מדיניות פרטיות

Mahon 1 Sports Medicine ("the Institute") is committed to protecting the privacy of its patients in accordance with the Israeli Privacy Protection Law, 5741-1981 (including Amendment 13, effective August 2025), the Privacy Protection (Data Security) Regulations, 5777-2017, and any applicable law.

This policy explains what data is collected, how it is used, and your rights as a patient. It applies to all of the Institute's digital services (website, online questionnaire, and appointment management system).

As part of the sports medical fitness examination process, we collect:

• Identifying details: full name, ID number, birth year, gender
• Physical data: height, weight, sport, club
• Medical history: responses to a comprehensive medical questionnaire
• Physical examination findings and medical conclusions
• Electronic signature
• Medical documents: fitness certificates and referrals

• Conducting sports medical fitness examinations
• Issuing fitness certificates and referrals for further tests
• Medical documentation and follow-up
• Compliance with legal and regulatory requirements

Processing of your medical data is based on your explicit consent, given when completing the medical questionnaire and providing your electronic signature, as well as to fulfill legal obligations applicable to the Institute.

Providing the data is voluntary; however, without it the medical fitness examination cannot be performed. You may withdraw your consent at any time, subject to legal medical-record retention duties.

Some patients are minors (under 18). For a minor, performing the examination and providing the data require the consent of a parent or guardian.

The parent/guardian may exercise the privacy rights described in this policy on the minor's behalf. Medical records of minors are retained for longer periods as required by law (see "Data Retention").

• Institute medical staff — authorized physicians and technicians only
• tor4you — appointment management system, receives basic identification details and fitness status
• Google Firebase — cloud storage service for data storage, under a data processing agreement
• WhatsApp Business (Meta) — for sending appointment confirmations and reminders only; receives phone number and basic appointment details

Service providers act as data processors on behalf of the Institute and solely under its instructions. Some of them store or process data outside Israel (mainly within the European Union); such transfers are made subject to the Privacy Protection (Transfer of Data to Databases Abroad) Regulations, 5761-2001.

Your data is never sold or transferred to third parties for advertising purposes.

• All communications are encrypted via HTTPS/TLS
• Data is stored on Google Cloud servers in Europe (europe-west3 region)
• Access to data is protected by two-factor authentication (2FA)
• All access to medical documents is recorded in an Audit Log
• Links to medical documents are valid for 15 minutes only
• The Institute complies with the Privacy Protection (Data Security) Regulations, 5777-2017, at the security level applicable to a database containing sensitive medical information

In the event of a serious security incident that may compromise the data, we will act in accordance with the law — including documenting the incident, taking immediate steps to mitigate harm, and notifying the Privacy Protection Authority and the relevant patients as required.

Medical records are retained for the period required by law — at least 7 years from the date of examination, and for minors until they reach the age of 18 plus the additional period prescribed by law.

As long as a legal duty to retain the record exists, the data will not be deleted — even if deletion is requested. Data no longer subject to a retention duty will be deleted or anonymized (rendered non-identifiable).

As a patient, you have the right to:

• Access the information recorded about you
• Correct inaccurate information
• Request deletion of information no longer required (subject to legal medical-record retention duties)
• Receive a copy of your data
• Withdraw your consent to the processing of your data
• Lodge a complaint with the Privacy Protection Authority

To exercise your rights, contact us at the address at the bottom of this page.

The system does not use tracking cookies or third-party analytics tools. No advertising.