Privacy Policy

Privacy notice for TwojeZnamiona.pl patients

This page is an English translation of the Polish-language document.

Personal data

Who is the controller of your personal data?

The controller of your personal data in connection with the healthcare services we provide (including online consultations), CCTV monitoring, the chat service (AI assistant) available on our website and automated telephone support (AI voice assistant) is Medify.me spółka z ograniczoną odpowiedzialnością, with its registered office at ul. Jagiellońska 12, 84-200 Kąpino, Poland, email: kontakt@twojeznamiona.pl.

Who can you contact about the processing of your personal data?

For matters concerning the processing of your personal data, contact us at kontakt@twojeznamiona.pl or write to the Controller at the address given above, marking your correspondence “personal data protection”.

The Controller has appointed Krzysztof Lamparski as Data Protection Officer. You can contact him at krzysztof@lamparski.pro. Please include “GDPR” in your message.

What data do we process?

BOOKING AN APPOINTMENT

To book an in-person examination at one of our centres or to make a booking by telephone, we need your first name and surname. If you book online, using the booking form on the website or the chat, we also need your telephone number and email address. If you contact us by email, we process your email address and/or telephone number. We use these contact details when we need to contact you, for example to reschedule an appointment or offer you an earlier date, including through the waiting list.

CONTACT AFTER YOUR VISIT

After your visit, we may contact you by SMS, email or telephone about the healthcare service provided: to pass on recommendations and information about your test results, and to remind you about a visit or follow-up examination at the interval recommended by your doctor. These messages do not contain offers or advertising. If you have not given us marketing consent, an email sent in connection with your visit may include a short note on how to give it (described below). You can opt out of follow-up examination reminders at any time by contacting our reception.

COMMERCIAL INFORMATION (MARKETING CONSENT)

We send discount codes and information about new services by email and SMS only to people who have given separate, voluntary consent. You can give it by ticking the optional box in the online booking form or, if you have not given it before (for example when booking by telephone), by clicking the button in an email sent in connection with your visit. We do not send separate messages asking for consent. Not giving consent does not affect your ability to book or the course of your visit.

On the basis of this consent, we process your name, email address and telephone number and, as proof of consent, the date, method and wording of the consent you gave. We do not use information about your health or your medical records to prepare commercial information.

You can withdraw consent at any time by contacting our reception or writing to kontakt@twojeznamiona.pl. Withdrawal does not affect the lawfulness of processing carried out before it.

REGISTRATION AT THE CENTRE

When you report to reception, we collect identification data required for maintaining medical records. This includes at least: surname and first name(s), date of birth, sex, home address and PESEL number. If you do not have a PESEL number, we collect the type and number of your identity document. If the patient is a minor, is fully legally incapacitated or is unable to give informed consent, we also collect the surname, first name(s) and home address of their legal representative.

EXAMINATION

Depending on the examination planned, we also collect other data required to perform it safely. The data is collected in a questionnaire or by the person carrying out the examination. It may include special categories of personal data concerning your health and personal circumstances, but providing it is necessary to organise the examination correctly. At this stage, we may also receive a referral and medical records needed to carry out the examination. If diagnostic material is collected, we also process personal data connected with that material. We record and describe the results and therefore process information about the healthcare services provided to you and the diagnosis made.

ONLINE CONSULTATION (E-VISIT)

Depending on the type of online consultation planned, we collect other data needed to keep the diagnostic process safe. The data is collected in a questionnaire or by the person conducting the consultation. It may include special categories of personal data concerning your health and personal circumstances, but providing it is necessary to conduct the consultation correctly. We may also receive a referral and medical records needed for the consultation.

To book an online consultation, we ask for your first name, surname, telephone number and email address. We process this data to arrange the consultation. Online consultations are voluntary; however, patients who use them are legally required to provide the personal data needed for the service. Without it, the online consultation cannot take place.

MAINTAINING MEDICAL RECORDS

We are legally required to maintain medical records for the healthcare services we provide. All the information listed above is also processed so that we can meet this obligation.

AUTHORISING ACCESS TO MEDICAL RECORDS

As our patient, you may authorise another person to access your medical records. To grant this authorisation, you must provide the authorised person’s first name and surname and the identifying details requested in the authorisation form. You must also provide that person with information about the processing of their personal data. The information to provide to the authorised person is available at: https://twojeznamiona.pl/en/osoby-upowaznione/

BILLING FOR SERVICES

To maintain accounting and tax records, we may process personal data needed to issue a named receipt or invoice. This may include your first name, surname, home address and, where applicable, details of your business activity.

CONTACT

If you contact us, for example by email, telephone or social media, we process the personal data you provide to answer your message. If you choose email, we process your email address; if you choose telephone contact, we process your telephone number. We also process any personal data included in your enquiry.

WEBSITE CHAT (AI ASSISTANT)

Our website provides a chat service operated by an artificial intelligence assistant. It helps users obtain information about our services and book appointments. To book through the chat, we ask for your first name, surname, telephone number and email address. We also process the content of your conversation, the session identifier and, once you have given consent, your IP address and browser information as evidence of that consent. The chat is intended only for enquiries and appointment bookings. Do not provide your PESEL number or detailed health information because it is not needed at this stage. The conversation is conducted by an AI system rather than an employee, as stated in the chat window.

AUTOMATED TELEPHONE SUPPORT (AI VOICE ASSISTANT)

Calls to our reception service may be handled by an artificial intelligence voice assistant that helps users book, reschedule or cancel appointments. During a call, we process your telephone number, the date, time and duration of the call, the conversation and its text transcription and, if the call is recorded, a recording of your voice. At the beginning of an incoming call, we tell you that the call may be recorded and is handled by an automated assistant. If you do not agree, you may ask to speak to an employee or book through the website. We may also call you, through an employee or the voice assistant, to confirm a booked appointment or remind you about it.

CCTV MONITORING

CCTV records images of people within camera range in reception and waiting areas at our centres. It does not record sound and is not used in bathrooms or consultation rooms.

What is the legal basis for processing your personal data?

We process our patients’ data lawfully on the basis of:

1. the Act of 6 November 2008 on Patients’ Rights and the Patient Ombudsman;
2. the Act of 15 April 2011 on Medical Activity;
3. the Act of 5 December 1996 on the Professions of Physician and Dentist;
4. the Regulation of 6 April 2020 on the types, scope and templates of medical records and the manner in which they are processed;
5. Article 6(1)(c) GDPR: compliance with a legal obligation to which the Controller is subject;
6. Article 9(2)(h) GDPR: processing health data for the provision of healthcare;
7. Article 6(1)(f) GDPR: the Controller’s legitimate interests concerning CCTV and the establishment, exercise or defence of legal claims;
8. the Accounting Act, for invoicing and accounting records;
9. Article 6(1)(b) GDPR: processing necessary for the performance of a contract for healthcare services; and
10. Article 6(1)(a) GDPR: the data subject’s consent, in relation to recording telephone calls, cookies that require consent and sending commercial information.

We process your telephone number and email address to book appointments and to contact you about the healthcare service provided, including contact after your visit, under Article 6(1)(b) GDPR (the contract for healthcare services) and, where the contact concerns your health and continuity of care, under Article 9(2)(h) GDPR (the provision of healthcare).

We send commercial information on the basis of your consent under Article 6(1)(a) GDPR and the Polish Electronic Communications Law of 12 July 2024, which requires prior consent to direct marketing by email and SMS.

For chat and AI voice assistant services, processing is based on Article 6(1)(b) GDPR for steps taken at your request to arrange an appointment and Article 6(1)(a) GDPR for consent to record telephone calls. If you provide health information on your own initiative during a conversation, we process it under Article 9(2)(h) GDPR for the provision of healthcare and protect it under medical confidentiality.

Is your personal data processed automatically?

We use artificial intelligence systems in the website chat and telephone reception service. This means that some personal data is processed automatically to answer questions and arrange visits. We do not, however, make decisions about you based solely on automated processing that produce legal effects or similarly significantly affect you within the meaning of Article 22 GDPR. The AI assistant does not diagnose or provide medical advice. Final decisions concerning appointments and healthcare services are made by our employees and doctors.

Who has access to the personal data we process?

We take care to prevent unauthorised access to your personal data and treat confidentiality as a priority. To provide high-quality healthcare, we use trusted partners to whom data may be disclosed with appropriate security safeguards. These include persons authorised by the Controller, healthcare professionals and organisations working with us, such as dermatologists and diagnostic laboratories, healthcare centres where our consultation rooms are located to the extent necessary, suppliers of medical software and equipment, and providers of legal, advisory, accounting, archiving, IT, online payment and organisational services.

In connection with the chat and AI telephone assistant, data may also be processed by technology providers, including hosting and database providers, telecommunications providers and artificial intelligence providers responsible for speech and text recognition, speech synthesis and response generation. Some of these organisations are based outside the European Economic Area, as described below. We have entered into data processing agreements with them.

Is your data transferred outside the EEA?

As a rule, we process data within the European Economic Area (EEA). Telephone call recordings and speech-to-text conversion take place on servers in the EU. In connection with the chat and AI voice assistant, some data, primarily the conversation content and, for telephone calls, the transcription sent to the AI model and data needed to synthesise the assistant’s voice, may be transferred to AI service providers based in the United States. Such transfers take place only with safeguards required by the GDPR: Standard Contractual Clauses approved by the European Commission under Article 46(2) GDPR or an adequacy decision of the European Commission under the EU-U.S. Data Privacy Framework. If you consent to analytics cookies, data about your use of the website collected by Google Analytics 4 (Google Ireland Limited) and Microsoft Clarity (Microsoft Ireland Operations Limited) may be transferred to affiliates of these providers in the United States under the European Commission’s adequacy decision (EU-U.S. Data Privacy Framework) or Standard Contractual Clauses. Other data, particularly medical records, billing data and CCTV recordings, is not transferred outside the EEA.

How long do we process your personal data?

• Medical records: 20 years from the last entry, or up to 30 years in cases specified by the Act on Patients’ Rights, including certain records concerning children under two and deaths.
• CCTV recordings: 40 days, unless secured as evidence in proceedings.
• Accounting data: 5 years.
• Contact data (telephone number, email address): until the purpose of the contact ceases, including the end of follow-up care recommended by your doctor. Contact data entered in medical records is kept for the retention period of those records.
• Data processed on the basis of marketing consent: until consent is withdrawn. Records of giving and withdrawing consent are kept afterwards for as long as related claims may be brought against us.
• Website chat conversations: up to 12 months after the last interaction. If a conversation results in a booking, the data required to fulfil it is processed for the periods applicable to appointment registration and medical records.
• Telephone call recordings: up to 90 days.
• Microsoft Clarity session recordings: 30 days from recording; recordings we flag or that are selected for a random sample: up to 9 months.
• Telephone call transcripts and call metadata: up to 365 days. Data that becomes part of medical records or an appointment booking is kept for the relevant periods stated above.

Do you have to provide your personal data?

Using our services is voluntary. Unless you decide to register for an examination, you do not have to provide personal data. Once you decide to use our services, providing and processing the data is necessary to perform and document the examination professionally and safely and to meet our legal obligations concerning accounting and medical records. Providing a telephone number and email address is voluntary but necessary for bookings made online or through the chat. Without them, we cannot complete the booking or contact you if the appointment needs to be changed. Providing data when contacting us is voluntary, although some data will be required depending on the contact method.

What rights do you have in connection with our processing of your personal data?

You have all rights provided for by the GDPR, including the right to:

1. access your personal data within the limits of Article 15 GDPR;
2. rectify it within the limits of Article 16 GDPR;
3. erase it within the limits of Article 17 GDPR;
4. restrict its processing within the limits of Article 18 GDPR;
5. data portability within the limits of Article 20 GDPR;
6. object to processing within the limits of Article 21 GDPR; and
7. withdraw consent where we process data on that basis (recording telephone calls, cookies that require consent, commercial information); withdrawal does not affect the lawfulness of processing carried out before it.

If you believe that we process personal data unlawfully, you may lodge a complaint with the Polish supervisory authority, the President of the Personal Data Protection Office (UODO).

To exercise any of these rights, contact kontakt@twojeznamiona.pl. You can also write to us if you have questions about this notice or your rights.

Privacy notice for persons authorised by patients to receive health information and access medical records

Information on the processing of personal data of persons authorised by patients to receive health information and access medical records is available at: https://twojeznamiona.pl/en/osoby-upowaznione/

Cookie policy

Twoje Znamiona uses the cookies described below on its websites.

Cookies are data files, particularly text files, stored on a website user’s device and read by servers whenever that device connects to the website.

Accepting the cookie policy means consenting to the use of these files. You can change your browser settings concerning cookies at any time.

Twoje Znamiona uses the following types of cookies:

• Facebook cookies used for advertising-related website traffic statistics;
• Google Analytics cookies used for website traffic statistics;
• Microsoft Clarity cookies (https://clarity.microsoft.com/, Microsoft Ireland Operations Limited) used for session recordings and heatmaps showing how you use the website (cursor movements, clicks and scrolling); text shown on the page and typed into forms is masked in recordings. Used only after you consent to analytics cookies;
• Appt-now cookies used for online booking;
• YouTube cookies used to play videos and collect viewing statistics; and
• cookies and browser local-storage data connected with the website’s AI chat, required to maintain the conversation session, remember consent and protect against abuse through Cloudflare Turnstile bot protection.

Cookies are widely used by website operators. Twoje Znamiona uses its own cookies and cookies from its partners to display selected website elements, show informational and advertising messages, collect website usage statistics, optimise the website and display its content correctly.

Cookies from partner organisations are used in accordance with those organisations’ own policies.

Users manage cookies through their browser settings. All browsers allow users to control cookies, including disabling them completely. By default, browsers normally allow cookies to be stored on the user’s device.