Privacy Policy

Personal Data Controller

The controller of your personal data is PREMIUM MEDICAL SERVICES SP. Z O.O. with its registered office in Warsaw at ul. Branickiego 10 lok. U6, 02-972 Warsaw, Tax ID: 9512522769, KRS: 0000910980, REGON: 389463419. You can contact the controller via email ginekologia@branickiego10.pl or by phone +48 500 600 509.

Purpose and scope of data processing

We process your personal data for the following purposes:

• Booking and carrying out medical appointments
• Maintaining medical documentation in accordance with applicable law
• Contacting the patient on organizational and medical matters
• Financial and tax settlements
• Statistical analysis and improvement of service quality (with consent)

Legal basis for processing

We process your data based on:

• Necessity for the performance of a contract (Art. 6(1)(b) GDPR) - regarding the performance of scheduled appointments
• Legal obligation (Art. 6(1)(c) GDPR) - regarding the maintenance of medical documentation
• Consent (Art. 6(1)(a) GDPR) - regarding marketing and statistical analyses

Data collected through Meta forms (Facebook, Instagram)

The Controller may collect personal data through contact forms made available on Facebook and Instagram, including Meta lead ads (Lead Ads).

The data processed include in particular first name, last name, phone number, email address and other information voluntarily provided in the form. The Controller does not require health data to be provided in such forms. If a user provides such information on their own initiative, the Controller processes it only to the extent necessary to handle the inquiry and, where required by law, on the basis of the user's explicit consent (Art. 9(2)(a) GDPR).

We process data collected through Meta forms in order to:

• respond to the user's inquiry;
• contact the user by phone or email regarding the submitted inquiry;
• provide information about the service, procedure or consultation the inquiry concerned;
• take steps at the user's request prior to a possible conclusion of a contract or use of a service.

The legal basis for processing is Art. 6(1)(b) GDPR where processing is necessary to take steps at the request of the data subject prior to entering into a contract, and otherwise Art. 6(1)(f) GDPR, i.e. the Controller's legitimate interest in handling inquiries and communicating with persons interested in the Controller's services.

If the data are to be used for other purposes, in particular for sending marketing information not directly related to the original inquiry, the Controller ensures an appropriate legal basis for such processing and, where required by law, obtains the user's separate consent, which may be withdrawn at any time.

In connection with the use of forms provided by Meta, data may also be processed by Meta Platforms Ireland Limited (4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland) or other Meta group entities, under Meta's lead ads terms and Meta's privacy policy (https://www.facebook.com/privacy/policy). Data may be transferred to Meta Platforms, Inc. in the United States on the basis of the European Commission's adequacy decision on the EU-US Data Privacy Framework or standard contractual clauses.

Data collected through contact forms are stored for the period necessary to handle the inquiry and the related correspondence, and then for the period necessary to secure possible claims. If the person decides not to use the service, the data will not be stored longer than justified by the purpose for which they were collected.

Providing data in the form is voluntary, however failure to provide the data necessary for contact may prevent the Controller from responding to the inquiry.

The data subject has the rights described in the "Your rights" section of this Privacy Policy, in particular the right to access, rectify and erase data, restrict processing, object, and lodge a complaint with the President of the Personal Data Protection Office (UODO).

Your rights

In connection with the processing of your personal data, you have the following rights:

• Right to access your data and receive a copy
• Right to rectify (correct) your data
• Right to erasure ("right to be forgotten") - subject to legal obligations
• Right to restrict data processing
• Right to data portability
• Right to object to data processing
• Right to withdraw consent at any time, without affecting the lawfulness of processing carried out before its withdrawal
• Right to lodge a complaint with the President of the Personal Data Protection Office (UODO, ul. Stawki 2, 00-193 Warsaw)

Cookies

This website uses cookies and similar technologies (e.g. browser local storage and measurement scripts). Necessary cookies are always used; all others only after you give consent in the cookie banner, in accordance with Art. 399 of the Polish Electronic Communications Law and the GDPR.

Consent is managed with Cookiebot, provided by Usercentrics A/S (Denmark). You can consent to selected categories and change or withdraw your consent at any time. Withdrawing consent does not affect the lawfulness of processing carried out before its withdrawal.

Google may transfer data to the United States. The transfer is based on the European Commission's adequacy decision on the EU-US Data Privacy Framework, under which Google LLC is certified, or on standard contractual clauses. Details: https://policies.google.com/privacy.

Retention depends on the type of cookie: session cookies are deleted when you close the browser, persistent cookies are stored for the period stated in the detailed list below (e.g. consent record up to 12 months, Google Analytics cookies up to 2 years).

Data retention period

Your personal data will be stored for the period necessary to achieve the purposes for which they were collected, in accordance with applicable law. Medical documentation is stored for 20 years from the end of the calendar year in which the last entry was made.

Data recipients

Your data may be shared with entities authorized by law (e.g., NFZ, ZUS, supervisory authorities) and IT service providers supporting the clinic's operations, with whom we have concluded data processing agreements.

Data security

We apply appropriate technical and organizational measures ensuring the protection of processed data appropriate to the threats and categories of data covered by protection, in particular we secure data against disclosure to unauthorized persons, loss or damage.