- Enforcing jurisdiction
- Estonia · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
Nura OÜ – Complaint Upheld (Estonia, 2025)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
Nura OÜ was warned by the Estonian Data Protection Authority for not providing medical information to two patients who requested it. The patients wanted copies of their treatment results and scans but did not receive them. This case shows that healthcare providers must respond to patient requests for their data.
What happened
Nura OÜ failed to provide two patients with copies of their requested medical data.
Who was affected
Two patients who requested access to their treatment results and scans.
What the authority found
The authority found that Nura OÜ did not comply with the patients' requests and ordered them to provide the information.
Why this matters
This case highlights the obligation of healthcare providers to fulfill patient data requests. It serves as a reminder for all businesses to ensure they are transparent and responsive to customer inquiries.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 19 March 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
Two patients (the data subjects) submitted access requests to Nura OÜ (the controller) on 12 May 2025 and 16 May 2025, respectively, in order to obtain copies of the final results of their treatment and the scans of their retainers. The same month, the data subjects filed complaints to the Estonian DPA (AKI) alleging that the controller did not disclose the medical information they requested. During the proceedings in front of the DPA, the controller claimed that it informed in August 2025 the two data subjects of the fact that it had not received the files from the manufacturer at that time. The DPA found that the controller did not provide the data subjects with the requested copies of medical data. Therefore, the DPA issued a warning to the controller, ordering it to provide the data subjects with a copy of the final results of their treatment and the scans of their retainers. The DPA specified that, if the controller failed to abide with the order, a fine of €2,000 may be imposed until the order was complied with.
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for Nura OÜ in EE
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Nura OÜ - Estonia (2025). Retrieved from cookiefines.eu
Last updated: