Privacy Policy

Data Controller

The controller of your personal data is:

Types of data processed

The clinic may process the following data:

• Name and surname
• PESEL number or other identifier
• Contact data (phone, email)
• Health data (to the extent necessary for maintaining medical documentation)
• Contact form data: name and surname, email address, phone number, message content
• Technical data: IP address, browser type, operating system, website visit time
• Cookies: session identifiers, language preferences, cookie consents

Purposes and legal basis for data processing

Personal data is processed for the purpose of:

• Providing physiotherapy services (based on Art. 6(1)(b) GDPR)
• Maintaining medical documentation (according to Art. 9(2)(h) GDPR and the Physiotherapist Profession Act)
• Patient contact, including appointment confirmation
• Marketing own services (based on consent)

Providing data is voluntary but necessary to use the clinic's services.

Purposes of data processing

We process personal data for the following purposes:

• Responding to inquiries sent through the contact form
• Scheduling appointments and treatment-related contact
• Website traffic analysis for optimization purposes
• Conducting marketing activities (with consent)
• Fulfilling legal obligations related to conducting medical activity

Data retention period

Personal data will be stored for the period:

• Required by law for medical documentation – at least 20 years from the date of the last entry (according to the Patient Rights and Patient Rights Ombudsman Act)
• Until consent is withdrawn (if processing is based on consent)
• Contact form data: until the inquiry is fulfilled or consent is withdrawn
• Analytics data: maximum 26 months

Data recipients

Data may be disclosed to entities supporting the administrator in service provision:

• Hosting company
• Appointment booking software providers
• Entities authorized by law (e.g., NFZ, ZUS)
• Analytics tool providers (Google Analytics, in anonymized form)
• Email service providers (for communication)

Rights of the data subject

Each patient has the right to:

• Access to data
• Rectification, restriction of processing or deletion (within the limits of the law)
• Lodge an objection
• Data portability
• Lodge a complaint with the President of UODO

To exercise the above rights, please contact: fizjomental@gmail.com

Data security

We implement appropriate technical and organizational measures to ensure the security of processed personal data, including protection against unauthorized access, loss, destruction, or damage.

Changes to the Privacy Policy

We reserve the right to make changes to this Privacy Policy. We will inform about any changes by publishing an updated version on our website.

Contact

For questions regarding personal data protection, please contact: