίες===

<gallery widths="700px" heights="200px">
File: CD Allergies (EN).png | Figure 4.2.5: Allergic Reactions and Intolerances.
</gallery>

===Χειρουργικές Επεμβάσεις===

<gallery widths="700px" heights="200px">
File: CD Surgical Procedures (EN).png | Figure 4.2.6: Details of Prior Surgical Procedures.
</gallery>

===Τρέχοντα Προβλήματα / Διαγνώσεις===

<gallery widths="700px" heights="200px">
File: CD Current Problems (EN).png | Figure 4.2.7: Details of Current Issues/Diagnoses.
</gallery>

===Ιατρικές Συσκευές και Εμφυτεύματα===

<gallery widths="700px" heights="200px">
File: CD Medical Devices (EN).png | Figure 4.2.8: Medical Devices and Implants Preview.
</gallery>

===Συνοπτικό Φαρμακευτικό Ιστορικό===

<gallery widths="700px" heights="250px">
File: CD Medication Summary (EN).png | Figure 4.2.9: Medication History Preview
</gallery>

[[Access & View Patient Summary | Back]]

About Us

2025-07-24T11:05:53Z

Terspithea.kittou:

{{DISPLAYTITLE: About Us}}
«Deployment of Generic Cross Border eHealth Services in Cyprus»

The NCPeH CY wiki pages provide a description of the functionalities related to Cross-Border Healthcare services. Users can be physicians or pharmacists who have access to the NCPeH portal

For any enquiries please contact to:

*National eHeath Authority
*67A Limassol Avenue,
*2121, Aglantzia, Nicosia
*Cyprus
*Call Center: +357 22 436038

About Us

2025-07-24T11:03:31Z

Terspithea.kittou:

{{DISPLAYTITLE: About Us}}
«Deployment of Generic Cross Border eHealth Services in Cyprus»

The NCPeH CY wiki pages provides the description of the functionalities for the Cross-Border Health Care services. The users can be physicians or pharmacists was have access to the NCPeH portal.

For any enquiries please contact to:

*National eHeath Authority
*67A Limassol Avenue,
*2121, Aglantzia, Nicosia
*Cyprus
*Call Center: +357 22 436038

Useful Links

2025-07-24T11:02:24Z

Terspithea.kittou: /* Information on Cross Boarder Services */

__NOTOC__
=Information on Cross Boarder Services=

Useful information about Cross-Border Services can be found at the following links:

=Republic of Cyprus=

[https://www.gov.cy/moh/en/ Ministry of Health]

[https://www.moh.gov.cy/moh/cbh/cbh.nsf/index_en/index_en?OpenDocument National Contact Point on the application of Patients' Rights on Cross Border Healthcare]

=Europe=

[https://hadea.ec.europa.eu/index_en HADEA ]

[https://health.ec.europa.eu/cross-border-healthcare_en CROSS BORDER HEALTHCARE - EUROPEAN COMMISSION]

[https://ec.europa.eu/inea/en/connecting-europe-facility CEF INEA ]

Search Patient EU

2025-07-24T10:53:57Z

Terspithea.kittou:

When a physician logs into the NCPeH application, they select the cross-border functionality on the platform, indicating that they will operate as an NCPB. The physician selects the patient’s country of origin and submits a request to retrieve the Patient Summary of an EU citizen/patient, after identifying the patient based on the identification document valid in the country of residence and entering the patient's unique identifiers, as defined by each Member State for NCP purposes.

Through the cross-border gateway of the NCPeH CY, the request is forwarded to the corresponding system of the patient’s country of origin and insurance, from which the Patient Summary (PSB) is retrieved in both XML and PDF formats. The PSB files are transferred to the physician's computer without being stored on the central infrastructure of the eHealth Authority. The physician does not have the ability to edit the patient’s data; they are accessible for viewing purposes only, strictly for the provision of cross-border healthcare (eHealth Services).

The pharmacist logs into the Cross-Border eHealth system and proceeds with identification and authentication when prompted. Then, by selecting the service "Cross-Border ePrescription Dispensation" (eDispensation – eD), they choose the relevant NCP of the corresponding Member State, enter the required patient details as specified by that Member State, and proceed to dispense the prescription. The dispensation record is transmitted via the Cross-Border portal of NCPeH CY to the respective National Contact Point of the patient’s Member State of affiliation.

<gallery widths="500px" heights="230px">
File: NCPeH_HomePage_EU.png | Figure 2.1: NCPeH Platform Home Page. Select "European Citizen" to search patient at European level.
</gallery>

<gallery widths="500px" heights="170px">
File: Select_Country_Patient.png | Figure 2.1: Select the Country of the Patient.
File: Greece_Patient_Data.png | Figure 2.1: Greek Patient Data Access.
</gallery>

Each member state of the European Union determines its methods for identifying its citizens. They may have one or more identification methods. For example, if the Greek flag is selected, it indicates that you are serving a Greek citizen, who is identified by their National Security Number.

Search Patient EU

2025-07-24T10:52:00Z

Terspithea.kittou:

When a physician logs into the NCPeH application, they select the cross-border functionality on the platform, indicating that they will operate as an NCPB. The physician selects the patient’s country of origin and submits a request to retrieve the Patient Summary of an EU citizen/patient, after identifying the patient based on the identification document valid in the country of residence and entering the patient's unique identifiers, as defined by each Member State for NCP purposes.

Through the cross-border gateway of the NCPeH CY, the request is forwarded to the corresponding system of the patient’s country of origin and insurance, from which the Patient Summary (PSB) is retrieved in both XML and PDF formats. The PSB files are transferred to the physician's computer without being stored on the central infrastructure of the eHealth Authority. The physician does not have the ability to edit the patient’s data; they are accessible for viewing purposes only, strictly for the provision of cross-border healthcare (eHealth Services).

The pharmacist logs into the cross-border eHealth system and proceeds with identification and authentication when prompted. Then, by selecting the service "Cross-Border ePrescription Dispensation" (eDispensation – eD), they choose the relevant NCP of the corresponding Member State, enter the required patient details as specified by that Member State, and proceed to dispense the prescription. The dispensation record is transmitted via the Cross-Border portal of NCPeH CY to the respective National Contact Point of the patient’s Member State of affiliation.

<gallery widths="500px" heights="230px">
File: NCPeH_HomePage_EU.png | Figure 2.1: NCPeH Platform Home Page. Select "European Citizen" to search patient at European level.
</gallery>

<gallery widths="500px" heights="170px">
File: Select_Country_Patient.png | Figure 2.1: Select the Country of the Patient.
File: Greece_Patient_Data.png | Figure 2.1: Greek Patient Data Access.
</gallery>

Each member state of the European Union determines its methods for identifying its citizens. They may have one or more identification methods. For example, if the Greek flag is selected, it indicates that you are serving a Greek citizen, who is identified by their National Security Number.

Search Patient EU

2025-07-24T10:49:07Z

Terspithea.kittou:

When a physician logs into the NCPeH application, they select the cross-border functionality on the platform, indicating that they will operate as an NCPB. The physician selects the patient’s country of origin and submits a request to retrieve the Patient Summary of an EU citizen/patient, after identifying the patient based on the identification document valid in the country of residence and entering the patient's unique identifiers, as defined by each Member State for NCP purposes.

Through the cross-border gateway of the NCPeH CY, the request is forwarded to the corresponding system of the patient’s country of origin and insurance, from which the Patient Summary (PSB) is retrieved in both XML and PDF formats. The PSB files are transferred to the physician's computer without being stored on the central infrastructure of the eHealth Authority. The physician does not have the ability to edit the patient’s data; they are accessible for viewing purposes only, strictly for the provision of cross-border healthcare (eHealth Services).

The pharmacist logs into the cross-border eHealth system and proceeds with identification and authentication when prompted. Then, by selecting the service "Cross-Border ePrescription Dispensation" (eDispensation – eD), they choose the relevant NCP of the corresponding Member State, enter the required patient details as specified by that Member State, and proceed to dispense the prescription. The dispensation record is transmitted via the cross-border gateway of NCPeH CY to the respective National Contact Point of the patient’s Member State of affiliation.

<gallery widths="500px" heights="230px">
File: NCPeH_HomePage_EU.png | Figure 2.1: NCPeH Platform Home Page. Select "European Citizen" to search patient at European level.
</gallery>

<gallery widths="500px" heights="170px">
File: Select_Country_Patient.png | Figure 2.1: Select the Country of the Patient.
File: Greece_Patient_Data.png | Figure 2.1: Greek Patient Data Access.
</gallery>

Each member state of the European Union determines its methods for identifying its citizens. They may have one or more identification methods. For example, if the Greek flag is selected, it indicates that you are serving a Greek citizen, who is identified by their National Security Number.

Search Patient

2025-07-24T10:35:31Z

Terspithea.kittou: /* Existing User - Patient */

<gallery widths="500px" heights="230px">
File:NCPeH_HomePage_SP.png | Figure 2.1: NCPeH Platform Home Page. Select "National Citizen" to search patient at national level.
File:NCPeH_Search_Patient.png | Figure 2.2: To search for a patient, the physician or pharmacist must enter the patient's ID number and date of birth.
</gallery>

==Providing Electronic Cross-Border Healthcare Services to New Users==

To create a Patient Summary or issue an Electronic Prescription for a Cypriot citizen, the Healthcare Professional searches for the patient in the system using their identification details or ARC number, along with their date of birth. A unique One-Time Password (OTP) is then sent to the patient, who provides it to the Healthcare Professional. The provision of the OTP is considered as the patient’s explicit consent to proceed with the creation of the Patient Summary or the issuance of the Electronic Prescription.

<gallery widths="500px" heights="150px">
File: NCPeH_Demographics.png | Figure 2.3: In order to create the initial patient record, the physician must enter the patient's ID number, date of birth and other demographic information.
File: NCPeH_OTP.png | Figure 2.4: One-Time Password (OTP) Field.
File: NCPeH_Patient_Profile.png | Figure 2.5: Patient Profile.
</gallery>

==Providing Electronic Cross-Border Healthcare Services to Existing Users==

There is no need for the Healthcare Professional to re-enter the patient’s demographic and related details; they may proceed directly with updating and/or completing the Patient Summary and issuing the Electronic Prescription.

<gallery widths="500px" heights="150px">
File: NCPeH_Patient_Profile.png | Figure 2.6: Patient Profile.
</gallery>

Search Patient

2025-07-24T10:33:06Z

Terspithea.kittou: /* Initial Adoption of Cross-Border Services */

<gallery widths="500px" heights="230px">
File:NCPeH_HomePage_SP.png | Figure 2.1: NCPeH Platform Home Page. Select "National Citizen" to search patient at national level.
File:NCPeH_Search_Patient.png | Figure 2.2: To search for a patient, the physician or pharmacist must enter the patient's ID number and date of birth.
</gallery>

==Providing Electronic Cross-Border Healthcare Services to New Users==

To create a Patient Summary or issue an Electronic Prescription for a Cypriot citizen, the Healthcare Professional searches for the patient in the system using their identification details or ARC number, along with their date of birth. A unique One-Time Password (OTP) is then sent to the patient, who provides it to the Healthcare Professional. The provision of the OTP is considered as the patient’s explicit consent to proceed with the creation of the Patient Summary or the issuance of the Electronic Prescription.

<gallery widths="500px" heights="150px">
File: NCPeH_Demographics.png | Figure 2.3: In order to create the initial patient record, the physician must enter the patient's ID number, date of birth and other demographic information.
File: NCPeH_OTP.png | Figure 2.4: One-Time Password (OTP) Field.
File: NCPeH_Patient_Profile.png | Figure 2.5: Patient Profile.
</gallery>

==Existing User - Patient==

If the user has previously utilized cross-border services, the doctor will not need to refill the demographic fields and will be directed straight to the screen displaying the patient's profile.

<gallery widths="500px" heights="150px">
File: NCPeH_Patient_Profile.png | Figure 2.6: Patient Profile.
</gallery>

Login to Platform

2025-07-24T07:41:55Z

Terspithea.kittou: /* For New Users */

The homepage provides clear guidance for both new and existing users..
* New Users: Please follow the three predefined steps to successfully complete the login process and access the Electronic Cross-Border Health Services.
* Existing Users: Simply log in to your account to continue using the services without interruption.

= For New Users =

<gallery widths="500px" heights="250px">
File: NCPeH_LandingPage_version1.png | Figure 2.1: Login page.
</gallery>

Within the "Registry", users are required to install a digital certificate on their computer.
Detailed instructions for installing the digital certificate can be found on the page"[[Digital Certificate | Digital Certificate]] ".

= Existing Users =

[[Two-Factor Authentication | How to enable Two-Factor Authentication]]

<gallery widths="250px" heights="370px">
File: CY_Login_1.1_EN.JPG | Figure 2.8: CY Login page. Enter your credentials.

File: CY_Login_2FA.png ‎| Figure 2.9: Mobile Two Factor Authentication.

File: CY_Login_2.1_EN.png | Figure 2.10: CY Login page. Personal Information Consent.
</gallery>

<gallery widths="500px" heights="250px">
File: NCPeH HomePage_version1.png | Figure 2.11: NCPeH Platform Home Page.
</gallery>

Login to Platform

2025-07-24T07:03:09Z

Terspithea.kittou: /* For New Users */

The homepage provides clear guidance for both new and existing users..
* New Users: Please follow the three predefined steps to successfully complete the login process and access the Electronic Cross-Border Health Services.
* Existing Users: Simply log in to your account to continue using the services without interruption.

= For New Users =

<gallery widths="500px" heights="250px">
File: NCPeH_LandingPage_version1.png | Figure 2.1: Login page.
</gallery>

Within the "Registration Portal", users are required to install a digital certificate on their computer.
Detailed instructions for installing the digital certificate can be found on the page"[[Digital Certificate | Digital Certificate]] ".

= Existing Users =

[[Two-Factor Authentication | How to enable Two-Factor Authentication]]

<gallery widths="250px" heights="370px">
File: CY_Login_1.1_EN.JPG | Figure 2.8: CY Login page. Enter your credentials.

File: CY_Login_2FA.png ‎| Figure 2.9: Mobile Two Factor Authentication.

File: CY_Login_2.1_EN.png | Figure 2.10: CY Login page. Personal Information Consent.
</gallery>

<gallery widths="500px" heights="250px">
File: NCPeH HomePage_version1.png | Figure 2.11: NCPeH Platform Home Page.
</gallery>

Login to Platform

2025-07-24T06:50:35Z

Terspithea.kittou: /* Existing Users */

The homepage provides clear guidance for both new and existing users..
* New Users: Please follow the three predefined steps to successfully complete the login process and access the Electronic Cross-Border Health Services.
* Existing Users: Simply log in to your account to continue using the services without interruption.

= For New Users =

<gallery widths="500px" heights="250px">
File: NCPeH_LandingPage_version1.png | Figure 2.1: Login page.
</gallery>

= Existing Users =

[[Two-Factor Authentication | How to enable Two-Factor Authentication]]

<gallery widths="250px" heights="370px">
File: CY_Login_1.1_EN.JPG | Figure 2.8: CY Login page. Enter your credentials.

File: CY_Login_2FA.png ‎| Figure 2.9: Mobile Two Factor Authentication.

File: CY_Login_2.1_EN.png | Figure 2.10: CY Login page. Personal Information Consent.
</gallery>

<gallery widths="500px" heights="250px">
File: NCPeH HomePage_version1.png | Figure 2.11: NCPeH Platform Home Page.
</gallery>

Login to Platform

2025-07-24T06:50:16Z

Terspithea.kittou: /* For New Users */

The homepage provides clear guidance for both new and existing users..
* New Users: Please follow the three predefined steps to successfully complete the login process and access the Electronic Cross-Border Health Services.
* Existing Users: Simply log in to your account to continue using the services without interruption.

= For New Users =

<gallery widths="500px" heights="250px">
File: NCPeH_LandingPage_version1.png | Figure 2.1: Login page.
</gallery>

= Existing Users =

[[Two-Factor Authentication | How to enable Two-Factor Authentication]]

<gallery widths="250px" heights="370px">
File: CY_Login_1.1_EN.JPG | Figure 2.8: CY Login page. Enter your credentials.

File: CY_Login_2FA.png ‎| Figure 2.9: Mobile Two Factor Authentication.

File: CY_Login_2.1_EN.png | Figure 2.10: CY Login page. Personal Information Consent.
</gallery>

<gallery widths="500px" heights="250px">
File: NCPeH HomePage_version1.png | Figure 2.11: NCPeH Platform Home Page.
</gallery>

Login to Platform

2025-07-24T06:48:39Z

Terspithea.kittou: /* For New Users */

The homepage provides clear guidance for both new and existing users..
* New Users: Please follow the three predefined steps to successfully complete the login process and access the Electronic Cross-Border Health Services.
* Existing Users: Simply log in to your account to continue using the services without interruption.

= For New Users =

<gallery widths="500px" heights="250px">
File: NCPeH_LandingPage_version1.png | Figure 2.0: Login page.
</gallery>

= Existing Users =

[[Two-Factor Authentication | How to enable Two-Factor Authentication]]

<gallery widths="250px" heights="370px">
File: CY_Login_1.1_EN.JPG | Figure 2.8: CY Login page. Enter your credentials.

File: CY_Login_2FA.png ‎| Figure 2.9: Mobile Two Factor Authentication.

File: CY_Login_2.1_EN.png | Figure 2.10: CY Login page. Personal Information Consent.
</gallery>

<gallery widths="500px" heights="250px">
File: NCPeH HomePage_version1.png | Figure 2.11: NCPeH Platform Home Page.
</gallery>

Login to Platform

2025-07-24T06:47:12Z

Terspithea.kittou:

The homepage provides clear guidance for both new and existing users..
* New Users: Please follow the three predefined steps to successfully complete the login process and access the Electronic Cross-Border Health Services.
* Existing Users: Simply log in to your account to continue using the services without interruption.

= For New Users =

Once the Physician / Pharmacist is certified and authorized to access the system, he/she can search for their patients and monitor/update or retrieve patient summary, the associated medical information and e-Prescription details.

Physicians / Pharmacists are able to perform a search after they enter their username and password via GOV.CY, https://www.gov.cy/.

<gallery widths="500px" heights="250px">
File: NCPeH_LandingPage_version1.png | Figure 2.0: Login page.
</gallery>

= Existing Users =

[[Two-Factor Authentication | How to enable Two-Factor Authentication]]

<gallery widths="250px" heights="370px">
File: CY_Login_1.1_EN.JPG | Figure 2.8: CY Login page. Enter your credentials.

File: CY_Login_2FA.png ‎| Figure 2.9: Mobile Two Factor Authentication.

File: CY_Login_2.1_EN.png | Figure 2.10: CY Login page. Personal Information Consent.
</gallery>

<gallery widths="500px" heights="250px">
File: NCPeH HomePage_version1.png | Figure 2.11: NCPeH Platform Home Page.
</gallery>

Login to Platform

2025-07-24T06:44:12Z

Terspithea.kittou:

The homepage provides clear guidance for both new and existing users..
* New Users: Please follow the three predefined steps to successfully complete the login process and access the Electronic Cross-Border Health Services.
* Existing Users: Simply log in to your account to continue using the services without interruption.

= For New Users =

Once the Physician / Pharmacist is certified and authorized to access the system, he/she can search for their patients and monitor/update or retrieve patient summary, the associated medical information and e-Prescription details.

Physicians / Pharmacists are able to perform a search after they enter their username and password via GOV.CY, https://www.gov.cy/.

<gallery widths="500px" heights="250px">
File: NCPeH_LandingPage_version1.png | Figure 2.0: Login page.
</gallery>

= Existing Users =

[[Two-Factor Authentication | How to enable Two-Factor Authentication]]

<gallery widths="250px" heights="370px">
File: CY_Login_1.1_EN.JPG | Figure 2.1: CY Login page. Enter your credentials.

File: CY_Login_2FA.png ‎| Figure 2.2: Mobile Two Factor Authentication.

File: CY_Login_2.1_EN.png | Figure 2.3: CY Login page. Personal Information Consent.
</gallery>

<gallery widths="500px" heights="250px">
File: NCPeH HomePage_version1.png | Figure 2.4: NCPeH Platform Home Page.
</gallery>

Login to Platform

2025-07-24T06:41:51Z

Terspithea.kittou: /* The user (Physician or Pharmacist) */

The homepage provides clear guidance for both new and existing users..
* New Users: Please follow the three predefined steps to successfully complete the login process and access the Electronic Cross-Border Health Services.
* Existing Users: Simply log in to your account to continue using the services without interruption.

= For New Users =

Once the Physician / Pharmacist is certified and authorized to access the system, he/she can search for their patients and monitor/update or retrieve patient summary, the associated medical information and e-Prescription details.

Physicians / Pharmacists are able to perform a search after they enter their username and password via GOV.CY, https://www.gov.cy/.

<gallery widths="500px" heights="250px">
File: NCPeH_LandingPage_version1.png | Figure 2.0: Login page.
</gallery>

[[Two-Factor Authentication | How to enable Two-Factor Authentication]]

<gallery widths="250px" heights="370px">
File: CY_Login_1.1_EN.JPG | Figure 2.1: CY Login page. Enter your credentials.

File: CY_Login_2FA.png ‎| Figure 2.2: Mobile Two Factor Authentication.

File: CY_Login_2.1_EN.png | Figure 2.3: CY Login page. Personal Information Consent.
</gallery>

<gallery widths="500px" heights="250px">
File: NCPeH HomePage_version1.png | Figure 2.4: NCPeH Platform Home Page.
</gallery>

Login to Platform

2025-07-24T06:40:06Z

Terspithea.kittou:

The homepage provides clear guidance for both new and existing users..
* New Users: Please follow the three predefined steps to successfully complete the login process and access the Electronic Cross-Border Health Services.
* Existing Users: Simply log in to your account to continue using the services without interruption.

= The user (Physician or Pharmacist) =

Once the Physician / Pharmacist is certified and authorized to access the system, he/she can search for their patients and monitor/update or retrieve patient summary, the associated medical information and e-Prescription details.

Physicians / Pharmacists are able to perform a search after they enter their username and password via GOV.CY, https://www.gov.cy/.

<gallery widths="500px" heights="250px">
File: NCPeH_LandingPage_version1.png | Figure 2.0: Login page.
</gallery>

[[Two-Factor Authentication | How to enable Two-Factor Authentication]]

<gallery widths="250px" heights="370px">
File: CY_Login_1.1_EN.JPG | Figure 2.1: CY Login page. Enter your credentials.

File: CY_Login_2FA.png ‎| Figure 2.2: Mobile Two Factor Authentication.

File: CY_Login_2.1_EN.png | Figure 2.3: CY Login page. Personal Information Consent.
</gallery>

<gallery widths="500px" heights="250px">
File: NCPeH HomePage_version1.png | Figure 2.4: NCPeH Platform Home Page.
</gallery>

Health Professional Information Notice (HPIN) about MyHealth@EU services

2025-07-24T06:26:17Z

Terspithea.kittou: /* (II) Summary of Member State-specific information */

='''(I) General information about MyHealth@EU'''=

==What is MyHealth@EU?==

MyHealth@EU, also called the eHealth Digital Service Infrastructure (eHDSI) enables the safe processing of your personal data, related to your role as a healthcare professional involved in the treatment of patients and the provision of medicines. This is done by electronic means through secure gateways provided by National Contact Points for eHealth (NCPeH) designated by each country.

Each country identifies which organization assumes the responsibility as a data controller for the processing of your data, as this is subject to the country's legislation.

See the last page for information specific to this country.

==Which categories of your data are exchanged?==

1) '''Patient summary''' – It includes critical information such as current medication, any allergies, and previous surgeries. This data is collected from the patient's country of origin and is utilized in case medical care is needed in another European Union country. Through the Summary Health Record, healthcare professionals abroad gain immediate and clear insight into the patient's health status, facilitating the provision of safe and appropriate medical care. This includes:

*Name of the health professional - Name of the Health Professional that has been treating or taking responsibility for the patient,
*Role of the health professional - The health professional's role in the organisation (i.e., healthcare provider),
*Health professional's organisation - Name of the health professional's organisation (i.e., healthcare provider),
*Telephone no. - telephone number of the health professional at the organisation (i.e., healthcare provider),
*Email - Email of the health professional or organisation (i.e., healthcare provider),
*Network affiliation - the health professional's organization that is affiliated with a European network, e.g., the European Reference Networks (ERN),
*Related with - Identification of the entry or entries of this Patient Summary for which the health professional is the preferred contact.

2) '''Electronic Prescription and Dispensation''' - the patient can get a prescription for medicine from a healthcare provider in one country and receive medication through a pharmacy in another EU country. The electronic prescription contains essentially the same information as a regular paper prescription, i.e. identification of the prescriber, the patient and the medicine prescribed. The electronic dispensation includes information about the medicine dispensed. This information will be sent by the pharmacy back to the country that issued the prescription. ePrescribing is defined as prescribing medicines through the support of software by a health professional who is legally authorised to do so, so that the medicine can be dispensed by a pharmacy, and eDispensation (eDispensing) is defined as the act of electronically retrieving a prescription and reporting on the dispensation of the medicine to the patient as indicated in the corresponding ePrescription. Hence, the following information is included: a) data used to identify the health professional who is entitled (according to national law) to prescribe medicinal products, and b) data used to identify the health professionals/health care providers who are entitled (according to national law) to dispense medicinal products.

To identify the prescribing health professional, the following information is processed:

*Family name - The family name/surname/last name of the prescriber. This enables the prescriber to be traced in the event of questions or emergencies,
*Given name - The given name/first name of the prescriber. This enables the prescriber to be traced in the event of questions or emergencies,
*Professional qualifications - The professional title of the prescribing health professional, which may be used to prove the authority of the prescriber,
*Details for direct contact - Details for direct contact could be an email address and/or phone/fax number of the prescriber in order for the dispenser and/or patient to contact the prescriber. This might be necessary if problems arise with dosage, allergies, reimbursement etc.,
*Work address - This is the address of the hospital or the practice, etc. where the health professional normally works, meets patients and prescribes medication. Minimally, the country is specified,
*Signature - Digital signature or token as proof of the authenticity of the prescriber,
*Health care provider identifier - A unique number or code issued for the purpose of identifying a health care provider [ISO/TS 27527:2010]; this may be a license or registration number which can be used to trace the prescriber and to check whether a medicinal product was prescribed by the right person according to the law of the prescribing country.

3) '''Original Clinical Documents''' – documents containing your health information.
<ol type="I">
<li>Laboratory Results - clinical documents containing the results of laboratory tests, stored in the home Country.</li>
<li>Imaging Reports - clinical documents containing the reports on images studies and, when requested, the images (e.g. in DICOM standard), stored in the home Country.</li>
<li>Discharge Reports - clinical document generated by the healthcare provider where the patient was treated, both as an inpatient and an outpatient, which gathers the main findings, stored in the Country of Affiliation.</li>
</ol>

This personal data is available in so far as it is already recorded in electronic form in your home country.
The source(s) of this data varies from country to country. In a subsequent phase, regarding the exchange of clinical documents, the system will support not only the transmission of reports in PDF format but also the exchange of detailed medical images in higher resolution.
See the last page for information specific to this country.

==What is the legal basis for the use of your personal data?==

The MyHealth@EU services will become available for you depending on the conditions set individually by each country.
When the patient receives treatment or medicine abroad, your data will be recorded in the country of treatment (or medicine dispensation) according to the EU General Data Protection Regulation, the national legislation of that country and the internal rules of the particular healthcare provider.
Emergency situations may justify the use of your data for the treatment of the patient without the patient’s consent.
See the last page for information specific to this country.

==What is the purpose of the processing?==
The primary purpose for processing your data is the medical treatment of your patient or the provision of medicine. However, due to the national legislation of each Member State, there may be additional purposes.
See the last page to check if such additional purposes are applicable to this country.

==Who processes and has access to this data? (recipients of personal data)==

Your personal data will be accessible by the National Contact Points for eHealth, i.e., entities that process your data to ensure its secure transmission to and from the specific healthcare organization or pharmacy, logging, or other related activities.
The list of data processors is indicated on the last page.

==Where and for how long is the personal data stored?==

The collected personal data may be stored in the information systems of the health institutions both in your home country and the country of treatment or dispensation of medicine.
The data shall be stored for no longer than is necessary for the purpose for which your personal data is processed. The Patient Summary data may be stored for 15 years from the last update for permanent residents of Cyprus and is automatically deleted after this period. However, for visitors from other European countries, the Patient Summary is not stored at all. The retention period may vary in other countries that offer Electronic Cross-Border Health Services, with relevant information available on the eHDSI website.

==What are your rights and how to exercise them?==

You have the right to access your personal data.
Apart from that, you can exercise the rights of rectification, erasure, restriction of the processing and data portability.
In order to exercise your rights, you may contact us.
Contact details are available on the last page.
Also, you have the right to lodge a complaint before the supervisory data protection authority.
 
The list of the national supervisory authorities can be found at https://edpb.europa.eu/about-edpb/about-edpb/members_en.

='''(II) Summary of Member State-specific information'''=

{| class="wikitable"
! Member State
! CYPRUS
|-
| Service(s) provided by country
|
* Patient Summary.
* Electronic Prescription and Dispensation.
|-
| Data that is exchanged
| Patient Summary:
* Identification of the patient/subject (National healthcare patient ID, Family name/surname, Given name, Date of birth, gender, Country of affiliation),
* Contact information (Patient address),
* Preferred HP to contact,
* Contact person/ Legal guardian,
* Insurance information,
* Document data,
* Author and Organisation (Author organisation, Legal authenticator),
* Additional information / Knowledge resources (External reference, Related with),
* Allergy, Medical alert information, Medical history (Vaccination/ Prophylaxis information, Resolved, closed or inactive problems, Medical history),
* Medical problems (Current problems, Medical devices and implants, Procedures, Functional status),
* Medication summary (Current and relevant past medicines),
* Social history,
* Pregnancy history (Current pregnancy status, History of previous pregnancies),
* Patient provided data,
* Results,
* Plan of Care.
Electronic Prescription and Dispensation:
* Patient administrative data (Family name/surname, Given name, Date of birth, Personal identifier, gender, Native language),
* Authentication of the prescription (Identifier of the Prescription, Issue date),
* Identification of the prescribing health professional (Family name, Given name, Professional qualifications, Details for direct contact, Work address, signature, Health care provider identifier),
* Identification of the prescribed product (Name of the medicinal product, Identifier of the medicinal product, Identifier(s) of the pharmaceutical product, Identifier(s) of the packaged medicinal product, Marketing authorisation holder, Active substance(s), Strength of the active substance(s), Product classification, Pharmaceutical dose form(s), Unit of presentation(s), Package type, Pack size),
* Prescription information (Quantity of prescribed product, Dose regimen, Number of units per intake, Frequency of intakes, Route of administration, Duration of treatment, Starting date of therapy, Directions for use, Prescription expiry date, Repeats, Reason for prescription, Substitution),
* Dispensation information (Identifier of the dispenser, Family name of the dispenser, Given name of the dispenser, Identifier of the pharmacy, Address of the pharmacy, Details of direct contact, Identifier of the prescription, Medicinal product, Dispensed quantity, Dispensation date, Substitution).
|-
| Role of the Country in the data exchange
|
* Accessing personal data from your home country.
(in case of electronic prescription, will also send dispensation details back to your home country).
* Providing access to your data to other health professionals in other countries.
|-
| Legal basis
|
* Your consent is needed before the service can be provided to you.
* In case of an emergency to the patient, access to your data may be available also without the consent of the patient.

Applicable law(s):

[https://www.neha.org.cy/wp-content/uploads/2022/10/%CE%9F-%CF%80%CE%B5%CF%81%CE%AF-%CE%97%CE%BB%CE%B5%CE%BA%CF%84%CF%81%CE%BF%CE%BD%CE%B9%CE%BA%CE%AE%CF%82-%CE%A5%CE%B3%CE%B5%CE%AF%CE%B1%CF%82-%CE%9D%CF%8C%CE%BC%CE%BF%CF%82-%CF%84%CE%BF%CF%85-2019.pdf Ο περί Ηλεκτρονικής Υγείας Νόμος του 2019 (neha.org.cy)]

[https://www.cylaw.org/nomoi/indexes/2013_1_149.html Ο περί Εφαρμογής των Δικαιωμάτων των Ασθενών στο πλαίσιο της Διασυνοριακής Υγειονομικής Περίθαλψης Νόμος του 2013 (cylaw.org)]

[https://www.cylaw.org/nomoi/enop/non-ind/2001_1_138/full.html Ο Περί Επεξεργασίας Δεδομένων Προσωπικού Χαρακτήρα (Προστασία του Ατόμου) Νόμος του 2001 - 138(I)/2001 (cylaw.org)]
|-
| Restriction of access to specific data
|
* You may restrict access to specific data.
Narcotic Drugs and Psychotropic Substances Regulations (Regulation 12).
 
More information about the restrictions you may set:

[https://www.moh.gov.cy/moh/phs/phs.nsf/crossborder_en/crossborder_en?OpenDocument Cross-border prescriptions | Pharmaceutical Services | (moh.gov.cy)]
|-
| Purpose of use
|
* Treatment purposes.
* Dispensation of medicinal products.
* Research, policy-making, and other secondary uses.
https://www.neha.org.cy/en/national-contact-point/
|-
| Storage of data
|Your data will be stored for:
1) PSA data will be stored for 15 years from the last reviewing.
2) PSB data will not be stored.
3) Log data will be stored forever.
* Data will be stored also for additional purposes.

Purpose: secondary use (anonymized databases). 
Storage period: will be deleted upon the receipt of patient’s request. 
Any restrictions that apply to the storage period: for secondary use all the data must be anonymized, all the data (for primary & secondary use) are stored encrypted. 
Conditions under which the data can be erased ("right to be forgotten"), e.g., the right only applies to data held at the time the request is received. It does not apply to data that may be created in the future. The right is not absolute and only applies in certain circumstances.
|-
| Data Controller(s)
(You may need to contact the data controller for example in order to exercise your data protection rights)
|
'''Name:''' Rafael Michael 
'''Address:''' 67Α Limassol Avenue, Aglantzia, 2121, Nicosia, Cyprus 
'''Email:''' rafael.michael@neha.org.cy 
'''Phone:''' +357 22436004 
|-
| Data Processor(s)
|
'''Name:''' Vanthia Toumpouri 
'''Address:''' 67Α Limassol Avenue, Aglantzia, 2121, Nicosia, Cyprus 
'''Email:''' vanthia.toumpouri@neha.org.cy 
'''Phone:''' +357 22436031 
|-
| Data Protection Officer
(You may need to contact the data protection officer for example in order to lodge a complaint)
|
'''Name:''' Office of the Commissioner for Personal Data Protection. 
'''Address:''' 15, Kypranoros Street, 1061 Nicosia, P.O. Box. 23378, 1682, Nicosia. 
'''Email:''' commissioner@dataprotection.gov.cy 
'''Phone:''' +357 22818456 
|}

='''(III) Link to Member State detailed health professional information notice'''=

{| class="wikitable"
! Member State
! CYPRUS
|-
| CYPRUS
|
* Patient Summary
* Electronic prescription and dispensation.
|}

Health Professional Information Notice (HPIN) about MyHealth@EU services

2025-07-24T06:10:06Z

Terspithea.kittou: /* Where and for how long is the personal data stored? */

='''(I) General information about MyHealth@EU'''=

==What is MyHealth@EU?==

MyHealth@EU, also called the eHealth Digital Service Infrastructure (eHDSI) enables the safe processing of your personal data, related to your role as a healthcare professional involved in the treatment of patients and the provision of medicines. This is done by electronic means through secure gateways provided by National Contact Points for eHealth (NCPeH) designated by each country.

Each country identifies which organization assumes the responsibility as a data controller for the processing of your data, as this is subject to the country's legislation.

See the last page for information specific to this country.

==Which categories of your data are exchanged?==

1) '''Patient summary''' – It includes critical information such as current medication, any allergies, and previous surgeries. This data is collected from the patient's country of origin and is utilized in case medical care is needed in another European Union country. Through the Summary Health Record, healthcare professionals abroad gain immediate and clear insight into the patient's health status, facilitating the provision of safe and appropriate medical care. This includes:

*Name of the health professional - Name of the Health Professional that has been treating or taking responsibility for the patient,
*Role of the health professional - The health professional's role in the organisation (i.e., healthcare provider),
*Health professional's organisation - Name of the health professional's organisation (i.e., healthcare provider),
*Telephone no. - telephone number of the health professional at the organisation (i.e., healthcare provider),
*Email - Email of the health professional or organisation (i.e., healthcare provider),
*Network affiliation - the health professional's organization that is affiliated with a European network, e.g., the European Reference Networks (ERN),
*Related with - Identification of the entry or entries of this Patient Summary for which the health professional is the preferred contact.

2) '''Electronic Prescription and Dispensation''' - the patient can get a prescription for medicine from a healthcare provider in one country and receive medication through a pharmacy in another EU country. The electronic prescription contains essentially the same information as a regular paper prescription, i.e. identification of the prescriber, the patient and the medicine prescribed. The electronic dispensation includes information about the medicine dispensed. This information will be sent by the pharmacy back to the country that issued the prescription. ePrescribing is defined as prescribing medicines through the support of software by a health professional who is legally authorised to do so, so that the medicine can be dispensed by a pharmacy, and eDispensation (eDispensing) is defined as the act of electronically retrieving a prescription and reporting on the dispensation of the medicine to the patient as indicated in the corresponding ePrescription. Hence, the following information is included: a) data used to identify the health professional who is entitled (according to national law) to prescribe medicinal products, and b) data used to identify the health professionals/health care providers who are entitled (according to national law) to dispense medicinal products.

To identify the prescribing health professional, the following information is processed:

*Family name - The family name/surname/last name of the prescriber. This enables the prescriber to be traced in the event of questions or emergencies,
*Given name - The given name/first name of the prescriber. This enables the prescriber to be traced in the event of questions or emergencies,
*Professional qualifications - The professional title of the prescribing health professional, which may be used to prove the authority of the prescriber,
*Details for direct contact - Details for direct contact could be an email address and/or phone/fax number of the prescriber in order for the dispenser and/or patient to contact the prescriber. This might be necessary if problems arise with dosage, allergies, reimbursement etc.,
*Work address - This is the address of the hospital or the practice, etc. where the health professional normally works, meets patients and prescribes medication. Minimally, the country is specified,
*Signature - Digital signature or token as proof of the authenticity of the prescriber,
*Health care provider identifier - A unique number or code issued for the purpose of identifying a health care provider [ISO/TS 27527:2010]; this may be a license or registration number which can be used to trace the prescriber and to check whether a medicinal product was prescribed by the right person according to the law of the prescribing country.

3) '''Original Clinical Documents''' – documents containing your health information.
<ol type="I">
<li>Laboratory Results - clinical documents containing the results of laboratory tests, stored in the home Country.</li>
<li>Imaging Reports - clinical documents containing the reports on images studies and, when requested, the images (e.g. in DICOM standard), stored in the home Country.</li>
<li>Discharge Reports - clinical document generated by the healthcare provider where the patient was treated, both as an inpatient and an outpatient, which gathers the main findings, stored in the Country of Affiliation.</li>
</ol>

This personal data is available in so far as it is already recorded in electronic form in your home country.
The source(s) of this data varies from country to country. In a subsequent phase, regarding the exchange of clinical documents, the system will support not only the transmission of reports in PDF format but also the exchange of detailed medical images in higher resolution.
See the last page for information specific to this country.

==What is the legal basis for the use of your personal data?==

The MyHealth@EU services will become available for you depending on the conditions set individually by each country.
When the patient receives treatment or medicine abroad, your data will be recorded in the country of treatment (or medicine dispensation) according to the EU General Data Protection Regulation, the national legislation of that country and the internal rules of the particular healthcare provider.
Emergency situations may justify the use of your data for the treatment of the patient without the patient’s consent.
See the last page for information specific to this country.

==What is the purpose of the processing?==
The primary purpose for processing your data is the medical treatment of your patient or the provision of medicine. However, due to the national legislation of each Member State, there may be additional purposes.
See the last page to check if such additional purposes are applicable to this country.

==Who processes and has access to this data? (recipients of personal data)==

Your personal data will be accessible by the National Contact Points for eHealth, i.e., entities that process your data to ensure its secure transmission to and from the specific healthcare organization or pharmacy, logging, or other related activities.
The list of data processors is indicated on the last page.

==Where and for how long is the personal data stored?==

The collected personal data may be stored in the information systems of the health institutions both in your home country and the country of treatment or dispensation of medicine.
The data shall be stored for no longer than is necessary for the purpose for which your personal data is processed. The Patient Summary data may be stored for 15 years from the last update for permanent residents of Cyprus and is automatically deleted after this period. However, for visitors from other European countries, the Patient Summary is not stored at all. The retention period may vary in other countries that offer Electronic Cross-Border Health Services, with relevant information available on the eHDSI website.

==What are your rights and how to exercise them?==

You have the right to access your personal data.
Apart from that, you can exercise the rights of rectification, erasure, restriction of the processing and data portability.
In order to exercise your rights, you may contact us.
Contact details are available on the last page.
Also, you have the right to lodge a complaint before the supervisory data protection authority.
 
The list of the national supervisory authorities can be found at https://edpb.europa.eu/about-edpb/about-edpb/members_en.

='''(II) Summary of Member State-specific information'''=

{| class="wikitable"
! Member State
! CYPRUS
|-
| Service(s) provided by country
|
* Patient Summary.
* Electronic prescription and dispensation.
|-
| Data that is exchanged
| Patient Summary:
* Identification of the patient/subject (National healthcare patient ID, Family name/surname, Given name, Date of birth, gender, Country of affiliation),
* Contact information (Patient address),
* Preferred HP to contact,
* Contact person/ Legal guardian,
* Insurance information,
* Document data,
* Author and Organisation (Author organisation, Legal authenticator),
* Additional information / Knowledge resources (External reference, Related with),
* Allergy, Medical alert information, Medical history (Vaccination/ Prophylaxis information, Resolved, closed or inactive problems, Medical history),
* Medical problems (Current problems, Medical devices and implants, Procedures, Functional status),
* Medication summary (Current and relevant past medicines),
* Social history,
* Pregnancy history (Current pregnancy status, History of previous pregnancies),
* Patient provided data,
* Results,
* Plan of Care.
Electronic prescription and dispensation:
* Patient administrative data (Family name/surname, Given name, Date of birth, Personal identifier, gender, Native language),
* Authentication of the prescription (Identifier of the Prescription, Issue date),
* Identification of the prescribing health professional (Family name, Given name, Professional qualifications, Details for direct contact, Work address, signature, Health care provider identifier),
* Identification of the prescribed product (Name of the medicinal product, Identifier of the medicinal product, Identifier(s) of the pharmaceutical product, Identifier(s) of the packaged medicinal product, Marketing authorisation holder, Active substance(s), Strength of the active substance(s), Product classification, Pharmaceutical dose form(s), Unit of presentation(s), Package type, Pack size),
* Prescription information (Quantity of prescribed product, Dose regimen, Number of units per intake, Frequency of intakes, Route of administration, Duration of treatment, Starting date of therapy, Directions for use, Prescription expiry date, Repeats, Reason for prescription, Substitution),
* Dispensation information (Identifier of the dispenser, Family name of the dispenser, Given name of the dispenser, Identifier of the pharmacy, Address of the pharmacy, Details of direct contact, Identifier of the prescription, Medicinal product, Dispensed quantity, Dispensation date, Substitution).
|-
| Role of the Country in the data exchange
|
* Accessing personal data from your home country.
(in case of electronic prescription, will also send dispensation details back to your home country).
* Providing access to your data to other health professionals in other countries.
|-
| Legal basis
|
* Your consent is needed before the service can be provided to you.
* In case of an emergency to the patient, access to your data may be available also without the consent of the patient.

Applicable law(s):

[https://www.neha.org.cy/wp-content/uploads/2022/10/%CE%9F-%CF%80%CE%B5%CF%81%CE%AF-%CE%97%CE%BB%CE%B5%CE%BA%CF%84%CF%81%CE%BF%CE%BD%CE%B9%CE%BA%CE%AE%CF%82-%CE%A5%CE%B3%CE%B5%CE%AF%CE%B1%CF%82-%CE%9D%CF%8C%CE%BC%CE%BF%CF%82-%CF%84%CE%BF%CF%85-2019.pdf Ο περί Ηλεκτρονικής Υγείας Νόμος του 2019 (neha.org.cy)]

[https://www.cylaw.org/nomoi/indexes/2013_1_149.html Ο περί Εφαρμογής των Δικαιωμάτων των Ασθενών στο πλαίσιο της Διασυνοριακής Υγειονομικής Περίθαλψης Νόμος του 2013 (cylaw.org)]

[https://www.cylaw.org/nomoi/enop/non-ind/2001_1_138/full.html Ο Περί Επεξεργασίας Δεδομένων Προσωπικού Χαρακτήρα (Προστασία του Ατόμου) Νόμος του 2001 - 138(I)/2001 (cylaw.org)]
|-
| Restriction of access to specific data
|
* You may restrict access to specific data.
Narcotic Drugs and Psychotropic Substances Regulations (Regulation 12).
 
More information about the restrictions you may set:

[https://www.moh.gov.cy/moh/phs/phs.nsf/crossborder_en/crossborder_en?OpenDocument Cross-border prescriptions | Pharmaceutical Services | (moh.gov.cy)]
|-
| Purpose of use
|
* Treatment purposes.
* Dispensation of medicinal products.
* Research, policy-making, and other secondary uses.
https://www.neha.org.cy/en/national-contact-point/
|-
| Storage of data
|Your data will be stored for:
1) PSA data will be stored for 15 years from the last reviewing.
2) PSB data will not be stored.
3) Log data will be stored forever.
* Data will be stored also for additional purposes.

Purpose: secondary use (anonymized databases). 
Storage period: will be deleted upon the receipt of patient’s request. 
Any restrictions that apply to the storage period: for secondary use all the data must be anonymized, all the data (for primary & secondary use) are stored encrypted. 
Conditions under which the data can be erased ("right to be forgotten"), e.g., the right only applies to data held at the time the request is received. It does not apply to data that may be created in the future. The right is not absolute and only applies in certain circumstances.
|-
| Data Controller(s)
(You may need to contact the data controller for example in order to exercise your data protection rights)
|
'''Name:''' Rafael Michael 
'''Address:''' 67Α Limassol Avenue, Aglantzia, 2121, Nicosia, Cyprus 
'''Email:''' rafael.michael@neha.org.cy 
'''Phone:''' +357 22436004 
|-
| Data Processor(s)
|
'''Name:''' Vanthia Toumpouri 
'''Address:''' 67Α Limassol Avenue, Aglantzia, 2121, Nicosia, Cyprus 
'''Email:''' vanthia.toumpouri@neha.org.cy 
'''Phone:''' +357 22436031 
|-
| Data Protection Officer
(You may need to contact the data protection officer for example in order to lodge a complaint)
|
'''Name:''' Office of the Commissioner for Personal Data Protection. 
'''Address:''' 15, Kypranoros Street, 1061 Nicosia, P.O. Box. 23378, 1682, Nicosia. 
'''Email:''' commissioner@dataprotection.gov.cy 
'''Phone:''' +357 22818456 
|}

='''(III) Link to Member State detailed health professional information notice'''=

{| class="wikitable"
! Member State
! CYPRUS
|-
| CYPRUS
|
* Patient Summary
* Electronic prescription and dispensation.
|}

Health Professional Information Notice (HPIN) about MyHealth@EU services

2025-07-24T06:09:45Z

Terspithea.kittou: /* Where and for how long is the personal data stored? */

='''(I) General information about MyHealth@EU'''=

==What is MyHealth@EU?==

MyHealth@EU, also called the eHealth Digital Service Infrastructure (eHDSI) enables the safe processing of your personal data, related to your role as a healthcare professional involved in the treatment of patients and the provision of medicines. This is done by electronic means through secure gateways provided by National Contact Points for eHealth (NCPeH) designated by each country.

Each country identifies which organization assumes the responsibility as a data controller for the processing of your data, as this is subject to the country's legislation.

See the last page for information specific to this country.

==Which categories of your data are exchanged?==

1) '''Patient summary''' – It includes critical information such as current medication, any allergies, and previous surgeries. This data is collected from the patient's country of origin and is utilized in case medical care is needed in another European Union country. Through the Summary Health Record, healthcare professionals abroad gain immediate and clear insight into the patient's health status, facilitating the provision of safe and appropriate medical care. This includes:

*Name of the health professional - Name of the Health Professional that has been treating or taking responsibility for the patient,
*Role of the health professional - The health professional's role in the organisation (i.e., healthcare provider),
*Health professional's organisation - Name of the health professional's organisation (i.e., healthcare provider),
*Telephone no. - telephone number of the health professional at the organisation (i.e., healthcare provider),
*Email - Email of the health professional or organisation (i.e., healthcare provider),
*Network affiliation - the health professional's organization that is affiliated with a European network, e.g., the European Reference Networks (ERN),
*Related with - Identification of the entry or entries of this Patient Summary for which the health professional is the preferred contact.

2) '''Electronic Prescription and Dispensation''' - the patient can get a prescription for medicine from a healthcare provider in one country and receive medication through a pharmacy in another EU country. The electronic prescription contains essentially the same information as a regular paper prescription, i.e. identification of the prescriber, the patient and the medicine prescribed. The electronic dispensation includes information about the medicine dispensed. This information will be sent by the pharmacy back to the country that issued the prescription. ePrescribing is defined as prescribing medicines through the support of software by a health professional who is legally authorised to do so, so that the medicine can be dispensed by a pharmacy, and eDispensation (eDispensing) is defined as the act of electronically retrieving a prescription and reporting on the dispensation of the medicine to the patient as indicated in the corresponding ePrescription. Hence, the following information is included: a) data used to identify the health professional who is entitled (according to national law) to prescribe medicinal products, and b) data used to identify the health professionals/health care providers who are entitled (according to national law) to dispense medicinal products.

To identify the prescribing health professional, the following information is processed:

*Family name - The family name/surname/last name of the prescriber. This enables the prescriber to be traced in the event of questions or emergencies,
*Given name - The given name/first name of the prescriber. This enables the prescriber to be traced in the event of questions or emergencies,
*Professional qualifications - The professional title of the prescribing health professional, which may be used to prove the authority of the prescriber,
*Details for direct contact - Details for direct contact could be an email address and/or phone/fax number of the prescriber in order for the dispenser and/or patient to contact the prescriber. This might be necessary if problems arise with dosage, allergies, reimbursement etc.,
*Work address - This is the address of the hospital or the practice, etc. where the health professional normally works, meets patients and prescribes medication. Minimally, the country is specified,
*Signature - Digital signature or token as proof of the authenticity of the prescriber,
*Health care provider identifier - A unique number or code issued for the purpose of identifying a health care provider [ISO/TS 27527:2010]; this may be a license or registration number which can be used to trace the prescriber and to check whether a medicinal product was prescribed by the right person according to the law of the prescribing country.

3) '''Original Clinical Documents''' – documents containing your health information.
<ol type="I">
<li>Laboratory Results - clinical documents containing the results of laboratory tests, stored in the home Country.</li>
<li>Imaging Reports - clinical documents containing the reports on images studies and, when requested, the images (e.g. in DICOM standard), stored in the home Country.</li>
<li>Discharge Reports - clinical document generated by the healthcare provider where the patient was treated, both as an inpatient and an outpatient, which gathers the main findings, stored in the Country of Affiliation.</li>
</ol>

This personal data is available in so far as it is already recorded in electronic form in your home country.
The source(s) of this data varies from country to country. In a subsequent phase, regarding the exchange of clinical documents, the system will support not only the transmission of reports in PDF format but also the exchange of detailed medical images in higher resolution.
See the last page for information specific to this country.

==What is the legal basis for the use of your personal data?==

The MyHealth@EU services will become available for you depending on the conditions set individually by each country.
When the patient receives treatment or medicine abroad, your data will be recorded in the country of treatment (or medicine dispensation) according to the EU General Data Protection Regulation, the national legislation of that country and the internal rules of the particular healthcare provider.
Emergency situations may justify the use of your data for the treatment of the patient without the patient’s consent.
See the last page for information specific to this country.

==What is the purpose of the processing?==
The primary purpose for processing your data is the medical treatment of your patient or the provision of medicine. However, due to the national legislation of each Member State, there may be additional purposes.
See the last page to check if such additional purposes are applicable to this country.

==Who processes and has access to this data? (recipients of personal data)==

Your personal data will be accessible by the National Contact Points for eHealth, i.e., entities that process your data to ensure its secure transmission to and from the specific healthcare organization or pharmacy, logging, or other related activities.
The list of data processors is indicated on the last page.

==Where and for how long is the personal data stored?==

The collected personal data may be stored in the information systems of the health institutions both in your home country and the country of treatment or dispensation of medicine.
The data shall be stored for no longer than is necessary for the purpose for which your personal data is processed. The Patient Summary data may be stored for 15 years from the last update for permanent residents of Cyprus and is automatically deleted after this period. However, for visitors from other European countries, the Patient Summary is not stored at all. The retention period may vary in other countries that offer Electronic Cross-Border Health Services, with relevant information available on the eHDSI website.
The storage period(s) in this Member State is indicated on the last page.

==What are your rights and how to exercise them?==

You have the right to access your personal data.
Apart from that, you can exercise the rights of rectification, erasure, restriction of the processing and data portability.
In order to exercise your rights, you may contact us.
Contact details are available on the last page.
Also, you have the right to lodge a complaint before the supervisory data protection authority.
 
The list of the national supervisory authorities can be found at https://edpb.europa.eu/about-edpb/about-edpb/members_en.

='''(II) Summary of Member State-specific information'''=

{| class="wikitable"
! Member State
! CYPRUS
|-
| Service(s) provided by country
|
* Patient Summary.
* Electronic prescription and dispensation.
|-
| Data that is exchanged
| Patient Summary:
* Identification of the patient/subject (National healthcare patient ID, Family name/surname, Given name, Date of birth, gender, Country of affiliation),
* Contact information (Patient address),
* Preferred HP to contact,
* Contact person/ Legal guardian,
* Insurance information,
* Document data,
* Author and Organisation (Author organisation, Legal authenticator),
* Additional information / Knowledge resources (External reference, Related with),
* Allergy, Medical alert information, Medical history (Vaccination/ Prophylaxis information, Resolved, closed or inactive problems, Medical history),
* Medical problems (Current problems, Medical devices and implants, Procedures, Functional status),
* Medication summary (Current and relevant past medicines),
* Social history,
* Pregnancy history (Current pregnancy status, History of previous pregnancies),
* Patient provided data,
* Results,
* Plan of Care.
Electronic prescription and dispensation:
* Patient administrative data (Family name/surname, Given name, Date of birth, Personal identifier, gender, Native language),
* Authentication of the prescription (Identifier of the Prescription, Issue date),
* Identification of the prescribing health professional (Family name, Given name, Professional qualifications, Details for direct contact, Work address, signature, Health care provider identifier),
* Identification of the prescribed product (Name of the medicinal product, Identifier of the medicinal product, Identifier(s) of the pharmaceutical product, Identifier(s) of the packaged medicinal product, Marketing authorisation holder, Active substance(s), Strength of the active substance(s), Product classification, Pharmaceutical dose form(s), Unit of presentation(s), Package type, Pack size),
* Prescription information (Quantity of prescribed product, Dose regimen, Number of units per intake, Frequency of intakes, Route of administration, Duration of treatment, Starting date of therapy, Directions for use, Prescription expiry date, Repeats, Reason for prescription, Substitution),
* Dispensation information (Identifier of the dispenser, Family name of the dispenser, Given name of the dispenser, Identifier of the pharmacy, Address of the pharmacy, Details of direct contact, Identifier of the prescription, Medicinal product, Dispensed quantity, Dispensation date, Substitution).
|-
| Role of the Country in the data exchange
|
* Accessing personal data from your home country.
(in case of electronic prescription, will also send dispensation details back to your home country).
* Providing access to your data to other health professionals in other countries.
|-
| Legal basis
|
* Your consent is needed before the service can be provided to you.
* In case of an emergency to the patient, access to your data may be available also without the consent of the patient.

Applicable law(s):

[https://www.neha.org.cy/wp-content/uploads/2022/10/%CE%9F-%CF%80%CE%B5%CF%81%CE%AF-%CE%97%CE%BB%CE%B5%CE%BA%CF%84%CF%81%CE%BF%CE%BD%CE%B9%CE%BA%CE%AE%CF%82-%CE%A5%CE%B3%CE%B5%CE%AF%CE%B1%CF%82-%CE%9D%CF%8C%CE%BC%CE%BF%CF%82-%CF%84%CE%BF%CF%85-2019.pdf Ο περί Ηλεκτρονικής Υγείας Νόμος του 2019 (neha.org.cy)]

[https://www.cylaw.org/nomoi/indexes/2013_1_149.html Ο περί Εφαρμογής των Δικαιωμάτων των Ασθενών στο πλαίσιο της Διασυνοριακής Υγειονομικής Περίθαλψης Νόμος του 2013 (cylaw.org)]

[https://www.cylaw.org/nomoi/enop/non-ind/2001_1_138/full.html Ο Περί Επεξεργασίας Δεδομένων Προσωπικού Χαρακτήρα (Προστασία του Ατόμου) Νόμος του 2001 - 138(I)/2001 (cylaw.org)]
|-
| Restriction of access to specific data
|
* You may restrict access to specific data.
Narcotic Drugs and Psychotropic Substances Regulations (Regulation 12).
 
More information about the restrictions you may set:

[https://www.moh.gov.cy/moh/phs/phs.nsf/crossborder_en/crossborder_en?OpenDocument Cross-border prescriptions | Pharmaceutical Services | (moh.gov.cy)]
|-
| Purpose of use
|
* Treatment purposes.
* Dispensation of medicinal products.
* Research, policy-making, and other secondary uses.
https://www.neha.org.cy/en/national-contact-point/
|-
| Storage of data
|Your data will be stored for:
1) PSA data will be stored for 15 years from the last reviewing.
2) PSB data will not be stored.
3) Log data will be stored forever.
* Data will be stored also for additional purposes.

Purpose: secondary use (anonymized databases). 
Storage period: will be deleted upon the receipt of patient’s request. 
Any restrictions that apply to the storage period: for secondary use all the data must be anonymized, all the data (for primary & secondary use) are stored encrypted. 
Conditions under which the data can be erased ("right to be forgotten"), e.g., the right only applies to data held at the time the request is received. It does not apply to data that may be created in the future. The right is not absolute and only applies in certain circumstances.
|-
| Data Controller(s)
(You may need to contact the data controller for example in order to exercise your data protection rights)
|
'''Name:''' Rafael Michael 
'''Address:''' 67Α Limassol Avenue, Aglantzia, 2121, Nicosia, Cyprus 
'''Email:''' rafael.michael@neha.org.cy 
'''Phone:''' +357 22436004 
|-
| Data Processor(s)
|
'''Name:''' Vanthia Toumpouri 
'''Address:''' 67Α Limassol Avenue, Aglantzia, 2121, Nicosia, Cyprus 
'''Email:''' vanthia.toumpouri@neha.org.cy 
'''Phone:''' +357 22436031 
|-
| Data Protection Officer
(You may need to contact the data protection officer for example in order to lodge a complaint)
|
'''Name:''' Office of the Commissioner for Personal Data Protection. 
'''Address:''' 15, Kypranoros Street, 1061 Nicosia, P.O. Box. 23378, 1682, Nicosia. 
'''Email:''' commissioner@dataprotection.gov.cy 
'''Phone:''' +357 22818456 
|}

='''(III) Link to Member State detailed health professional information notice'''=

{| class="wikitable"
! Member State
! CYPRUS
|-
| CYPRUS
|
* Patient Summary
* Electronic prescription and dispensation.
|}

Health Professional Information Notice (HPIN) about MyHealth@EU services

2025-07-24T05:13:24Z

Terspithea.kittou: /* Which categories of your data are exchanged? */

='''(I) General information about MyHealth@EU'''=

==What is MyHealth@EU?==

MyHealth@EU, also called the eHealth Digital Service Infrastructure (eHDSI) enables the safe processing of your personal data, related to your role as a healthcare professional involved in the treatment of patients and the provision of medicines. This is done by electronic means through secure gateways provided by National Contact Points for eHealth (NCPeH) designated by each country.

Each country identifies which organization assumes the responsibility as a data controller for the processing of your data, as this is subject to the country's legislation.

See the last page for information specific to this country.

==Which categories of your data are exchanged?==

1) '''Patient summary''' – It includes critical information such as current medication, any allergies, and previous surgeries. This data is collected from the patient's country of origin and is utilized in case medical care is needed in another European Union country. Through the Summary Health Record, healthcare professionals abroad gain immediate and clear insight into the patient's health status, facilitating the provision of safe and appropriate medical care. This includes:

*Name of the health professional - Name of the Health Professional that has been treating or taking responsibility for the patient,
*Role of the health professional - The health professional's role in the organisation (i.e., healthcare provider),
*Health professional's organisation - Name of the health professional's organisation (i.e., healthcare provider),
*Telephone no. - telephone number of the health professional at the organisation (i.e., healthcare provider),
*Email - Email of the health professional or organisation (i.e., healthcare provider),
*Network affiliation - the health professional's organization that is affiliated with a European network, e.g., the European Reference Networks (ERN),
*Related with - Identification of the entry or entries of this Patient Summary for which the health professional is the preferred contact.

2) '''Electronic Prescription and Dispensation''' - the patient can get a prescription for medicine from a healthcare provider in one country and receive medication through a pharmacy in another EU country. The electronic prescription contains essentially the same information as a regular paper prescription, i.e. identification of the prescriber, the patient and the medicine prescribed. The electronic dispensation includes information about the medicine dispensed. This information will be sent by the pharmacy back to the country that issued the prescription. ePrescribing is defined as prescribing medicines through the support of software by a health professional who is legally authorised to do so, so that the medicine can be dispensed by a pharmacy, and eDispensation (eDispensing) is defined as the act of electronically retrieving a prescription and reporting on the dispensation of the medicine to the patient as indicated in the corresponding ePrescription. Hence, the following information is included: a) data used to identify the health professional who is entitled (according to national law) to prescribe medicinal products, and b) data used to identify the health professionals/health care providers who are entitled (according to national law) to dispense medicinal products.

To identify the prescribing health professional, the following information is processed:

*Family name - The family name/surname/last name of the prescriber. This enables the prescriber to be traced in the event of questions or emergencies,
*Given name - The given name/first name of the prescriber. This enables the prescriber to be traced in the event of questions or emergencies,
*Professional qualifications - The professional title of the prescribing health professional, which may be used to prove the authority of the prescriber,
*Details for direct contact - Details for direct contact could be an email address and/or phone/fax number of the prescriber in order for the dispenser and/or patient to contact the prescriber. This might be necessary if problems arise with dosage, allergies, reimbursement etc.,
*Work address - This is the address of the hospital or the practice, etc. where the health professional normally works, meets patients and prescribes medication. Minimally, the country is specified,
*Signature - Digital signature or token as proof of the authenticity of the prescriber,
*Health care provider identifier - A unique number or code issued for the purpose of identifying a health care provider [ISO/TS 27527:2010]; this may be a license or registration number which can be used to trace the prescriber and to check whether a medicinal product was prescribed by the right person according to the law of the prescribing country.

3) '''Original Clinical Documents''' – documents containing your health information.
<ol type="I">
<li>Laboratory Results - clinical documents containing the results of laboratory tests, stored in the home Country.</li>
<li>Imaging Reports - clinical documents containing the reports on images studies and, when requested, the images (e.g. in DICOM standard), stored in the home Country.</li>
<li>Discharge Reports - clinical document generated by the healthcare provider where the patient was treated, both as an inpatient and an outpatient, which gathers the main findings, stored in the Country of Affiliation.</li>
</ol>

This personal data is available in so far as it is already recorded in electronic form in your home country.
The source(s) of this data varies from country to country. In a subsequent phase, regarding the exchange of clinical documents, the system will support not only the transmission of reports in PDF format but also the exchange of detailed medical images in higher resolution.
See the last page for information specific to this country.

==What is the legal basis for the use of your personal data?==

The MyHealth@EU services will become available for you depending on the conditions set individually by each country.
When the patient receives treatment or medicine abroad, your data will be recorded in the country of treatment (or medicine dispensation) according to the EU General Data Protection Regulation, the national legislation of that country and the internal rules of the particular healthcare provider.
Emergency situations may justify the use of your data for the treatment of the patient without the patient’s consent.
See the last page for information specific to this country.

==What is the purpose of the processing?==
The primary purpose for processing your data is the medical treatment of your patient or the provision of medicine. However, due to the national legislation of each Member State, there may be additional purposes.
See the last page to check if such additional purposes are applicable to this country.

==Who processes and has access to this data? (recipients of personal data)==

Your personal data will be accessible by the National Contact Points for eHealth, i.e., entities that process your data to ensure its secure transmission to and from the specific healthcare organization or pharmacy, logging, or other related activities.
The list of data processors is indicated on the last page.

==Where and for how long is the personal data stored?==

The collected personal data may be stored in the information systems of the health institutions both in your home country and the country of treatment or dispensation of medicine.
The data shall be stored for no longer than is necessary for the purpose for which your personal data is processed. The Patient Summary data may be stored for 15 years from the last update for permanent residents of Cyprus and is automatically deleted after this period. However, for visitors from other European countries, the Patient Summary is not stored at all. The retention period may vary in other countries that offer Electronic Cross-Border Health Services, with relevant information available on the eHDSI website. The storage period in other participating countries may vary. Information about the storage periods is available on the eHDSI website.
The storage period(s) in this Member State is indicated on the last page.

==What are your rights and how to exercise them?==

You have the right to access your personal data.
Apart from that, you can exercise the rights of rectification, erasure, restriction of the processing and data portability.
In order to exercise your rights, you may contact us.
Contact details are available on the last page.
Also, you have the right to lodge a complaint before the supervisory data protection authority.
 
The list of the national supervisory authorities can be found at https://edpb.europa.eu/about-edpb/about-edpb/members_en.

='''(II) Summary of Member State-specific information'''=

{| class="wikitable"
! Member State
! CYPRUS
|-
| Service(s) provided by country
|
* Patient Summary.
* Electronic prescription and dispensation.
|-
| Data that is exchanged
| Patient Summary:
* Identification of the patient/subject (National healthcare patient ID, Family name/surname, Given name, Date of birth, gender, Country of affiliation),
* Contact information (Patient address),
* Preferred HP to contact,
* Contact person/ Legal guardian,
* Insurance information,
* Document data,
* Author and Organisation (Author organisation, Legal authenticator),
* Additional information / Knowledge resources (External reference, Related with),
* Allergy, Medical alert information, Medical history (Vaccination/ Prophylaxis information, Resolved, closed or inactive problems, Medical history),
* Medical problems (Current problems, Medical devices and implants, Procedures, Functional status),
* Medication summary (Current and relevant past medicines),
* Social history,
* Pregnancy history (Current pregnancy status, History of previous pregnancies),
* Patient provided data,
* Results,
* Plan of Care.
Electronic prescription and dispensation:
* Patient administrative data (Family name/surname, Given name, Date of birth, Personal identifier, gender, Native language),
* Authentication of the prescription (Identifier of the Prescription, Issue date),
* Identification of the prescribing health professional (Family name, Given name, Professional qualifications, Details for direct contact, Work address, signature, Health care provider identifier),
* Identification of the prescribed product (Name of the medicinal product, Identifier of the medicinal product, Identifier(s) of the pharmaceutical product, Identifier(s) of the packaged medicinal product, Marketing authorisation holder, Active substance(s), Strength of the active substance(s), Product classification, Pharmaceutical dose form(s), Unit of presentation(s), Package type, Pack size),
* Prescription information (Quantity of prescribed product, Dose regimen, Number of units per intake, Frequency of intakes, Route of administration, Duration of treatment, Starting date of therapy, Directions for use, Prescription expiry date, Repeats, Reason for prescription, Substitution),
* Dispensation information (Identifier of the dispenser, Family name of the dispenser, Given name of the dispenser, Identifier of the pharmacy, Address of the pharmacy, Details of direct contact, Identifier of the prescription, Medicinal product, Dispensed quantity, Dispensation date, Substitution).
|-
| Role of the Country in the data exchange
|
* Accessing personal data from your home country.
(in case of electronic prescription, will also send dispensation details back to your home country).
* Providing access to your data to other health professionals in other countries.
|-
| Legal basis
|
* Your consent is needed before the service can be provided to you.
* In case of an emergency to the patient, access to your data may be available also without the consent of the patient.

Applicable law(s):

[https://www.neha.org.cy/wp-content/uploads/2022/10/%CE%9F-%CF%80%CE%B5%CF%81%CE%AF-%CE%97%CE%BB%CE%B5%CE%BA%CF%84%CF%81%CE%BF%CE%BD%CE%B9%CE%BA%CE%AE%CF%82-%CE%A5%CE%B3%CE%B5%CE%AF%CE%B1%CF%82-%CE%9D%CF%8C%CE%BC%CE%BF%CF%82-%CF%84%CE%BF%CF%85-2019.pdf Ο περί Ηλεκτρονικής Υγείας Νόμος του 2019 (neha.org.cy)]

[https://www.cylaw.org/nomoi/indexes/2013_1_149.html Ο περί Εφαρμογής των Δικαιωμάτων των Ασθενών στο πλαίσιο της Διασυνοριακής Υγειονομικής Περίθαλψης Νόμος του 2013 (cylaw.org)]

[https://www.cylaw.org/nomoi/enop/non-ind/2001_1_138/full.html Ο Περί Επεξεργασίας Δεδομένων Προσωπικού Χαρακτήρα (Προστασία του Ατόμου) Νόμος του 2001 - 138(I)/2001 (cylaw.org)]
|-
| Restriction of access to specific data
|
* You may restrict access to specific data.
Narcotic Drugs and Psychotropic Substances Regulations (Regulation 12).
 
More information about the restrictions you may set:

[https://www.moh.gov.cy/moh/phs/phs.nsf/crossborder_en/crossborder_en?OpenDocument Cross-border prescriptions | Pharmaceutical Services | (moh.gov.cy)]
|-
| Purpose of use
|
* Treatment purposes.
* Dispensation of medicinal products.
* Research, policy-making, and other secondary uses.
https://www.neha.org.cy/en/national-contact-point/
|-
| Storage of data
|Your data will be stored for:
1) PSA data will be stored for 15 years from the last reviewing.
2) PSB data will not be stored.
3) Log data will be stored forever.
* Data will be stored also for additional purposes.

Purpose: secondary use (anonymized databases). 
Storage period: will be deleted upon the receipt of patient’s request. 
Any restrictions that apply to the storage period: for secondary use all the data must be anonymized, all the data (for primary & secondary use) are stored encrypted. 
Conditions under which the data can be erased ("right to be forgotten"), e.g., the right only applies to data held at the time the request is received. It does not apply to data that may be created in the future. The right is not absolute and only applies in certain circumstances.
|-
| Data Controller(s)
(You may need to contact the data controller for example in order to exercise your data protection rights)
|
'''Name:''' Rafael Michael 
'''Address:''' 67Α Limassol Avenue, Aglantzia, 2121, Nicosia, Cyprus 
'''Email:''' rafael.michael@neha.org.cy 
'''Phone:''' +357 22436004 
|-
| Data Processor(s)
|
'''Name:''' Vanthia Toumpouri 
'''Address:''' 67Α Limassol Avenue, Aglantzia, 2121, Nicosia, Cyprus 
'''Email:''' vanthia.toumpouri@neha.org.cy 
'''Phone:''' +357 22436031 
|-
| Data Protection Officer
(You may need to contact the data protection officer for example in order to lodge a complaint)
|
'''Name:''' Office of the Commissioner for Personal Data Protection. 
'''Address:''' 15, Kypranoros Street, 1061 Nicosia, P.O. Box. 23378, 1682, Nicosia. 
'''Email:''' commissioner@dataprotection.gov.cy 
'''Phone:''' +357 22818456 
|}

='''(III) Link to Member State detailed health professional information notice'''=

{| class="wikitable"
! Member State
! CYPRUS
|-
| CYPRUS
|
* Patient Summary
* Electronic prescription and dispensation.
|}

Patient Information Notice

2025-07-24T05:12:42Z

Terspithea.kittou: /* The categories of your personal health data concerned */

= '''(I)General information about MyHealth@EU''' =

= Patient Information Notice regarding cross-border transfer of personal health data =

The following information is provided to fulfil the requirement of the EU General Data Protection Regulation to inform citizens about the processing of their personal data.

= What is the eHealth Digital Service Infrastructure? =

MyHealth@EU, also called the eHealth Digital Service Infrastructure (eHDSI), enables safe and easy access to your health data for healthcare professionals involved in your treatment and the provision of medicines - anytime and anywhere within the EU. This is done by electronic means through secure gateways provided by National Contact Points for eHealth (NCPeH) designated by each country.

Each country identifies which organization assumes the responsibility as a data controller for the processing of your data, as this is subject to the country's legislation.

See the last page for information specific to Cyprus.

= The categories of your personal health data concerned =

1)'''Patient Summary'''- It is a basic medical dataset that is transferred for the purpose of receiving treatment in another country. It includes important patient data such as allergies, current medication, previous illnesses and surgeries, that is necessary to treat the patient properly abroad. The Patient Summary includes:

*Name of the health professional - Name of the Health Professional that has been treating or taking responsibility for the patient,
*Role of the health professional - The health professional's role in the organisation (i.e., healthcare provider),
*Health professional's organisation - Name of the health professional's organisation (i.e., healthcare provider),
*Telephone no. - telephone number of the health professional at the organisation (i.e., healthcare provider),
*Email - Email of the health professional or organisation (i.e., healthcare provider),
*Network affiliation - the health professional's organization that is affiliated with a European network, e.g., the European Reference Networks (ERN),
*Related with - Identification of the entry or entries of this Patient Summary for which the health professional is the preferred contact.

2)'''Electronic prescription and dispensation''' - the patient can get a prescription for medicine from a healthcare provider in one country and receive medication through a pharmacy in another EU country. The electronic prescription contains essentially the same information as a regular paper prescription, i.e. identification of the prescriber, the patient and the medicine prescribed. The electronic dispensation includes information about the medicine dispensed. This information will be sent by the pharmacy back to the country that issued the prescription. ePrescribing is defined as prescribing medicines through the support of software by a health professional who is legally authorised to do so, so that the medicine can be dispensed by a pharmacy, and eDispensation (eDispensing) is defined as the act of electronically retrieving a prescription and reporting on the dispensation of the medicine to the patient as indicated in the corresponding ePrescription. Hence, the following information is included: a) data used to identify the health professional who is entitled (according to national law) to prescribe medicinal products, and b) data used to identify the health professionals/health care providers who are entitled (according to national law) to dispense medicinal products.

To identify the prescribing health professional, the following information is processed:

*Family name - The family name/surname/last name of the prescriber. This enables the prescriber to be traced in the event of questions or emergencies,
*Given name - The given name/first name of the prescriber. This enables the prescriber to be traced in the event of questions or emergencies,
*Professional qualifications - The professional title of the prescribing health professional, which may be used to prove the authority of the prescriber,
*Details for direct contact - Details for direct contact could be an email address and/or phone/fax number of the prescriber in order for the dispenser and/or patient to contact the prescriber. This might be necessary if problems arise with dosage, allergies, reimbursement etc.,
*Work address - This is the address of the hospital or the practice, etc. where the health professional normally works, meets patients and prescribes medication. Minimally, the country is specified,
*Signature - Digital signature or token as proof of the authenticity of the prescriber,
*Health care provider identifier - A unique number or code issued for the purpose of identifying a health care provider [ISO/TS 27527:2010]; this may be a license or registration number which can be used to trace the prescriber and to check whether a medicinal product was prescribed by the right person according to the law of the prescribing country.

3)'''Original Clinical Documents'''- containing your health information.

<ol type="I">
<li>laboratory results report:- clinical documents containing the results of laboratory tests, stored in the home Country.
<li>hospital discharge report:- clinical document generated by the healthcare provider where the patient was treated, both as an inpatient and an outpatient, which gathers the main findings, stored in the Country of Affiliation.
<li>medical imaging report:- clinical documents containing the reports on images studies.
</ol>
This personal health data is available in so far as it is already recorded in electronic form in your home country.

The source(s) of this data varies from country to country.

In a subsequent phase, regarding the exchange of clinical documents, the system will support not only the transmission of reports in PDF format but also the exchange of detailed medical images in higher resolution.

= What is the legal basis for the use of your personal data? =

The eHDSI services will become available for you only upon your explicit consent. Although emergency situations may justify the use of your data for your treatment without consent, if you don’t give explicit consent before travelling, your data will not be available through the eHDSI system when you are in another country, not even in case of emergency. When you are abroad in an actual care situation, your Patient Summary data or Electronic Prescriptions will be recorded in the country of treatment in accordance with the EU General Data Protection Regulation (GDPR), the laws of that country and the practices of the particular healthcare institution.

= What is the purpose of processing? =

Your medical data will only be used for your personal treatment or provision of medicine.
In Cyprus, the data collected for inclusion in your Patient Summary will not be used for secondary purposes, other than for statistical purposes after it has been completely anonymised. Information about the purposes of such further processing according to the laws of various countries is available at the eHDSI website.

= Who processes and has access to this data? =

Your Patient Summary data will be accessible only by authorised and identifiable health professionals involved in your treatment, under professional secrecy, in the country of treatment. These are health professionals in the healthcare organization where you receive your treatment or the pharmacy where you receive your prescribed medicine. Each country of treatment participating in the eHDSI system has undertaken to ensure that the participating health professionals and healthcare providers on their territory have adequate information and training about their duties. Please refer to the eHDSI website for details of the participating countries. The Patient Summary data and Electronic Prescriptions will be transferred through a secure gateway provided by the eHealth National Contact Point designated by each country.

= Where and how long is the personal data stored? =

The Patient Summary data may be stored for 15 years from the last update for permanent residents of Cyprus and is automatically deleted after this period. However, for visitors from other European countries, the Patient Summary is not stored at all. The retention period may vary in other countries that offer Electronic Cross-Border Health Services, with relevant information available on the eHDSI website. The storage period in other participating countries may vary. Information about the storage periods is available on the eHDSI website.

= Your access rights =

If you consent to the processing of your Patient Summary data by the eHDSI system, you must explicitly provide your consent.
You have the right to:
a) rectify any inaccurate data in your Patient Summary data, according to Article 16 of the GDPR.
b) obtain the erasure of your Patient Summary data, according to Article 17 of the GDPR.
c) object to the processing of your Patient Summary data on grounds relating to your particular situation, according to Article 21 of the GDPR.

= You have the right to withdraw your consent at any time. =

If you do not consent for your personal data to be processed by the eHDSI system, your data will not be available for you through this system when you are in another country, not even in case of emergency.

Finally, you have the right to lodge a complaint with a supervisory authority either in Cyprus or in the country of treatment, depending on the factual situation.

='''(II) Summary of Member State-specific information'''=

{| class="wikitable"
! Member State
! CYPRUS
|-
| Service(s) provided by country
|
* Patient Summary.
* Electronic Prescription and Dispensation.
|-
| Data that is exchanged
| Patient Summary:
* Identification of the patient/subject (National healthcare patient ID, Family name/surname, Given name, Date of birth, gender, Country of affiliation),
* Contact information (Patient address),
* Preferred HP to contact,
* Contact person/ Legal guardian,
* Insurance information,
* Document data,
* Author and Organisation (Author organisation, Legal authenticator),
* Additional information / Knowledge resources (External reference, Related with),
* Allergy, Medical alert information, Medical history (Vaccination/ Prophylaxis information, Resolved, closed or inactive problems, Medical history),
* Medical problems (Current problems, Medical devices and implants, Procedures, Functional status),
* Medication summary (Current and relevant past medicines),
* Social history,
* Pregnancy history (Current pregnancy status, History of previous pregnancies),
* Patient provided data,
* Results,
* Plan of Care.
Electronic prescription and dispensation:
* Patient administrative data (Family name/surname, Given name, Date of birth, Personal identifier, gender, Native language),
* Authentication of the prescription (Identifier of the Prescription, Issue date),
* Identification of the prescribing health professional (Family name, Given name, Professional qualifications, Details for direct contact, Work address, signature, Health care provider identifier),
* Identification of the prescribed product (Name of the medicinal product, Identifier of the medicinal product, Identifier(s) of the pharmaceutical product, Identifier(s) of the packaged medicinal product, Marketing authorisation holder, Active substance(s), Strength of the active substance(s), Product classification, Pharmaceutical dose form(s), Unit of presentation(s), Package type, Pack size),
* Prescription information (Quantity of prescribed product, Dose regimen, Number of units per intake, Frequency of intakes, Route of administration, Duration of treatment, Starting date of therapy, Directions for use, Prescription expiry date, Repeats, Reason for prescription, Substitution),
* Dispensation information (Identifier of the dispenser, Family name of the dispenser, Given name of the dispenser, Identifier of the pharmacy, Address of the pharmacy, Details of direct contact, Identifier of the prescription, Medicinal product, Dispensed quantity, Dispensation date, Substitution).
|-
| Role of the Country in the data exchange
|
* Accessing personal data from your home country.
(in case of electronic prescription, will also send dispensation details back to your home country).
* Providing access to your data to other health professionals in other countries.
|-
| Legal basis
|
* Your consent is needed before the service can be provided to you.
* In case of an emergency to the patient, access to your data may be available also without the consent of the patient.

Applicable law(s):

[https://www.neha.org.cy/wp-content/uploads/2022/10/%CE%9F-%CF%80%CE%B5%CF%81%CE%AF-%CE%97%CE%BB%CE%B5%CE%BA%CF%84%CF%81%CE%BF%CE%BD%CE%B9%CE%BA%CE%AE%CF%82-%CE%A5%CE%B3%CE%B5%CE%AF%CE%B1%CF%82-%CE%9D%CF%8C%CE%BC%CE%BF%CF%82-%CF%84%CE%BF%CF%85-2019.pdf Ο περί Ηλεκτρονικής Υγείας Νόμος του 2019 (neha.org.cy)]

[https://www.cylaw.org/nomoi/indexes/2013_1_149.html Ο περί Εφαρμογής των Δικαιωμάτων των Ασθενών στο πλαίσιο της Διασυνοριακής Υγειονομικής Περίθαλψης Νόμος του 2013 (cylaw.org)]

[https://www.cylaw.org/nomoi/enop/non-ind/2001_1_138/full.html Ο Περί Επεξεργασίας Δεδομένων Προσωπικού Χαρακτήρα (Προστασία του Ατόμου) Νόμος του 2001 - 138(I)/2001 (cylaw.org)]
|-
| Restriction of access to specific data
|
* You may restrict access to specific data.
Narcotic Drugs and Psychotropic Substances Regulations (Regulation 12).
 
More information about the restrictions you may set:

[https://www.moh.gov.cy/moh/phs/phs.nsf/crossborder_en/crossborder_en?OpenDocument Cross-border prescriptions | Pharmaceutical Services | (moh.gov.cy)]
|-
| Purpose of use
|
* Treatment purposes.
* Dispensation of medicinal products.
* Research, policy-making, and other secondary uses.
https://www.neha.org.cy/en/national-contact-point/
|-
| Storage of data
|Your data will be stored for:
1) PSA data will be stored for 15 years from the last reviewing.
2) PSB data will not be stored.
3) Log data will be stored forever.
* Data will be stored also for additional purposes.

Purpose: secondary use (anonymized databases). 
Storage period: will be deleted upon the receipt of patient’s request. 
Any restrictions that apply to the storage period: for secondary use all the data must be anonymized, all the data (for primary & secondary use) are stored encrypted. 
Conditions under which the data can be erased ("right to be forgotten"), e.g., the right only applies to data held at the time the request is received. It does not apply to data that may be created in the future. The right is not absolute and only applies in certain circumstances.
|-
| Data Controller(s)
(You may need to contact the data controller for example in order to exercise your data protection rights)
|
'''Name:''' Rafael Michael 
'''Address:''' 67Α Limassol Avenue, Aglantzia, 2121, Nicosia, Cyprus 
'''Email:''' rafael.michael@neha.org.cy 
'''Phone:''' +357 22436004 
|-
| Data Processor(s)
|
'''Name:''' Vanthia Toumpouri 
'''Address:''' 67Α Limassol Avenue, Aglantzia, 2121, Nicosia, Cyprus 
'''Email:''' vanthia.toumpouri@neha.org.cy 
'''Phone:''' +357 22436031 
|-
| Data Protection Officer
(You may need to contact the data protection officer for example in order to lodge a complaint)
|
'''Name:''' Office of the Commissioner for Personal Data Protection. 
'''Address:''' 15, Kypranoros Street, 1061 Nicosia, P.O. Box. 23378, 1682, Nicosia. 
'''Email:''' commissioner@dataprotection.gov.cy 
'''Phone:''' +357 22818456 
|}

='''(III) Link to Member State detailed health professional information notice'''=

{| class="wikitable"
! Member State
! CYPRUS
|-
| CYPRUS
|
* Patient Summary
* Electronic prescription and dispensation.
|}

Health Professional Information Notice (HPIN) about MyHealth@EU services

2025-07-24T04:51:33Z

Terspithea.kittou: /* Which categories of your data are exchanged? */

='''(I) General information about MyHealth@EU'''=

==What is MyHealth@EU?==

MyHealth@EU, also called the eHealth Digital Service Infrastructure (eHDSI) enables the safe processing of your personal data, related to your role as a healthcare professional involved in the treatment of patients and the provision of medicines. This is done by electronic means through secure gateways provided by National Contact Points for eHealth (NCPeH) designated by each country.

Each country identifies which organization assumes the responsibility as a data controller for the processing of your data, as this is subject to the country's legislation.

See the last page for information specific to this country.

==Which categories of your data are exchanged?==

1) '''Patient summary''' – It includes critical information such as current medication, any allergies, and previous surgeries. This data is collected from the patient's country of origin and is utilized in case medical care is needed in another European Union country. Through the Summary Health Record, healthcare professionals abroad gain immediate and clear insight into the patient's health status, facilitating the provision of safe and appropriate medical care. This includes:

*Name of the health professional - Name of the Health Professional that has been treating or taking responsibility for the patient,
*Role of the health professional - The health professional's role in the organisation (i.e., healthcare provider),
*Health professional's organisation - Name of the health professional's organisation (i.e., healthcare provider),
*Telephone no. - telephone number of the health professional at the organisation (i.e., healthcare provider),
*Email - Email of the health professional or organisation (i.e., healthcare provider),
*Network affiliation - the health professional's organization that is affiliated with a European network, e.g., the European Reference Networks (ERN),
*Related with - Identification of the entry or entries of this Patient Summary for which the health professional is the preferred contact.

2) '''Electronic Prescription and Dispensation''' - the patient can get a prescription for medicine from a healthcare provider in one country and receive medication through a pharmacy in another EU country. The electronic prescription contains essentially the same information as a regular paper prescription, i.e. identification of the prescriber, the patient and the medicine prescribed. The electronic dispensation includes information about the medicine dispensed. This information will be sent by the pharmacy back to the country that issued the prescription. ePrescribing is defined as prescribing medicines through the support of software by a health professional who is legally authorised to do so, so that the medicine can be dispensed by a pharmacy, and eDispensation (eDispensing) is defined as the act of electronically retrieving a prescription and reporting on the dispensation of the medicine to the patient as indicated in the corresponding ePrescription. Hence, the following information is included: a) data used to identify the health professional who is entitled (according to national law) to prescribe medicinal products, and b) data used to identify the health professionals/health care providers who are entitled (according to national law) to dispense medicinal products.

To identify the prescribing health professional, the following information is processed:

*Family name - The family name/surname/last name of the prescriber. This enables the prescriber to be traced in the event of questions or emergencies,
*Given name - The given name/first name of the prescriber. This enables the prescriber to be traced in the event of questions or emergencies,
*Professional qualifications - The professional title of the prescribing health professional, which may be used to prove the authority of the prescriber,
*Details for direct contact - Details for direct contact could be an email address and/or phone/fax number of the prescriber in order for the dispenser and/or patient to contact the prescriber. This might be necessary if problems arise with dosage, allergies, reimbursement etc.,
*Work address - This is the address of the hospital or the practice, etc. where the health professional normally works, meets patients and prescribes medication. Minimally, the country is specified,
*Signature - Digital signature or token as proof of the authenticity of the prescriber,
*Health care provider identifier - A unique number or code issued for the purpose of identifying a health care provider [ISO/TS 27527:2010]; this may be a license or registration number which can be used to trace the prescriber and to check whether a medicinal product was prescribed by the right person according to the law of the prescribing country.

3) '''Original Clinical Documents''' – documents containing your health information.
<ol type="I">
<li>Laboratory Results - clinical documents containing the results of laboratory tests, stored in the home Country.</li>
<li>Imaging Reports - clinical documents containing the reports on images studies and, when requested, the images (e.g. in DICOM standard), stored in the home Country.</li>
<li>Discharge Reports - clinical document generated by the healthcare provider where the patient was treated, both as an inpatient and an outpatient, which gathers the main findings, stored in the Country of Affiliation.</li>
</ol>

This personal data is available in so far as it is already recorded in electronic form in your home country.
The source(s) of this data varies from country to country.
See the last page for information specific to this country.

==What is the legal basis for the use of your personal data?==

The MyHealth@EU services will become available for you depending on the conditions set individually by each country.
When the patient receives treatment or medicine abroad, your data will be recorded in the country of treatment (or medicine dispensation) according to the EU General Data Protection Regulation, the national legislation of that country and the internal rules of the particular healthcare provider.
Emergency situations may justify the use of your data for the treatment of the patient without the patient’s consent.
See the last page for information specific to this country.

==What is the purpose of the processing?==
The primary purpose for processing your data is the medical treatment of your patient or the provision of medicine. However, due to the national legislation of each Member State, there may be additional purposes.
See the last page to check if such additional purposes are applicable to this country.

==Who processes and has access to this data? (recipients of personal data)==

Your personal data will be accessible by the National Contact Points for eHealth, i.e., entities that process your data to ensure its secure transmission to and from the specific healthcare organization or pharmacy, logging, or other related activities.
The list of data processors is indicated on the last page.

==Where and for how long is the personal data stored?==

The collected personal data may be stored in the information systems of the health institutions both in your home country and the country of treatment or dispensation of medicine.
The data shall be stored for no longer than is necessary for the purpose for which your personal data is processed. The Patient Summary data may be stored for 15 years from the last update for permanent residents of Cyprus and is automatically deleted after this period. However, for visitors from other European countries, the Patient Summary is not stored at all. The retention period may vary in other countries that offer Electronic Cross-Border Health Services, with relevant information available on the eHDSI website. The storage period in other participating countries may vary. Information about the storage periods is available on the eHDSI website.
The storage period(s) in this Member State is indicated on the last page.

==What are your rights and how to exercise them?==

You have the right to access your personal data.
Apart from that, you can exercise the rights of rectification, erasure, restriction of the processing and data portability.
In order to exercise your rights, you may contact us.
Contact details are available on the last page.
Also, you have the right to lodge a complaint before the supervisory data protection authority.
 
The list of the national supervisory authorities can be found at https://edpb.europa.eu/about-edpb/about-edpb/members_en.

='''(II) Summary of Member State-specific information'''=

{| class="wikitable"
! Member State
! CYPRUS
|-
| Service(s) provided by country
|
* Patient Summary.
* Electronic prescription and dispensation.
|-
| Data that is exchanged
| Patient Summary:
* Identification of the patient/subject (National healthcare patient ID, Family name/surname, Given name, Date of birth, gender, Country of affiliation),
* Contact information (Patient address),
* Preferred HP to contact,
* Contact person/ Legal guardian,
* Insurance information,
* Document data,
* Author and Organisation (Author organisation, Legal authenticator),
* Additional information / Knowledge resources (External reference, Related with),
* Allergy, Medical alert information, Medical history (Vaccination/ Prophylaxis information, Resolved, closed or inactive problems, Medical history),
* Medical problems (Current problems, Medical devices and implants, Procedures, Functional status),
* Medication summary (Current and relevant past medicines),
* Social history,
* Pregnancy history (Current pregnancy status, History of previous pregnancies),
* Patient provided data,
* Results,
* Plan of Care.
Electronic prescription and dispensation:
* Patient administrative data (Family name/surname, Given name, Date of birth, Personal identifier, gender, Native language),
* Authentication of the prescription (Identifier of the Prescription, Issue date),
* Identification of the prescribing health professional (Family name, Given name, Professional qualifications, Details for direct contact, Work address, signature, Health care provider identifier),
* Identification of the prescribed product (Name of the medicinal product, Identifier of the medicinal product, Identifier(s) of the pharmaceutical product, Identifier(s) of the packaged medicinal product, Marketing authorisation holder, Active substance(s), Strength of the active substance(s), Product classification, Pharmaceutical dose form(s), Unit of presentation(s), Package type, Pack size),
* Prescription information (Quantity of prescribed product, Dose regimen, Number of units per intake, Frequency of intakes, Route of administration, Duration of treatment, Starting date of therapy, Directions for use, Prescription expiry date, Repeats, Reason for prescription, Substitution),
* Dispensation information (Identifier of the dispenser, Family name of the dispenser, Given name of the dispenser, Identifier of the pharmacy, Address of the pharmacy, Details of direct contact, Identifier of the prescription, Medicinal product, Dispensed quantity, Dispensation date, Substitution).
|-
| Role of the Country in the data exchange
|
* Accessing personal data from your home country.
(in case of electronic prescription, will also send dispensation details back to your home country).
* Providing access to your data to other health professionals in other countries.
|-
| Legal basis
|
* Your consent is needed before the service can be provided to you.
* In case of an emergency to the patient, access to your data may be available also without the consent of the patient.

Applicable law(s):

[https://www.neha.org.cy/wp-content/uploads/2022/10/%CE%9F-%CF%80%CE%B5%CF%81%CE%AF-%CE%97%CE%BB%CE%B5%CE%BA%CF%84%CF%81%CE%BF%CE%BD%CE%B9%CE%BA%CE%AE%CF%82-%CE%A5%CE%B3%CE%B5%CE%AF%CE%B1%CF%82-%CE%9D%CF%8C%CE%BC%CE%BF%CF%82-%CF%84%CE%BF%CF%85-2019.pdf Ο περί Ηλεκτρονικής Υγείας Νόμος του 2019 (neha.org.cy)]

[https://www.cylaw.org/nomoi/indexes/2013_1_149.html Ο περί Εφαρμογής των Δικαιωμάτων των Ασθενών στο πλαίσιο της Διασυνοριακής Υγειονομικής Περίθαλψης Νόμος του 2013 (cylaw.org)]

[https://www.cylaw.org/nomoi/enop/non-ind/2001_1_138/full.html Ο Περί Επεξεργασίας Δεδομένων Προσωπικού Χαρακτήρα (Προστασία του Ατόμου) Νόμος του 2001 - 138(I)/2001 (cylaw.org)]
|-
| Restriction of access to specific data
|
* You may restrict access to specific data.
Narcotic Drugs and Psychotropic Substances Regulations (Regulation 12).
 
More information about the restrictions you may set:

[https://www.moh.gov.cy/moh/phs/phs.nsf/crossborder_en/crossborder_en?OpenDocument Cross-border prescriptions | Pharmaceutical Services | (moh.gov.cy)]
|-
| Purpose of use
|
* Treatment purposes.
* Dispensation of medicinal products.
* Research, policy-making, and other secondary uses.
https://www.neha.org.cy/en/national-contact-point/
|-
| Storage of data
|Your data will be stored for:
1) PSA data will be stored for 15 years from the last reviewing.
2) PSB data will not be stored.
3) Log data will be stored forever.
* Data will be stored also for additional purposes.

Purpose: secondary use (anonymized databases). 
Storage period: will be deleted upon the receipt of patient’s request. 
Any restrictions that apply to the storage period: for secondary use all the data must be anonymized, all the data (for primary & secondary use) are stored encrypted. 
Conditions under which the data can be erased ("right to be forgotten"), e.g., the right only applies to data held at the time the request is received. It does not apply to data that may be created in the future. The right is not absolute and only applies in certain circumstances.
|-
| Data Controller(s)
(You may need to contact the data controller for example in order to exercise your data protection rights)
|
'''Name:''' Rafael Michael 
'''Address:''' 67Α Limassol Avenue, Aglantzia, 2121, Nicosia, Cyprus 
'''Email:''' rafael.michael@neha.org.cy 
'''Phone:''' +357 22436004 
|-
| Data Processor(s)
|
'''Name:''' Vanthia Toumpouri 
'''Address:''' 67Α Limassol Avenue, Aglantzia, 2121, Nicosia, Cyprus 
'''Email:''' vanthia.toumpouri@neha.org.cy 
'''Phone:''' +357 22436031 
|-
| Data Protection Officer
(You may need to contact the data protection officer for example in order to lodge a complaint)
|
'''Name:''' Office of the Commissioner for Personal Data Protection. 
'''Address:''' 15, Kypranoros Street, 1061 Nicosia, P.O. Box. 23378, 1682, Nicosia. 
'''Email:''' commissioner@dataprotection.gov.cy 
'''Phone:''' +357 22818456 
|}

='''(III) Link to Member State detailed health professional information notice'''=

{| class="wikitable"
! Member State
! CYPRUS
|-
| CYPRUS
|
* Patient Summary
* Electronic prescription and dispensation.
|}

Health Professional Information Notice (HPIN) about MyHealth@EU services

2025-07-24T04:45:29Z

Terspithea.kittou: /* Which categories of your data are exchanged? */

='''(I) General information about MyHealth@EU'''=

==What is MyHealth@EU?==

MyHealth@EU, also called the eHealth Digital Service Infrastructure (eHDSI) enables the safe processing of your personal data, related to your role as a healthcare professional involved in the treatment of patients and the provision of medicines. This is done by electronic means through secure gateways provided by National Contact Points for eHealth (NCPeH) designated by each country.

Each country identifies which organization assumes the responsibility as a data controller for the processing of your data, as this is subject to the country's legislation.

See the last page for information specific to this country.

==Which categories of your data are exchanged?==

1) Patient summary – It includes critical information such as current medication, any allergies, and previous surgeries. This data is collected from the patient's country of origin and is utilized in case medical care is needed in another European Union country. Through the Summary Health Record, healthcare professionals abroad gain immediate and clear insight into the patient's health status, facilitating the provision of safe and appropriate medical care. This includes:

*Name of the health professional - Name of the Health Professional that has been treating or taking responsibility for the patient,
*Role of the health professional - The health professional's role in the organisation (i.e., healthcare provider),
*Health professional's organisation - Name of the health professional's organisation (i.e., healthcare provider),
*Telephone no. - telephone number of the health professional at the organisation (i.e., healthcare provider),
*Email - Email of the health professional or organisation (i.e., healthcare provider),
*Network affiliation - the health professional's organization that is affiliated with a European network, e.g., the European Reference Networks (ERN),
*Related with - Identification of the entry or entries of this Patient Summary for which the health professional is the preferred contact.

2) Electronic prescription and dispensation - the patient can get a prescription for medicine from a healthcare provider in one country and receive medication through a pharmacy in another EU country. The electronic prescription contains essentially the same information as a regular paper prescription, i.e. identification of the prescriber, the patient and the medicine prescribed. The electronic dispensation includes information about the medicine dispensed. This information will be sent by the pharmacy back to the country that issued the prescription. ePrescribing is defined as prescribing medicines through the support of software by a health professional who is legally authorised to do so, so that the medicine can be dispensed by a pharmacy, and eDispensation (eDispensing) is defined as the act of electronically retrieving a prescription and reporting on the dispensation of the medicine to the patient as indicated in the corresponding ePrescription. Hence, the following information is included: a) data used to identify the health professional who is entitled (according to national law) to prescribe medicinal products, and b) data used to identify the health professionals/health care providers who are entitled (according to national law) to dispense medicinal products.

To identify the prescribing health professional, the following information is processed:

*Family name - The family name/surname/last name of the prescriber. This enables the prescriber to be traced in the event of questions or emergencies,
*Given name - The given name/first name of the prescriber. This enables the prescriber to be traced in the event of questions or emergencies,
*Professional qualifications - The professional title of the prescribing health professional, which may be used to prove the authority of the prescriber,
*Details for direct contact - Details for direct contact could be an email address and/or phone/fax number of the prescriber in order for the dispenser and/or patient to contact the prescriber. This might be necessary if problems arise with dosage, allergies, reimbursement etc.,
*Work address - This is the address of the hospital or the practice, etc. where the health professional normally works, meets patients and prescribes medication. Minimally, the country is specified,
*Signature - Digital signature or token as proof of the authenticity of the prescriber,
*Health care provider identifier - A unique number or code issued for the purpose of identifying a health care provider [ISO/TS 27527:2010]; this may be a license or registration number which can be used to trace the prescriber and to check whether a medicinal product was prescribed by the right person according to the law of the prescribing country.

3) Original clinical documents – documents containing your health information.
<ol type="I">
<li>Laboratory Results - clinical documents containing the results of laboratory tests, stored in the home Country.</li>
<li>Imaging Reports - clinical documents containing the reports on images studies and, when requested, the images (e.g. in DICOM standard), stored in the home Country.</li>
<li>Discharge Reports - clinical document generated by the healthcare provider where the patient was treated, both as an inpatient and an outpatient, which gathers the main findings, stored in the Country of Affiliation.</li>
</ol>

This personal data is available in so far as it is already recorded in electronic form in your home country.
The source(s) of this data varies from country to country.
See the last page for information specific to this country.

==What is the legal basis for the use of your personal data?==

The MyHealth@EU services will become available for you depending on the conditions set individually by each country.
When the patient receives treatment or medicine abroad, your data will be recorded in the country of treatment (or medicine dispensation) according to the EU General Data Protection Regulation, the national legislation of that country and the internal rules of the particular healthcare provider.
Emergency situations may justify the use of your data for the treatment of the patient without the patient’s consent.
See the last page for information specific to this country.

==What is the purpose of the processing?==
The primary purpose for processing your data is the medical treatment of your patient or the provision of medicine. However, due to the national legislation of each Member State, there may be additional purposes.
See the last page to check if such additional purposes are applicable to this country.

==Who processes and has access to this data? (recipients of personal data)==

Your personal data will be accessible by the National Contact Points for eHealth, i.e., entities that process your data to ensure its secure transmission to and from the specific healthcare organization or pharmacy, logging, or other related activities.
The list of data processors is indicated on the last page.

==Where and for how long is the personal data stored?==

The collected personal data may be stored in the information systems of the health institutions both in your home country and the country of treatment or dispensation of medicine.
The data shall be stored for no longer than is necessary for the purpose for which your personal data is processed. The Patient Summary data may be stored for 15 years from the last update for permanent residents of Cyprus and is automatically deleted after this period. However, for visitors from other European countries, the Patient Summary is not stored at all. The retention period may vary in other countries that offer Electronic Cross-Border Health Services, with relevant information available on the eHDSI website. The storage period in other participating countries may vary. Information about the storage periods is available on the eHDSI website.
The storage period(s) in this Member State is indicated on the last page.

==What are your rights and how to exercise them?==

You have the right to access your personal data.
Apart from that, you can exercise the rights of rectification, erasure, restriction of the processing and data portability.
In order to exercise your rights, you may contact us.
Contact details are available on the last page.
Also, you have the right to lodge a complaint before the supervisory data protection authority.
 
The list of the national supervisory authorities can be found at https://edpb.europa.eu/about-edpb/about-edpb/members_en.

='''(II) Summary of Member State-specific information'''=

{| class="wikitable"
! Member State
! CYPRUS
|-
| Service(s) provided by country
|
* Patient Summary.
* Electronic prescription and dispensation.
|-
| Data that is exchanged
| Patient Summary:
* Identification of the patient/subject (National healthcare patient ID, Family name/surname, Given name, Date of birth, gender, Country of affiliation),
* Contact information (Patient address),
* Preferred HP to contact,
* Contact person/ Legal guardian,
* Insurance information,
* Document data,
* Author and Organisation (Author organisation, Legal authenticator),
* Additional information / Knowledge resources (External reference, Related with),
* Allergy, Medical alert information, Medical history (Vaccination/ Prophylaxis information, Resolved, closed or inactive problems, Medical history),
* Medical problems (Current problems, Medical devices and implants, Procedures, Functional status),
* Medication summary (Current and relevant past medicines),
* Social history,
* Pregnancy history (Current pregnancy status, History of previous pregnancies),
* Patient provided data,
* Results,
* Plan of Care.
Electronic prescription and dispensation:
* Patient administrative data (Family name/surname, Given name, Date of birth, Personal identifier, gender, Native language),
* Authentication of the prescription (Identifier of the Prescription, Issue date),
* Identification of the prescribing health professional (Family name, Given name, Professional qualifications, Details for direct contact, Work address, signature, Health care provider identifier),
* Identification of the prescribed product (Name of the medicinal product, Identifier of the medicinal product, Identifier(s) of the pharmaceutical product, Identifier(s) of the packaged medicinal product, Marketing authorisation holder, Active substance(s), Strength of the active substance(s), Product classification, Pharmaceutical dose form(s), Unit of presentation(s), Package type, Pack size),
* Prescription information (Quantity of prescribed product, Dose regimen, Number of units per intake, Frequency of intakes, Route of administration, Duration of treatment, Starting date of therapy, Directions for use, Prescription expiry date, Repeats, Reason for prescription, Substitution),
* Dispensation information (Identifier of the dispenser, Family name of the dispenser, Given name of the dispenser, Identifier of the pharmacy, Address of the pharmacy, Details of direct contact, Identifier of the prescription, Medicinal product, Dispensed quantity, Dispensation date, Substitution).
|-
| Role of the Country in the data exchange
|
* Accessing personal data from your home country.
(in case of electronic prescription, will also send dispensation details back to your home country).
* Providing access to your data to other health professionals in other countries.
|-
| Legal basis
|
* Your consent is needed before the service can be provided to you.
* In case of an emergency to the patient, access to your data may be available also without the consent of the patient.

Applicable law(s):

[https://www.neha.org.cy/wp-content/uploads/2022/10/%CE%9F-%CF%80%CE%B5%CF%81%CE%AF-%CE%97%CE%BB%CE%B5%CE%BA%CF%84%CF%81%CE%BF%CE%BD%CE%B9%CE%BA%CE%AE%CF%82-%CE%A5%CE%B3%CE%B5%CE%AF%CE%B1%CF%82-%CE%9D%CF%8C%CE%BC%CE%BF%CF%82-%CF%84%CE%BF%CF%85-2019.pdf Ο περί Ηλεκτρονικής Υγείας Νόμος του 2019 (neha.org.cy)]

[https://www.cylaw.org/nomoi/indexes/2013_1_149.html Ο περί Εφαρμογής των Δικαιωμάτων των Ασθενών στο πλαίσιο της Διασυνοριακής Υγειονομικής Περίθαλψης Νόμος του 2013 (cylaw.org)]

[https://www.cylaw.org/nomoi/enop/non-ind/2001_1_138/full.html Ο Περί Επεξεργασίας Δεδομένων Προσωπικού Χαρακτήρα (Προστασία του Ατόμου) Νόμος του 2001 - 138(I)/2001 (cylaw.org)]
|-
| Restriction of access to specific data
|
* You may restrict access to specific data.
Narcotic Drugs and Psychotropic Substances Regulations (Regulation 12).
 
More information about the restrictions you may set:

[https://www.moh.gov.cy/moh/phs/phs.nsf/crossborder_en/crossborder_en?OpenDocument Cross-border prescriptions | Pharmaceutical Services | (moh.gov.cy)]
|-
| Purpose of use
|
* Treatment purposes.
* Dispensation of medicinal products.
* Research, policy-making, and other secondary uses.
https://www.neha.org.cy/en/national-contact-point/
|-
| Storage of data
|Your data will be stored for:
1) PSA data will be stored for 15 years from the last reviewing.
2) PSB data will not be stored.
3) Log data will be stored forever.
* Data will be stored also for additional purposes.

Purpose: secondary use (anonymized databases). 
Storage period: will be deleted upon the receipt of patient’s request. 
Any restrictions that apply to the storage period: for secondary use all the data must be anonymized, all the data (for primary & secondary use) are stored encrypted. 
Conditions under which the data can be erased ("right to be forgotten"), e.g., the right only applies to data held at the time the request is received. It does not apply to data that may be created in the future. The right is not absolute and only applies in certain circumstances.
|-
| Data Controller(s)
(You may need to contact the data controller for example in order to exercise your data protection rights)
|
'''Name:''' Rafael Michael 
'''Address:''' 67Α Limassol Avenue, Aglantzia, 2121, Nicosia, Cyprus 
'''Email:''' rafael.michael@neha.org.cy 
'''Phone:''' +357 22436004 
|-
| Data Processor(s)
|
'''Name:''' Vanthia Toumpouri 
'''Address:''' 67Α Limassol Avenue, Aglantzia, 2121, Nicosia, Cyprus 
'''Email:''' vanthia.toumpouri@neha.org.cy 
'''Phone:''' +357 22436031 
|-
| Data Protection Officer
(You may need to contact the data protection officer for example in order to lodge a complaint)
|
'''Name:''' Office of the Commissioner for Personal Data Protection. 
'''Address:''' 15, Kypranoros Street, 1061 Nicosia, P.O. Box. 23378, 1682, Nicosia. 
'''Email:''' commissioner@dataprotection.gov.cy 
'''Phone:''' +357 22818456 
|}

='''(III) Link to Member State detailed health professional information notice'''=

{| class="wikitable"
! Member State
! CYPRUS
|-
| CYPRUS
|
* Patient Summary
* Electronic prescription and dispensation.
|}

Health Professional Information Notice (HPIN) about MyHealth@EU services

2025-07-23T10:00:56Z

Terspithea.kittou:

='''(I) General information about MyHealth@EU'''=

==What is MyHealth@EU?==

MyHealth@EU, also called the eHealth Digital Service Infrastructure (eHDSI) enables the safe processing of your personal data, related to your role as a healthcare professional involved in the treatment of patients and the provision of medicines. This is done by electronic means through secure gateways provided by National Contact Points for eHealth (NCPeH) designated by each country.

Each country identifies which organization assumes the responsibility as a data controller for the processing of your data, as this is subject to the country's legislation.

See the last page for information specific to this country.

==Which categories of your data are exchanged?==

1) Patient summary – the most important information about your health is collected from the country where it is stored, such as your home country, in order to use it for treatment in another country. The patient summary includes relevant information needed for identifying the health professional that is treating the patient:

*Name of the health professional - Name of the Health Professional that has been treating or taking responsibility for the patient,
*Role of the health professional - The health professional's role in the organisation (i.e., healthcare provider),
*Health professional's organisation - Name of the health professional's organisation (i.e., healthcare provider),
*Telephone no. - telephone number of the health professional at the organisation (i.e., healthcare provider),
*Email - Email of the health professional or organisation (i.e., healthcare provider),
*Network affiliation - the health professional's organization that is affiliated with a European network, e.g., the European Reference Networks (ERN),
*Related with - Identification of the entry or entries of this Patient Summary for which the health professional is the preferred contact.

2) Electronic prescription and dispensation - the patient can get a prescription for medicine from a healthcare provider in one country and receive medication through a pharmacy in another EU country. The electronic prescription contains essentially the same information as a regular paper prescription, i.e. identification of the prescriber, the patient and the medicine prescribed. The electronic dispensation includes information about the medicine dispensed. This information will be sent by the pharmacy back to the country that issued the prescription. ePrescribing is defined as prescribing medicines through the support of software by a health professional who is legally authorised to do so, so that the medicine can be dispensed by a pharmacy, and eDispensation (eDispensing) is defined as the act of electronically retrieving a prescription and reporting on the dispensation of the medicine to the patient as indicated in the corresponding ePrescription. Hence, the following information is included: a) data used to identify the health professional who is entitled (according to national law) to prescribe medicinal products, and b) data used to identify the health professionals/health care providers who are entitled (according to national law) to dispense medicinal products.

To identify the prescribing health professional, the following information is processed:

*Family name - The family name/surname/last name of the prescriber. This enables the prescriber to be traced in the event of questions or emergencies,
*Given name - The given name/first name of the prescriber. This enables the prescriber to be traced in the event of questions or emergencies,
*Professional qualifications - The professional title of the prescribing health professional, which may be used to prove the authority of the prescriber,
*Details for direct contact - Details for direct contact could be an email address and/or phone/fax number of the prescriber in order for the dispenser and/or patient to contact the prescriber. This might be necessary if problems arise with dosage, allergies, reimbursement etc.,
*Work address - This is the address of the hospital or the practice, etc. where the health professional normally works, meets patients and prescribes medication. Minimally, the country is specified,
*Signature - Digital signature or token as proof of the authenticity of the prescriber,
*Health care provider identifier - A unique number or code issued for the purpose of identifying a health care provider [ISO/TS 27527:2010]; this may be a license or registration number which can be used to trace the prescriber and to check whether a medicinal product was prescribed by the right person according to the law of the prescribing country.

3) Original clinical documents – documents containing your health information.
<ol type="I">
<li>Laboratory Results - clinical documents containing the results of laboratory tests, stored in the home Country.</li>
<li>Imaging Reports - clinical documents containing the reports on images studies and, when requested, the images (e.g. in DICOM standard), stored in the home Country.</li>
<li>Discharge Reports - clinical document generated by the healthcare provider where the patient was treated, both as an inpatient and an outpatient, which gathers the main findings, stored in the Country of Affiliation.</li>
</ol>

This personal data is available in so far as it is already recorded in electronic form in your home country.
The source(s) of this data varies from country to country.
See the last page for information specific to this country.

==What is the legal basis for the use of your personal data?==

The MyHealth@EU services will become available for you depending on the conditions set individually by each country.
When the patient receives treatment or medicine abroad, your data will be recorded in the country of treatment (or medicine dispensation) according to the EU General Data Protection Regulation, the national legislation of that country and the internal rules of the particular healthcare provider.
Emergency situations may justify the use of your data for the treatment of the patient without the patient’s consent.
See the last page for information specific to this country.

==What is the purpose of the processing?==
The primary purpose for processing your data is the medical treatment of your patient or the provision of medicine. However, due to the national legislation of each Member State, there may be additional purposes.
See the last page to check if such additional purposes are applicable to this country.

==Who processes and has access to this data? (recipients of personal data)==

Your personal data will be accessible by the National Contact Points for eHealth, i.e., entities that process your data to ensure its secure transmission to and from the specific healthcare organization or pharmacy, logging, or other related activities.
The list of data processors is indicated on the last page.

==Where and for how long is the personal data stored?==

The collected personal data may be stored in the information systems of the health institutions both in your home country and the country of treatment or dispensation of medicine.
The data shall be stored for no longer than is necessary for the purpose for which your personal data is processed. The Patient Summary data may be stored for 15 years from the last update for permanent residents of Cyprus and is automatically deleted after this period. However, for visitors from other European countries, the Patient Summary is not stored at all. The retention period may vary in other countries that offer Electronic Cross-Border Health Services, with relevant information available on the eHDSI website. The storage period in other participating countries may vary. Information about the storage periods is available on the eHDSI website.
The storage period(s) in this Member State is indicated on the last page.

==What are your rights and how to exercise them?==

You have the right to access your personal data.
Apart from that, you can exercise the rights of rectification, erasure, restriction of the processing and data portability.
In order to exercise your rights, you may contact us.
Contact details are available on the last page.
Also, you have the right to lodge a complaint before the supervisory data protection authority.
 
The list of the national supervisory authorities can be found at https://edpb.europa.eu/about-edpb/about-edpb/members_en.

='''(II) Summary of Member State-specific information'''=

{| class="wikitable"
! Member State
! CYPRUS
|-
| Service(s) provided by country
|
* Patient Summary.
* Electronic prescription and dispensation.
|-
| Data that is exchanged
| Patient Summary:
* Identification of the patient/subject (National healthcare patient ID, Family name/surname, Given name, Date of birth, gender, Country of affiliation),
* Contact information (Patient address),
* Preferred HP to contact,
* Contact person/ Legal guardian,
* Insurance information,
* Document data,
* Author and Organisation (Author organisation, Legal authenticator),
* Additional information / Knowledge resources (External reference, Related with),
* Allergy, Medical alert information, Medical history (Vaccination/ Prophylaxis information, Resolved, closed or inactive problems, Medical history),
* Medical problems (Current problems, Medical devices and implants, Procedures, Functional status),
* Medication summary (Current and relevant past medicines),
* Social history,
* Pregnancy history (Current pregnancy status, History of previous pregnancies),
* Patient provided data,
* Results,
* Plan of Care.
Electronic prescription and dispensation:
* Patient administrative data (Family name/surname, Given name, Date of birth, Personal identifier, gender, Native language),
* Authentication of the prescription (Identifier of the Prescription, Issue date),
* Identification of the prescribing health professional (Family name, Given name, Professional qualifications, Details for direct contact, Work address, signature, Health care provider identifier),
* Identification of the prescribed product (Name of the medicinal product, Identifier of the medicinal product, Identifier(s) of the pharmaceutical product, Identifier(s) of the packaged medicinal product, Marketing authorisation holder, Active substance(s), Strength of the active substance(s), Product classification, Pharmaceutical dose form(s), Unit of presentation(s), Package type, Pack size),
* Prescription information (Quantity of prescribed product, Dose regimen, Number of units per intake, Frequency of intakes, Route of administration, Duration of treatment, Starting date of therapy, Directions for use, Prescription expiry date, Repeats, Reason for prescription, Substitution),
* Dispensation information (Identifier of the dispenser, Family name of the dispenser, Given name of the dispenser, Identifier of the pharmacy, Address of the pharmacy, Details of direct contact, Identifier of the prescription, Medicinal product, Dispensed quantity, Dispensation date, Substitution).
|-
| Role of the Country in the data exchange
|
* Accessing personal data from your home country.
(in case of electronic prescription, will also send dispensation details back to your home country).
* Providing access to your data to other health professionals in other countries.
|-
| Legal basis
|
* Your consent is needed before the service can be provided to you.
* In case of an emergency to the patient, access to your data may be available also without the consent of the patient.

Applicable law(s):

[https://www.neha.org.cy/wp-content/uploads/2022/10/%CE%9F-%CF%80%CE%B5%CF%81%CE%AF-%CE%97%CE%BB%CE%B5%CE%BA%CF%84%CF%81%CE%BF%CE%BD%CE%B9%CE%BA%CE%AE%CF%82-%CE%A5%CE%B3%CE%B5%CE%AF%CE%B1%CF%82-%CE%9D%CF%8C%CE%BC%CE%BF%CF%82-%CF%84%CE%BF%CF%85-2019.pdf Ο περί Ηλεκτρονικής Υγείας Νόμος του 2019 (neha.org.cy)]

[https://www.cylaw.org/nomoi/indexes/2013_1_149.html Ο περί Εφαρμογής των Δικαιωμάτων των Ασθενών στο πλαίσιο της Διασυνοριακής Υγειονομικής Περίθαλψης Νόμος του 2013 (cylaw.org)]

[https://www.cylaw.org/nomoi/enop/non-ind/2001_1_138/full.html Ο Περί Επεξεργασίας Δεδομένων Προσωπικού Χαρακτήρα (Προστασία του Ατόμου) Νόμος του 2001 - 138(I)/2001 (cylaw.org)]
|-
| Restriction of access to specific data
|
* You may restrict access to specific data.
Narcotic Drugs and Psychotropic Substances Regulations (Regulation 12).
 
More information about the restrictions you may set:

[https://www.moh.gov.cy/moh/phs/phs.nsf/crossborder_en/crossborder_en?OpenDocument Cross-border prescriptions | Pharmaceutical Services | (moh.gov.cy)]
|-
| Purpose of use
|
* Treatment purposes.
* Dispensation of medicinal products.
* Research, policy-making, and other secondary uses.
https://www.neha.org.cy/en/national-contact-point/
|-
| Storage of data
|Your data will be stored for:
1) PSA data will be stored for 15 years from the last reviewing.
2) PSB data will not be stored.
3) Log data will be stored forever.
* Data will be stored also for additional purposes.

Purpose: secondary use (anonymized databases). 
Storage period: will be deleted upon the receipt of patient’s request. 
Any restrictions that apply to the storage period: for secondary use all the data must be anonymized, all the data (for primary & secondary use) are stored encrypted. 
Conditions under which the data can be erased ("right to be forgotten"), e.g., the right only applies to data held at the time the request is received. It does not apply to data that may be created in the future. The right is not absolute and only applies in certain circumstances.
|-
| Data Controller(s)
(You may need to contact the data controller for example in order to exercise your data protection rights)
|
'''Name:''' Rafael Michael 
'''Address:''' 67Α Limassol Avenue, Aglantzia, 2121, Nicosia, Cyprus 
'''Email:''' rafael.michael@neha.org.cy 
'''Phone:''' +357 22436004 
|-
| Data Processor(s)
|
'''Name:''' Vanthia Toumpouri 
'''Address:''' 67Α Limassol Avenue, Aglantzia, 2121, Nicosia, Cyprus 
'''Email:''' vanthia.toumpouri@neha.org.cy 
'''Phone:''' +357 22436031 
|-
| Data Protection Officer
(You may need to contact the data protection officer for example in order to lodge a complaint)
|
'''Name:''' Office of the Commissioner for Personal Data Protection. 
'''Address:''' 15, Kypranoros Street, 1061 Nicosia, P.O. Box. 23378, 1682, Nicosia. 
'''Email:''' commissioner@dataprotection.gov.cy 
'''Phone:''' +357 22818456 
|}

='''(III) Link to Member State detailed health professional information notice'''=

{| class="wikitable"
! Member State
! CYPRUS
|-
| CYPRUS
|
* Patient Summary
* Electronic prescription and dispensation.
|}

Patient Consent

2025-07-23T09:56:15Z

Terspithea.kittou:

This document provides information on the purpose of cross-border healthcare as well as a statement of consent for the storage, use and exchange of individual medical and personal data in the National Contact Point of Cyprus [NCP]). The two services are in English language.

Introduction: The National Electronic Health Authority is a member of the European eHealth Network. Cross-border healthcare is regulated by a directive of the European Parliament and the Council of the European Union. As part of the implementation of this Directive, certain Member States have decided to establish a common online platform among themselves, with the aim of exchanging agreed, standardized information provided by citizens, in the form of:

*Patient Summary [PS]
*Electronic Prescription [eP]

Procedure: the joint platform will be developed by the European eHealth Network. Each member country developed its own "National Contact Point for eHealth (NCPeH)". This is interconnected with the corresponding National Contact Points in other European countries. Through them, a brief health history and ePrescription will be sent and received only for people who need urgent health care in another EU country. Interconnection will take place only with the consent of the individual.

Benefits: The participant will be provided with high quality cross-border healthcare as follows:

*Providing secure access to your data when there is a need for cross-border healthcare (except Cyprus),
*Reducing the incidence of medical errors by providing quick and secure access to patient health information anywhere,
*Providing important information to medical staff in emergencies, reducing the repetition of diagnostic procedures and reducing the valuable time,
*Secure identification of both the individuals and the health care providers.

Personal Data Protection: The National Contact Point for eHealth of Cyprus is coordinated and managed by the National eHealth Authority. The "National Contact Point of Cyprus" is located within Cyprus and the data stored in an encrypted form. Only authorized personnel have access to data. The exchange of data within the National Contact Points of EU countries is encrypted form via a secure network (TESTA).

Confidentiality: The data will not be available to third parties (for example, insurance companies). The statistical processing of participants' data is anonymous and the identification of the individual is impossible.

Participation: It is voluntary and can be withdrawn at any time, without needing to explain the reason.

Non-participation: For the purpose of Cross-Border healthcare, you will not be able to have a Patient Summary or prescription in electronic form.

Right to withdraw consent: Tell your doctor or, alternatively, the National Contact Point of Cross-border Healthcare (see below). This will cause your data to no longer be stored and deleted from the database on request.

*Information: National Contact Point eHealth Cyprus

*Complaints: You have the right to submit them to the following organization

= National eHealth Authority =

67A Limassol Avenue,

2121, Aglantzia,

Cyprus

Call Center: 00357 22436000

Website: https://www.neha.gov.cy/

Patient Consent

2025-07-23T09:49:49Z

Terspithea.kittou:

This document provides information on the purpose of cross-border healthcare as well as a statement of consent for the storage, use and exchange of individual medical and personal data in the National Contact Point of Cyprus [NCP]). The two services are in English language.

Introduction: The National Electronic Health Authority is a member of the European eHealth Network. Cross-border healthcare is regulated by a directive of the European Parliament and the Council of the European Union. As part of the implementation of this Directive, certain Member States have decided to establish a common online platform among themselves, with the aim of exchanging agreed, standardized information provided by citizens, in the form of:

*Patient Summary [PS]
*Electronic Prescription [eP]

Procedure: the joint platform will be developed by the European eHealth Network. Each member country developed its own "National Contact Point for eHealth (NCPeH)". This is interconnected with the corresponding National Contact Points in other European countries. Through them, a brief health history and ePrescription will be sent and received only for people who need urgent health care in another EU country. Interconnection will take place only with the consent of the individual.

Benefits: The participant will be provided with high quality cross-border healthcare as follows:

*Providing secure access to your data when there is a need for cross-border healthcare (except Cyprus),
*Reducing the incidence of medical errors by providing quick and secure access to patient health information anywhere,
*Providing important information to medical staff in emergencies, reducing the repetition of diagnostic procedures and reducing the valuable time,
*Secure identification of both the individuals and the health care providers.

Personal Data Protection: The National Contact Point for eHealth of Cyprus is coordinated and managed by the National eHealth Authority. The "National Contact Point of Cyprus" is located within Cyprus and the data stored in an encrypted form. Only authorized personnel have access to data. The exchange of data within the National Contact Points of EU countries is encrypted form via a secure network (TESTA).

Confidentiality: The data will not be available to third parties (for example, insurance companies). The statistical processing of participants' data is anonymous and the identification of the individual is impossible.

Participation: It is voluntary and can be withdrawn at any time, without needing to explain the reason.

Non-participation: For the purpose of Cross-Border healthcare, you will not be able to have an electronic health history or prescription in electronic form.

Right to withdraw consent: Tell your doctor or, alternatively, the National Contact Point of Cross-border Healthcare (see below). This will cause your data to no longer be stored and deleted from the database on request.

*Information: National Contact Point eHealth Cyprus

*Complaints: You have the right to submit them to the following organization

= National eHealth Authority =

67A Limassol Avenue,

2121, Aglantzia,

Cyprus

Call Center: 00357 22436000

Website: https://www.neha.gov.cy/

Patient Consent

2025-07-23T09:42:51Z

Terspithea.kittou:

This document provides information on the purpose of cross-border healthcare as well as a statement of consent for the storage, use and exchange of individual medical and personal data in the National Contact Point of Cyprus [NCP]). The two services are in English language.

Introduction: The National Electronic Health Authority is a member of the European eHealth Network. Cross-border healthcare is regulated by a directive of the European Parliament and the Council of the European Union. As part of the implementation of this Directive, certain Member States have decided to establish a common online platform among themselves, with the aim of exchanging agreed, standardized information provided by citizens, in the form of:

*Patient Summary [PS]
*Electronic Prescription [eP]

Procedure: the joint platform will be developed by the European eHealth Network. Each member country developed its own "National Contact Point for eHealth (NCPeH)". This is interconnected with the corresponding National Contact Points in other European countries. Through them, a brief health history and ePrescription will be sent and received only for people who need urgent health care in another EU country. Interconnection will take place only with the consent of the individual.

Benefits: The participant will be provided with high quality cross-border healthcare as follows:

*Providing secure access to your data when there is a need for cross-border healthcare (except Cyprus),
*Reducing the incidence of medical errors by providing quick and secure access to patient health information anywhere,
*Providing important information to medical staff in emergencies, reducing the repetition of diagnostic procedures and reducing the valuable time,
*Secure identification of both the individuals and the health care providers.

Personal Data Protection: The National Contact Point of Cyprus is coordinated and managed by the National eHealth Authority, the Ministry of Health, together with the University of Cyprus. The "National Contact Point of Cyprus" is located within Cyprus and the data stored in an encrypted form. Only authorized personnel have access to data. The exchange of data within the National Contact Points of EU countries is encrypted form via a secure network (TESTA).

Confidentiality: The data will not be available to third parties (for example, insurance companies). The statistical processing of participants' data is anonymous and the identification of the individual is impossible.

Participation: It is voluntary and can be withdrawn at any time, without needing to explain the reason.

Non-participation: For the purpose of cross-border healthcare, you will not be able to have an electronic health history or prescription in electronic form.

Right to withdraw consent: Tell your doctor or, alternatively, the National Contact Point of Cross-border Healthcare (see below). This will cause your data to no longer be stored and deleted from the database on request.

*Information: National Contact Point eHealth Cyprus

*Complaints: You have the right to submit them to the following organization

= National eHealth Authority =

67A Limassol Avenue,

2121, Aglantzia,

Cyprus

Call Center: 00357 22436000

Website: https://www.neha.gov.cy/

Patient Information Notice

2025-07-23T08:14:46Z

Terspithea.kittou: /* (II) Summary of Member State-specific information */

= '''(I)General information about MyHealth@EU''' =

= Patient Information Notice regarding cross-border transfer of personal health data =

The following information is provided to fulfil the requirement of the EU General Data Protection Regulation to inform citizens about the processing of their personal data.

= What is the eHealth Digital Service Infrastructure? =

MyHealth@EU, also called the eHealth Digital Service Infrastructure (eHDSI), enables safe and easy access to your health data for healthcare professionals involved in your treatment and the provision of medicines - anytime and anywhere within the EU. This is done by electronic means through secure gateways provided by National Contact Points for eHealth (NCPeH) designated by each country.

Each country identifies which organization assumes the responsibility as a data controller for the processing of your data, as this is subject to the country's legislation.

See the last page for information specific to Cyprus.

= The categories of your personal health data concerned =

1)'''Patient Summary'''- It is a basic medical dataset that is transferred for the purpose of receiving treatment in another country. It includes important patient data such as allergies, current medication, previous illnesses and surgeries, that is necessary to treat the patient properly abroad. The Patient Summary includes:

*Name of the health professional - Name of the Health Professional that has been treating or taking responsibility for the patient,
*Role of the health professional - The health professional's role in the organisation (i.e., healthcare provider),
*Health professional's organisation - Name of the health professional's organisation (i.e., healthcare provider),
*Telephone no. - telephone number of the health professional at the organisation (i.e., healthcare provider),
*Email - Email of the health professional or organisation (i.e., healthcare provider),
*Network affiliation - the health professional's organization that is affiliated with a European network, e.g., the European Reference Networks (ERN),
*Related with - Identification of the entry or entries of this Patient Summary for which the health professional is the preferred contact.

2)'''Electronic prescription and dispensation''' - the patient can get a prescription for medicine from a healthcare provider in one country and receive medication through a pharmacy in another EU country. The electronic prescription contains essentially the same information as a regular paper prescription, i.e. identification of the prescriber, the patient and the medicine prescribed. The electronic dispensation includes information about the medicine dispensed. This information will be sent by the pharmacy back to the country that issued the prescription. ePrescribing is defined as prescribing medicines through the support of software by a health professional who is legally authorised to do so, so that the medicine can be dispensed by a pharmacy, and eDispensation (eDispensing) is defined as the act of electronically retrieving a prescription and reporting on the dispensation of the medicine to the patient as indicated in the corresponding ePrescription. Hence, the following information is included: a) data used to identify the health professional who is entitled (according to national law) to prescribe medicinal products, and b) data used to identify the health professionals/health care providers who are entitled (according to national law) to dispense medicinal products.

To identify the prescribing health professional, the following information is processed:

*Family name - The family name/surname/last name of the prescriber. This enables the prescriber to be traced in the event of questions or emergencies,
*Given name - The given name/first name of the prescriber. This enables the prescriber to be traced in the event of questions or emergencies,
*Professional qualifications - The professional title of the prescribing health professional, which may be used to prove the authority of the prescriber,
*Details for direct contact - Details for direct contact could be an email address and/or phone/fax number of the prescriber in order for the dispenser and/or patient to contact the prescriber. This might be necessary if problems arise with dosage, allergies, reimbursement etc.,
*Work address - This is the address of the hospital or the practice, etc. where the health professional normally works, meets patients and prescribes medication. Minimally, the country is specified,
*Signature - Digital signature or token as proof of the authenticity of the prescriber,
*Health care provider identifier - A unique number or code issued for the purpose of identifying a health care provider [ISO/TS 27527:2010]; this may be a license or registration number which can be used to trace the prescriber and to check whether a medicinal product was prescribed by the right person according to the law of the prescribing country.

3)'''Original Clinical Documents'''- containing your health information.

<ol type="I">
<li>laboratory results report:- clinical documents containing the results of laboratory tests, stored in the home Country.
<li>hospital discharge report:- clinical document generated by the healthcare provider where the patient was treated, both as an inpatient and an outpatient, which gathers the main findings, stored in the Country of Affiliation.
<li>medical imaging report:- clinical documents containing the reports on images studies.
</ol>
This personal health data is available in so far as it is already recorded in electronic form in your home country.

The source(s) of this data varies from country to country.

In a subsequent phase, regarding the exchange of clinical documents, the system will support not only the transmission of reports in PDF format but also the exchange of detailed medical images in higher resolution

= What is the legal basis for the use of your personal data? =

The eHDSI services will become available for you only upon your explicit consent. Although emergency situations may justify the use of your data for your treatment without consent, if you don’t give explicit consent before travelling, your data will not be available through the eHDSI system when you are in another country, not even in case of emergency. When you are abroad in an actual care situation, your Patient Summary data or Electronic Prescriptions will be recorded in the country of treatment in accordance with the EU General Data Protection Regulation (GDPR), the laws of that country and the practices of the particular healthcare institution.

= What is the purpose of processing? =

Your medical data will only be used for your personal treatment or provision of medicine.
In Cyprus, the data collected for inclusion in your Patient Summary will not be used for secondary purposes, other than for statistical purposes after it has been completely anonymised. Information about the purposes of such further processing according to the laws of various countries is available at the eHDSI website.

= Who processes and has access to this data? =

Your Patient Summary data will be accessible only by authorised and identifiable health professionals involved in your treatment, under professional secrecy, in the country of treatment. These are health professionals in the healthcare organization where you receive your treatment or the pharmacy where you receive your prescribed medicine. Each country of treatment participating in the eHDSI system has undertaken to ensure that the participating health professionals and healthcare providers on their territory have adequate information and training about their duties. Please refer to the eHDSI website for details of the participating countries. The Patient Summary data and Electronic Prescriptions will be transferred through a secure gateway provided by the eHealth National Contact Point designated by each country.

= Where and how long is the personal data stored? =

The Patient Summary data may be stored for 15 years from the last update for permanent residents of Cyprus and is automatically deleted after this period. However, for visitors from other European countries, the Patient Summary is not stored at all. The retention period may vary in other countries that offer Electronic Cross-Border Health Services, with relevant information available on the eHDSI website. The storage period in other participating countries may vary. Information about the storage periods is available on the eHDSI website.

= Your access rights =

If you consent to the processing of your Patient Summary data by the eHDSI system, you must explicitly provide your consent.
You have the right to:
a) rectify any inaccurate data in your Patient Summary data, according to Article 16 of the GDPR.
b) obtain the erasure of your Patient Summary data, according to Article 17 of the GDPR.
c) object to the processing of your Patient Summary data on grounds relating to your particular situation, according to Article 21 of the GDPR.

= You have the right to withdraw your consent at any time. =

If you do not consent for your personal data to be processed by the eHDSI system, your data will not be available for you through this system when you are in another country, not even in case of emergency.

Finally, you have the right to lodge a complaint with a supervisory authority either in Cyprus or in the country of treatment, depending on the factual situation.

='''(II) Summary of Member State-specific information'''=

{| class="wikitable"
! Member State
! CYPRUS
|-
| Service(s) provided by country
|
* Patient Summary.
* Electronic Prescription and Dispensation.
|-
| Data that is exchanged
| Patient Summary:
* Identification of the patient/subject (National healthcare patient ID, Family name/surname, Given name, Date of birth, gender, Country of affiliation),
* Contact information (Patient address),
* Preferred HP to contact,
* Contact person/ Legal guardian,
* Insurance information,
* Document data,
* Author and Organisation (Author organisation, Legal authenticator),
* Additional information / Knowledge resources (External reference, Related with),
* Allergy, Medical alert information, Medical history (Vaccination/ Prophylaxis information, Resolved, closed or inactive problems, Medical history),
* Medical problems (Current problems, Medical devices and implants, Procedures, Functional status),
* Medication summary (Current and relevant past medicines),
* Social history,
* Pregnancy history (Current pregnancy status, History of previous pregnancies),
* Patient provided data,
* Results,
* Plan of Care.
Electronic prescription and dispensation:
* Patient administrative data (Family name/surname, Given name, Date of birth, Personal identifier, gender, Native language),
* Authentication of the prescription (Identifier of the Prescription, Issue date),
* Identification of the prescribing health professional (Family name, Given name, Professional qualifications, Details for direct contact, Work address, signature, Health care provider identifier),
* Identification of the prescribed product (Name of the medicinal product, Identifier of the medicinal product, Identifier(s) of the pharmaceutical product, Identifier(s) of the packaged medicinal product, Marketing authorisation holder, Active substance(s), Strength of the active substance(s), Product classification, Pharmaceutical dose form(s), Unit of presentation(s), Package type, Pack size),
* Prescription information (Quantity of prescribed product, Dose regimen, Number of units per intake, Frequency of intakes, Route of administration, Duration of treatment, Starting date of therapy, Directions for use, Prescription expiry date, Repeats, Reason for prescription, Substitution),
* Dispensation information (Identifier of the dispenser, Family name of the dispenser, Given name of the dispenser, Identifier of the pharmacy, Address of the pharmacy, Details of direct contact, Identifier of the prescription, Medicinal product, Dispensed quantity, Dispensation date, Substitution).
|-
| Role of the Country in the data exchange
|
* Accessing personal data from your home country.
(in case of electronic prescription, will also send dispensation details back to your home country).
* Providing access to your data to other health professionals in other countries.
|-
| Legal basis
|
* Your consent is needed before the service can be provided to you.
* In case of an emergency to the patient, access to your data may be available also without the consent of the patient.

Applicable law(s):

[https://www.neha.org.cy/wp-content/uploads/2022/10/%CE%9F-%CF%80%CE%B5%CF%81%CE%AF-%CE%97%CE%BB%CE%B5%CE%BA%CF%84%CF%81%CE%BF%CE%BD%CE%B9%CE%BA%CE%AE%CF%82-%CE%A5%CE%B3%CE%B5%CE%AF%CE%B1%CF%82-%CE%9D%CF%8C%CE%BC%CE%BF%CF%82-%CF%84%CE%BF%CF%85-2019.pdf Ο περί Ηλεκτρονικής Υγείας Νόμος του 2019 (neha.org.cy)]

[https://www.cylaw.org/nomoi/indexes/2013_1_149.html Ο περί Εφαρμογής των Δικαιωμάτων των Ασθενών στο πλαίσιο της Διασυνοριακής Υγειονομικής Περίθαλψης Νόμος του 2013 (cylaw.org)]

[https://www.cylaw.org/nomoi/enop/non-ind/2001_1_138/full.html Ο Περί Επεξεργασίας Δεδομένων Προσωπικού Χαρακτήρα (Προστασία του Ατόμου) Νόμος του 2001 - 138(I)/2001 (cylaw.org)]
|-
| Restriction of access to specific data
|
* You may restrict access to specific data.
Narcotic Drugs and Psychotropic Substances Regulations (Regulation 12).
 
More information about the restrictions you may set:

[https://www.moh.gov.cy/moh/phs/phs.nsf/crossborder_en/crossborder_en?OpenDocument Cross-border prescriptions | Pharmaceutical Services | (moh.gov.cy)]
|-
| Purpose of use
|
* Treatment purposes.
* Dispensation of medicinal products.
* Research, policy-making, and other secondary uses.
https://www.neha.org.cy/en/national-contact-point/
|-
| Storage of data
|Your data will be stored for:
1) PSA data will be stored for 15 years from the last reviewing.
2) PSB data will not be stored.
3) Log data will be stored forever.
* Data will be stored also for additional purposes.

Purpose: secondary use (anonymized databases). 
Storage period: will be deleted upon the receipt of patient’s request. 
Any restrictions that apply to the storage period: for secondary use all the data must be anonymized, all the data (for primary & secondary use) are stored encrypted. 
Conditions under which the data can be erased ("right to be forgotten"), e.g., the right only applies to data held at the time the request is received. It does not apply to data that may be created in the future. The right is not absolute and only applies in certain circumstances.
|-
| Data Controller(s)
(You may need to contact the data controller for example in order to exercise your data protection rights)
|
'''Name:''' Rafael Michael 
'''Address:''' 67Α Limassol Avenue, Aglantzia, 2121, Nicosia, Cyprus 
'''Email:''' rafael.michael@neha.org.cy 
'''Phone:''' +357 22436004 
|-
| Data Processor(s)
|
'''Name:''' Vanthia Toumpouri 
'''Address:''' 67Α Limassol Avenue, Aglantzia, 2121, Nicosia, Cyprus 
'''Email:''' vanthia.toumpouri@neha.org.cy 
'''Phone:''' +357 22436031 
|-
| Data Protection Officer
(You may need to contact the data protection officer for example in order to lodge a complaint)
|
'''Name:''' Office of the Commissioner for Personal Data Protection. 
'''Address:''' 15, Kypranoros Street, 1061 Nicosia, P.O. Box. 23378, 1682, Nicosia. 
'''Email:''' commissioner@dataprotection.gov.cy 
'''Phone:''' +357 22818456 
|}

='''(III) Link to Member State detailed health professional information notice'''=

{| class="wikitable"
! Member State
! CYPRUS
|-
| CYPRUS
|
* Patient Summary
* Electronic prescription and dispensation.
|}

Patient Information Notice

2025-07-23T07:50:51Z

Terspithea.kittou: /* The categories of your personal health data concerned */

= '''(I)General information about MyHealth@EU''' =

= Patient Information Notice regarding cross-border transfer of personal health data =

The following information is provided to fulfil the requirement of the EU General Data Protection Regulation to inform citizens about the processing of their personal data.

= What is the eHealth Digital Service Infrastructure? =

MyHealth@EU, also called the eHealth Digital Service Infrastructure (eHDSI), enables safe and easy access to your health data for healthcare professionals involved in your treatment and the provision of medicines - anytime and anywhere within the EU. This is done by electronic means through secure gateways provided by National Contact Points for eHealth (NCPeH) designated by each country.

Each country identifies which organization assumes the responsibility as a data controller for the processing of your data, as this is subject to the country's legislation.

See the last page for information specific to Cyprus.

= The categories of your personal health data concerned =

1)'''Patient Summary'''- It is a basic medical dataset that is transferred for the purpose of receiving treatment in another country. It includes important patient data such as allergies, current medication, previous illnesses and surgeries, that is necessary to treat the patient properly abroad. The Patient Summary includes:

*Name of the health professional - Name of the Health Professional that has been treating or taking responsibility for the patient,
*Role of the health professional - The health professional's role in the organisation (i.e., healthcare provider),
*Health professional's organisation - Name of the health professional's organisation (i.e., healthcare provider),
*Telephone no. - telephone number of the health professional at the organisation (i.e., healthcare provider),
*Email - Email of the health professional or organisation (i.e., healthcare provider),
*Network affiliation - the health professional's organization that is affiliated with a European network, e.g., the European Reference Networks (ERN),
*Related with - Identification of the entry or entries of this Patient Summary for which the health professional is the preferred contact.

2)'''Electronic prescription and dispensation''' - the patient can get a prescription for medicine from a healthcare provider in one country and receive medication through a pharmacy in another EU country. The electronic prescription contains essentially the same information as a regular paper prescription, i.e. identification of the prescriber, the patient and the medicine prescribed. The electronic dispensation includes information about the medicine dispensed. This information will be sent by the pharmacy back to the country that issued the prescription. ePrescribing is defined as prescribing medicines through the support of software by a health professional who is legally authorised to do so, so that the medicine can be dispensed by a pharmacy, and eDispensation (eDispensing) is defined as the act of electronically retrieving a prescription and reporting on the dispensation of the medicine to the patient as indicated in the corresponding ePrescription. Hence, the following information is included: a) data used to identify the health professional who is entitled (according to national law) to prescribe medicinal products, and b) data used to identify the health professionals/health care providers who are entitled (according to national law) to dispense medicinal products.

To identify the prescribing health professional, the following information is processed:

*Family name - The family name/surname/last name of the prescriber. This enables the prescriber to be traced in the event of questions or emergencies,
*Given name - The given name/first name of the prescriber. This enables the prescriber to be traced in the event of questions or emergencies,
*Professional qualifications - The professional title of the prescribing health professional, which may be used to prove the authority of the prescriber,
*Details for direct contact - Details for direct contact could be an email address and/or phone/fax number of the prescriber in order for the dispenser and/or patient to contact the prescriber. This might be necessary if problems arise with dosage, allergies, reimbursement etc.,
*Work address - This is the address of the hospital or the practice, etc. where the health professional normally works, meets patients and prescribes medication. Minimally, the country is specified,
*Signature - Digital signature or token as proof of the authenticity of the prescriber,
*Health care provider identifier - A unique number or code issued for the purpose of identifying a health care provider [ISO/TS 27527:2010]; this may be a license or registration number which can be used to trace the prescriber and to check whether a medicinal product was prescribed by the right person according to the law of the prescribing country.

3)'''Original Clinical Documents'''- containing your health information.

<ol type="I">
<li>laboratory results report:- clinical documents containing the results of laboratory tests, stored in the home Country.
<li>hospital discharge report:- clinical document generated by the healthcare provider where the patient was treated, both as an inpatient and an outpatient, which gathers the main findings, stored in the Country of Affiliation.
<li>medical imaging report:- clinical documents containing the reports on images studies.
</ol>
This personal health data is available in so far as it is already recorded in electronic form in your home country.

The source(s) of this data varies from country to country.

In a subsequent phase, regarding the exchange of clinical documents, the system will support not only the transmission of reports in PDF format but also the exchange of detailed medical images in higher resolution

= What is the legal basis for the use of your personal data? =

The eHDSI services will become available for you only upon your explicit consent. Although emergency situations may justify the use of your data for your treatment without consent, if you don’t give explicit consent before travelling, your data will not be available through the eHDSI system when you are in another country, not even in case of emergency. When you are abroad in an actual care situation, your Patient Summary data or Electronic Prescriptions will be recorded in the country of treatment in accordance with the EU General Data Protection Regulation (GDPR), the laws of that country and the practices of the particular healthcare institution.

= What is the purpose of processing? =

Your medical data will only be used for your personal treatment or provision of medicine.
In Cyprus, the data collected for inclusion in your Patient Summary will not be used for secondary purposes, other than for statistical purposes after it has been completely anonymised. Information about the purposes of such further processing according to the laws of various countries is available at the eHDSI website.

= Who processes and has access to this data? =

Your Patient Summary data will be accessible only by authorised and identifiable health professionals involved in your treatment, under professional secrecy, in the country of treatment. These are health professionals in the healthcare organization where you receive your treatment or the pharmacy where you receive your prescribed medicine. Each country of treatment participating in the eHDSI system has undertaken to ensure that the participating health professionals and healthcare providers on their territory have adequate information and training about their duties. Please refer to the eHDSI website for details of the participating countries. The Patient Summary data and Electronic Prescriptions will be transferred through a secure gateway provided by the eHealth National Contact Point designated by each country.

= Where and how long is the personal data stored? =

The Patient Summary data may be stored for 15 years from the last update for permanent residents of Cyprus and is automatically deleted after this period. However, for visitors from other European countries, the Patient Summary is not stored at all. The retention period may vary in other countries that offer Electronic Cross-Border Health Services, with relevant information available on the eHDSI website. The storage period in other participating countries may vary. Information about the storage periods is available on the eHDSI website.

= Your access rights =

If you consent to the processing of your Patient Summary data by the eHDSI system, you must explicitly provide your consent.
You have the right to:
a) rectify any inaccurate data in your Patient Summary data, according to Article 16 of the GDPR.
b) obtain the erasure of your Patient Summary data, according to Article 17 of the GDPR.
c) object to the processing of your Patient Summary data on grounds relating to your particular situation, according to Article 21 of the GDPR.

= You have the right to withdraw your consent at any time. =

If you do not consent for your personal data to be processed by the eHDSI system, your data will not be available for you through this system when you are in another country, not even in case of emergency.

Finally, you have the right to lodge a complaint with a supervisory authority either in Cyprus or in the country of treatment, depending on the factual situation.

='''(II) Summary of Member State-specific information'''=

{| class="wikitable"
! Member State
! CYPRUS
|-
| Service(s) provided by country
|
* Patient Summary.
* Electronic prescription and dispensation.
|-
| Data that is exchanged
| Patient Summary:
* Identification of the patient/subject (National healthcare patient ID, Family name/surname, Given name, Date of birth, gender, Country of affiliation),
* Contact information (Patient address),
* Preferred HP to contact,
* Contact person/ Legal guardian,
* Insurance information,
* Document data,
* Author and Organisation (Author organisation, Legal authenticator),
* Additional information / Knowledge resources (External reference, Related with),
* Allergy, Medical alert information, Medical history (Vaccination/ Prophylaxis information, Resolved, closed or inactive problems, Medical history),
* Medical problems (Current problems, Medical devices and implants, Procedures, Functional status),
* Medication summary (Current and relevant past medicines),
* Social history,
* Pregnancy history (Current pregnancy status, History of previous pregnancies),
* Patient provided data,
* Results,
* Plan of Care.
Electronic prescription and dispensation:
* Patient administrative data (Family name/surname, Given name, Date of birth, Personal identifier, gender, Native language),
* Authentication of the prescription (Identifier of the Prescription, Issue date),
* Identification of the prescribing health professional (Family name, Given name, Professional qualifications, Details for direct contact, Work address, signature, Health care provider identifier),
* Identification of the prescribed product (Name of the medicinal product, Identifier of the medicinal product, Identifier(s) of the pharmaceutical product, Identifier(s) of the packaged medicinal product, Marketing authorisation holder, Active substance(s), Strength of the active substance(s), Product classification, Pharmaceutical dose form(s), Unit of presentation(s), Package type, Pack size),
* Prescription information (Quantity of prescribed product, Dose regimen, Number of units per intake, Frequency of intakes, Route of administration, Duration of treatment, Starting date of therapy, Directions for use, Prescription expiry date, Repeats, Reason for prescription, Substitution),
* Dispensation information (Identifier of the dispenser, Family name of the dispenser, Given name of the dispenser, Identifier of the pharmacy, Address of the pharmacy, Details of direct contact, Identifier of the prescription, Medicinal product, Dispensed quantity, Dispensation date, Substitution).
|-
| Role of the Country in the data exchange
|
* Accessing personal data from your home country.
(in case of electronic prescription, will also send dispensation details back to your home country).
* Providing access to your data to other health professionals in other countries.
|-
| Legal basis
|
* Your consent is needed before the service can be provided to you.
* In case of an emergency to the patient, access to your data may be available also without the consent of the patient.

Applicable law(s):

[https://www.neha.org.cy/wp-content/uploads/2022/10/%CE%9F-%CF%80%CE%B5%CF%81%CE%AF-%CE%97%CE%BB%CE%B5%CE%BA%CF%84%CF%81%CE%BF%CE%BD%CE%B9%CE%BA%CE%AE%CF%82-%CE%A5%CE%B3%CE%B5%CE%AF%CE%B1%CF%82-%CE%9D%CF%8C%CE%BC%CE%BF%CF%82-%CF%84%CE%BF%CF%85-2019.pdf Ο περί Ηλεκτρονικής Υγείας Νόμος του 2019 (neha.org.cy)]

[https://www.cylaw.org/nomoi/indexes/2013_1_149.html Ο περί Εφαρμογής των Δικαιωμάτων των Ασθενών στο πλαίσιο της Διασυνοριακής Υγειονομικής Περίθαλψης Νόμος του 2013 (cylaw.org)]

[https://www.cylaw.org/nomoi/enop/non-ind/2001_1_138/full.html Ο Περί Επεξεργασίας Δεδομένων Προσωπικού Χαρακτήρα (Προστασία του Ατόμου) Νόμος του 2001 - 138(I)/2001 (cylaw.org)]
|-
| Restriction of access to specific data
|
* You may restrict access to specific data.
Narcotic Drugs and Psychotropic Substances Regulations (Regulation 12).
 
More information about the restrictions you may set:

[https://www.moh.gov.cy/moh/phs/phs.nsf/crossborder_en/crossborder_en?OpenDocument Cross-border prescriptions | Pharmaceutical Services | (moh.gov.cy)]
|-
| Purpose of use
|
* Treatment purposes.
* Dispensation of medicinal products.
* Research, policy-making, and other secondary uses.
https://www.neha.org.cy/en/national-contact-point/
|-
| Storage of data
|Your data will be stored for:
1) PSA data will be stored for 15 years from the last reviewing.
2) PSB data will not be stored.
3) Log data will be stored forever.
* Data will be stored also for additional purposes.

Purpose: secondary use (anonymized databases). 
Storage period: will be deleted upon the receipt of patient’s request. 
Any restrictions that apply to the storage period: for secondary use all the data must be anonymized, all the data (for primary & secondary use) are stored encrypted. 
Conditions under which the data can be erased ("right to be forgotten"), e.g., the right only applies to data held at the time the request is received. It does not apply to data that may be created in the future. The right is not absolute and only applies in certain circumstances.
|-
| Data Controller(s)
(You may need to contact the data controller for example in order to exercise your data protection rights)
|
'''Name:''' Rafael Michael 
'''Address:''' 67Α Limassol Avenue, Aglantzia, 2121, Nicosia, Cyprus 
'''Email:''' rafael.michael@neha.org.cy 
'''Phone:''' +357 22436004 
|-
| Data Processor(s)
|
'''Name:''' Vanthia Toumpouri 
'''Address:''' 67Α Limassol Avenue, Aglantzia, 2121, Nicosia, Cyprus 
'''Email:''' vanthia.toumpouri@neha.org.cy 
'''Phone:''' +357 22436031 
|-
| Data Protection Officer
(You may need to contact the data protection officer for example in order to lodge a complaint)
|
'''Name:''' Office of the Commissioner for Personal Data Protection. 
'''Address:''' 15, Kypranoros Street, 1061 Nicosia, P.O. Box. 23378, 1682, Nicosia. 
'''Email:''' commissioner@dataprotection.gov.cy 
'''Phone:''' +357 22818456 
|}

='''(III) Link to Member State detailed health professional information notice'''=

{| class="wikitable"
! Member State
! CYPRUS
|-
| CYPRUS
|
* Patient Summary
* Electronic prescription and dispensation.
|}

Patient Information Notice

2025-07-23T07:47:35Z

Terspithea.kittou: /* The categories of your personal health data concerned */

= '''(I)General information about MyHealth@EU''' =

= Patient Information Notice regarding cross-border transfer of personal health data =

The following information is provided to fulfil the requirement of the EU General Data Protection Regulation to inform citizens about the processing of their personal data.

= What is the eHealth Digital Service Infrastructure? =

MyHealth@EU, also called the eHealth Digital Service Infrastructure (eHDSI), enables safe and easy access to your health data for healthcare professionals involved in your treatment and the provision of medicines - anytime and anywhere within the EU. This is done by electronic means through secure gateways provided by National Contact Points for eHealth (NCPeH) designated by each country.

Each country identifies which organization assumes the responsibility as a data controller for the processing of your data, as this is subject to the country's legislation.

See the last page for information specific to Cyprus.

= The categories of your personal health data concerned =

1)'''Patient Summary'''- It is a basic medical dataset that is transferred for the purpose of receiving treatment in another country. It includes important patient data such as allergies, current medication, previous illnesses and surgeries, that is necessary to treat the patient properly abroad. The Patient Summary includes:

*Name of the health professional - Name of the Health Professional that has been treating or taking responsibility for the patient,
*Role of the health professional - The health professional's role in the organisation (i.e., healthcare provider),
*Health professional's organisation - Name of the health professional's organisation (i.e., healthcare provider),
*Telephone no. - telephone number of the health professional at the organisation (i.e., healthcare provider),
*Email - Email of the health professional or organisation (i.e., healthcare provider),
*Network affiliation - the health professional's organization that is affiliated with a European network, e.g., the European Reference Networks (ERN),
*Related with - Identification of the entry or entries of this Patient Summary for which the health professional is the preferred contact.

2)'''Electronic prescription and dispensation''' - the patient can get a prescription for medicine from a healthcare provider in one country and receive medication through a pharmacy in another EU country. The electronic prescription contains essentially the same information as a regular paper prescription, i.e. identification of the prescriber, the patient and the medicine prescribed. The electronic dispensation includes information about the medicine dispensed. This information will be sent by the pharmacy back to the country that issued the prescription. ePrescribing is defined as prescribing medicines through the support of software by a health professional who is legally authorised to do so, so that the medicine can be dispensed by a pharmacy, and eDispensation (eDispensing) is defined as the act of electronically retrieving a prescription and reporting on the dispensation of the medicine to the patient as indicated in the corresponding ePrescription. Hence, the following information is included: a) data used to identify the health professional who is entitled (according to national law) to prescribe medicinal products, and b) data used to identify the health professionals/health care providers who are entitled (according to national law) to dispense medicinal products.

To identify the prescribing health professional, the following information is processed:

*Family name - The family name/surname/last name of the prescriber. This enables the prescriber to be traced in the event of questions or emergencies,
*Given name - The given name/first name of the prescriber. This enables the prescriber to be traced in the event of questions or emergencies,
*Professional qualifications - The professional title of the prescribing health professional, which may be used to prove the authority of the prescriber,
*Details for direct contact - Details for direct contact could be an email address and/or phone/fax number of the prescriber in order for the dispenser and/or patient to contact the prescriber. This might be necessary if problems arise with dosage, allergies, reimbursement etc.,
*Work address - This is the address of the hospital or the practice, etc. where the health professional normally works, meets patients and prescribes medication. Minimally, the country is specified,
*Signature - Digital signature or token as proof of the authenticity of the prescriber,
*Health care provider identifier - A unique number or code issued for the purpose of identifying a health care provider [ISO/TS 27527:2010]; this may be a license or registration number which can be used to trace the prescriber and to check whether a medicinal product was prescribed by the right person according to the law of the prescribing country.

3)'''Original Clinical Documents'''- containing your health information.

<ol type="I">
<li>laboratory results report:- clinical documents containing the results of laboratory tests, stored in the home Country.
<li>hospital discharge report:- clinical document generated by the healthcare provider where the patient was treated, both as an inpatient and an outpatient, which gathers the main findings, stored in the Country of Affiliation.
<li>medical imaging report:- clinical documents containing the reports on images studies
</ol>
This personal health data is available in so far as it is already recorded in electronic form in your home country.

The source(s) of this data varies from country to country.

In a subsequent phase, regarding the exchange of clinical documents, the system will support not only the transmission of reports in PDF format but also the exchange of detailed medical images in higher resolution

= What is the legal basis for the use of your personal data? =

The eHDSI services will become available for you only upon your explicit consent. Although emergency situations may justify the use of your data for your treatment without consent, if you don’t give explicit consent before travelling, your data will not be available through the eHDSI system when you are in another country, not even in case of emergency. When you are abroad in an actual care situation, your Patient Summary data or Electronic Prescriptions will be recorded in the country of treatment in accordance with the EU General Data Protection Regulation (GDPR), the laws of that country and the practices of the particular healthcare institution.

= What is the purpose of processing? =

Your medical data will only be used for your personal treatment or provision of medicine.
In Cyprus, the data collected for inclusion in your Patient Summary will not be used for secondary purposes, other than for statistical purposes after it has been completely anonymised. Information about the purposes of such further processing according to the laws of various countries is available at the eHDSI website.

= Who processes and has access to this data? =

Your Patient Summary data will be accessible only by authorised and identifiable health professionals involved in your treatment, under professional secrecy, in the country of treatment. These are health professionals in the healthcare organization where you receive your treatment or the pharmacy where you receive your prescribed medicine. Each country of treatment participating in the eHDSI system has undertaken to ensure that the participating health professionals and healthcare providers on their territory have adequate information and training about their duties. Please refer to the eHDSI website for details of the participating countries. The Patient Summary data and Electronic Prescriptions will be transferred through a secure gateway provided by the eHealth National Contact Point designated by each country.

= Where and how long is the personal data stored? =

The Patient Summary data may be stored for 15 years from the last update for permanent residents of Cyprus and is automatically deleted after this period. However, for visitors from other European countries, the Patient Summary is not stored at all. The retention period may vary in other countries that offer Electronic Cross-Border Health Services, with relevant information available on the eHDSI website. The storage period in other participating countries may vary. Information about the storage periods is available on the eHDSI website.

= Your access rights =

If you consent to the processing of your Patient Summary data by the eHDSI system, you must explicitly provide your consent.
You have the right to:
a) rectify any inaccurate data in your Patient Summary data, according to Article 16 of the GDPR.
b) obtain the erasure of your Patient Summary data, according to Article 17 of the GDPR.
c) object to the processing of your Patient Summary data on grounds relating to your particular situation, according to Article 21 of the GDPR.

= You have the right to withdraw your consent at any time. =

If you do not consent for your personal data to be processed by the eHDSI system, your data will not be available for you through this system when you are in another country, not even in case of emergency.

Finally, you have the right to lodge a complaint with a supervisory authority either in Cyprus or in the country of treatment, depending on the factual situation.

='''(II) Summary of Member State-specific information'''=

{| class="wikitable"
! Member State
! CYPRUS
|-
| Service(s) provided by country
|
* Patient Summary.
* Electronic prescription and dispensation.
|-
| Data that is exchanged
| Patient Summary:
* Identification of the patient/subject (National healthcare patient ID, Family name/surname, Given name, Date of birth, gender, Country of affiliation),
* Contact information (Patient address),
* Preferred HP to contact,
* Contact person/ Legal guardian,
* Insurance information,
* Document data,
* Author and Organisation (Author organisation, Legal authenticator),
* Additional information / Knowledge resources (External reference, Related with),
* Allergy, Medical alert information, Medical history (Vaccination/ Prophylaxis information, Resolved, closed or inactive problems, Medical history),
* Medical problems (Current problems, Medical devices and implants, Procedures, Functional status),
* Medication summary (Current and relevant past medicines),
* Social history,
* Pregnancy history (Current pregnancy status, History of previous pregnancies),
* Patient provided data,
* Results,
* Plan of Care.
Electronic prescription and dispensation:
* Patient administrative data (Family name/surname, Given name, Date of birth, Personal identifier, gender, Native language),
* Authentication of the prescription (Identifier of the Prescription, Issue date),
* Identification of the prescribing health professional (Family name, Given name, Professional qualifications, Details for direct contact, Work address, signature, Health care provider identifier),
* Identification of the prescribed product (Name of the medicinal product, Identifier of the medicinal product, Identifier(s) of the pharmaceutical product, Identifier(s) of the packaged medicinal product, Marketing authorisation holder, Active substance(s), Strength of the active substance(s), Product classification, Pharmaceutical dose form(s), Unit of presentation(s), Package type, Pack size),
* Prescription information (Quantity of prescribed product, Dose regimen, Number of units per intake, Frequency of intakes, Route of administration, Duration of treatment, Starting date of therapy, Directions for use, Prescription expiry date, Repeats, Reason for prescription, Substitution),
* Dispensation information (Identifier of the dispenser, Family name of the dispenser, Given name of the dispenser, Identifier of the pharmacy, Address of the pharmacy, Details of direct contact, Identifier of the prescription, Medicinal product, Dispensed quantity, Dispensation date, Substitution).
|-
| Role of the Country in the data exchange
|
* Accessing personal data from your home country.
(in case of electronic prescription, will also send dispensation details back to your home country).
* Providing access to your data to other health professionals in other countries.
|-
| Legal basis
|
* Your consent is needed before the service can be provided to you.
* In case of an emergency to the patient, access to your data may be available also without the consent of the patient.

Applicable law(s):

[https://www.neha.org.cy/wp-content/uploads/2022/10/%CE%9F-%CF%80%CE%B5%CF%81%CE%AF-%CE%97%CE%BB%CE%B5%CE%BA%CF%84%CF%81%CE%BF%CE%BD%CE%B9%CE%BA%CE%AE%CF%82-%CE%A5%CE%B3%CE%B5%CE%AF%CE%B1%CF%82-%CE%9D%CF%8C%CE%BC%CE%BF%CF%82-%CF%84%CE%BF%CF%85-2019.pdf Ο περί Ηλεκτρονικής Υγείας Νόμος του 2019 (neha.org.cy)]

[https://www.cylaw.org/nomoi/indexes/2013_1_149.html Ο περί Εφαρμογής των Δικαιωμάτων των Ασθενών στο πλαίσιο της Διασυνοριακής Υγειονομικής Περίθαλψης Νόμος του 2013 (cylaw.org)]

[https://www.cylaw.org/nomoi/enop/non-ind/2001_1_138/full.html Ο Περί Επεξεργασίας Δεδομένων Προσωπικού Χαρακτήρα (Προστασία του Ατόμου) Νόμος του 2001 - 138(I)/2001 (cylaw.org)]
|-
| Restriction of access to specific data
|
* You may restrict access to specific data.
Narcotic Drugs and Psychotropic Substances Regulations (Regulation 12).
 
More information about the restrictions you may set:

[https://www.moh.gov.cy/moh/phs/phs.nsf/crossborder_en/crossborder_en?OpenDocument Cross-border prescriptions | Pharmaceutical Services | (moh.gov.cy)]
|-
| Purpose of use
|
* Treatment purposes.
* Dispensation of medicinal products.
* Research, policy-making, and other secondary uses.
https://www.neha.org.cy/en/national-contact-point/
|-
| Storage of data
|Your data will be stored for:
1) PSA data will be stored for 15 years from the last reviewing.
2) PSB data will not be stored.
3) Log data will be stored forever.
* Data will be stored also for additional purposes.

Purpose: secondary use (anonymized databases). 
Storage period: will be deleted upon the receipt of patient’s request. 
Any restrictions that apply to the storage period: for secondary use all the data must be anonymized, all the data (for primary & secondary use) are stored encrypted. 
Conditions under which the data can be erased ("right to be forgotten"), e.g., the right only applies to data held at the time the request is received. It does not apply to data that may be created in the future. The right is not absolute and only applies in certain circumstances.
|-
| Data Controller(s)
(You may need to contact the data controller for example in order to exercise your data protection rights)
|
'''Name:''' Rafael Michael 
'''Address:''' 67Α Limassol Avenue, Aglantzia, 2121, Nicosia, Cyprus 
'''Email:''' rafael.michael@neha.org.cy 
'''Phone:''' +357 22436004 
|-
| Data Processor(s)
|
'''Name:''' Vanthia Toumpouri 
'''Address:''' 67Α Limassol Avenue, Aglantzia, 2121, Nicosia, Cyprus 
'''Email:''' vanthia.toumpouri@neha.org.cy 
'''Phone:''' +357 22436031 
|-
| Data Protection Officer
(You may need to contact the data protection officer for example in order to lodge a complaint)
|
'''Name:''' Office of the Commissioner for Personal Data Protection. 
'''Address:''' 15, Kypranoros Street, 1061 Nicosia, P.O. Box. 23378, 1682, Nicosia. 
'''Email:''' commissioner@dataprotection.gov.cy 
'''Phone:''' +357 22818456 
|}

='''(III) Link to Member State detailed health professional information notice'''=

{| class="wikitable"
! Member State
! CYPRUS
|-
| CYPRUS
|
* Patient Summary
* Electronic prescription and dispensation.
|}

Patient Information Notice

2025-07-23T07:46:49Z

Terspithea.kittou: /* The categories of your personal health data concerned */

= '''(I)General information about MyHealth@EU''' =

= Patient Information Notice regarding cross-border transfer of personal health data =

The following information is provided to fulfil the requirement of the EU General Data Protection Regulation to inform citizens about the processing of their personal data.

= What is the eHealth Digital Service Infrastructure? =

MyHealth@EU, also called the eHealth Digital Service Infrastructure (eHDSI), enables safe and easy access to your health data for healthcare professionals involved in your treatment and the provision of medicines - anytime and anywhere within the EU. This is done by electronic means through secure gateways provided by National Contact Points for eHealth (NCPeH) designated by each country.

Each country identifies which organization assumes the responsibility as a data controller for the processing of your data, as this is subject to the country's legislation.

See the last page for information specific to Cyprus.

= The categories of your personal health data concerned =

1)'''Patient Summary'''- It is a basic medical dataset that is transferred for the purpose of receiving treatment in another country. It includes important patient data such as allergies, current medication, previous illnesses and surgeries, that is necessary to treat the patient properly abroad. The Patient Summary includes:

*Name of the health professional - Name of the Health Professional that has been treating or taking responsibility for the patient,
*Role of the health professional - The health professional's role in the organisation (i.e., healthcare provider),
*Health professional's organisation - Name of the health professional's organisation (i.e., healthcare provider),
*Telephone no. - telephone number of the health professional at the organisation (i.e., healthcare provider),
*Email - Email of the health professional or organisation (i.e., healthcare provider),
*Network affiliation - the health professional's organization that is affiliated with a European network, e.g., the European Reference Networks (ERN),
*Related with - Identification of the entry or entries of this Patient Summary for which the health professional is the preferred contact.

2)'''Electronic prescription and dispensation''' - the patient can get a prescription for medicine from a healthcare provider in one country and receive medication through a pharmacy in another EU country. The electronic prescription contains essentially the same information as a regular paper prescription, i.e. identification of the prescriber, the patient and the medicine prescribed. The electronic dispensation includes information about the medicine dispensed. This information will be sent by the pharmacy back to the country that issued the prescription. ePrescribing is defined as prescribing medicines through the support of software by a health professional who is legally authorised to do so, so that the medicine can be dispensed by a pharmacy, and eDispensation (eDispensing) is defined as the act of electronically retrieving a prescription and reporting on the dispensation of the medicine to the patient as indicated in the corresponding ePrescription. Hence, the following information is included: a) data used to identify the health professional who is entitled (according to national law) to prescribe medicinal products, and b) data used to identify the health professionals/health care providers who are entitled (according to national law) to dispense medicinal products.

To identify the prescribing health professional, the following information is processed:

*Family name - The family name/surname/last name of the prescriber. This enables the prescriber to be traced in the event of questions or emergencies,
*Given name - The given name/first name of the prescriber. This enables the prescriber to be traced in the event of questions or emergencies,
*Professional qualifications - The professional title of the prescribing health professional, which may be used to prove the authority of the prescriber,
*Details for direct contact - Details for direct contact could be an email address and/or phone/fax number of the prescriber in order for the dispenser and/or patient to contact the prescriber. This might be necessary if problems arise with dosage, allergies, reimbursement etc.,
*Work address - This is the address of the hospital or the practice, etc. where the health professional normally works, meets patients and prescribes medication. Minimally, the country is specified,
*Signature - Digital signature or token as proof of the authenticity of the prescriber,
*Health care provider identifier - A unique number or code issued for the purpose of identifying a health care provider [ISO/TS 27527:2010]; this may be a license or registration number which can be used to trace the prescriber and to check whether a medicinal product was prescribed by the right person according to the law of the prescribing country.

3)'''Original Clinical Documents'''- containing your health information.

<ol type="I">
<li>laboratory results report: clinical documents containing the results of laboratory tests, stored in the home Country.
<li>hospital discharge report</li>- clinical document generated by the healthcare provider where the patient was treated, both as an inpatient and an outpatient, which gathers the main findings, stored in the Country of Affiliation.
<li>medical imaging report</li>- clinical documents containing the reports on images studies
</ol>
This personal health data is available in so far as it is already recorded in electronic form in your home country.

The source(s) of this data varies from country to country.

In a subsequent phase, regarding the exchange of clinical documents, the system will support not only the transmission of reports in PDF format but also the exchange of detailed medical images in higher resolution

= What is the legal basis for the use of your personal data? =

The eHDSI services will become available for you only upon your explicit consent. Although emergency situations may justify the use of your data for your treatment without consent, if you don’t give explicit consent before travelling, your data will not be available through the eHDSI system when you are in another country, not even in case of emergency. When you are abroad in an actual care situation, your Patient Summary data or Electronic Prescriptions will be recorded in the country of treatment in accordance with the EU General Data Protection Regulation (GDPR), the laws of that country and the practices of the particular healthcare institution.

= What is the purpose of processing? =

Your medical data will only be used for your personal treatment or provision of medicine.
In Cyprus, the data collected for inclusion in your Patient Summary will not be used for secondary purposes, other than for statistical purposes after it has been completely anonymised. Information about the purposes of such further processing according to the laws of various countries is available at the eHDSI website.

= Who processes and has access to this data? =

Your Patient Summary data will be accessible only by authorised and identifiable health professionals involved in your treatment, under professional secrecy, in the country of treatment. These are health professionals in the healthcare organization where you receive your treatment or the pharmacy where you receive your prescribed medicine. Each country of treatment participating in the eHDSI system has undertaken to ensure that the participating health professionals and healthcare providers on their territory have adequate information and training about their duties. Please refer to the eHDSI website for details of the participating countries. The Patient Summary data and Electronic Prescriptions will be transferred through a secure gateway provided by the eHealth National Contact Point designated by each country.

= Where and how long is the personal data stored? =

The Patient Summary data may be stored for 15 years from the last update for permanent residents of Cyprus and is automatically deleted after this period. However, for visitors from other European countries, the Patient Summary is not stored at all. The retention period may vary in other countries that offer Electronic Cross-Border Health Services, with relevant information available on the eHDSI website. The storage period in other participating countries may vary. Information about the storage periods is available on the eHDSI website.

= Your access rights =

If you consent to the processing of your Patient Summary data by the eHDSI system, you must explicitly provide your consent.
You have the right to:
a) rectify any inaccurate data in your Patient Summary data, according to Article 16 of the GDPR.
b) obtain the erasure of your Patient Summary data, according to Article 17 of the GDPR.
c) object to the processing of your Patient Summary data on grounds relating to your particular situation, according to Article 21 of the GDPR.

= You have the right to withdraw your consent at any time. =

If you do not consent for your personal data to be processed by the eHDSI system, your data will not be available for you through this system when you are in another country, not even in case of emergency.

Finally, you have the right to lodge a complaint with a supervisory authority either in Cyprus or in the country of treatment, depending on the factual situation.

='''(II) Summary of Member State-specific information'''=

{| class="wikitable"
! Member State
! CYPRUS
|-
| Service(s) provided by country
|
* Patient Summary.
* Electronic prescription and dispensation.
|-
| Data that is exchanged
| Patient Summary:
* Identification of the patient/subject (National healthcare patient ID, Family name/surname, Given name, Date of birth, gender, Country of affiliation),
* Contact information (Patient address),
* Preferred HP to contact,
* Contact person/ Legal guardian,
* Insurance information,
* Document data,
* Author and Organisation (Author organisation, Legal authenticator),
* Additional information / Knowledge resources (External reference, Related with),
* Allergy, Medical alert information, Medical history (Vaccination/ Prophylaxis information, Resolved, closed or inactive problems, Medical history),
* Medical problems (Current problems, Medical devices and implants, Procedures, Functional status),
* Medication summary (Current and relevant past medicines),
* Social history,
* Pregnancy history (Current pregnancy status, History of previous pregnancies),
* Patient provided data,
* Results,
* Plan of Care.
Electronic prescription and dispensation:
* Patient administrative data (Family name/surname, Given name, Date of birth, Personal identifier, gender, Native language),
* Authentication of the prescription (Identifier of the Prescription, Issue date),
* Identification of the prescribing health professional (Family name, Given name, Professional qualifications, Details for direct contact, Work address, signature, Health care provider identifier),
* Identification of the prescribed product (Name of the medicinal product, Identifier of the medicinal product, Identifier(s) of the pharmaceutical product, Identifier(s) of the packaged medicinal product, Marketing authorisation holder, Active substance(s), Strength of the active substance(s), Product classification, Pharmaceutical dose form(s), Unit of presentation(s), Package type, Pack size),
* Prescription information (Quantity of prescribed product, Dose regimen, Number of units per intake, Frequency of intakes, Route of administration, Duration of treatment, Starting date of therapy, Directions for use, Prescription expiry date, Repeats, Reason for prescription, Substitution),
* Dispensation information (Identifier of the dispenser, Family name of the dispenser, Given name of the dispenser, Identifier of the pharmacy, Address of the pharmacy, Details of direct contact, Identifier of the prescription, Medicinal product, Dispensed quantity, Dispensation date, Substitution).
|-
| Role of the Country in the data exchange
|
* Accessing personal data from your home country.
(in case of electronic prescription, will also send dispensation details back to your home country).
* Providing access to your data to other health professionals in other countries.
|-
| Legal basis
|
* Your consent is needed before the service can be provided to you.
* In case of an emergency to the patient, access to your data may be available also without the consent of the patient.

Applicable law(s):

[https://www.neha.org.cy/wp-content/uploads/2022/10/%CE%9F-%CF%80%CE%B5%CF%81%CE%AF-%CE%97%CE%BB%CE%B5%CE%BA%CF%84%CF%81%CE%BF%CE%BD%CE%B9%CE%BA%CE%AE%CF%82-%CE%A5%CE%B3%CE%B5%CE%AF%CE%B1%CF%82-%CE%9D%CF%8C%CE%BC%CE%BF%CF%82-%CF%84%CE%BF%CF%85-2019.pdf Ο περί Ηλεκτρονικής Υγείας Νόμος του 2019 (neha.org.cy)]

[https://www.cylaw.org/nomoi/indexes/2013_1_149.html Ο περί Εφαρμογής των Δικαιωμάτων των Ασθενών στο πλαίσιο της Διασυνοριακής Υγειονομικής Περίθαλψης Νόμος του 2013 (cylaw.org)]

[https://www.cylaw.org/nomoi/enop/non-ind/2001_1_138/full.html Ο Περί Επεξεργασίας Δεδομένων Προσωπικού Χαρακτήρα (Προστασία του Ατόμου) Νόμος του 2001 - 138(I)/2001 (cylaw.org)]
|-
| Restriction of access to specific data
|
* You may restrict access to specific data.
Narcotic Drugs and Psychotropic Substances Regulations (Regulation 12).
 
More information about the restrictions you may set:

[https://www.moh.gov.cy/moh/phs/phs.nsf/crossborder_en/crossborder_en?OpenDocument Cross-border prescriptions | Pharmaceutical Services | (moh.gov.cy)]
|-
| Purpose of use
|
* Treatment purposes.
* Dispensation of medicinal products.
* Research, policy-making, and other secondary uses.
https://www.neha.org.cy/en/national-contact-point/
|-
| Storage of data
|Your data will be stored for:
1) PSA data will be stored for 15 years from the last reviewing.
2) PSB data will not be stored.
3) Log data will be stored forever.
* Data will be stored also for additional purposes.

Purpose: secondary use (anonymized databases). 
Storage period: will be deleted upon the receipt of patient’s request. 
Any restrictions that apply to the storage period: for secondary use all the data must be anonymized, all the data (for primary & secondary use) are stored encrypted. 
Conditions under which the data can be erased ("right to be forgotten"), e.g., the right only applies to data held at the time the request is received. It does not apply to data that may be created in the future. The right is not absolute and only applies in certain circumstances.
|-
| Data Controller(s)
(You may need to contact the data controller for example in order to exercise your data protection rights)
|
'''Name:''' Rafael Michael 
'''Address:''' 67Α Limassol Avenue, Aglantzia, 2121, Nicosia, Cyprus 
'''Email:''' rafael.michael@neha.org.cy 
'''Phone:''' +357 22436004 
|-
| Data Processor(s)
|
'''Name:''' Vanthia Toumpouri 
'''Address:''' 67Α Limassol Avenue, Aglantzia, 2121, Nicosia, Cyprus 
'''Email:''' vanthia.toumpouri@neha.org.cy 
'''Phone:''' +357 22436031 
|-
| Data Protection Officer
(You may need to contact the data protection officer for example in order to lodge a complaint)
|
'''Name:''' Office of the Commissioner for Personal Data Protection. 
'''Address:''' 15, Kypranoros Street, 1061 Nicosia, P.O. Box. 23378, 1682, Nicosia. 
'''Email:''' commissioner@dataprotection.gov.cy 
'''Phone:''' +357 22818456 
|}

='''(III) Link to Member State detailed health professional information notice'''=

{| class="wikitable"
! Member State
! CYPRUS
|-
| CYPRUS
|
* Patient Summary
* Electronic prescription and dispensation.
|}

Patient Information Notice

2025-07-23T07:43:35Z

Terspithea.kittou: /* The categories of your personal health data concerned */

= '''(I)General information about MyHealth@EU''' =

= Patient Information Notice regarding cross-border transfer of personal health data =

The following information is provided to fulfil the requirement of the EU General Data Protection Regulation to inform citizens about the processing of their personal data.

= What is the eHealth Digital Service Infrastructure? =

MyHealth@EU, also called the eHealth Digital Service Infrastructure (eHDSI), enables safe and easy access to your health data for healthcare professionals involved in your treatment and the provision of medicines - anytime and anywhere within the EU. This is done by electronic means through secure gateways provided by National Contact Points for eHealth (NCPeH) designated by each country.

Each country identifies which organization assumes the responsibility as a data controller for the processing of your data, as this is subject to the country's legislation.

See the last page for information specific to Cyprus.

= The categories of your personal health data concerned =

1)'''Patient Summary'''- It is a basic medical dataset that is transferred for the purpose of receiving treatment in another country. It includes important patient data such as allergies, current medication, previous illnesses and surgeries, that is necessary to treat the patient properly abroad. The Patient Summary includes:

*Name of the health professional - Name of the Health Professional that has been treating or taking responsibility for the patient,
*Role of the health professional - The health professional's role in the organisation (i.e., healthcare provider),
*Health professional's organisation - Name of the health professional's organisation (i.e., healthcare provider),
*Telephone no. - telephone number of the health professional at the organisation (i.e., healthcare provider),
*Email - Email of the health professional or organisation (i.e., healthcare provider),
*Network affiliation - the health professional's organization that is affiliated with a European network, e.g., the European Reference Networks (ERN),
*Related with - Identification of the entry or entries of this Patient Summary for which the health professional is the preferred contact.

2)'''Electronic prescription and dispensation''' - the patient can get a prescription for medicine from a healthcare provider in one country and receive medication through a pharmacy in another EU country. The electronic prescription contains essentially the same information as a regular paper prescription, i.e. identification of the prescriber, the patient and the medicine prescribed. The electronic dispensation includes information about the medicine dispensed. This information will be sent by the pharmacy back to the country that issued the prescription. ePrescribing is defined as prescribing medicines through the support of software by a health professional who is legally authorised to do so, so that the medicine can be dispensed by a pharmacy, and eDispensation (eDispensing) is defined as the act of electronically retrieving a prescription and reporting on the dispensation of the medicine to the patient as indicated in the corresponding ePrescription. Hence, the following information is included: a) data used to identify the health professional who is entitled (according to national law) to prescribe medicinal products, and b) data used to identify the health professionals/health care providers who are entitled (according to national law) to dispense medicinal products.

To identify the prescribing health professional, the following information is processed:

*Family name - The family name/surname/last name of the prescriber. This enables the prescriber to be traced in the event of questions or emergencies,
*Given name - The given name/first name of the prescriber. This enables the prescriber to be traced in the event of questions or emergencies,
*Professional qualifications - The professional title of the prescribing health professional, which may be used to prove the authority of the prescriber,
*Details for direct contact - Details for direct contact could be an email address and/or phone/fax number of the prescriber in order for the dispenser and/or patient to contact the prescriber. This might be necessary if problems arise with dosage, allergies, reimbursement etc.,
*Work address - This is the address of the hospital or the practice, etc. where the health professional normally works, meets patients and prescribes medication. Minimally, the country is specified,
*Signature - Digital signature or token as proof of the authenticity of the prescriber,
*Health care provider identifier - A unique number or code issued for the purpose of identifying a health care provider [ISO/TS 27527:2010]; this may be a license or registration number which can be used to trace the prescriber and to check whether a medicinal product was prescribed by the right person according to the law of the prescribing country.

3)'''Original Clinical Documents'''- containing your health information.

<ol type="I">
<li>laboratory results report</li>: clinical documents containing the results of laboratory tests, stored in the home Country.
<li>hospital discharge report</li>- clinical document generated by the healthcare provider where the patient was treated, both as an inpatient and an outpatient, which gathers the main findings, stored in the Country of Affiliation.
<li>medical imaging report</li>- clinical documents containing the reports on images studies
</ol>
This personal health data is available in so far as it is already recorded in electronic form in your home country.

The source(s) of this data varies from country to country.

In a subsequent phase, regarding the exchange of clinical documents, the system will support not only the transmission of reports in PDF format but also the exchange of detailed medical images in higher resolution

= What is the legal basis for the use of your personal data? =

The eHDSI services will become available for you only upon your explicit consent. Although emergency situations may justify the use of your data for your treatment without consent, if you don’t give explicit consent before travelling, your data will not be available through the eHDSI system when you are in another country, not even in case of emergency. When you are abroad in an actual care situation, your Patient Summary data or Electronic Prescriptions will be recorded in the country of treatment in accordance with the EU General Data Protection Regulation (GDPR), the laws of that country and the practices of the particular healthcare institution.

= What is the purpose of processing? =

Your medical data will only be used for your personal treatment or provision of medicine.
In Cyprus, the data collected for inclusion in your Patient Summary will not be used for secondary purposes, other than for statistical purposes after it has been completely anonymised. Information about the purposes of such further processing according to the laws of various countries is available at the eHDSI website.

= Who processes and has access to this data? =

Your Patient Summary data will be accessible only by authorised and identifiable health professionals involved in your treatment, under professional secrecy, in the country of treatment. These are health professionals in the healthcare organization where you receive your treatment or the pharmacy where you receive your prescribed medicine. Each country of treatment participating in the eHDSI system has undertaken to ensure that the participating health professionals and healthcare providers on their territory have adequate information and training about their duties. Please refer to the eHDSI website for details of the participating countries. The Patient Summary data and Electronic Prescriptions will be transferred through a secure gateway provided by the eHealth National Contact Point designated by each country.

= Where and how long is the personal data stored? =

The Patient Summary data may be stored for 15 years from the last update for permanent residents of Cyprus and is automatically deleted after this period. However, for visitors from other European countries, the Patient Summary is not stored at all. The retention period may vary in other countries that offer Electronic Cross-Border Health Services, with relevant information available on the eHDSI website. The storage period in other participating countries may vary. Information about the storage periods is available on the eHDSI website.

= Your access rights =

If you consent to the processing of your Patient Summary data by the eHDSI system, you must explicitly provide your consent.
You have the right to:
a) rectify any inaccurate data in your Patient Summary data, according to Article 16 of the GDPR.
b) obtain the erasure of your Patient Summary data, according to Article 17 of the GDPR.
c) object to the processing of your Patient Summary data on grounds relating to your particular situation, according to Article 21 of the GDPR.

= You have the right to withdraw your consent at any time. =

If you do not consent for your personal data to be processed by the eHDSI system, your data will not be available for you through this system when you are in another country, not even in case of emergency.

Finally, you have the right to lodge a complaint with a supervisory authority either in Cyprus or in the country of treatment, depending on the factual situation.

='''(II) Summary of Member State-specific information'''=

{| class="wikitable"
! Member State
! CYPRUS
|-
| Service(s) provided by country
|
* Patient Summary.
* Electronic prescription and dispensation.
|-
| Data that is exchanged
| Patient Summary:
* Identification of the patient/subject (National healthcare patient ID, Family name/surname, Given name, Date of birth, gender, Country of affiliation),
* Contact information (Patient address),
* Preferred HP to contact,
* Contact person/ Legal guardian,
* Insurance information,
* Document data,
* Author and Organisation (Author organisation, Legal authenticator),
* Additional information / Knowledge resources (External reference, Related with),
* Allergy, Medical alert information, Medical history (Vaccination/ Prophylaxis information, Resolved, closed or inactive problems, Medical history),
* Medical problems (Current problems, Medical devices and implants, Procedures, Functional status),
* Medication summary (Current and relevant past medicines),
* Social history,
* Pregnancy history (Current pregnancy status, History of previous pregnancies),
* Patient provided data,
* Results,
* Plan of Care.
Electronic prescription and dispensation:
* Patient administrative data (Family name/surname, Given name, Date of birth, Personal identifier, gender, Native language),
* Authentication of the prescription (Identifier of the Prescription, Issue date),
* Identification of the prescribing health professional (Family name, Given name, Professional qualifications, Details for direct contact, Work address, signature, Health care provider identifier),
* Identification of the prescribed product (Name of the medicinal product, Identifier of the medicinal product, Identifier(s) of the pharmaceutical product, Identifier(s) of the packaged medicinal product, Marketing authorisation holder, Active substance(s), Strength of the active substance(s), Product classification, Pharmaceutical dose form(s), Unit of presentation(s), Package type, Pack size),
* Prescription information (Quantity of prescribed product, Dose regimen, Number of units per intake, Frequency of intakes, Route of administration, Duration of treatment, Starting date of therapy, Directions for use, Prescription expiry date, Repeats, Reason for prescription, Substitution),
* Dispensation information (Identifier of the dispenser, Family name of the dispenser, Given name of the dispenser, Identifier of the pharmacy, Address of the pharmacy, Details of direct contact, Identifier of the prescription, Medicinal product, Dispensed quantity, Dispensation date, Substitution).
|-
| Role of the Country in the data exchange
|
* Accessing personal data from your home country.
(in case of electronic prescription, will also send dispensation details back to your home country).
* Providing access to your data to other health professionals in other countries.
|-
| Legal basis
|
* Your consent is needed before the service can be provided to you.
* In case of an emergency to the patient, access to your data may be available also without the consent of the patient.

Applicable law(s):

[https://www.neha.org.cy/wp-content/uploads/2022/10/%CE%9F-%CF%80%CE%B5%CF%81%CE%AF-%CE%97%CE%BB%CE%B5%CE%BA%CF%84%CF%81%CE%BF%CE%BD%CE%B9%CE%BA%CE%AE%CF%82-%CE%A5%CE%B3%CE%B5%CE%AF%CE%B1%CF%82-%CE%9D%CF%8C%CE%BC%CE%BF%CF%82-%CF%84%CE%BF%CF%85-2019.pdf Ο περί Ηλεκτρονικής Υγείας Νόμος του 2019 (neha.org.cy)]

[https://www.cylaw.org/nomoi/indexes/2013_1_149.html Ο περί Εφαρμογής των Δικαιωμάτων των Ασθενών στο πλαίσιο της Διασυνοριακής Υγειονομικής Περίθαλψης Νόμος του 2013 (cylaw.org)]

[https://www.cylaw.org/nomoi/enop/non-ind/2001_1_138/full.html Ο Περί Επεξεργασίας Δεδομένων Προσωπικού Χαρακτήρα (Προστασία του Ατόμου) Νόμος του 2001 - 138(I)/2001 (cylaw.org)]
|-
| Restriction of access to specific data
|
* You may restrict access to specific data.
Narcotic Drugs and Psychotropic Substances Regulations (Regulation 12).
 
More information about the restrictions you may set:

[https://www.moh.gov.cy/moh/phs/phs.nsf/crossborder_en/crossborder_en?OpenDocument Cross-border prescriptions | Pharmaceutical Services | (moh.gov.cy)]
|-
| Purpose of use
|
* Treatment purposes.
* Dispensation of medicinal products.
* Research, policy-making, and other secondary uses.
https://www.neha.org.cy/en/national-contact-point/
|-
| Storage of data
|Your data will be stored for:
1) PSA data will be stored for 15 years from the last reviewing.
2) PSB data will not be stored.
3) Log data will be stored forever.
* Data will be stored also for additional purposes.

Purpose: secondary use (anonymized databases). 
Storage period: will be deleted upon the receipt of patient’s request. 
Any restrictions that apply to the storage period: for secondary use all the data must be anonymized, all the data (for primary & secondary use) are stored encrypted. 
Conditions under which the data can be erased ("right to be forgotten"), e.g., the right only applies to data held at the time the request is received. It does not apply to data that may be created in the future. The right is not absolute and only applies in certain circumstances.
|-
| Data Controller(s)
(You may need to contact the data controller for example in order to exercise your data protection rights)
|
'''Name:''' Rafael Michael 
'''Address:''' 67Α Limassol Avenue, Aglantzia, 2121, Nicosia, Cyprus 
'''Email:''' rafael.michael@neha.org.cy 
'''Phone:''' +357 22436004 
|-
| Data Processor(s)
|
'''Name:''' Vanthia Toumpouri 
'''Address:''' 67Α Limassol Avenue, Aglantzia, 2121, Nicosia, Cyprus 
'''Email:''' vanthia.toumpouri@neha.org.cy 
'''Phone:''' +357 22436031 
|-
| Data Protection Officer
(You may need to contact the data protection officer for example in order to lodge a complaint)
|
'''Name:''' Office of the Commissioner for Personal Data Protection. 
'''Address:''' 15, Kypranoros Street, 1061 Nicosia, P.O. Box. 23378, 1682, Nicosia. 
'''Email:''' commissioner@dataprotection.gov.cy 
'''Phone:''' +357 22818456 
|}

='''(III) Link to Member State detailed health professional information notice'''=

{| class="wikitable"
! Member State
! CYPRUS
|-
| CYPRUS
|
* Patient Summary
* Electronic prescription and dispensation.
|}

Patient Information Notice

2025-07-23T07:41:42Z

Terspithea.kittou: /* The categories of your personal health data concerned */

= '''(I)General information about MyHealth@EU''' =

= Patient Information Notice regarding cross-border transfer of personal health data =

The following information is provided to fulfil the requirement of the EU General Data Protection Regulation to inform citizens about the processing of their personal data.

= What is the eHealth Digital Service Infrastructure? =

MyHealth@EU, also called the eHealth Digital Service Infrastructure (eHDSI), enables safe and easy access to your health data for healthcare professionals involved in your treatment and the provision of medicines - anytime and anywhere within the EU. This is done by electronic means through secure gateways provided by National Contact Points for eHealth (NCPeH) designated by each country.

Each country identifies which organization assumes the responsibility as a data controller for the processing of your data, as this is subject to the country's legislation.

See the last page for information specific to Cyprus.

= The categories of your personal health data concerned =

1)'''Patient Summary'''- It is a basic medical dataset that is transferred for the purpose of receiving treatment in another country. It includes important patient data such as allergies, current medication, previous illnesses and surgeries, that is necessary to treat the patient properly abroad. The Patient Summary includes:

*Name of the health professional - Name of the Health Professional that has been treating or taking responsibility for the patient,
*Role of the health professional - The health professional's role in the organisation (i.e., healthcare provider),
*Health professional's organisation - Name of the health professional's organisation (i.e., healthcare provider),
*Telephone no. - telephone number of the health professional at the organisation (i.e., healthcare provider),
*Email - Email of the health professional or organisation (i.e., healthcare provider),
*Network affiliation - the health professional's organization that is affiliated with a European network, e.g., the European Reference Networks (ERN),
*Related with - Identification of the entry or entries of this Patient Summary for which the health professional is the preferred contact.

2)'''Electronic prescription and dispensation''' - the patient can get a prescription for medicine from a healthcare provider in one country and receive medication through a pharmacy in another EU country. The electronic prescription contains essentially the same information as a regular paper prescription, i.e. identification of the prescriber, the patient and the medicine prescribed. The electronic dispensation includes information about the medicine dispensed. This information will be sent by the pharmacy back to the country that issued the prescription. ePrescribing is defined as prescribing medicines through the support of software by a health professional who is legally authorised to do so, so that the medicine can be dispensed by a pharmacy, and eDispensation (eDispensing) is defined as the act of electronically retrieving a prescription and reporting on the dispensation of the medicine to the patient as indicated in the corresponding ePrescription. Hence, the following information is included: a) data used to identify the health professional who is entitled (according to national law) to prescribe medicinal products, and b) data used to identify the health professionals/health care providers who are entitled (according to national law) to dispense medicinal products.

To identify the prescribing health professional, the following information is processed:

*Family name - The family name/surname/last name of the prescriber. This enables the prescriber to be traced in the event of questions or emergencies,
*Given name - The given name/first name of the prescriber. This enables the prescriber to be traced in the event of questions or emergencies,
*Professional qualifications - The professional title of the prescribing health professional, which may be used to prove the authority of the prescriber,
*Details for direct contact - Details for direct contact could be an email address and/or phone/fax number of the prescriber in order for the dispenser and/or patient to contact the prescriber. This might be necessary if problems arise with dosage, allergies, reimbursement etc.,
*Work address - This is the address of the hospital or the practice, etc. where the health professional normally works, meets patients and prescribes medication. Minimally, the country is specified,
*Signature - Digital signature or token as proof of the authenticity of the prescriber,
*Health care provider identifier - A unique number or code issued for the purpose of identifying a health care provider [ISO/TS 27527:2010]; this may be a license or registration number which can be used to trace the prescriber and to check whether a medicinal product was prescribed by the right person according to the law of the prescribing country.

3)'''Original Clinical Documents'''- containing your health information.

<ol type="I">
<li>laboratory results report</li>-clinical documents containing the results of laboratory tests, stored in the home Country.
<li>hospital discharge report</li>- clinical document generated by the healthcare provider where the patient was treated, both as an inpatient and an outpatient, which gathers the main findings, stored in the Country of Affiliation.
<li>medical imaging report</li>- clinical documents containing the reports on images studies
</ol>
This personal health data is available in so far as it is already recorded in electronic form in your home country.

The source(s) of this data varies from country to country.

In a subsequent phase, regarding the exchange of clinical documents, the system will support not only the transmission of reports in PDF format but also the exchange of detailed medical images in higher resolution

= What is the legal basis for the use of your personal data? =

The eHDSI services will become available for you only upon your explicit consent. Although emergency situations may justify the use of your data for your treatment without consent, if you don’t give explicit consent before travelling, your data will not be available through the eHDSI system when you are in another country, not even in case of emergency. When you are abroad in an actual care situation, your Patient Summary data or Electronic Prescriptions will be recorded in the country of treatment in accordance with the EU General Data Protection Regulation (GDPR), the laws of that country and the practices of the particular healthcare institution.

= What is the purpose of processing? =

Your medical data will only be used for your personal treatment or provision of medicine.
In Cyprus, the data collected for inclusion in your Patient Summary will not be used for secondary purposes, other than for statistical purposes after it has been completely anonymised. Information about the purposes of such further processing according to the laws of various countries is available at the eHDSI website.

= Who processes and has access to this data? =

Your Patient Summary data will be accessible only by authorised and identifiable health professionals involved in your treatment, under professional secrecy, in the country of treatment. These are health professionals in the healthcare organization where you receive your treatment or the pharmacy where you receive your prescribed medicine. Each country of treatment participating in the eHDSI system has undertaken to ensure that the participating health professionals and healthcare providers on their territory have adequate information and training about their duties. Please refer to the eHDSI website for details of the participating countries. The Patient Summary data and Electronic Prescriptions will be transferred through a secure gateway provided by the eHealth National Contact Point designated by each country.

= Where and how long is the personal data stored? =

The Patient Summary data may be stored for 15 years from the last update for permanent residents of Cyprus and is automatically deleted after this period. However, for visitors from other European countries, the Patient Summary is not stored at all. The retention period may vary in other countries that offer Electronic Cross-Border Health Services, with relevant information available on the eHDSI website. The storage period in other participating countries may vary. Information about the storage periods is available on the eHDSI website.

= Your access rights =

If you consent to the processing of your Patient Summary data by the eHDSI system, you must explicitly provide your consent.
You have the right to:
a) rectify any inaccurate data in your Patient Summary data, according to Article 16 of the GDPR.
b) obtain the erasure of your Patient Summary data, according to Article 17 of the GDPR.
c) object to the processing of your Patient Summary data on grounds relating to your particular situation, according to Article 21 of the GDPR.

= You have the right to withdraw your consent at any time. =

If you do not consent for your personal data to be processed by the eHDSI system, your data will not be available for you through this system when you are in another country, not even in case of emergency.

Finally, you have the right to lodge a complaint with a supervisory authority either in Cyprus or in the country of treatment, depending on the factual situation.

='''(II) Summary of Member State-specific information'''=

{| class="wikitable"
! Member State
! CYPRUS
|-
| Service(s) provided by country
|
* Patient Summary.
* Electronic prescription and dispensation.
|-
| Data that is exchanged
| Patient Summary:
* Identification of the patient/subject (National healthcare patient ID, Family name/surname, Given name, Date of birth, gender, Country of affiliation),
* Contact information (Patient address),
* Preferred HP to contact,
* Contact person/ Legal guardian,
* Insurance information,
* Document data,
* Author and Organisation (Author organisation, Legal authenticator),
* Additional information / Knowledge resources (External reference, Related with),
* Allergy, Medical alert information, Medical history (Vaccination/ Prophylaxis information, Resolved, closed or inactive problems, Medical history),
* Medical problems (Current problems, Medical devices and implants, Procedures, Functional status),
* Medication summary (Current and relevant past medicines),
* Social history,
* Pregnancy history (Current pregnancy status, History of previous pregnancies),
* Patient provided data,
* Results,
* Plan of Care.
Electronic prescription and dispensation:
* Patient administrative data (Family name/surname, Given name, Date of birth, Personal identifier, gender, Native language),
* Authentication of the prescription (Identifier of the Prescription, Issue date),
* Identification of the prescribing health professional (Family name, Given name, Professional qualifications, Details for direct contact, Work address, signature, Health care provider identifier),
* Identification of the prescribed product (Name of the medicinal product, Identifier of the medicinal product, Identifier(s) of the pharmaceutical product, Identifier(s) of the packaged medicinal product, Marketing authorisation holder, Active substance(s), Strength of the active substance(s), Product classification, Pharmaceutical dose form(s), Unit of presentation(s), Package type, Pack size),
* Prescription information (Quantity of prescribed product, Dose regimen, Number of units per intake, Frequency of intakes, Route of administration, Duration of treatment, Starting date of therapy, Directions for use, Prescription expiry date, Repeats, Reason for prescription, Substitution),
* Dispensation information (Identifier of the dispenser, Family name of the dispenser, Given name of the dispenser, Identifier of the pharmacy, Address of the pharmacy, Details of direct contact, Identifier of the prescription, Medicinal product, Dispensed quantity, Dispensation date, Substitution).
|-
| Role of the Country in the data exchange
|
* Accessing personal data from your home country.
(in case of electronic prescription, will also send dispensation details back to your home country).
* Providing access to your data to other health professionals in other countries.
|-
| Legal basis
|
* Your consent is needed before the service can be provided to you.
* In case of an emergency to the patient, access to your data may be available also without the consent of the patient.

Applicable law(s):

[https://www.neha.org.cy/wp-content/uploads/2022/10/%CE%9F-%CF%80%CE%B5%CF%81%CE%AF-%CE%97%CE%BB%CE%B5%CE%BA%CF%84%CF%81%CE%BF%CE%BD%CE%B9%CE%BA%CE%AE%CF%82-%CE%A5%CE%B3%CE%B5%CE%AF%CE%B1%CF%82-%CE%9D%CF%8C%CE%BC%CE%BF%CF%82-%CF%84%CE%BF%CF%85-2019.pdf Ο περί Ηλεκτρονικής Υγείας Νόμος του 2019 (neha.org.cy)]

[https://www.cylaw.org/nomoi/indexes/2013_1_149.html Ο περί Εφαρμογής των Δικαιωμάτων των Ασθενών στο πλαίσιο της Διασυνοριακής Υγειονομικής Περίθαλψης Νόμος του 2013 (cylaw.org)]

[https://www.cylaw.org/nomoi/enop/non-ind/2001_1_138/full.html Ο Περί Επεξεργασίας Δεδομένων Προσωπικού Χαρακτήρα (Προστασία του Ατόμου) Νόμος του 2001 - 138(I)/2001 (cylaw.org)]
|-
| Restriction of access to specific data
|
* You may restrict access to specific data.
Narcotic Drugs and Psychotropic Substances Regulations (Regulation 12).
 
More information about the restrictions you may set:

[https://www.moh.gov.cy/moh/phs/phs.nsf/crossborder_en/crossborder_en?OpenDocument Cross-border prescriptions | Pharmaceutical Services | (moh.gov.cy)]
|-
| Purpose of use
|
* Treatment purposes.
* Dispensation of medicinal products.
* Research, policy-making, and other secondary uses.
https://www.neha.org.cy/en/national-contact-point/
|-
| Storage of data
|Your data will be stored for:
1) PSA data will be stored for 15 years from the last reviewing.
2) PSB data will not be stored.
3) Log data will be stored forever.
* Data will be stored also for additional purposes.

Purpose: secondary use (anonymized databases). 
Storage period: will be deleted upon the receipt of patient’s request. 
Any restrictions that apply to the storage period: for secondary use all the data must be anonymized, all the data (for primary & secondary use) are stored encrypted. 
Conditions under which the data can be erased ("right to be forgotten"), e.g., the right only applies to data held at the time the request is received. It does not apply to data that may be created in the future. The right is not absolute and only applies in certain circumstances.
|-
| Data Controller(s)
(You may need to contact the data controller for example in order to exercise your data protection rights)
|
'''Name:''' Rafael Michael 
'''Address:''' 67Α Limassol Avenue, Aglantzia, 2121, Nicosia, Cyprus 
'''Email:''' rafael.michael@neha.org.cy 
'''Phone:''' +357 22436004 
|-
| Data Processor(s)
|
'''Name:''' Vanthia Toumpouri 
'''Address:''' 67Α Limassol Avenue, Aglantzia, 2121, Nicosia, Cyprus 
'''Email:''' vanthia.toumpouri@neha.org.cy 
'''Phone:''' +357 22436031 
|-
| Data Protection Officer
(You may need to contact the data protection officer for example in order to lodge a complaint)
|
'''Name:''' Office of the Commissioner for Personal Data Protection. 
'''Address:''' 15, Kypranoros Street, 1061 Nicosia, P.O. Box. 23378, 1682, Nicosia. 
'''Email:''' commissioner@dataprotection.gov.cy 
'''Phone:''' +357 22818456 
|}

='''(III) Link to Member State detailed health professional information notice'''=

{| class="wikitable"
! Member State
! CYPRUS
|-
| CYPRUS
|
* Patient Summary
* Electronic prescription and dispensation.
|}

Patient Information Notice

2025-07-23T07:40:11Z

Terspithea.kittou: /* The categories of your personal health data concerned */

= '''(I)General information about MyHealth@EU''' =

= Patient Information Notice regarding cross-border transfer of personal health data =

The following information is provided to fulfil the requirement of the EU General Data Protection Regulation to inform citizens about the processing of their personal data.

= What is the eHealth Digital Service Infrastructure? =

MyHealth@EU, also called the eHealth Digital Service Infrastructure (eHDSI), enables safe and easy access to your health data for healthcare professionals involved in your treatment and the provision of medicines - anytime and anywhere within the EU. This is done by electronic means through secure gateways provided by National Contact Points for eHealth (NCPeH) designated by each country.

Each country identifies which organization assumes the responsibility as a data controller for the processing of your data, as this is subject to the country's legislation.

See the last page for information specific to Cyprus.

= The categories of your personal health data concerned =

1)'''Patient Summary'''- It is a basic medical dataset that is transferred for the purpose of receiving treatment in another country. It includes important patient data such as allergies, current medication, previous illnesses and surgeries, that is necessary to treat the patient properly abroad. The Patient Summary includes:

*Name of the health professional - Name of the Health Professional that has been treating or taking responsibility for the patient,
*Role of the health professional - The health professional's role in the organisation (i.e., healthcare provider),
*Health professional's organisation - Name of the health professional's organisation (i.e., healthcare provider),
*Telephone no. - telephone number of the health professional at the organisation (i.e., healthcare provider),
*Email - Email of the health professional or organisation (i.e., healthcare provider),
*Network affiliation - the health professional's organization that is affiliated with a European network, e.g., the European Reference Networks (ERN),
*Related with - Identification of the entry or entries of this Patient Summary for which the health professional is the preferred contact.

2)'''Electronic prescription and dispensation''' - the patient can get a prescription for medicine from a healthcare provider in one country and receive medication through a pharmacy in another EU country. The electronic prescription contains essentially the same information as a regular paper prescription, i.e. identification of the prescriber, the patient and the medicine prescribed. The electronic dispensation includes information about the medicine dispensed. This information will be sent by the pharmacy back to the country that issued the prescription. ePrescribing is defined as prescribing medicines through the support of software by a health professional who is legally authorised to do so, so that the medicine can be dispensed by a pharmacy, and eDispensation (eDispensing) is defined as the act of electronically retrieving a prescription and reporting on the dispensation of the medicine to the patient as indicated in the corresponding ePrescription. Hence, the following information is included: a) data used to identify the health professional who is entitled (according to national law) to prescribe medicinal products, and b) data used to identify the health professionals/health care providers who are entitled (according to national law) to dispense medicinal products.

To identify the prescribing health professional, the following information is processed:

*Family name - The family name/surname/last name of the prescriber. This enables the prescriber to be traced in the event of questions or emergencies,
*Given name - The given name/first name of the prescriber. This enables the prescriber to be traced in the event of questions or emergencies,
*Professional qualifications - The professional title of the prescribing health professional, which may be used to prove the authority of the prescriber,
*Details for direct contact - Details for direct contact could be an email address and/or phone/fax number of the prescriber in order for the dispenser and/or patient to contact the prescriber. This might be necessary if problems arise with dosage, allergies, reimbursement etc.,
*Work address - This is the address of the hospital or the practice, etc. where the health professional normally works, meets patients and prescribes medication. Minimally, the country is specified,
*Signature - Digital signature or token as proof of the authenticity of the prescriber,
*Health care provider identifier - A unique number or code issued for the purpose of identifying a health care provider [ISO/TS 27527:2010]; this may be a license or registration number which can be used to trace the prescriber and to check whether a medicinal product was prescribed by the right person according to the law of the prescribing country.

3)'''Original Clinical Documents'''- containing your health information.

<ol type="I">
<li>laboratory results report</li>
<li>hospital discharge report</li>
<li>medical imaging report</li>
</ol>
This personal health data is available in so far as it is already recorded in electronic form in your home country.

The source(s) of this data varies from country to country.

In a subsequent phase, regarding the exchange of clinical documents, the system will support not only the transmission of reports in PDF format but also the exchange of detailed medical images in higher resolution

4)'''Imaging Reports''' - clinical documents containing the reports on images studies and, when requested, the images (e.g. in DICOM standard), stored in the home Country.

5)'''Discharge Reports''' - clinical document generated by the healthcare provider where the patient was treated, both as an inpatient and an outpatient, which gathers the main findings, stored in the Country of Affiliation.

6)'''Laboratory Results''' - clinical documents containing the results of laboratory tests, stored in the home Country.

= What is the legal basis for the use of your personal data? =

The eHDSI services will become available for you only upon your explicit consent. Although emergency situations may justify the use of your data for your treatment without consent, if you don’t give explicit consent before travelling, your data will not be available through the eHDSI system when you are in another country, not even in case of emergency. When you are abroad in an actual care situation, your Patient Summary data or Electronic Prescriptions will be recorded in the country of treatment in accordance with the EU General Data Protection Regulation (GDPR), the laws of that country and the practices of the particular healthcare institution.

= What is the purpose of processing? =

Your medical data will only be used for your personal treatment or provision of medicine.
In Cyprus, the data collected for inclusion in your Patient Summary will not be used for secondary purposes, other than for statistical purposes after it has been completely anonymised. Information about the purposes of such further processing according to the laws of various countries is available at the eHDSI website.

= Who processes and has access to this data? =

Your Patient Summary data will be accessible only by authorised and identifiable health professionals involved in your treatment, under professional secrecy, in the country of treatment. These are health professionals in the healthcare organization where you receive your treatment or the pharmacy where you receive your prescribed medicine. Each country of treatment participating in the eHDSI system has undertaken to ensure that the participating health professionals and healthcare providers on their territory have adequate information and training about their duties. Please refer to the eHDSI website for details of the participating countries. The Patient Summary data and Electronic Prescriptions will be transferred through a secure gateway provided by the eHealth National Contact Point designated by each country.

= Where and how long is the personal data stored? =

The Patient Summary data may be stored for 15 years from the last update for permanent residents of Cyprus and is automatically deleted after this period. However, for visitors from other European countries, the Patient Summary is not stored at all. The retention period may vary in other countries that offer Electronic Cross-Border Health Services, with relevant information available on the eHDSI website. The storage period in other participating countries may vary. Information about the storage periods is available on the eHDSI website.

= Your access rights =

If you consent to the processing of your Patient Summary data by the eHDSI system, you must explicitly provide your consent.
You have the right to:
a) rectify any inaccurate data in your Patient Summary data, according to Article 16 of the GDPR.
b) obtain the erasure of your Patient Summary data, according to Article 17 of the GDPR.
c) object to the processing of your Patient Summary data on grounds relating to your particular situation, according to Article 21 of the GDPR.

= You have the right to withdraw your consent at any time. =

If you do not consent for your personal data to be processed by the eHDSI system, your data will not be available for you through this system when you are in another country, not even in case of emergency.

Finally, you have the right to lodge a complaint with a supervisory authority either in Cyprus or in the country of treatment, depending on the factual situation.

='''(II) Summary of Member State-specific information'''=

{| class="wikitable"
! Member State
! CYPRUS
|-
| Service(s) provided by country
|
* Patient Summary.
* Electronic prescription and dispensation.
|-
| Data that is exchanged
| Patient Summary:
* Identification of the patient/subject (National healthcare patient ID, Family name/surname, Given name, Date of birth, gender, Country of affiliation),
* Contact information (Patient address),
* Preferred HP to contact,
* Contact person/ Legal guardian,
* Insurance information,
* Document data,
* Author and Organisation (Author organisation, Legal authenticator),
* Additional information / Knowledge resources (External reference, Related with),
* Allergy, Medical alert information, Medical history (Vaccination/ Prophylaxis information, Resolved, closed or inactive problems, Medical history),
* Medical problems (Current problems, Medical devices and implants, Procedures, Functional status),
* Medication summary (Current and relevant past medicines),
* Social history,
* Pregnancy history (Current pregnancy status, History of previous pregnancies),
* Patient provided data,
* Results,
* Plan of Care.
Electronic prescription and dispensation:
* Patient administrative data (Family name/surname, Given name, Date of birth, Personal identifier, gender, Native language),
* Authentication of the prescription (Identifier of the Prescription, Issue date),
* Identification of the prescribing health professional (Family name, Given name, Professional qualifications, Details for direct contact, Work address, signature, Health care provider identifier),
* Identification of the prescribed product (Name of the medicinal product, Identifier of the medicinal product, Identifier(s) of the pharmaceutical product, Identifier(s) of the packaged medicinal product, Marketing authorisation holder, Active substance(s), Strength of the active substance(s), Product classification, Pharmaceutical dose form(s), Unit of presentation(s), Package type, Pack size),
* Prescription information (Quantity of prescribed product, Dose regimen, Number of units per intake, Frequency of intakes, Route of administration, Duration of treatment, Starting date of therapy, Directions for use, Prescription expiry date, Repeats, Reason for prescription, Substitution),
* Dispensation information (Identifier of the dispenser, Family name of the dispenser, Given name of the dispenser, Identifier of the pharmacy, Address of the pharmacy, Details of direct contact, Identifier of the prescription, Medicinal product, Dispensed quantity, Dispensation date, Substitution).
|-
| Role of the Country in the data exchange
|
* Accessing personal data from your home country.
(in case of electronic prescription, will also send dispensation details back to your home country).
* Providing access to your data to other health professionals in other countries.
|-
| Legal basis
|
* Your consent is needed before the service can be provided to you.
* In case of an emergency to the patient, access to your data may be available also without the consent of the patient.

Applicable law(s):

[https://www.neha.org.cy/wp-content/uploads/2022/10/%CE%9F-%CF%80%CE%B5%CF%81%CE%AF-%CE%97%CE%BB%CE%B5%CE%BA%CF%84%CF%81%CE%BF%CE%BD%CE%B9%CE%BA%CE%AE%CF%82-%CE%A5%CE%B3%CE%B5%CE%AF%CE%B1%CF%82-%CE%9D%CF%8C%CE%BC%CE%BF%CF%82-%CF%84%CE%BF%CF%85-2019.pdf Ο περί Ηλεκτρονικής Υγείας Νόμος του 2019 (neha.org.cy)]

[https://www.cylaw.org/nomoi/indexes/2013_1_149.html Ο περί Εφαρμογής των Δικαιωμάτων των Ασθενών στο πλαίσιο της Διασυνοριακής Υγειονομικής Περίθαλψης Νόμος του 2013 (cylaw.org)]

[https://www.cylaw.org/nomoi/enop/non-ind/2001_1_138/full.html Ο Περί Επεξεργασίας Δεδομένων Προσωπικού Χαρακτήρα (Προστασία του Ατόμου) Νόμος του 2001 - 138(I)/2001 (cylaw.org)]
|-
| Restriction of access to specific data
|
* You may restrict access to specific data.
Narcotic Drugs and Psychotropic Substances Regulations (Regulation 12).
 
More information about the restrictions you may set:

[https://www.moh.gov.cy/moh/phs/phs.nsf/crossborder_en/crossborder_en?OpenDocument Cross-border prescriptions | Pharmaceutical Services | (moh.gov.cy)]
|-
| Purpose of use
|
* Treatment purposes.
* Dispensation of medicinal products.
* Research, policy-making, and other secondary uses.
https://www.neha.org.cy/en/national-contact-point/
|-
| Storage of data
|Your data will be stored for:
1) PSA data will be stored for 15 years from the last reviewing.
2) PSB data will not be stored.
3) Log data will be stored forever.
* Data will be stored also for additional purposes.

Purpose: secondary use (anonymized databases). 
Storage period: will be deleted upon the receipt of patient’s request. 
Any restrictions that apply to the storage period: for secondary use all the data must be anonymized, all the data (for primary & secondary use) are stored encrypted. 
Conditions under which the data can be erased ("right to be forgotten"), e.g., the right only applies to data held at the time the request is received. It does not apply to data that may be created in the future. The right is not absolute and only applies in certain circumstances.
|-
| Data Controller(s)
(You may need to contact the data controller for example in order to exercise your data protection rights)
|
'''Name:''' Rafael Michael 
'''Address:''' 67Α Limassol Avenue, Aglantzia, 2121, Nicosia, Cyprus 
'''Email:''' rafael.michael@neha.org.cy 
'''Phone:''' +357 22436004 
|-
| Data Processor(s)
|
'''Name:''' Vanthia Toumpouri 
'''Address:''' 67Α Limassol Avenue, Aglantzia, 2121, Nicosia, Cyprus 
'''Email:''' vanthia.toumpouri@neha.org.cy 
'''Phone:''' +357 22436031 
|-
| Data Protection Officer
(You may need to contact the data protection officer for example in order to lodge a complaint)
|
'''Name:''' Office of the Commissioner for Personal Data Protection. 
'''Address:''' 15, Kypranoros Street, 1061 Nicosia, P.O. Box. 23378, 1682, Nicosia. 
'''Email:''' commissioner@dataprotection.gov.cy 
'''Phone:''' +357 22818456 
|}

='''(III) Link to Member State detailed health professional information notice'''=

{| class="wikitable"
! Member State
! CYPRUS
|-
| CYPRUS
|
* Patient Summary
* Electronic prescription and dispensation.
|}

Patient Information Notice

2025-07-23T07:32:10Z

Terspithea.kittou: /* The categories of your personal health data concerned */

= '''(I)General information about MyHealth@EU''' =

= Patient Information Notice regarding cross-border transfer of personal health data =

The following information is provided to fulfil the requirement of the EU General Data Protection Regulation to inform citizens about the processing of their personal data.

= What is the eHealth Digital Service Infrastructure? =

MyHealth@EU, also called the eHealth Digital Service Infrastructure (eHDSI), enables safe and easy access to your health data for healthcare professionals involved in your treatment and the provision of medicines - anytime and anywhere within the EU. This is done by electronic means through secure gateways provided by National Contact Points for eHealth (NCPeH) designated by each country.

Each country identifies which organization assumes the responsibility as a data controller for the processing of your data, as this is subject to the country's legislation.

See the last page for information specific to Cyprus.

= The categories of your personal health data concerned =

1)'''Patient Summary'''- It is a basic medical dataset that is transferred for the purpose of receiving treatment in another country. It includes important patient data such as allergies, current medication, previous illnesses and surgeries, that is necessary to treat the patient properly abroad. The Patient Summary includes:

*Name of the health professional - Name of the Health Professional that has been treating or taking responsibility for the patient,
*Role of the health professional - The health professional's role in the organisation (i.e., healthcare provider),
*Health professional's organisation - Name of the health professional's organisation (i.e., healthcare provider),
*Telephone no. - telephone number of the health professional at the organisation (i.e., healthcare provider),
*Email - Email of the health professional or organisation (i.e., healthcare provider),
*Network affiliation - the health professional's organization that is affiliated with a European network, e.g., the European Reference Networks (ERN),
*Related with - Identification of the entry or entries of this Patient Summary for which the health professional is the preferred contact.

2)'''Electronic prescription and dispensation''' - the patient can get a prescription for medicine from a healthcare provider in one country and receive medication through a pharmacy in another EU country. The electronic prescription contains essentially the same information as a regular paper prescription, i.e. identification of the prescriber, the patient and the medicine prescribed. The electronic dispensation includes information about the medicine dispensed. This information will be sent by the pharmacy back to the country that issued the prescription. ePrescribing is defined as prescribing medicines through the support of software by a health professional who is legally authorised to do so, so that the medicine can be dispensed by a pharmacy, and eDispensation (eDispensing) is defined as the act of electronically retrieving a prescription and reporting on the dispensation of the medicine to the patient as indicated in the corresponding ePrescription. Hence, the following information is included: a) data used to identify the health professional who is entitled (according to national law) to prescribe medicinal products, and b) data used to identify the health professionals/health care providers who are entitled (according to national law) to dispense medicinal products.

To identify the prescribing health professional, the following information is processed:

*Family name - The family name/surname/last name of the prescriber. This enables the prescriber to be traced in the event of questions or emergencies,
*Given name - The given name/first name of the prescriber. This enables the prescriber to be traced in the event of questions or emergencies,
*Professional qualifications - The professional title of the prescribing health professional, which may be used to prove the authority of the prescriber,
*Details for direct contact - Details for direct contact could be an email address and/or phone/fax number of the prescriber in order for the dispenser and/or patient to contact the prescriber. This might be necessary if problems arise with dosage, allergies, reimbursement etc.,
*Work address - This is the address of the hospital or the practice, etc. where the health professional normally works, meets patients and prescribes medication. Minimally, the country is specified,
*Signature - Digital signature or token as proof of the authenticity of the prescriber,
*Health care provider identifier - A unique number or code issued for the purpose of identifying a health care provider [ISO/TS 27527:2010]; this may be a license or registration number which can be used to trace the prescriber and to check whether a medicinal product was prescribed by the right person according to the law of the prescribing country.

3)'''Original Clinical Documents'''- containing your health information.

<ol type="I">
<li>laboratory results report</li>
<li>hospital discharge report</li>
<li>medical imaging report</li>
</ol>
This personal health data is available in so far as it is already recorded in electronic form in your home country.

The source(s) of this data varies from country to country.

In a subsequent phase, the following services will be included into the Electronic Cross-Border Health Services."

4)'''Imaging Reports''' - clinical documents containing the reports on images studies and, when requested, the images (e.g. in DICOM standard), stored in the home Country.

5)'''Discharge Reports''' - clinical document generated by the healthcare provider where the patient was treated, both as an inpatient and an outpatient, which gathers the main findings, stored in the Country of Affiliation.

6)'''Laboratory Results''' - clinical documents containing the results of laboratory tests, stored in the home Country.

= What is the legal basis for the use of your personal data? =

The eHDSI services will become available for you only upon your explicit consent. Although emergency situations may justify the use of your data for your treatment without consent, if you don’t give explicit consent before travelling, your data will not be available through the eHDSI system when you are in another country, not even in case of emergency. When you are abroad in an actual care situation, your Patient Summary data or Electronic Prescriptions will be recorded in the country of treatment in accordance with the EU General Data Protection Regulation (GDPR), the laws of that country and the practices of the particular healthcare institution.

= What is the purpose of processing? =

Your medical data will only be used for your personal treatment or provision of medicine.
In Cyprus, the data collected for inclusion in your Patient Summary will not be used for secondary purposes, other than for statistical purposes after it has been completely anonymised. Information about the purposes of such further processing according to the laws of various countries is available at the eHDSI website.

= Who processes and has access to this data? =

Your Patient Summary data will be accessible only by authorised and identifiable health professionals involved in your treatment, under professional secrecy, in the country of treatment. These are health professionals in the healthcare organization where you receive your treatment or the pharmacy where you receive your prescribed medicine. Each country of treatment participating in the eHDSI system has undertaken to ensure that the participating health professionals and healthcare providers on their territory have adequate information and training about their duties. Please refer to the eHDSI website for details of the participating countries. The Patient Summary data and Electronic Prescriptions will be transferred through a secure gateway provided by the eHealth National Contact Point designated by each country.

= Where and how long is the personal data stored? =

The Patient Summary data may be stored for 15 years from the last update for permanent residents of Cyprus and is automatically deleted after this period. However, for visitors from other European countries, the Patient Summary is not stored at all. The retention period may vary in other countries that offer Electronic Cross-Border Health Services, with relevant information available on the eHDSI website. The storage period in other participating countries may vary. Information about the storage periods is available on the eHDSI website.

= Your access rights =

If you consent to the processing of your Patient Summary data by the eHDSI system, you must explicitly provide your consent.
You have the right to:
a) rectify any inaccurate data in your Patient Summary data, according to Article 16 of the GDPR.
b) obtain the erasure of your Patient Summary data, according to Article 17 of the GDPR.
c) object to the processing of your Patient Summary data on grounds relating to your particular situation, according to Article 21 of the GDPR.

= You have the right to withdraw your consent at any time. =

If you do not consent for your personal data to be processed by the eHDSI system, your data will not be available for you through this system when you are in another country, not even in case of emergency.

Finally, you have the right to lodge a complaint with a supervisory authority either in Cyprus or in the country of treatment, depending on the factual situation.

='''(II) Summary of Member State-specific information'''=

{| class="wikitable"
! Member State
! CYPRUS
|-
| Service(s) provided by country
|
* Patient Summary.
* Electronic prescription and dispensation.
|-
| Data that is exchanged
| Patient Summary:
* Identification of the patient/subject (National healthcare patient ID, Family name/surname, Given name, Date of birth, gender, Country of affiliation),
* Contact information (Patient address),
* Preferred HP to contact,
* Contact person/ Legal guardian,
* Insurance information,
* Document data,
* Author and Organisation (Author organisation, Legal authenticator),
* Additional information / Knowledge resources (External reference, Related with),
* Allergy, Medical alert information, Medical history (Vaccination/ Prophylaxis information, Resolved, closed or inactive problems, Medical history),
* Medical problems (Current problems, Medical devices and implants, Procedures, Functional status),
* Medication summary (Current and relevant past medicines),
* Social history,
* Pregnancy history (Current pregnancy status, History of previous pregnancies),
* Patient provided data,
* Results,
* Plan of Care.
Electronic prescription and dispensation:
* Patient administrative data (Family name/surname, Given name, Date of birth, Personal identifier, gender, Native language),
* Authentication of the prescription (Identifier of the Prescription, Issue date),
* Identification of the prescribing health professional (Family name, Given name, Professional qualifications, Details for direct contact, Work address, signature, Health care provider identifier),
* Identification of the prescribed product (Name of the medicinal product, Identifier of the medicinal product, Identifier(s) of the pharmaceutical product, Identifier(s) of the packaged medicinal product, Marketing authorisation holder, Active substance(s), Strength of the active substance(s), Product classification, Pharmaceutical dose form(s), Unit of presentation(s), Package type, Pack size),
* Prescription information (Quantity of prescribed product, Dose regimen, Number of units per intake, Frequency of intakes, Route of administration, Duration of treatment, Starting date of therapy, Directions for use, Prescription expiry date, Repeats, Reason for prescription, Substitution),
* Dispensation information (Identifier of the dispenser, Family name of the dispenser, Given name of the dispenser, Identifier of the pharmacy, Address of the pharmacy, Details of direct contact, Identifier of the prescription, Medicinal product, Dispensed quantity, Dispensation date, Substitution).
|-
| Role of the Country in the data exchange
|
* Accessing personal data from your home country.
(in case of electronic prescription, will also send dispensation details back to your home country).
* Providing access to your data to other health professionals in other countries.
|-
| Legal basis
|
* Your consent is needed before the service can be provided to you.
* In case of an emergency to the patient, access to your data may be available also without the consent of the patient.

Applicable law(s):

[https://www.neha.org.cy/wp-content/uploads/2022/10/%CE%9F-%CF%80%CE%B5%CF%81%CE%AF-%CE%97%CE%BB%CE%B5%CE%BA%CF%84%CF%81%CE%BF%CE%BD%CE%B9%CE%BA%CE%AE%CF%82-%CE%A5%CE%B3%CE%B5%CE%AF%CE%B1%CF%82-%CE%9D%CF%8C%CE%BC%CE%BF%CF%82-%CF%84%CE%BF%CF%85-2019.pdf Ο περί Ηλεκτρονικής Υγείας Νόμος του 2019 (neha.org.cy)]

[https://www.cylaw.org/nomoi/indexes/2013_1_149.html Ο περί Εφαρμογής των Δικαιωμάτων των Ασθενών στο πλαίσιο της Διασυνοριακής Υγειονομικής Περίθαλψης Νόμος του 2013 (cylaw.org)]

[https://www.cylaw.org/nomoi/enop/non-ind/2001_1_138/full.html Ο Περί Επεξεργασίας Δεδομένων Προσωπικού Χαρακτήρα (Προστασία του Ατόμου) Νόμος του 2001 - 138(I)/2001 (cylaw.org)]
|-
| Restriction of access to specific data
|
* You may restrict access to specific data.
Narcotic Drugs and Psychotropic Substances Regulations (Regulation 12).
 
More information about the restrictions you may set:

[https://www.moh.gov.cy/moh/phs/phs.nsf/crossborder_en/crossborder_en?OpenDocument Cross-border prescriptions | Pharmaceutical Services | (moh.gov.cy)]
|-
| Purpose of use
|
* Treatment purposes.
* Dispensation of medicinal products.
* Research, policy-making, and other secondary uses.
https://www.neha.org.cy/en/national-contact-point/
|-
| Storage of data
|Your data will be stored for:
1) PSA data will be stored for 15 years from the last reviewing.
2) PSB data will not be stored.
3) Log data will be stored forever.
* Data will be stored also for additional purposes.

Purpose: secondary use (anonymized databases). 
Storage period: will be deleted upon the receipt of patient’s request. 
Any restrictions that apply to the storage period: for secondary use all the data must be anonymized, all the data (for primary & secondary use) are stored encrypted. 
Conditions under which the data can be erased ("right to be forgotten"), e.g., the right only applies to data held at the time the request is received. It does not apply to data that may be created in the future. The right is not absolute and only applies in certain circumstances.
|-
| Data Controller(s)
(You may need to contact the data controller for example in order to exercise your data protection rights)
|
'''Name:''' Rafael Michael 
'''Address:''' 67Α Limassol Avenue, Aglantzia, 2121, Nicosia, Cyprus 
'''Email:''' rafael.michael@neha.org.cy 
'''Phone:''' +357 22436004 
|-
| Data Processor(s)
|
'''Name:''' Vanthia Toumpouri 
'''Address:''' 67Α Limassol Avenue, Aglantzia, 2121, Nicosia, Cyprus 
'''Email:''' vanthia.toumpouri@neha.org.cy 
'''Phone:''' +357 22436031 
|-
| Data Protection Officer
(You may need to contact the data protection officer for example in order to lodge a complaint)
|
'''Name:''' Office of the Commissioner for Personal Data Protection. 
'''Address:''' 15, Kypranoros Street, 1061 Nicosia, P.O. Box. 23378, 1682, Nicosia. 
'''Email:''' commissioner@dataprotection.gov.cy 
'''Phone:''' +357 22818456 
|}

='''(III) Link to Member State detailed health professional information notice'''=

{| class="wikitable"
! Member State
! CYPRUS
|-
| CYPRUS
|
* Patient Summary
* Electronic prescription and dispensation.
|}