Privacy statement for Terhikki 

We process personal data in order to comply with statutory requirements and to carry out tasks that are in the public interest, and also to exercise the public authority vested by law in Finnish Supervisory Agency: 

• EU General Data Protection Regulation (EU 2016/679), Article 6(1) subparagraphs c) and e).
• Data Protection Act (1050/2018), section 4(1)2. 

We process data in special categories of personal data and data pertaining to crimes and misdemeanours in order to carry out tasks that are in the public interest and to exercise the public authority vested by law in Finnish Supervisory Agency: 

• EU General Data Protection Regulation (EU 2016/679), Articles 9 and 10.
• Data Protection Act (1050/2018), section 6(1)2 and section 7(1)2.

The duties of the Finnish Supervisory Agency and the processing of personal data in matters related to the right to practise a profession in health care are provided for in: 

• Act on the Finnish Supervisory Agency (530/2025).
• Act on Health Care Professionals (559/1994).
• Decree of the Ministry of Social Affairs and Health on Health Care Professionals (564/1994).
• The public information service of the register is provided for in the Act on Health Care Professionals (559/1994), section 24c.

The deletion of register data is provided for in detail in section 24a of the Act on Health Care Professionals.

The retention periods for personal data are determined according to the Archives Act (831/1994), other legislation, orders and decisions issued by the National Archives, recommendations of the Information Management Board and the Finnish Supervisory Agency’s information management plan (TOS).

Data subjects themselves, the Population Information System of the Digital and Population Data Services Agency, the VIRTA education and training data service of the Ministry of Education and Culture, the National Registry and Data Transfer Service for Study Rights and Completed Studies (Koski) of the National Agency for Education. Finnish Supervisory Agency may also receive information from other public authorities on request.

Data may be disclosed, or processing of personal data outsourced, only as allowed in currently valid legislation. Finnish Supervisory Agency enforces through agreements that any partners employed in the outsourcing of the processing of personal data (personal data processors) comply with data protection legislation.

The disclosure of register data is provided for in section 24b of the Act on Health Care Professionals.

Data are regularly disclosed as required by law to other public authorities: Digital and Population Data Services Agency, Social Insurance Institution (Kela), Finnish Medicines Agency Fimea, Finnish Defence Forces, Statistics Finland and National Institute for Health and Welfare.

Data are regularly disclosed on the basis of a data disclosure agreement to: Finnish Dental Association, Finnish Medical Association, Finnish Medical Society Duodecim and Tehy ry.

As per section 24c of the Act on Health Care Professionals, Finnish Supervisory Agency discloses data in the public information service of the register (Julkiterhikki). The data to be disclosed in the information service are transferred from the source system once a day.

Documents and register data deemed to be retained indefinitely pursuant to the Archives Act are delivered to the National Archives for storage when no longer needed for Finnish Supervisory Agency’s own purposes as described in the present Privacy Policy.

Data are disclosed to parties requesting them, in accordance with the Act on the Openness of Government Activities (621/1999). Data and documents are public unless they have been specifically classified as confidential.

No data are disclosed for direct marketing, opinion polls or market research, unless disclosure for this purpose is specifically provided for by law.

Transfer of personal data to outside of the European Union or the European Economic Area

The statutory public information service of the register on the Finnish Supervisory Agency website allows access to personal data from outside the EU/EEA. Personal data will not otherwise be transferred out of the EU/EEA.

A. Right of access to data: You have the right to know whether Finnish Supervisory Agency is processing personal data concerning you. If we are, you have the right to receive a copy of such data, unless we have a legal basis for refusing to allow you to exercise this right.

B. Right to request rectification: If the personal data concerning you that we are processing are incorrect, inaccurate or outdated, you may request us to correct your data.

C. Right to restrict processing: You may have the right to restrict the processing of your personal data in cases outlined in legislation. Such restricting may be possible for instance in any of the following cases: 

• you consider that the personal data concerning you are incorrect,  
• the data are being processed unlawfully,  
• Finnish Supervisory Agency no longer requires your personal data for the purposes described in the present Privacy Policy but you need them in order to prepare, file or defend a legal claim, or
• you have objected to the processing of your personal data.

Finnish Supervisory Agency will restrict processing of your personal data while we respond to your request(s) concerning the correcting of your personal data or to your objection to the processing of your personal data. If we restrict the processing of your personal data, we are still allowed to process your personal data: 

• with your consent, 
• in order to prepare, file or defend a legal claim, 
• if it is in the public interest, or 
• in order to safeguard the rights of another individual. 

We will also notify you when the restriction on the processing of your personal data is discontinued.

D. Right to object:  You have the right to object, on grounds relating to your particular situation, at any time to the processing of your personal data by Finnish Supervisory Agency for carrying out a task in the public interest, for exercising the public authority vested in the controller, or for exercising the justified interests of the controller or of a third party.

Please send requests concerning any of the above rights to the Finnish Supervisory Agency registry by e-mail (kirjaamo(at)lvv.fi) or by mail (Finnish Supervisory Agency, PO Box 20, FI-13035 LVV). In order to ensure your privacy, we may ask you to verify your identity. We will respond to you generally within one month of receiving your request.

Further information on the rights of data subjects can be found on the website of the Office of the Data Protection Ombudsman.

Right to lodge a complaint with the competent supervisory authority

If you consider that data protection legislation has been violated in the processing of your personal data, you have the right to lodge a complaint with the Office of the Data Protection Ombudsman.

Office of the Data Protection Ombudsman 
Phone (switchboard): +358 29 566 6700  
E-mail: tietosuoja(at)om.fi   
Mail address: PO Box 800, FI-00531 Helsinki, Finland