Privacy notice on the processing of personal data of persons authorised by a patient
This page is an English translation of the Polish-language document.
Who is the controller of your personal data?
The controller of the personal data provided in the authorisation to access health information and medical records granted by a patient is MEDIFY.ME spółka z ograniczoną odpowiedzialnością, ul. Jagiellońska 12, 84-200 Kąpino, Poland, email: kontakt@twojeznamiona.pl.
Who can you contact about the processing of personal data?
The Data Protection Officer is Krzysztof Lamparski (email: krzysztof@lamparski.pro).
Where did we obtain your data?
The data comes from the person (patient) who authorised you to access medical information.
What data do we process?
The authorisation contains your first name and surname and details that allow you to be uniquely identified: your PESEL number, the series and number of an identity document, or your date of birth (one of these is sufficient).
For what purpose and on what basis do we process your data?
Your personal data will be included in the medical records of the patient who authorised you to access medical information and processed in connection with carrying out that authorisation, on the basis of Article 6(1)(c) GDPR in conjunction with Article 26 of the Act on Patients’ Rights and the Patient Ombudsman.
Who has access to your data?
Your personal data will be available to management staff and patient service employees. It may also be disclosed to entities that provide us with courier services, legal support, IT services, hosting and electronic medical records services, and to other trusted entities.
How long do we keep your data?
Your personal data will be kept for 20 years from the date of the last healthcare service provided to the patient. This results from the Controller’s obligation to retain medical records.
What rights do you have?
You have the right to request access to your data within the limits of Article 15 GDPR, its rectification within the limits of Article 16 GDPR, its erasure within the limits of Article 17 GDPR, restriction of its processing within the limits of Article 18 GDPR and data portability within the limits of Article 20 GDPR, and the right to object to the processing of your personal data within the limits of Article 21 GDPR. If you wish to exercise any of these rights, please contact us at kontakt@twojeznamiona.pl or contact the Data Protection Officer at krzysztof@lamparski.pro.
Right to lodge a complaint
If you believe that we process your personal data in breach of the law, you have the right to lodge a complaint with the supervisory authority, the President of the Personal Data Protection Office (UODO).
Last updated: 05.11.2026