Data Protection Policy
MURMO Centre for Specialist Psychology and Art Therapy
1031 Budapest, Győri út 2/c
MURMO JOINT DATA PROCESSING AND DATA PROTECTION POLICY
Version: 2026/1
Effective from: 1 September 2026
1. Purpose and scope of the Policy
This Policy lays down the joint minimum data protection and data security rules for OPTIMUM-2000 Kft., operating within the framework of the MURMO Centre for Specialist Psychology and Art Therapy, and for the independent service providers participating in MURMO’s professional collaboration. The purpose of the Policy is to ensure, in a setting where several independent controllers work together, a clear delineation of processing roles, access rights, information flows and responsibilities.
This Policy does not make OPTIMUM-2000 Kft. the sole controller of all client data, nor does it make the independent service providers processors merely because they use MURMO infrastructure or shared professional protocols. Controller status must be assessed for each processing operation on the basis of its actual purpose, means and decision-making powers.
The Policy applies to the staff of OPTIMUM-2000 Kft. working in connection with MURMO, to the independent service providers participating in the professional collaboration and the persons they engage for this purpose, and to volunteers, trainees and residents insofar as they may have access to personal data.
2. Key definitions and processing roles
- Independent controller: a MURMO service provider which, in its own name and within its own sphere of professional responsibility, determines the purposes and essential means of the processing related to the care it provides.
- OPTIMUM-2000 Kft.: the operator of MURMO’s central organisational, infrastructure and administrative functions; a controller in respect of its own processing.
- Joint controllers: controllers which actually determine jointly the purposes and essential means of a specific operation. Joint controller status is specific to each operation.
- Processor: a person or organisation acting solely on behalf of the controller and on documented instructions, which does not decide independently on the purposes of the processing.
- Authorised person: a person who, by virtue of a specific task, may access defined data in accordance with the need-to-know principle.
- Extended confidentiality: a principle of professional collaboration; it does not in itself constitute a legal basis or a general right of access.
3. Delineation of roles
3.1. A Partner providing specific professional care in its own name is the controller of the care it provides, including its own obligations regarding the content, necessity and retention of professional records.
3.2. OPTIMUM is an independent controller in particular as regards the operation of the central intake channel, basic administrative intake, contracts for the use of premises and infrastructure, its own billing, access administration, operational security and organisational communications.
3.3. Joint controllership may arise in particular where OPTIMUM and the service provider(s) concerned jointly determine the purposes and essential means of case coordination linked to central intake, coordinated care by several providers, a joint case conference or any element of shared records.
3.4. The mere fact that two service providers treat the same client consecutively or in parallel does not constitute joint controllership where each decides independently on its own purposes and means of processing; in such cases, data may be transferred between them on an appropriate legal basis.
4. Data protection principles
- lawfulness, fairness and transparency;
- purpose limitation and data minimisation;
- accuracy and keeping data up to date;
- storage limitation;
- integrity and confidentiality;
- accountability;
- need-to-know: data may be disclosed only to persons who require them for a specific task;
professional collaboration and team membership may not override the above principles.
5. Legal bases
5.1. In healthcare, the legal basis for processing ordinary personal data is typically the performance of the service relationship and compliance with legal obligations; for health data and other special categories of data, Article 9(2)(h) GDPR and the Hungarian rules on the processing of health data apply.
5.2. For non-healthcare counselling, training or other services, the legal basis under Article 6 is primarily the performance of a contract; where the service requires the processing of special categories of data and no other condition under Article 9 applies, explicit consent is required.
5.3. Consent must and may be requested only for processing for which consent is in fact the legal basis. Provision of the service may not be made conditional on consent to optional processing that is not necessary for the service.
5.4. For billing, accounting, complaint handling, reporting to public authorities and the enforcement of legal claims, the relevant legal basis applies, namely contract, legal obligation, legitimate interest or the establishment, exercise or defence of legal claims.
6. Central intake and case coordination
6.1. Through the central intake channel, only the data necessary for initial intake and for identifying the appropriate practitioner/service provider may be requested.
6.2. Administrative staff may pass on information received at intake only to the extent required for selecting a practitioner; the full clinical history or records may not be shared merely for the purpose of finding a placement for the case.
6.3. The proposed practitioner accepts the case on the basis of their own competence and capacity. Once the case has been accepted, the data subject must be clearly informed of the identity of the care-providing service provider as controller.
6.4. Where a client contacts a Partner directly, the Partner may forward to central administration only such data as are genuinely necessary for the organisational task and for whose transfer an appropriate legal basis exists.
7. Professional consultation, case conferences and referral
7.1. Only persons actually involved in the care of, consultation on or lawful preparation of decisions concerning the given case may be included in professional consultation.
7.2. At team meetings, identifiable case details may be presented only where this is necessary for the purpose of the consultation and an appropriate legal basis exists; otherwise, the case must be presented in anonymised form or with the lowest possible degree of identifiability.
7.3. The involvement of another independent service provider may result in a new controller; the information of the data subject and the legal basis for the transfer of data must be addressed.
7.4. Recommending an external practitioner does not in itself justify the transfer of client data. Where the family contacts the external practitioner themselves, the records are, as a general rule, also to be passed on by the family.
7.5. Internal professional consultation may not delay compliance with an urgent statutory obligation to report or intervene, nor make it subject to the approval of another manager.
8. Access management
8.1. Access rights are tied to the individual and to the task. There is no general “team member access level”.
8.2. For every shared e-mail, Drive, calendar or other platform, it must be defined who has access, for what purpose and to which categories of data.
8.3. New access may be granted by OPTIMUM or by the designated administrator of the system concerned only where the necessity for the professional/operational task has been demonstrated.
8.4. Access must be revoked without undue delay when the task ends or upon withdrawal from the MURMO collaboration.
8.5. Only designated persons may access a shared mailbox; the mailbox may not be used as an automatic repository for all professional documents.
9. Minimum IT and physical data security requirements
- individual user account and a strong password not used for any other service;
- multi-factor authentication where available;
- screen lock, device encryption and an up-to-date operating system/antivirus protection on any device that processes personal data;
- client data may be kept in private e-mail or unvetted cloud services only exceptionally and where the necessity is documented; as a general rule, the designated MURMO/business channel must be used;
- verification of the recipient when sending health documents by e-mail; where justified, a password-protected document with the password communicated via a separate channel;
- USB drives/storage media only where necessary, preferably encrypted;
- paper documents to be kept, after use, in a locked cabinet or other place that prevents unauthorised access;
- printed documents, notes or test materials must not be left unattended in shared rooms;
- disposal only by irreversible destruction.
10. Records and retention
10.1. Each controller is responsible for its own professional and statutory record-keeping obligations.
10.2. Health records must be handled in accordance with the statutory retention period applicable to them; the different retention periods for individual document types must be recorded in the record of processing activities.
10.3. Records of non-healthcare services may be retained only for as long as necessary for the service, for accountability and for the enforceability of any legal claims.
10.4. The shared system does not relieve an independent controller of its own mandatory record-keeping obligations; however, no unnecessary duplicate copies may be created.
10.5. Upon expiry of the retention period, the data must be erased or destroyed, unless a new legal basis or a statutory retention obligation applies.
11. Electronic communication and delivery of expert opinions
11.1. Expert opinions may be sent electronically only to a verified address provided by the data subject/legal representative.
11.2. Automatically copying in the central murmomail@murmo.hu address merely as a matter of internal routine is not permitted. A copy may be sent only for a documented purpose, on an appropriate legal basis and in compliance with the principle of data minimisation.
11.3. Where it is necessary to document the fact of delivery, only the minimum data required for that purpose should, in the first instance, be recorded; central copying of the full expert opinion is justified only where it has its own processing purpose and legal basis.
11.4. Any misdirected transmission or transmission to an unauthorised recipient must be treated as a suspected personal data breach.
12. Processors
12.1. Each independent controller is responsible for its own processors and for ensuring the contractual terms required under Article 28 GDPR.
12.2. OPTIMUM records the processors connected with the shared infrastructure it operates in its own records.
12.3. The accountants of MURMO members do not become processors for MURMO as a whole; they act solely on behalf of the controller that engaged them.
13. Data subject rights and requests
13.1. A data subject’s request must be fulfilled primarily by the controller that processes the data to which the request relates.
13.2. A request relating to joint processing may be submitted to any of the joint controllers. The party receiving the request shall notify the other controllers concerned without delay and coordinate its fulfilment within the prescribed time limit.
13.3. General contact point: murmomail@murmo.hu. The contact point is not authorised to disclose data in respect of which OPTIMUM is not the controller and has no appropriate access/legal basis.
13.4. The allocation of tasks and responsibilities among the joint controllers does not limit the rights of data subjects under the GDPR. Each controller is responsible for the lawfulness of the processing operations it carries out independently and, within the scope of joint processing, for fulfilling the obligations incumbent upon it under this Policy, the MURMO framework agreement on professional collaboration and the use of infrastructure and premises, or the actual circumstances of the processing operation concerned.
14. Personal data breaches
14.1. Anyone who becomes aware of a personal data breach or a suspected breach shall report it without delay to the controller concerned and, where shared infrastructure or several service providers are affected, to OPTIMUM’s designated data protection contact person.
14.2. Wherever possible, the report should include the time of the incident, the system/data categories affected, the estimated number of data subjects concerned, the immediate measures taken and the contact details of the reporting person.
14.3. The controller(s) concerned shall carry out a documented risk assessment and decide whether notification of the supervisory authority or of the data subjects is required. In the case of a breach affecting several controllers, they shall cooperate.
14.4. A record of breaches and the measures taken must be kept.
15. Data protection impact assessment and data protection officer
15.1. The general finding in the previous policy that a data protection impact assessment is not required cannot be applied automatically to the MURMO system as a whole. Before introducing any new or substantially modified processing that involves a wider range of special categories of data, new technology, systematic monitoring or other high-risk factors, an assessment of whether a DPIA is required must be carried out.
15.2. The need to designate a data protection officer must be reviewed periodically in light of the conditions set out in Article 37 GDPR, taking into account MURMO’s actual volume of processing and the nature of its processing of special categories of data. This Policy does not in itself determine either the existence or the absence of such an obligation.
15.3. Irrespective of the designation of a DPO, OPTIMUM maintains a data protection coordination contact point for the operation of the shared system: murmomail@murmo.hu.
16. Onboarding, training and confidentiality
16.1. A Partner joining the MURMO collaboration shall, before commencing its activities, familiarise itself with this Policy, the data subject information notice, the access arrangements and the professional and data protection protocols applicable to it.
16.2. The Partner and every person with access undertake a duty of confidentiality, which continues after the termination of the relationship.
16.3. Volunteers, trainees and residents may access data only for a specific task, under appropriate professional supervision and subject to the necessary data protection conditions.
17. Withdrawal and termination
17.1. Upon termination of the MURMO collaboration, access granted to the shared system and to MURMO mailboxes must be revoked.
17.2. Withdrawal does not terminate the Partner’s retention, record-keeping and confidentiality obligations arising from its own status as controller.
17.3. In the case of ongoing care, the client’s freedom of choice, continuity of care and the requirements for lawful data transfer must be observed; no automatic “handover” of a client or of the complete records may take place.
17.4. The departing party shall erase or destroy copies originating from the shared system that are not required for its own mandatory retention.
18. Record of processing activities
OPTIMUM and each independent service provider shall maintain a record of their own processing activities in accordance with Article 30 GDPR, where required to do so. Joint processing operations must be shown in an identifiable manner in the records of the participating controllers. The record shall contain at least the purposes of processing, the categories of data subjects and of data, the recipients, the retention periods or the criteria for determining them, and the main security measures.
19. Entry into force, review and hierarchy of documents
19.1. This Policy constitutes MURMO’s joint data protection framework. Individual independent controllers set out their own processor, accounting or other processing details that concern them alone in their own records and, where necessary, in their own supplementary policies.
19.2. A professional protocol, job/role description or process chart does not in itself create any processing or access rights. The data protection provisions of such documents must be interpreted in accordance with this Policy.
19.3. The Policy must be reviewed at least annually, and additionally without delay in the event of any significant organisational, technical or legislative change.