Effective from 18 September 2026
1. Purpose of this Privacy Notice
Med-Forensic Bt. attaches particular importance to the protection of personal data, especially medical data and other confidential information obtained in the course of its forensic expert activities.
The purpose of this Privacy Notice is to provide transparent information about the processing of personal data in connection with the use of the Med-Forensic Bt. website, enquiries, requests for quotations, engagements, and the provision of court-appointed and privately instructed forensic expert services.
Given the nature of forensic medical expert activities, the Data Controller may process medical data and, in certain cases, other special categories of personal data or personal data requiring enhanced protection.
Personal data are processed solely for specified, explicit and lawful purposes and only to the extent necessary to achieve those purposes.
2. Details of the Data Controller
Full name of the Data Controller: Med-Forensic Igazságügyi Orvosszakértői Betéti Társaság
Abbreviated name: Med-Forensic Bt.
Registered office: 6725 Szeged, Teve utca 31., Hungary
Company registration number: 06-06-016672
Tax number: 25292949-2-06
Representative: Dr. Tóth Anita Réka
Principal activity: 8699 – Other human health activities n.e.c.
Email: tothar@gmail.com
Telephone: +36 30 128 9840
Website: https://medforensic.hu/
The Data Controller carries out its forensic expert activities in accordance with the legislation in force at any given time, in particular Act XXIX of 2016 on Judicial Experts.
Forensic expert carrying out the expert activities: Dr. Tóth Anita Réka, forensic medical expert
Enquiries relating to data processing, the exercise of data subjects’ rights and data security may be sent using the Data Controller’s contact details provided in this Privacy Notice.
II. Principal Legislation Governing Data Processing
The Data Controller’s data-processing activities are governed in particular by the following legislation:
- Regulation (EU) 2016/679 of the European Parliament and of the Council (the “GDPR”);
- Act CXII of 2011 on Informational Self-Determination and Freedom of Information (the “Privacy Act”);
- Act XXIX of 2016 on Judicial Experts (the “Judicial Experts Act”);
- where applicable to the processing of medical data, Act XLVII of 1997 on the Processing and Protection of Medical and Other Related Personal Data (the “Medical Data Act”);
- Act V of 2013 on the Civil Code;
- Act C of 2000 on Accounting;
- the procedural and other legislation in force governing the relevant expert proceedings and the particular type of case.
III. Principles of Data Processing
3. Principles
When processing personal data, Med-Forensic Bt. takes particular account of the following requirements:
- lawfulness, fairness and transparency;
- purpose limitation;
- data minimisation;
- accuracy;
- storage limitation;
- integrity and confidentiality;
- accountability;
- the professional and statutory duty of confidentiality applicable to forensic experts.
The Data Controller processes only personal data that are necessary for the performance of the relevant case, service or legal obligation.
IV. Data Processing Related to the Use of the Website
4. Enquiries and Requests for Quotations
Data subjects
Individuals who contact Med-Forensic Bt. by email, telephone, through the contact facility available on the website or by another communication channel.
Personal data processed
Name, email address, telephone number, the content of the message, basic details of the matter and any other personal data voluntarily provided by the data subject.
Purpose of processing
Establishing contact, responding to the enquiry, conducting a preliminary assessment of professional competence and potential conflicts of interest, providing a quotation and preparing a possible engagement.
Legal basis
Taking steps at the request of the data subject prior to entering into a contract pursuant to Article 6(1)(b) of the GDPR or, where applicable, the legitimate interests of the Data Controller pursuant to Article 6(1)(f) of the GDPR.
Important data security notice
The general contact facility provided on the website is not intended for submitting complete medical records, expert case files or other special categories of personal data unless the Data Controller has expressly provided an appropriate and secure method of data transmission for this purpose.
Where possible, the data subject should not include any medical, genetic, biometric, criminal-proceedings-related or other special-category data in the contact form unless such information is necessary for the initial enquiry.
V. Data Processing Related to Forensic Expert Activities
5. Forensic Medical Expert Activities Performed Pursuant to an Official Appointment
In the course of forensic expert activities, the Data Controller may process the following personal data in particular:
- personal identification data;
- contact details;
- medical data;
- medical history and medical records;
- the results of diagnostic and imaging examinations;
- laboratory, toxicology and other test results;
- medication data;
- data relating to psychological and psychiatric conditions, where their processing is necessary for the relevant expert assignment;
- data relating to injuries, illnesses, disabilities and health status;
- photographic, visual, audio or other documentation, where its processing is lawfully required for the performance of the relevant expert assignment;
- data contained in documents issued by authorities, the police, public prosecutors and courts;
- data concerning other persons involved in the case where such data are necessary for the performance of the expert assignment;
- where necessary, personal data relating to criminal convictions and offences;
- data and professional findings generated during the expert’s examination of the person concerned.
Purpose of processing
The purposes of processing are:
- fulfilling the official appointment;
- conducting the expert examination;
- answering the specialist question;
- preparing the expert opinion;
- enabling subsequent verification of the professional, methodological, disciplinary and legal compliance of the expert activities;
- fulfilling statutory record-keeping and data-transfer obligations applicable to forensic experts.
Legal basis for processing
Where the expert is appointed by a public authority or court, the processing is not based on the consent of the data subject.
The legal basis for processing is provided in particular by Article 6(1)(c) or, where applicable, Article 6(1)(e) of the GDPR, the applicable provisions of Article 9 of the GDPR governing the processing of special categories of personal data, the Judicial Experts Act and the legislation governing the relevant proceedings.
Medical data and other special categories of personal data may be processed only to the extent necessary for the performance of the relevant expert assignment.
6. Preparation of a Privately Instructed Expert Opinion
From a data-protection perspective, privately instructed expert activities are separate from appointments made by a public authority or court.
Under the provisions of the Judicial Experts Act, when preparing a privately instructed expert opinion, the expert may process personal data made available to or otherwise obtained by the expert for the purpose of performing the engagement only with the data subject’s prior written consent.
Consent cannot be presumed or interpreted broadly.
Where the instructing party is not the person whose personal data or special-category data are concerned by the expert examination, the engagement itself does not provide a legal basis for processing the data subject’s personal data.
Before accepting a private engagement, the Data Controller may therefore examine whether the personal data required to prepare the expert opinion can lawfully be made available.
Where the conditions for lawful processing are not met, the Data Controller may refuse to process the relevant data and, where necessary, may decline to perform the engagement.
VI. Sources of Personal Data
7. Sources of Personal Data
Personal data processed during expert activities may be obtained in particular from:
- the data subject;
- the appointing court, public authority, public prosecutor’s office or investigating authority;
- the instructing party;
- a healthcare provider;
- a legal representative;
- another expert or specialist consultant;
- the case files;
- the expert’s examination of the person concerned;
- imaging, laboratory or other diagnostic examinations;
- another body or person authorised or required by law to provide the data.
The expert may process personal data that have not been provided directly by the data subject.
VII. Involvement of Specialist Consultants and Co-Experts
8. Involvement of Other Professionals
Where justified and lawful for answering the relevant specialist question, the expert may engage another expert, specialist consultant or other professional in accordance with the applicable procedural and expert rules.
In such cases, only the personal data necessary for the performance of the assignment may be disclosed.
The professional involved is subject to the applicable statutory, professional and contractual duties of confidentiality.
VIII. Confidentiality and Data Transfers
9. Expert Confidentiality
A forensic expert is subject to a statutory duty of confidentiality concerning the facts and data that come to their knowledge during the performance of their activities.
The expert may make case-related data accessible only to a person, body or public authority authorised to receive them under applicable legislation, an official appointment, an engagement or another appropriate legal basis.
Exceptions to the expert’s duty of confidentiality may include mandatory reporting or data-transfer obligations prescribed by law.
IX. Data Retention
10. Retention of Data Relating to Expert Cases
Under the Judicial Experts Act, unless otherwise provided by law, the expert restricts the processing of personal data without delay after the completion of the official appointment or the performance of the engagement.
The expert retains personal data subject to restricted processing for ten years from the date on which processing was restricted. This retention period enables verification of the professional, methodological, disciplinary and legal compliance of the expert’s activities. Unless otherwise required by law, the data are deleted after this period.
During the period of restricted processing, the data may be used or transferred only for the purposes and to the recipients specified by law.
The expert retains records of data transfers for ten years from the date of the relevant transfer.
11. Accounting Data
The Data Controller retains the data contained in invoices and accounting documents for the period prescribed by the accounting and tax legislation in force at any given time.
X. Data Processors
12. Service Providers Used by the Data Controller
Med-Forensic Bt. uses only data processors that provide sufficient guarantees to meet the requirements of the GDPR and protect the rights of data subjects.
Hosting Provider
Company name: Tárhely.Eu Szolgáltató Kft.
Postal address: 1538 Budapest, Pf. 510., Hungary
Telephone: +36 1 789 2 789
Email: support@tarhely.eu
Website: https://tarhely.eu/
Technical Operator of the Website
Name: Kecskés Imre E.V.
Registered office: 6724 Szeged, Sík Sándor utca 3., Hungary
Contact: https://cwdstudio.hu/
XI. Artificial Intelligence-Based and Other Digital Services
13. External Digital Services
Where the Data Controller uses artificial intelligence-based, speech-recognition, document-processing, cloud-based or other external digital services in its workflows, personal data, medical data or other special categories of personal data may be processed in such systems only where an appropriate legal basis, adequate data-protection safeguards and, where necessary, an appropriate data-processing agreement are in place.
The Data Controller does not delegate the formulation of forensic expert conclusions or responsibility for the professional content of an expert opinion to an automated system.
The Data Controller does not make decisions based solely on automated processing that produce legal effects concerning a data subject or similarly significantly affect them unless the statutory conditions for such processing are met.
XII. Cookies and Web Analytics
14. Cookies
The website may use cookies that are strictly necessary for its operation.
Non-essential statistical, analytical or marketing cookies may be used only with the data subject’s appropriate prior consent.
Refusing non-essential cookies will not prevent the basic use of the website.
The types, providers, purposes and lifespans of the cookies actually used on the website are described in a separate Cookie Notice.
XIII. Data Security
15. Technical and Organisational Measures
As a significant proportion of the data processed during forensic medical expert activities consists of medical data or other personal data requiring enhanced protection, Med-Forensic Bt. applies technical and organisational measures appropriate to the risks associated with the processing.
These measures include in particular:
- restricting access permissions;
- using IT systems protected by passwords and appropriate authentication;
- protecting devices against unauthorised access;
- performing regular backups;
- using up-to-date IT security solutions;
- using encrypted data transmission and data storage where necessary;
- physically protecting paper documents against unauthorised access;
- restricting access by employees, contributors and data processors to the extent necessary;
- imposing duties of confidentiality;
- appropriately managing personal data breaches.
XIV. Rights of Data Subjects
16. General Rights of Data Subjects
Subject to the conditions set out in the GDPR and applicable Hungarian legislation, the data subject is entitled in particular to:
- request information about the processing of their personal data;
- request access to their personal data;
- request the rectification of inaccurate personal data;
- request the erasure of their data in the cases specified by law;
- request restriction of processing;
- exercise the right to data portability where the statutory conditions are met;
- object, subject to the conditions of the GDPR, to processing based on legitimate interests or the performance of a task carried out in the public interest;
- withdraw consent where processing is based on consent;
- lodge a complaint with the supervisory authority;
- seek a judicial remedy.
16.1. Limitations on Data Subjects’ Rights in Expert Proceedings
The rights of data subjects are not absolute.
In particular, a data subject does not automatically have the right to erasure where processing is necessary for compliance with a legal obligation, public authority or court proceedings, the establishment, exercise or defence of legal claims, or the statutory verifiability of forensic expert activities.
Under the Judicial Experts Act, the expert will refuse to facilitate the exercise of the data subject’s right of access to the data processed by the expert where instructed to do so by the appointing authority or instructing party for the prevention or prosecution of criminal offences or for the protection of the rights of the data subject or others.
The data subject therefore cannot require the destruction of expert documentation solely on the grounds that they have withdrawn their consent or requested erasure where the continued retention of that documentation is required by law.
XV. Remedies
17. Contacting the Data Controller
Data subjects may primarily submit data-protection requests to the Data Controller using the following contact details:
Med-Forensic Bt.
Email: tothar@gmail.com
The Data Controller will examine and respond to the data subject’s request without undue delay and, as a general rule, within one month of receiving it.
18. Hungarian National Authority for Data Protection and Freedom of Information
If a data subject considers that the processing of their personal data infringes data-protection legislation, they may lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information.
Hungarian National Authority for Data Protection and Freedom of Information (NAIH)
Registered office: 1055 Budapest, Falk Miksa utca 9–11., Hungary
Postal address: 1363 Budapest, Pf. 9., Hungary
Telephone: +36 1 391 1400
Email: ugyfelszolgalat@naih.hu
Data subjects may also bring proceedings before a court if their data-protection rights have been infringed.
XVI. Specific Information for Persons Involved in Expert Examinations
19. An Expert Examination Is Not Medical Treatment
The primary purpose of a forensic medical expert examination is not to provide medical treatment, diagnostic healthcare or therapy, but to answer the specialist question specified in an official appointment or lawful engagement.
Medical data obtained during an expert examination are therefore assessed by the expert within the scope of the relevant expert assignment.
Consent to data processing given by the data subject or instructing party does not affect the independence of the expert’s professional conclusions.
XVII. Personal Data of Minors and Persons with Limited Legal Capacity
20. Enhanced Protection
When processing the personal data of a minor, a person under guardianship or another person with limited decision-making capacity, the Data Controller pays particular attention to protecting the rights and interests of the data subject.
Matters relating to the required consent, legal representation, provision of information and disclosure of data are handled in accordance with the legislation governing the relevant proceedings.
Personal and medical data relating to a child or another vulnerable person may be processed only to the extent necessary for the relevant expert assignment.
XVIII. Photographic, Audio and Video Recordings
21. Preparation of Documentation
Where necessary for the performance of the expert assignment and where an appropriate legal basis exists, the expert may take photographs or prepare other documentation during the examination. The expert may also assess lawfully provided photographic, audio or video recordings for expert purposes.
Such recordings may constitute personal data and, in certain cases, special categories of personal data. They are therefore subject to the same enhanced data-security and confidentiality requirements as the other protected data relating to the case.
XIX. Scientific and Educational Use
22. Use in a Form That Does Not Permit Identification
Facts and data obtained during expert activities may be used for scientific or educational purposes only within the framework of the applicable legislation.
Unless otherwise provided by law or by a contract concluded with the expert, such use may take place only in a form that does not permit the identification of the persons concerned.
XX. Personal Data Breaches
23. Management of Personal Data Breaches
In the event of a personal data breach, Med-Forensic Bt. will take the necessary technical and organisational measures without delay to remedy the breach, limit its consequences and prevent its recurrence.
Where the conditions set out in the GDPR are met, the Data Controller will notify the supervisory authority of the breach and, where the breach is likely to result in a high risk, will also inform the affected data subject.
XXI. Amendments to this Privacy Notice
24. Final Provisions
Med-Forensic Bt. reserves the right to amend this Privacy Notice in response to changes in the legal environment, its data-processing practices or the operation of the website.
The current version is available at all times on the Med-Forensic Bt. website.
Effective date: 18 September 2026