Privacy Policy

Privacy notice for TwojeZnamiona.pl patients

This page is an English translation of the Polish-language document.

Personal data

Who is the controller of your personal data?

The controller of your personal data in connection with the healthcare services we provide (including online consultations), CCTV monitoring, the chat service (AI assistant) available on our website and automated telephone support (AI voice assistant) is Medify.me spółka z ograniczoną odpowiedzialnością, with its registered office at ul. Jagiellońska 12, 84-200 Kąpino, Poland, email: kontakt@twojeznamiona.pl.

Who can you contact about the processing of your personal data?

For matters concerning the processing of your personal data, contact us at kontakt@twojeznamiona.pl or write to the Controller at the address given above, marking your correspondence “personal data protection”.

The Controller has appointed Krzysztof Lamparski as Data Protection Officer. You can contact him at krzysztof@lamparski.pro. Please include “GDPR” in your message.

What data do we process?

BOOKING AN APPOINTMENT

To book an in-person examination at one of our centres or to make a booking by telephone, we need your first name and surname. If you book online, using the booking form on the website or the chat, we also need your telephone number and email address. If you contact us by email or through the contact form, we process your email address and/or telephone number. We use these contact details when we need to contact you, for example to reschedule an appointment or offer you an earlier date, including through the waiting list.

REGISTRATION AT THE CENTRE

When you report to reception, we collect identification data required for maintaining medical records. This includes at least: surname and first name(s), date of birth, sex, home address and PESEL number. If you do not have a PESEL number, we collect the type and number of your identity document. If the patient is a minor, is fully legally incapacitated or is unable to give informed consent, we also collect the surname, first name(s) and home address of their legal representative.

EXAMINATION

Depending on the examination planned, we also collect other data required to perform it safely. The data is collected in a questionnaire or by the person carrying out the examination. It may include special categories of personal data concerning your health and personal circumstances, but providing it is necessary to organise the examination correctly. At this stage, we may also receive a referral and medical records needed to carry out the examination. If diagnostic material is collected, we also process personal data connected with that material. We record and describe the results and therefore process information about the healthcare services provided to you and the diagnosis made.

ONLINE CONSULTATION (E-VISIT)

Depending on the type of online consultation planned, we collect other data needed to keep the diagnostic process safe. The data is collected in a questionnaire or by the person conducting the consultation. It may include special categories of personal data concerning your health and personal circumstances, but providing it is necessary to conduct the consultation correctly. We may also receive a referral and medical records needed for the consultation.

To book an online consultation, we ask for your first name, surname, telephone number and email address. We process this data to arrange the consultation. Online consultations are voluntary; however, patients who use them are legally required to provide the personal data needed for the service. Without it, the online consultation cannot take place.

MAINTAINING MEDICAL RECORDS

We are legally required to maintain medical records for the healthcare services we provide. All the information listed above is also processed so that we can meet this obligation.

AUTHORISING ACCESS TO MEDICAL RECORDS

As our patient, you may authorise another person to access your medical records. To grant this authorisation, you must provide the authorised person’s first name and surname and the identifying details requested in the authorisation form. You must also provide that person with information about the processing of their personal data.

BILLING FOR SERVICES

To maintain accounting and tax records, we may process personal data needed to issue a named receipt or invoice. This may include your first name, surname, home address and, where applicable, details of your business activity.

CONTACT

If you use the contact form on our website or contact us in another way, including through social media, we process the personal data you provide to answer your message. The contact form asks for your first name, surname and, at your choice, a telephone number or email address. If you choose email, we process your email address; if you choose telephone contact, we process your telephone number. We also process any personal data included in your enquiry.

WEBSITE CHAT (AI ASSISTANT)

Our website provides a chat service operated by an artificial intelligence assistant. It helps users obtain information about our services and book appointments. To book through the chat, we ask for your first name, surname, telephone number and email address. We also process the content of your conversation, the session identifier and, once you have given consent, your IP address and browser information as evidence of that consent. The chat is intended only for enquiries and appointment bookings. Do not provide your PESEL number or detailed health information because it is not needed at this stage. The conversation is conducted by an AI system rather than an employee, as stated in the chat window.

AUTOMATED TELEPHONE SUPPORT (AI VOICE ASSISTANT)

Calls to our reception service may be handled by an artificial intelligence voice assistant that helps users book, reschedule or cancel appointments. During a call, we process your telephone number, the date, time and duration of the call, the conversation and its text transcription and, if the call is recorded, a recording of your voice. At the beginning of an incoming call, we tell you that the call may be recorded and is handled by an automated assistant. If you do not agree, you may ask to speak to an employee or book through the website. The assistant may also call you back to confirm or remind you about an appointment.

CCTV MONITORING

CCTV records images of people within camera range in reception and waiting areas at our centres. It does not record sound and is not used in bathrooms or consultation rooms.

What is the legal basis for processing your personal data?

We process our patients’ data lawfully on the basis of:

1. the Act of 6 November 2008 on Patients’ Rights and the Patient Ombudsman;
2. the Act of 15 April 2011 on Medical Activity;
3. the Act of 5 December 1996 on the Professions of Physician and Dentist;
4. the Regulation of 6 April 2020 on the types, scope and templates of medical records and the manner in which they are processed;
5. Article 6(1)(c) GDPR: compliance with a legal obligation to which the Controller is subject;
6. Article 9(2)(h) GDPR: processing health data for the provision of healthcare;
7. Article 6(1)(f) GDPR: the Controller’s legitimate interests concerning CCTV and the establishment, exercise or defence of legal claims;
8. the Accounting Act, for invoicing and accounting records;
9. Article 6(1)(b) GDPR: processing necessary for the performance of a contract for healthcare services; and
10. Article 6(1)(a) GDPR: the data subject’s consent, in relation to the telephone number.

For chat and AI voice assistant services, processing is based on Article 6(1)(b) GDPR for steps taken at your request to arrange an appointment and Article 6(1)(a) GDPR for consent to record telephone calls. If you provide health information on your own initiative during a conversation, we process it under Article 9(2)(h) GDPR for the provision of healthcare and protect it under medical confidentiality.

Is your personal data processed automatically?

We use artificial intelligence systems in the website chat and telephone reception service. This means that some personal data is processed automatically to answer questions and arrange visits. We do not, however, make decisions about you based solely on automated processing that produce legal effects or similarly significantly affect you within the meaning of Article 22 GDPR. The AI assistant does not diagnose or provide medical advice. Final decisions concerning appointments and healthcare services are made by our employees and doctors.

Who has access to the personal data we process?

We take care to prevent unauthorised access to your personal data and treat confidentiality as a priority. To provide high-quality healthcare, we use trusted partners to whom data may be disclosed with appropriate security safeguards. These include persons authorised by the Controller, healthcare professionals and organisations working with us, such as dermatologists and diagnostic laboratories, healthcare centres where our consultation rooms are located to the extent necessary, suppliers of medical software and equipment, and providers of legal, advisory, accounting, archiving, IT, online payment and organisational services.

In connection with the chat and AI telephone assistant, data may also be processed by technology providers, including hosting and database providers, telecommunications providers and artificial intelligence providers responsible for speech and text recognition, speech synthesis and response generation. Some of these organisations are based outside the European Economic Area, as described below. We have entered into data processing agreements with them.

Is your data transferred outside the EEA?

As a rule, we process data within the European Economic Area (EEA). Telephone call recordings and speech-to-text conversion take place on servers in the EU. In connection with the chat and AI voice assistant, some data, primarily the conversation content and, for telephone calls, the transcription sent to the AI model and data needed to synthesise the assistant’s voice, may be transferred to AI service providers based in the United States. Such transfers take place only with safeguards required by the GDPR: Standard Contractual Clauses approved by the European Commission under Article 46(2) GDPR or an adequacy decision of the European Commission under the EU-U.S. Data Privacy Framework. Other data, particularly medical records, billing data and CCTV recordings, is not transferred outside the EEA.

How long do we process your personal data?

• Medical records: 20 years from the last entry, or up to 30 years in cases specified by the Act on Patients’ Rights, including certain records concerning children under two and deaths.
• CCTV recordings: 40 days, unless secured as evidence in proceedings.
• Accounting data: 5 years.
• Contact data: until consent is withdrawn or the purpose of the contact ceases.
• Website chat conversations: up to 12 months after the last interaction. If a conversation results in a booking, the data required to fulfil it is processed for the periods applicable to appointment registration and medical records.
• Telephone call recordings: up to 90 days.
• Telephone call transcripts and call metadata: up to 365 days. Data that becomes part of medical records or an appointment booking is kept for the relevant periods stated above.

Do you have to provide your personal data?

Using our services is voluntary. Unless you decide to register for an examination, you do not have to provide personal data. Once you decide to use our services, providing and processing the data is necessary to perform and document the examination professionally and safely and to meet our legal obligations concerning accounting and medical records. Providing a telephone number and email address is voluntary but necessary for bookings made online or through the chat. Without them, we cannot complete the booking or contact you if the appointment needs to be changed. Providing data when contacting us is voluntary, although some data will be required depending on the contact method.

What rights do you have in connection with our processing of your personal data?

You have all rights provided for by the GDPR, including the right to:

1. access your personal data within the limits of Article 15 GDPR;
2. rectify it within the limits of Article 16 GDPR;
3. erase it within the limits of Article 17 GDPR;
4. restrict its processing within the limits of Article 18 GDPR;
5. data portability within the limits of Article 20 GDPR;
6. object to processing within the limits of Article 21 GDPR; and
7. withdraw consent to the processing of your personal data in relation to your telephone number.

If you believe that we process personal data unlawfully, you may lodge a complaint with the Polish supervisory authority, the President of the Personal Data Protection Office (UODO).

To exercise any of these rights, contact kontakt@twojeznamiona.pl. You can also write to us if you have questions about this notice or your rights.

Privacy notice for persons authorised by patients to receive health information and access medical records

Who is the controller of your personal data and where did we obtain it?

The controller is Medify.me spółka z ograniczoną odpowiedzialnością, with its registered office at ul. Jagiellońska 12, 84-200 Kąpino, Poland, email: kontakt@twojeznamiona.pl.

Your data was provided by our patient, who decided to authorise you to receive information about their health and access their medical records.

Who can you contact about the processing of your personal data?

Contact us at kontakt@twojeznamiona.pl or write to the Controller at the address above, marking your correspondence “personal data protection”. You may also contact the Data Protection Officer, Krzysztof Lamparski, at krzysztof@lamparski.pro.

What data do we process?

The authorisation contains your first name and surname and information needed to identify you, namely your PESEL number.

What is the legal basis for processing your personal data?

We process the data lawfully. The data of persons authorised by patients is processed to exercise patients’ rights under Article 6(1)(c) GDPR in conjunction with the Act on Patients’ Rights and the Patient Ombudsman.

Is your personal data processed automatically?

Your data is not processed automatically.

Who has access to the personal data we process?

Data in the authorisation is entered into our systems, which means it is disclosed to the providers of our IT systems.

Is your data transferred outside the EEA?

Your personal data is not transferred outside the European Economic Area, where GDPR rules apply.

How long do we process your personal data?

We do not keep personal data that is no longer needed. Information connected with an authorisation forms part of the medical records and is retained for the periods required by law: generally 20 years from the last entry and, in specified cases, up to 30 years.

What rights do you have in connection with our processing of your personal data?

You have the rights provided for by the GDPR, including the right to:

1. access your personal data within the limits of Article 15 GDPR;
2. rectify it within the limits of Article 16 GDPR;
3. erase it within the limits of Article 17 GDPR;
4. restrict its processing within the limits of Article 18 GDPR;
5. data portability within the limits of Article 20 GDPR; and
6. object to processing within the limits of Article 21 GDPR.

If you believe that we process personal data unlawfully, you may lodge a complaint with the President of the Personal Data Protection Office (UODO). Contact us at kontakt@twojeznamiona.pl to exercise your rights.

Cookie policy

Twoje Znamiona uses the cookies described below on its websites.

Cookies are data files, particularly text files, stored on a website user’s device and read by servers whenever that device connects to the website.

Accepting the cookie policy means consenting to the use of these files. You can change your browser settings concerning cookies at any time.

Twoje Znamiona uses the following types of cookies:

• Facebook cookies used for advertising-related website traffic statistics;
• Google Analytics cookies used for website traffic statistics;
• Appt-now cookies used for online booking;
• YouTube cookies used to play videos and collect viewing statistics; and
• cookies and browser local-storage data connected with the website’s AI chat, required to maintain the conversation session, remember consent and protect against abuse through Cloudflare Turnstile bot protection.

Cookies are widely used by website operators. Twoje Znamiona uses its own cookies and cookies from its partners to display selected website elements, show informational and advertising messages, collect website usage statistics, optimise the website and display its content correctly.

Cookies from partner organisations are used in accordance with those organisations’ own policies.

Users manage cookies through their browser settings. All browsers allow users to control cookies, including disabling them completely. By default, browsers normally allow cookies to be stored on the user’s device.