GDPR

INFORMATION ON THE PROCESSING OF PATIENTS' PERSONAL DATA

In accordance with Article 13 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR), we provide the following information on the processing of patients' personal data at Centrum Medyczne Tartaczna 2.

1. Personal Data Controller

The controller of your personal data is Centrum Medyczne Tartaczna 2 spółka z ograniczoną odpowiedzialnością spółka komandytowa, with its registered office at ul. Tartaczna 2/1A, 80-839 Gdańsk, Poland, REGON 386604641, KRS 0000851660, hereinafter referred to as the "Controller" or the "Medical Centre".

Contact details of the Controller:

• telephone: +48 58 719 10 25;
• email: kontakt@tartaczna2.pl;
• for matters concerning the protection of personal data: iod@tartaczna2.pl.

2. Purposes and Legal Bases for Processing Personal Data

Your personal data, including health-related data, are processed for the following purposes:

a) Provision of healthcare services, in particular preventive healthcare, diagnosis, treatment and continuity of healthcare – pursuant to Article 6(1)(b) or (c) GDPR, as appropriate to the nature of the processing, in conjunction with Article 9(2)(h) GDPR and the applicable provisions governing healthcare activities.

b) Creation, maintenance, storage and disclosure of medical records, compliance with obligations relating to the documentation of healthcare services provided, and the exercise of patients' rights – pursuant to Article 6(1)(c) in conjunction with Article 9(2)(h) GDPR, Articles 24–29 of the Polish Act on Patients' Rights and the Patient Rights Ombudsman, and other applicable legislation.

c) Patient registration and appointment management, including appointment confirmations, reminders and notifications of changes or cancellations – pursuant to Article 6(1)(b) GDPR and, where applicable, Article 6(1)(f) GDPR, namely the Controller's legitimate interest in ensuring the efficient organisation of healthcare services.

d) Settlement and billing of healthcare services, issuing accounting documents and fulfilling tax and accounting obligations – pursuant to Article 6(1)(b) or (c) GDPR, depending on the purpose of processing.

e) Establishment, exercise or defence of legal claims relating to the Medical Centre's activities – pursuant to Article 6(1)(f) GDPR and, where processing of special categories of personal data is necessary, also Article 9(2)(f) GDPR.

Health-related data constitute a special category of personal data within the meaning of Article 9(1) GDPR and are subject to particular protection.

3. Categories of Personal Data Processed

The Controller processes personal data to the extent necessary to fulfil the above purposes, including in particular:

• identification data, including first name, surname, PESEL identification number, date of birth and address;
• contact details, including telephone number and email address;
• information relating to appointments and visits attended;
• health data and information on diagnosis and treatment;
• results of laboratory, imaging, genetic and other diagnostic tests;
• information contained in medical records;
• data necessary for billing and settlement of healthcare services.

4. Recipients of Personal Data

Your personal data may be disclosed to entities authorised under applicable law, in particular other healthcare providers, where necessary to ensure continuity of diagnosis and treatment, in accordance with Article 26 of the Polish Act on Patients' Rights and the Patient Rights Ombudsman.

In connection with the provision of healthcare services, personal data and biological samples may be transferred to cooperating diagnostic, pathology and genetic laboratories, including entities performing specialised prenatal tests.

Personal data may also be accessed by entities providing services to the Controller in relation to electronic medical records, appointment booking, patient communications, IT support, hosting, accounting, legal services and technical support.

Such entities may act as independent data controllers or as processors acting on behalf of the Controller under appropriate data processing agreements, where required.

Personal data may also be disclosed to authorised public authorities and institutions in cases provided for by law.

5. Transfers of Personal Data Outside the European Economic Area

In connection with the Medical Centre's use of IT services and external diagnostic laboratories, certain personal data may be transferred outside the European Economic Area (EEA).

Documentation provided by IT service providers indicates that data processing may involve entities operating in the United States of America.

For certain specialised genetic and prenatal tests, documentation provided by the testing entities allows for the possibility of transferring specified test-related data and pseudonymised biological samples to a laboratory in Hong Kong.

The scope of such transfers depends on the type of service provided and the data processing arrangements of the relevant service provider.

Information concerning the legal bases for transfers of personal data outside the EEA, the applicable safeguards, and how to obtain copies of those safeguards or information on where they are made available can be requested from the Controller at iod@tartaczna2.pl.

6. Retention Periods

Medical records are generally retained for 20 years from the end of the calendar year in which the last entry was made, subject to the exceptions set out in Article 29 of the Polish Act on Patients' Rights and the Patient Rights Ombudsman and other applicable legislation.

Personal data processed in connection with tax and accounting obligations are retained for the period required by applicable law.

Data processed for the establishment, exercise or defence of legal claims are retained for as long as necessary for those purposes, taking into account applicable limitation periods and statutory medical record retention requirements.

Contact details used for appointment management are processed for the period justified by the provision of healthcare services and applicable legal obligations.

7. Requirement to Provide Personal Data

Providing personal data required by law, in particular data necessary to identify the patient and maintain medical records, is mandatory.

Failure to provide data necessary for the proper provision of healthcare services may prevent certain medical or administrative activities from being performed, without prejudice to situations in which the law requires medical assistance to be provided.

Providing a telephone number and email address for organisational communications is voluntary. Failure to provide them may prevent appointment reminders and notifications of schedule changes from being sent through these channels.

8. Rights of Data Subjects

In the cases and to the extent provided for by the GDPR, you have the following rights:

• the right to access your personal data and obtain a copy;
• the right to rectify inaccurate personal data;
• the right to request erasure of personal data;
• the right to request restriction of processing;
• the right to data portability;
• the right to object to processing where it is based on Article 6(1)(f) GDPR.

The exercise of certain rights may be restricted under applicable law, in particular legal provisions governing the maintenance and retention of medical records.

Requests concerning the exercise of these rights may be submitted to the Controller, in particular by email to iod@tartaczna2.pl.

9. Right to Lodge a Complaint

If you believe that the processing of your personal data infringes the GDPR, you have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), the Polish supervisory authority.

Information about the supervisory authority is available at www.uodo.gov.pl.

10. Automated Decision-Making and Profiling

The Controller does not make decisions concerning patients based solely on automated processing of personal data, including profiling, which would produce legal effects concerning them or similarly significantly affect them within the meaning of Article 22 GDPR.

11. Communication with Patients

The Medical Centre may contact patients by telephone, SMS or email regarding organisational matters related to the provision of healthcare services, in particular to confirm appointments, send reminders, or notify patients of changes or cancellations.

Such communication is not marketing in nature.

The Medical Centre does not use patients' contact details to send commercial information, promotional offers or other marketing communications.