Client register for the digital service platform Lunna

1. Data controller

The County Board of the Western Uusimaa Wellbeing Services County

2. Person responsible for the register

The Wellbeing Services County Director

3. Contact person of the register

Administrative Managers for the service areas

Contact details

Western Uusimaa Wellbeing Services County

P.O. Box 33, 02033 Western Uusimaa Wellbeing Services County

Switchboard: 029 151 2000

4. Purposes of processing personal data and the legal grounds for processing

Purposes of processing

Lunna is a digital platform for accessing the social and health care services provided by Western Uusimaa Wellbeing Services County. The purpose of processing personal data in the register is to provide the client with personalised care and service guidance, information pertaining to their wellbeing and the opportunity to manage administrative matters. After secure authentication, users can enter personal data, communicate with professionals, receive notifications, and manage administrative tasks.

Personal data is processed pursuant to the statutory obligations of the Western Uusimaa Wellbeing Services County. Use of the platform requires acceptance of its terms of use. These terms are available at registration and login. Processed data includes information on health status and other relevant data. The data may be submitted by the user or, through suomi.fi, by an authorized representative.

Legal grounds for processing

Article 6(1)(c) of the General Data Protection Regulation of the European Union: processing is necessary for compliance with a legal obligation to which the controller is subject.

Key legislation

General Data Protection Regulation of the European Union (679/2016)
Data Protection Act (1050/2018)
Act on the Provision of Digital Services (306/2019)
Health Care Act (1326/2010)
Act on the Processing of Client Data in Healthcare and Social Welfare (703/2023)
Act on Organising Healthcare and Social Welfare Services (612/2021)
Act on the Status and Rights of Patients (785/1992)
Student Welfare Act (1287/2013)
Government Decree on maternity and child health clinic services, school and student health services and preventive oral health services for children and youth (338/2011)
Mental Health Act (1116/1990)
Archives Act (831/1994)
Act on Organising Healthcare, Social Welfare and Rescue Services in the Region of Uusimaa (615/2021)
Act on Healthcare Professionals (559/1994)

5. Data contents of the register

The personal data processed consists of the following personal data of the client: name, telephone number, address, email address, age, gender, date of birth, personal identity code, unique identifier in the system, health information, image and internal communication information (communication between healthcare professional and client) and content produced by the client themselves.

Data relevant for the client’s care and service are recorded as part of the client and patient information system in the Western Uusimaa Wellbeing Services County.

On the service platform, personal data on the employees of the Western Uusimaa Wellbeing Services County are also processed with respect to following personal details: name, work email address, individual user identifier, job title and technical identifiers, such as IP address and data on terminal equipment and log data generated by the platform.

6. Regular disclosure of personal data

Register data is not routinely disclosed Information may be shared only with the subject's explicit consent, or with authorities legally entitled to access it.

As a rule, data is not transferred from the register to countries outside the EU or the EEA. However, personal data may be transferred to countries outside the EU/EEA area where the European Commission has determined that the level of data protection is adequate. In addition, personal data may be transferred to countries outside the EU/EEA when the protection measures required by the General Data Protection Regulation have been implemented, for example, by incorporating standard data protection clauses into contracts and by employing additional measures recommended by the European Data Protection Board as necessary.

7. Data retention periods

The retention period for personal data is determined in accordance with the Act on the Processing of Client Data in Healthcare and Social Welfare (702/2023).

Data relevant for the client’s care and service are recorded as part of the client and patient information system in the Western Uusimaa Wellbeing Services County. The retention period is determined in accordance with the statutory obligations of the data controller.

The data controller has set the following retention periods for documents that are not governed by the Client Data Act:

User and disclosure logs (and their backups): Stored on the platform for 12 years.
Chat conversations and non-urgent messages: Stored on the platform for 3 years.
Digital care pathways and online forms: Stored on the platform for 5 years.
Other personal or service-usage data: Basic client information remain on the platform until the user deletes their account.

Users of the Lunna application have the right to delete their account from the platform. All data on the user (personal data, data on use of the service and notifications) will be removed from the application upon account deletion.

8. Sources of personal data

The Digital and Population Data Services Agency primarily provides clients’ identification and contact information, such as name and address.

Information related to the organization of care and services from the patient register and the social and health care client register is collected and maintained based on information provided by the client/patient or their representative, as well as data generated within social and health care units.

Data concerning employees of the Western Uusimaa Wellbeing Services County is obtained from their respective work units.

The whole Western Uusimaa Wellbeing Services County