Privacy policy

Data controller

The controller of your personal data is Indywidualna Praktyka Lekarska Katarzyna Zugaj, ul. Antoniego Dobiszewskiego 2, unit 23, 01-405 Warsaw, Poland, NIP 6612065086. For data matters, write to [email protected], call +48 784 234 564 or send a letter to the practice address. We have not appointed a data protection officer — processing of patient data by an individual doctor is not large-scale processing (Recital 91 GDPR).

What data we process

Booking data — name, phone, email, type and time of visit.
Medical records — identifying data (including PESEL and address), information about your health, test results, diagnosis, recommendations, trichoscopy photos, and details of an authorised person if you name one.
Billing data — amount, date and method of payment, invoice details.
Online payment data — if you pay the deposit via Stripe: name, email, amount, card brand and last 4 digits, payment status. The full card number and CVC are processed only by Stripe — we never receive them. We pass no health information to Stripe.
Technical data — IP address and browser information, recorded in the web server's log.

Purposes and legal bases

Providing health services, diagnosis and treatment — Art. 9(2)(h) GDPR together with the Medical Activity Act and the Act on the Professions of Doctor and Dentist.
Keeping, storing and providing medical records — a legal obligation (Art. 6(1)(c) and Art. 9(2)(h) GDPR, the Act on Patient Rights and the Patient Ombudsman).
Booking and confirming visits, including by text message — Art. 6(1)(b) GDPR (steps before providing a service at your request).
Taking the deposit and payments, refunds — Art. 6(1)(b) GDPR.
Tax and accounting — Art. 6(1)(c) GDPR.
Handling complaints and establishing, pursuing or defending claims — Art. 6(1)(f) and Art. 9(2)(f) GDPR.
Website security — Art. 6(1)(f) GDPR.

Providing data for medical records is a statutory requirement — without it we cannot provide a service. We do not make automated decisions or profile you. This website uses no analytics or marketing tools.

Recipients

The e-Health Centre (Centrum e-Zdrowia) — the P1 system when issuing e-prescriptions and e-referrals; the data also appears on your Internet Patient Account.
The Social Insurance Institution (ZUS) — when issuing a sick note (e-ZLA).
The provider of our electronic medical records system — under a data processing agreement.
Stripe — Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland: online payment provider; also as an independent controller for fraud prevention and legal obligations (stripe.com/privacy).
Hosting and email — our website and email hosting provider, acting under a data processing agreement.
Telecoms operator and text message gateway — for calls and appointment confirmations.
Accounting office — billing data only (no health data), under a data processing agreement.
The bank holding the practice's account — for transfers and refunds.
Bodies entitled by law, such as courts, the Patient Ombudsman and the medical self-government (Art. 26 of the Patient Rights Act) — only as the law provides.

We do not sell data or share it for marketing.

Transfers outside the EEA

Medical records are stored in the European Economic Area. Stripe may transfer payment data to the United States — based on its participation in the EU-U.S. Data Privacy Framework (European Commission decision of 10 July 2023) and standard contractual clauses. We will provide a copy of the safeguards on request.

Retention

Medical records, including trichoscopy photos — 20 years from the end of the calendar year of the last entry (Art. 29 of the Patient Rights Act), unless the law provides otherwise.
Booking data, if the visit did not take place — up to 12 months.
Billing and payment data — 5 years from the end of the calendar year in which the tax payment deadline passed.
Data needed to handle complaints and claims — until the claims become time-barred.

Your rights

You have the right to access your data, rectify it, restrict its processing, port it, and object to processing based on our legitimate interests. The right to erasure does not cover medical records during the period in which we are required to keep them (Art. 17(3)(b) and (c) GDPR). Access to medical records is provided as described under patient rights — the first copy is free. Write to [email protected]; we reply within one month.

Security

Only the doctor and people she authorises, who are bound by confidentiality, have access to medical records. Please do not send health information by email or through the website form — ordinary email is not end-to-end encrypted. It is best to bring test results to your visit.

Right to complain

You have the right to lodge a complaint with the President of the Personal Data Protection Office (UODO, ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl) or with the supervisory authority in your country of residence. For browser storage, see the Cookie policy.