The site of East Tallinn Central Hospital — 223 requests, 12 nodes, an 88-second recording. The Cookiebot consent platform is installed on the site, but Hotjar session recording, Google analytics and the legacy Universal Analytics start before the user's choice is recorded: Hotjar switches on at +178 ms, almost together with the consent platform itself. The attached document describes the processing of patient data, but has no section on the site, cookies and web tracking at all — the actual recipients of web data are not disclosed. In the site's favour: Facebook loads only the SDK, no pixel requests were recorded.
Request timeline
Declared versus actual
Transfer timings
Third-party CDN, the swiper library.
Google Tag Manager GTM-NM8GSJ2.
Hotjar, session recording and heatmaps, 11 requests.
Universal Analytics, the legacy analytics.js library.
Only the Facebook SDK; no pixel /tr requests were recorded.
GA4 G-4YVM3Y21SF, page_view, without the gcs marker.
Detected trackers
- Hotjar (script.hotjar.com, static.hotjar.com, hotjar-3178275) — session recording and heatmaps, starts at +178 ms, 11 requests
- Google Analytics 4 (region1.analytics.google.com, G-4YVM3Y21SF) — page_view; the consent marker gcs is absent from the request
- Universal Analytics (www.google-analytics.com/analytics.js) — Google's legacy library (retired in 2023), the script is still loaded
- Google Tag Manager (GTM-NM8GSJ2), Google Fonts (fonts.googleapis.com) — tag loader and fonts
- Facebook (connect.facebook.net) — only the SDK is loaded, no pixel /tr requests were recorded
- jsDelivr (cdn.jsdelivr.net) — third-party CDN, the swiper library
Indicators of GDPR non-compliance
- ePrivacy — Directive 2002/58/EC, Art. 5(3) (in conjunction with GDPR Art. 6(1)(a))The consent-management platform Cookiebot is installed on the hospital site (uc.js loads at +165 ms), but the trackers start before the user's choice is recorded. Hotjar session recording starts at +178 ms — almost simultaneously with the consent platform itself — Google Tag Manager and jsDelivr at +166 ms, the legacy Universal Analytics library at +491 ms, and Google Analytics 4 sends a page_view at +5693 ms. Session recording falls into a category requiring explicit prior consent; here it switches on among the first, before the visitor could choose anything.
- GDPR Art. 13, 14 — information and disclosure of recipientsThe attached 'Data protection terms' document describes the processing of patient data in the provision of medical services, hiring and participation in events, but contains no section on the site: cookies, web analytics, session recording and data transmission to third-party services are not mentioned in it. No separate cookie policy for the site could be found. Thus the actual recipients of web data — Hotjar, Google Analytics, Google Tag Manager, Facebook, jsDelivr — are disclosed nowhere.
- GDPR Art. 9 — special categories of data (health context)The site belongs to a hospital. Even without logging into the patient portal, the very fact of a visit to a medical institution's pages and specific clinics' sections may indicate the visitor's state of health or medical interest. Hotjar session recording and Google analytics, running before consent, record behaviour on such pages and transmit it to third-party processors, which in a health context requires particular caution and reliable prior consent.
- GDPR Art. 32 — security measuresThe security headers are almost absent: there is no strict transport, no content-security-policy, no referrer policy, no permissions policy; only the frame-embedding ban SAMEORIGIN is set. The server is served under Apache / ZoneOS. For a medical institution's site loading third-party session-recording and analytics code, this is an insufficient level of protection of the client side.
Context
www.itk.ee is the site of AS Ida-Tallinna Keskhaigla (East Tallinn Central Hospital), a large Estonian medical institution with seven clinics in Tallinn. The controller is AS Ida-Tallinna Keskhaigla, registry code 10822068, Ravi 18, Tallinn. The site is served under Apache / ZoneOS; the content is in Estonian, Russian and English.
The recording: 223 requests, 12 nodes, a recording length of 88.1 seconds, taken on 14 August 2026. The recording covers the publicly accessible part of the site — the home page, the Russian version, the public-documents section and the partners page; the patient portal with authorisation is not included in the recording. Besides the main domain, the page addresses third-party recipients: the Cookiebot consent platform, Hotjar session recording, Google analytics (GA4, Universal Analytics, Tag Manager), the Facebook SDK, the third-party CDN jsDelivr and Google Fonts.
The processing of patient data is described by the attached ‘Data protection terms’ document. It should be noted separately: this document concerns the processing of personal data in the provision of medical and social services, hiring and participation in events, but has no section on the site, cookies or web analytics. No separate cookie policy for the site could be found.
Who receives data directly
Hotjar, Google (Analytics 4, Universal Analytics, Tag Manager), Facebook (SDK), jsDelivr.
Declared versus actual
A consent platform is installed, but the trackers do not depend on it. Cookiebot runs on the site: uc.js loads at +165 ms, followed by the configuration and the banner SDK. However, Hotjar session recording starts at +178 ms — almost simultaneously with the consent platform itself and earlier than the visitor could make a choice. Google Tag Manager and the third-party CDN jsDelivr go out at +166 ms, the legacy Universal Analytics library at +491 ms, and Google Analytics 4 sends page_view at +5693 ms. The order of events shows: the consent mechanism is present, but it does not block the actual loading of the trackers.
Session recording on a hospital site is the most significant finding. Hotjar records the visitor’s behaviour — cursor movements, clicks, scrolling — and builds heatmaps; 11 requests go to it over the recording. On a medical institution’s site, even the publicly accessible pages (clinic and service sections) are sensitive in a health context: the very fact of interest in them may indirectly indicate the visitor’s condition. Starting such recording before consent requires particular attention.
Facebook loads only the SDK, without the pixel — this should be said in the site’s favour. The domain connect.facebook.net delivers only sdk.js; no requests to facebook.com/tr (Meta pixel events) were recorded over the whole recording. That is, unlike the typical scenario, the Facebook pixel transmits no data about the visitor to Meta — only the SDK is present, probably for a widget or button.
Legacy analytics is still in the code. The site still loads www.google-analytics.com/analytics.js — the Universal Analytics library, which Google retired from data processing back in 2023. It transmits no data to the current analytics, but its presence in the code indicates that the web-analytics setup has long gone unreviewed.
The processing on the site is disclosed nowhere. The attached ‘Data protection terms’ document describes the processing of patient data, but says nothing about the site, cookies and web tracking. No separate cookie policy for the site could be found. Thus the actual recipients of web data — Hotjar, Google Analytics, Google Tag Manager, Facebook, jsDelivr — are named in no available document, although Cookiebot is technically present on the site.
Security headers are almost absent. Only the frame-embedding ban SAMEORIGIN is set. There is no strict transport, no content-security-policy, no referrer policy, no permissions policy. For a hospital site loading third-party session-recording and analytics code, this is an insufficient level of protection of the client side.
Consent: what is proven and what is not
Proven: a consent platform is present, but the trackers start before the choice is recorded. Cookiebot loads from +165 ms; Hotjar (+178 ms), GTM and jsDelivr (+166 ms), Universal Analytics (+491 ms) and Google Analytics 4 (+5693 ms) are initiated by the markup and precede the user’s choice.
Proven: Hotjar session recording works from the first milliseconds. The requests to static.hotjar.com and script.hotjar.com are read from the recording from +178 ms; 11 requests in total over the session.
Proven: the Facebook pixel transmits no data. Over the whole recording there is only the loading of sdk.js; there are no requests to facebook.com/tr.
Proven: Google Analytics 4 sends a page_view without a consent marker. In the region1.analytics.google.com/g/collect request the gcs marker is absent, gcd=13l3l3l2l1l1.
Not proven and not asserted: the state of cookies on the device. Cookie headers and response bodies were removed from the published file during sanitisation. All conclusions rest on addresses, initiators, response codes and the composition of requests.
Separately: the browser was sending the DNT: 1 header during capture. This had no effect on the composition and addressing of the requests.
Boundaries of observation
The recording covers the publicly accessible part of the site; the patient portal with authorisation is not included in the recording, and no specific patient’s medical data appears in it. The observation records the browser’s behaviour, not the services’ internal workings: server-side processing, contractual relationships with recipients and settings on their side are not verified by a browser recording. The legal assessment is made by the competent authority — Andmekaitse Inspektsioon.
The absence of a section on the site in the attached document and the absence of a separate cookie policy were checked against the document itself and open sources; the conclusion that the recipients of web data are not disclosed is made on this basis. If the hospital has a separate, undiscovered cookie policy, this conclusion is subject to revision.
The file is published sanitised of personal data: cookie headers in requests and response bodies were removed. The conclusion that the trackers start before consent is recorded rests on the network level — the timings, addresses and initiators of the requests are read from the recording. The absence of Facebook pixel requests is established by the absence of requests to facebook.com/tr over the whole recording.
The identification of services rests on domains and address patterns: Cookiebot — by cookiebot.com and uc.js; Hotjar — by hotjar.com and the identifier hotjar-3178275; Google Analytics 4 — by analytics.google.com/g/collect and the property G-4YVM3Y21SF; Universal Analytics — by www.google-analytics.com/analytics.js; Google Tag Manager — by googletagmanager.com and the container GTM-NM8GSJ2; Facebook — by connect.facebook.net; jsDelivr — by cdn.jsdelivr.net; the serving provider — by the server: Apache / ZoneOS header.
Conclusion
The site of East Tallinn Central Hospital has installed the Cookiebot consent-management platform, but has not tied the actual loading of the trackers to its result: Hotjar session recording switches on at +178 ms, almost simultaneously with the consent platform itself, and Google Tag Manager, the third-party CDN jsDelivr, the legacy Universal Analytics and Google Analytics 4 start in the first seconds of the visit. For a medical institution’s site, starting the recording of visitor behaviour before consent is the most significant part of the picture.
In the site’s favour is that Facebook loads only the SDK: no Meta pixel requests transmitting events were recorded over the whole recording. But the processing on the site is disclosed nowhere — the attached ‘Data protection terms’ concern patients and do not mention cookies, analytics and session recording, and no separate cookie policy could be found. The security headers are almost absent.
Remediation: make the actual loading of Hotjar session recording, Google Analytics and other analytics scripts conditional on the user’s choice in Cookiebot, so that they do not start before consent; publish a cookie policy naming all recipients of web data individually — Hotjar, Google Analytics, Google Tag Manager, Facebook, jsDelivr — with the purposes and, for session recording, a separate basis; remove the legacy Universal Analytics library from the code; host the swiper library on the own infrastructure, eliminating the transmission of the IP address to a third-party CDN; set strict transport, a content-security-policy, a referrer policy and a permissions policy.
How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.
38432a493935508f5a2b97204ba5d76071e783533018e1f55a7cf3556154dae6Want a response from the company about this audit? → Open the tool
Fill in once — it will be inserted into every letter below:
All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.
RIA DigiDoc — phone · Smart-ID / Mobile-ID
Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).
Тема: Запрос доступа к персональным данным (ст. 15 GDPR) — itk.ee Кому: [укажите адрес компании — DPO / поддержка / юридический отдел] От: [Ваше имя], [контактный email] Прошу предоставить доступ к моим персональным данным, обрабатываемым в связи с использованием сайта itk.ee. 1. Категории данных и цели обработки (ст. 15(1)(a)-(c)) На основании независимого технического анализа сайта прошу подтвердить и подробно раскрыть следующие категории обработки: 1) На сайте больницы установлена платформа управления согласием Cookiebot (uc.js загружается на +165 мс), но трекеры стартуют до фиксации выбора пользователя. Запись сеанса Hotjar стартует на +178 мс — практически одновременно с самой платформой согласия, — Google Tag Manager и jsDelivr на +166 мс, устаревшая библиотека Universal Analytics на +491 мс, а Google Analytics 4 отправляет page_view на +5693 мс. Запись сеанса относится к категории, требующей явного предварительного согласия; здесь она включается одной из первых, до того как посетитель мог что-либо выбрать. 2) Приложенный документ «Условия защиты данных» описывает обработку данных пациентов при оказании медицинских услуг, найме и участии в мероприятиях, но не содержит раздела о сайте: cookie, веб-аналитика, запись сеанса и передача данных сторонним сервисам в нём не упомянуты. Отдельной политики в отношении cookie у сайта обнаружить не удалось. Таким образом, фактические получатели веб-данных — Hotjar, Google Analytics, Google Tag Manager, Facebook, jsDelivr — не раскрыты нигде. 3) Сайт принадлежит больнице. Даже без авторизации в пациентском портале сам факт визита на страницы медицинского учреждения и разделы конкретных клиник может указывать на состояние здоровья или медицинский интерес посетителя. Запись сеанса Hotjar и аналитика Google, работающие до согласия, фиксируют поведение на таких страницах и передают его сторонним обработчикам, что в контексте здоровья требует особой осторожности и надёжного предварительного согласия. 4) Защитные заголовки почти отсутствуют: строгого транспорта нет, политики безопасности содержимого нет, политики реферера нет, политики разрешений нет; выставлен только запрет вложения в кадр SAMEORIGIN. Сервер отдаётся под Apache / ZoneOS. Для сайта медицинского учреждения, загружающего сторонний код записи сеанса и аналитики, это недостаточный уровень защиты клиентской части. 2. Получатели, сроки хранения и передача за пределы ЕЭЗ (ст. 15(1)(c)-(d), 46) Прошу также указать полный список третьих лиц-получателей, применимые сроки хранения по каждой категории и правовые основания передачи данных за пределы ЕЭЗ, если таковая происходит. Полный технический разбор с доказательствами (сохранённый сетевой журнал, контрольная сумма SHA-256) опубликован по адресу: https://gdpru.eu/en/audits/ee-itk-ee/ 3. Автоматизированная обработка и профилирование (ст. 15(1)(h)) Прошу сообщить, применяется ли в отношении меня автоматизированное принятие решений или профилирование, и если да — раскрыть логику такой обработки. С уважением, [Ваше имя] [контактный email] [Страна] [Дата]
Subject: Data access request (GDPR Art. 15) — itk.ee To: [insert the company's address — DPO / support / legal department] From: [Your name], [contact email] I request access to my personal data processed in connection with the website itk.ee. 1. Categories of data and purposes of processing (Art. 15(1)(a)-(c)) Based on an independent technical analysis of the site, I request confirmation and detailed disclosure of the following categories of processing: 1) The consent-management platform Cookiebot is installed on the hospital site (uc.js loads at +165 ms), but the trackers start before the user's choice is recorded. Hotjar session recording starts at +178 ms — almost simultaneously with the consent platform itself — Google Tag Manager and jsDelivr at +166 ms, the legacy Universal Analytics library at +491 ms, and Google Analytics 4 sends a page_view at +5693 ms. Session recording falls into a category requiring explicit prior consent; here it switches on among the first, before the visitor could choose anything. 2) The attached 'Data protection terms' document describes the processing of patient data in the provision of medical services, hiring and participation in events, but contains no section on the site: cookies, web analytics, session recording and data transmission to third-party services are not mentioned in it. No separate cookie policy for the site could be found. Thus the actual recipients of web data — Hotjar, Google Analytics, Google Tag Manager, Facebook, jsDelivr — are disclosed nowhere. 3) The site belongs to a hospital. Even without logging into the patient portal, the very fact of a visit to a medical institution's pages and specific clinics' sections may indicate the visitor's state of health or medical interest. Hotjar session recording and Google analytics, running before consent, record behaviour on such pages and transmit it to third-party processors, which in a health context requires particular caution and reliable prior consent. 4) The security headers are almost absent: there is no strict transport, no content-security-policy, no referrer policy, no permissions policy; only the frame-embedding ban SAMEORIGIN is set. The server is served under Apache / ZoneOS. For a medical institution's site loading third-party session-recording and analytics code, this is an insufficient level of protection of the client side. 2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46) I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/ee-itk-ee/ 3. Automated processing and profiling (Art. 15(1)(h)) Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved. Sincerely, [Your name] [contact email] [Country] [Date]
Teema: Isikuandmetele juurdepääsu taotlus (IKÜM art 15) — itk.ee Kellele: [märkige ettevõtte aadress — DPO / tugi / juriidiline osakond] Kellelt: [Teie nimi], [kontakt-e-post] Palun anda mulle juurdepääs minu isikuandmetele, mida töödeldakse seoses veebisaidi itk.ee kasutamisega. 1. Andmekategooriad ja töötlemise eesmärgid (IKÜM art 15(1)(a)-(c)) Sõltumatu tehnilise analüüsi põhjal palun kinnitada ja üksikasjalikult avaldada järgmised töötlemiskategooriad: 1) Haigla veebisaidil on nõusoleku haldamise platvorm Cookiebot (uc.js allalaaditud +165 ms-le), kuid jälgimisseadmed käivituvad enne, kui kasutaja valik on fikseeritud. Hotjari seansi salvestamine algab +178 ms-st - peaaegu samaaegselt nõusoleku platvormiga ise - Google Tag Manager ja jsDelivr +166 ms-s, aegunud Universal Analyticsi raamatukogu +491 ms-s ja Google Analytics 4 saadab lehevaate +5693 ms-le. Sessiooni salvestamine kuulub kategooriasse, mis nõuab selgesõnalist eelnevat nõusolekut; siin on see üks esimesi, mis lisatakse enne, kui külastajal on valikuvõimalus. 2) Lisatud andmekaitsetingimuste dokument kirjeldab patsiendiandmete töötlemist meditsiiniteenuste osutamisel, rentimisel ja üritustel osalemisel, kuid ei sisalda saidi kohta jaotist: selles ei mainita küpsiseid, veebianalüütikat, sessiooni salvestamist ega andmete edastamist kolmandate isikute teenustele. Eraldi küpsisepoliitikat veebilehel ei leitud. Seega ei avaldata veebiandmete tegelikke saajaid – Hotjar, Google Analytics, Google Tag Manager, Facebook, jsDelivr – kusagil. 3) Koht kuulub haiglale. Isegi ilma patsiendiportaalis loata võib raviasutuse lehtede ja konkreetsete kliinikute sektsioonide külastamine näidata külastaja tervislikku seisundit või meditsiinilist huvi. Hotjari seansi salvestused ja Google'i analüütikud, kes töötavad enne nõusoleku saamist, salvestavad selliste lehtede käitumise ja edastavad selle kolmanda osapoole töötlejatele, mis nõuab tervise kontekstis erilist hoolt ja usaldusväärset eelnevat nõusolekut. 4) Turvapäised on peaaegu puuduvad: puudub range transport, puudub sisuturbepoliitika, ei ole suunaja poliitikat, ei ole loapoliitikat; pannakse ainult SAMEORIGINi raamile kinnitamise keeld. Server on saadaval Apache/ZoneOS all. Meditsiiniasutuse saidi puhul, mis laadib alla kolmanda osapoole seansi salvestuse ja analüüsikoodi, on see kliendikaitse ebapiisav tase. 2. Vastuvõtjad, säilitustähtajad ja edastamine väljapoole EMP-d (IKÜM art 15(1)(c)-(d), 46) Palun samuti esitada täielik loetelu kolmandatest isikutest vastuvõtjatest, iga kategooria puhul kohaldatavad säilitustähtajad ning andmete EMP-välisele edastamisele kohaldatav õiguslik alus, kui selline edastamine toimub. Täielik tehniline analüüs koos tõenditega (salvestatud võrgulogi, SHA-256 kontrollsumma) on avaldatud aadressil: https://gdpru.eu/en/audits/ee-itk-ee/ 3. Automatiseeritud töötlemine ja profiilianalüüs (IKÜM art 15(1)(h)) Palun teatada, kas minu suhtes kohaldatakse automatiseeritud otsuste tegemist või profiilianalüüsi, ning kui jah, siis avaldada selle loogika. Lugupidamisega, [Teie nimi] [kontakt-e-post] [Riik] [Kuupäev]
RIA DigiDoc — phone · Smart-ID / Mobile-ID
Where to file: Estonian Data Protection Inspectorate (AKI) — write to info@aki.ee
Important: AKI only handles submissions in Estonian. Translate the letter before sending.
The regulator reviews complaints in its national language. There is an officially translated template from the European Data Protection Board (EDPB) — you can use it instead of or alongside this letter: Official EDPB complaint form (PDF, your language)
Тема: Жалоба на обработку персональных данных — itk.ee 1. Предмет жалобы Я подаю жалобу в отношении обработки моих персональных данных сайтом itk.ee. 2. Обстоятельства Я посетил сайт itk.ee и обнаружил признаки несоответствия обработки моих персональных данных требованиям GDPR. Технический разбор, опубликованный на gdpru.eu 14.08.2026 (открытая методология, воспроизводимые измерения), документирует следующие признаки: 1) На сайте больницы установлена платформа управления согласием Cookiebot (uc.js загружается на +165 мс), но трекеры стартуют до фиксации выбора пользователя. Запись сеанса Hotjar стартует на +178 мс — практически одновременно с самой платформой согласия, — Google Tag Manager и jsDelivr на +166 мс, устаревшая библиотека Universal Analytics на +491 мс, а Google Analytics 4 отправляет page_view на +5693 мс. Запись сеанса относится к категории, требующей явного предварительного согласия; здесь она включается одной из первых, до того как посетитель мог что-либо выбрать. 2) Приложенный документ «Условия защиты данных» описывает обработку данных пациентов при оказании медицинских услуг, найме и участии в мероприятиях, но не содержит раздела о сайте: cookie, веб-аналитика, запись сеанса и передача данных сторонним сервисам в нём не упомянуты. Отдельной политики в отношении cookie у сайта обнаружить не удалось. Таким образом, фактические получатели веб-данных — Hotjar, Google Analytics, Google Tag Manager, Facebook, jsDelivr — не раскрыты нигде. 3) Сайт принадлежит больнице. Даже без авторизации в пациентском портале сам факт визита на страницы медицинского учреждения и разделы конкретных клиник может указывать на состояние здоровья или медицинский интерес посетителя. Запись сеанса Hotjar и аналитика Google, работающие до согласия, фиксируют поведение на таких страницах и передают его сторонним обработчикам, что в контексте здоровья требует особой осторожности и надёжного предварительного согласия. 4) Защитные заголовки почти отсутствуют: строгого транспорта нет, политики безопасности содержимого нет, политики реферера нет, политики разрешений нет; выставлен только запрет вложения в кадр SAMEORIGIN. Сервер отдаётся под Apache / ZoneOS. Для сайта медицинского учреждения, загружающего сторонний код записи сеанса и аналитики, это недостаточный уровень защиты клиентской части. Полная техническая документация опубликована по адресу: https://gdpru.eu/en/audits/ee-itk-ee/ 3. Положения GDPR, соблюдение которых прошу проверить ePrivacy — Директива 2002/58/EC, ст. 5(3) (в связке с GDPR Art. 6(1)(a)); GDPR Art. 13, 14 — информирование и раскрытие получателей; GDPR Art. 9 — особые категории данных (контекст здоровья); GDPR Art. 32 — меры безопасности 4. Требование Прошу проверить изложенные обстоятельства и, если несоответствие подтвердится, принять меры, предусмотренные статьёй 58(2) GDPR. 5. Приложения Полная доказательная база — HAR-файл, контрольная сумма SHA-256 и цитата из политики конфиденциальности сайта, документирующая указанное противоречие — опубликована и проверяема по ссылке в пункте 2 выше. С уважением, [Ваше имя] [контактный email] [Страна] [Дата]
Subject: Complaint regarding personal data processing — itk.ee 1. Subject of the complaint I am filing a complaint regarding the processing of my personal data by the website itk.ee. 2. Circumstances I visited the website itk.ee and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 14 August 2026 (open methodology, reproducible measurements) documents the following indications: 1) The consent-management platform Cookiebot is installed on the hospital site (uc.js loads at +165 ms), but the trackers start before the user's choice is recorded. Hotjar session recording starts at +178 ms — almost simultaneously with the consent platform itself — Google Tag Manager and jsDelivr at +166 ms, the legacy Universal Analytics library at +491 ms, and Google Analytics 4 sends a page_view at +5693 ms. Session recording falls into a category requiring explicit prior consent; here it switches on among the first, before the visitor could choose anything. 2) The attached 'Data protection terms' document describes the processing of patient data in the provision of medical services, hiring and participation in events, but contains no section on the site: cookies, web analytics, session recording and data transmission to third-party services are not mentioned in it. No separate cookie policy for the site could be found. Thus the actual recipients of web data — Hotjar, Google Analytics, Google Tag Manager, Facebook, jsDelivr — are disclosed nowhere. 3) The site belongs to a hospital. Even without logging into the patient portal, the very fact of a visit to a medical institution's pages and specific clinics' sections may indicate the visitor's state of health or medical interest. Hotjar session recording and Google analytics, running before consent, record behaviour on such pages and transmit it to third-party processors, which in a health context requires particular caution and reliable prior consent. 4) The security headers are almost absent: there is no strict transport, no content-security-policy, no referrer policy, no permissions policy; only the frame-embedding ban SAMEORIGIN is set. The server is served under Apache / ZoneOS. For a medical institution's site loading third-party session-recording and analytics code, this is an insufficient level of protection of the client side. Full technical documentation is published at: https://gdpru.eu/en/audits/ee-itk-ee/ 3. GDPR provisions I ask you to examine ePrivacy — Directive 2002/58/EC, Art. 5(3) (in conjunction with GDPR Art. 6(1)(a)); GDPR Art. 13, 14 — information and disclosure of recipients; GDPR Art. 9 — special categories of data (health context); GDPR Art. 32 — security measures 4. Request I request that you examine the circumstances described and, if non-compliance is confirmed, apply the measures provided for in Article 58(2) GDPR. 5. Attachments The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above. Sincerely, [Your name] [contact email] [Country] [Date]
1. Kaebuse ese Esitan kaebuse seoses minu isikuandmete töötlemisega veebisaidil itk.ee. 2. Asjaolud Külastasin veebisaiti itk.ee ja tuvastasin märke sellest, et minu isikuandmete töötlemine ei vasta isikuandmete kaitse üldmääruse (IKÜM) nõuetele. Tehniline analüüs, mis on avaldatud aadressil gdpru.eu 14.08.2026 (avatud metoodika, korratavad mõõtmised), dokumenteerib järgmist: 1) Haigla veebisaidil on nõusoleku haldamise platvorm Cookiebot (uc.js allalaaditud +165 ms-le), kuid jälgimisseadmed käivituvad enne, kui kasutaja valik on fikseeritud. Hotjari seansi salvestamine algab +178 ms-st - peaaegu samaaegselt nõusoleku platvormiga ise - Google Tag Manager ja jsDelivr +166 ms-s, aegunud Universal Analyticsi raamatukogu +491 ms-s ja Google Analytics 4 saadab lehevaate +5693 ms-le. Sessiooni salvestamine kuulub kategooriasse, mis nõuab selgesõnalist eelnevat nõusolekut; siin on see üks esimesi, mis lisatakse enne, kui külastajal on valikuvõimalus. 2) Lisatud andmekaitsetingimuste dokument kirjeldab patsiendiandmete töötlemist meditsiiniteenuste osutamisel, rentimisel ja üritustel osalemisel, kuid ei sisalda saidi kohta jaotist: selles ei mainita küpsiseid, veebianalüütikat, sessiooni salvestamist ega andmete edastamist kolmandate isikute teenustele. Eraldi küpsisepoliitikat veebilehel ei leitud. Seega ei avaldata veebiandmete tegelikke saajaid – Hotjar, Google Analytics, Google Tag Manager, Facebook, jsDelivr – kusagil. 3) Koht kuulub haiglale. Isegi ilma patsiendiportaalis loata võib raviasutuse lehtede ja konkreetsete kliinikute sektsioonide külastamine näidata külastaja tervislikku seisundit või meditsiinilist huvi. Hotjari seansi salvestused ja Google'i analüütikud, kes töötavad enne nõusoleku saamist, salvestavad selliste lehtede käitumise ja edastavad selle kolmanda osapoole töötlejatele, mis nõuab tervise kontekstis erilist hoolt ja usaldusväärset eelnevat nõusolekut. 4) Turvapäised on peaaegu puuduvad: puudub range transport, puudub sisuturbepoliitika, ei ole suunaja poliitikat, ei ole loapoliitikat; pannakse ainult SAMEORIGINi raamile kinnitamise keeld. Server on saadaval Apache/ZoneOS all. Meditsiiniasutuse saidi puhul, mis laadib alla kolmanda osapoole seansi salvestuse ja analüüsikoodi, on see kliendikaitse ebapiisav tase. Täielik tehniline dokumentatsioon on avaldatud aadressil: https://gdpru.eu/en/audits/ee-itk-ee/ 3. Sätted, mille järgimist palun kontrollida e-privaatsus – direktiiv 2002/58/EÜ, artikli 5 lõige 3 (koosmõjus GDPRi artikli 6 lõike 1 punktiga a); GDPR artiklid 13, 14 – vastuvõtjate teavitamine ja avalikustamine; GDPR artikkel 9 Andmete eriliigid (tervisekontekst); GDPR artikkel 32 – Turvameetmed 4. Nõue Palun kontrollida kirjeldatud asjaolusid ja mittevastavuse kinnitamisel kohaldada IKÜM artikli 58 lõikes 2 ette nähtud meetmeid. 5. Lisad Täielik tõendusmaterjal — HAR-fail, kontrollsumma SHA-256 ning veebisaidi privaatsuspoliitika tsitaat, mis dokumenteerib nimetatud vastuolu — on avaldatud ja kontrollitav punktis 2 viidatud lingil. Lugupidamisega, [Teie nimi] [kontakt-e-post] [Riik] [Kuupäev]