On 25 May 2018, a new EU regulation came into force, the purpose of which is to modernise and harmonise the regulations on the protection of personal data applicable across the EU, namely the “GDPR”. Below, we present information on the processing of personal data and the related patient rights.
Your personal data controller is BEAUTYdoc Praktyka Lekarska
Barbara Parda-Głomska, with its registered office in Piaseczno at ul. Gruszek i Jabłuszek 7, 05-502 Wólka Kozodawska,
NIP: 7391279121, REGON: 510686416.
You may contact the data controller by email at: kontakt@drparda.com.pl, by telephone at +48 517 535 878, or in writing to the controller’s registered office address.
As a rule, your personal data is provided directly by you at the time of registration: in person, via the e-registration system, or via the helpline.
In the case of continued treatment initiated elsewhere, the data may also be received from other medical facilities.
In specific situations justified by your state of health, your personal data may be obtained from persons close to you.
For the purpose of scheduling appointments, your personal data is processed, including your first name, surname, sex, PESEL number or date of birth (if no PESEL number has been assigned), telephone number, and email address. The above data is also used to verify your identity before the provision of a service.
As a medical entity, the data controller is obliged to maintain and store medical records, the content and scope of which are specified by applicable law. The data contained in the records includes, among other things, a description of the course of treatment and diagnostic procedures.
If you have consented to marketing communication, your email address or telephone number, as well as your first name and surname, will also be used.
The processing of your personal data is necessary for the purposes of providing healthcare services (diagnostics, prevention, therapy) and managing healthcare services (e.g. settlements with the payer, maintaining and storing medical records, verifying identity before an appointment).
Legal basis:
Article 9(2)(h) GDPR in conjunction with the provisions governing the provision of healthcare services, in particular the provisions of the Act of 15 April 2011 on Medical Activity, the Act of 6 November 2008 on Patient Rights and the Patient Rights Ombudsman, the Act of 27 August 2004 on Healthcare Services Financed from Public Funds, and the Act on the Professions of Doctor and Dentist.
Your data may also be processed for the purposes of maintaining accounting records and tax settlements.
Legal basis:
Article 6(1)(c) GDPR in conjunction with the provisions of the Act of 29 September 1994 on Accounting and the Act of 11 March 2004 on Goods and Services Tax.
The data may also be processed for the purpose of defending rights and pursuing claims by the data controller in connection with its business activity.
Legal basis:
Article 6(1)(b) and (f) GDPR and, in the case of special category data, Article 9(2)(f) GDPR.
If you have consented to marketing communication, your data may be used for marketing purposes in relation to products and services offered by the controller.
The legal basis for processing this data is your consent, in accordance with Article 6(1)(a) GDPR.
Your data will be stored for the period specified by law, and in particular for the period resulting from Article 29 of the Act of 6 November 2008 on Patient Rights and the Patient Rights Ombudsman. Medical records are, as a rule, stored for at least 20 years from the end of the calendar year in which the last entry was made. After the statutory retention period for medical records expires, they will be destroyed in a manner preventing identification of the patient concerned, or released to you or to a person authorised by you.
Data used for the settlement of healthcare services, as well as data used for the pursuit of claims, will be processed for the limitation period of such claims in accordance with the provisions of the Civil Code.
Data processed for accounting and tax settlement purposes is processed for 5 years from the end of the calendar year in which the tax obligation arose.
If you have consented to communication for marketing purposes, the data will be processed until you withdraw your consent to the processing of personal data for those purposes.
Your data may be disclosed to entities authorised under the law, in particular in accordance with Article 26 of the Act of 6 November 2008 on Patient Rights and the Patient Rights Ombudsman, including, among others, entities providing healthcare services in order to ensure continuity of healthcare services, as well as public authorities, including the Patient Rights Ombudsman, the National Health Fund, self-government bodies of medical professions, and national and provincial consultants, to the extent necessary for these entities to perform their tasks, in particular supervision and control. Your data may also be transferred to entities processing personal data on behalf of the controller, including IT service providers and other processors, whereby such entities process the data on the basis of an agreement with the controller and solely in accordance with the controller’s instructions. In addition, if you have consented to communication for marketing purposes, your data may be transferred to entities processing personal data on behalf of the controller, including IT service providers or marketing agencies, as well as other processors, whereby such entities process the data on the basis of an agreement with the controller and solely in accordance with the controller’s instructions.
You have the right to:
You also have the right to lodge a complaint with the supervisory authority responsible for personal data protection.
In order to exercise the above rights, please contact the data controller or the data protection officer. The contact details are provided above.
You have the right to:
You also have the right to lodge a complaint with the supervisory authority responsible for personal data protection.
In order to exercise the above rights, please contact the data controller or the data protection officer. The contact details are provided above.
Providing personal data is a necessary condition for the provision of healthcare services due to the legal requirements imposed on the data controller, including, among others, the obligation to maintain medical records. Refusal to provide data may constitute grounds for refusing to provide a healthcare service. Providing data is also necessary for the issuance of a bill or invoice.
Providing personal data for marketing purposes is entirely voluntary, and failure to consent to marketing communication cannot constitute grounds for refusing to provide a healthcare service.
Your personal data will not be used for automated decision-making.