Privacy policy

1. Who controls your data

The data controller is Centrum Rehabilitacji „Pomoc” Kateryna Melnyk, a sole trader registered at ul. Pańska 96 / lokal 207A, 00-837 Warszawa, tax number (NIP) 5273054463, statistical number (REGON) 525178770 — referred to below as “the Centre” or “we”.

For anything concerning personal data, contact us at kontakt@crpomoc.pl, by telephone on +48 573 323 068, or by post to the address above.

We have not appointed a Data Protection Officer. All data protection matters are handled through the contact details above.

2. What data we collect, and where it comes from

We collect only the data we need in order to book and deliver an appointment and to keep the records the law requires us to keep.

• Contact form on the website: first name, telephone number, optionally an email address and — if you choose to fill it in — a description of your complaint. That description is health data, a special category of personal data. The field is optional.
• Appointment booking: the service, specialist and time you selected, together with the contact details given in the booking form.
• Patient account: your telephone number and a one-time SMS code confirming the number is yours. Alternatively an email address with a password, or signing in with a Google account — in which case Google passes us your email address, first name and account identifier.
• Appointments and records: dates, services delivered, payments, your physiotherapist's notes, and files you exchange with your physiotherapist.
• History from the previous system: patient and appointment records previously kept in the Altegio booking system were migrated into our own system so that the documentation remains continuous.
• Technical data: the IP address of the device you use for our forms and sign-in. We never store the IP address in readable form — only an irreversible cryptographic digest of it, used to count attempts and detect abuse.

3. Purposes and legal bases

The legal bases come from the GDPR (Regulation 2016/679) and from Polish medical law.

• Calling you back and arranging an appointment — Art. 6(1)(b) GDPR, steps taken at your request before entering into a contract.
• The description of your complaint submitted through the form before you become our patient — Art. 9(2)(a) GDPR, your explicit consent given by ticking the box under the form. You may withdraw that consent at any time; withdrawal does not affect the lawfulness of processing carried out beforehand.
• Providing health services and keeping and storing medical records — Art. 6(1)(c) and Art. 9(2)(h) GDPR in conjunction with the Polish Act on medical activity (ustawa o działalności leczniczej) and the Act on patients' rights (ustawa o prawach pacjenta i Rzeczniku Praw Pacjenta). The data is processed by people bound by professional secrecy.
• Running your patient account — Art. 6(1)(b) GDPR.
• Settlements, invoices and accounting — Art. 6(1)(c) GDPR in conjunction with tax legislation and the Accounting Act.
• System security: limiting sign-in attempts and SMS code sends, and keeping an administrative event log — Art. 6(1)(f) GDPR, our legitimate interest in protecting patient data against unauthorised access.
• Establishing, exercising and defending legal claims — Art. 6(1)(f) GDPR.
• We do not market to patients migrated from the previous system and we send them no marketing messages. A reminder about a booked appointment is not marketing — it is part of the service you asked for.

4. Is providing your data mandatory

Providing your data is voluntary, but without a name and a telephone number we cannot call you back or book an appointment. The description of your complaint is entirely optional — you may leave only your name and number and tell us the rest by phone or at the appointment.

Once you become our patient, some data must be collected under the rules on medical records; there we have no discretion.

5. How long we keep data

• Medical records — 20 years, counted from the end of the calendar year in which the last entry was made (Art. 29(1) of the Act on patients' rights).
• Exceptions under the same provision: 30 years where the patient died as a result of bodily injury or poisoning, 22 years for the records of children up to the age of 2, 10 years for X-ray images stored outside the records, and 5 years for referrals and doctors' orders.
• Contact form enquiries that did not lead to an appointment — until reception closes the enquiry. You may ask us to delete such an enquiry at any time and we remove it from the system.
• Settlement data — 5 years from the end of the tax year in which the tax obligation arose.
• One-time sign-in codes — 10 minutes, after which they expire; a code can be used only once.
• A signed-in session — expires after a short period of inactivity and when the browser is closed. You can end it yourself by signing out.
• Security event records and the log of staff access to records — for as long as needed to demonstrate that processing was lawful and to establish or defend legal claims.

6. Who we share data with

We do not sell data and we pass it to no one for marketing purposes. Data reaches only those parties we need in order to run the Centre, and only to the extent required.

• Vercel Inc. — the hosting provider for this website.
• Supabase, Inc. — the database provider that holds the patient cards and the medical records. The servers stand in Paris (AWS, region eu-west-3), inside the EEA. A data processing agreement is in place.
• Altegio — the booking system in which reception keeps the current appointment diary. The “Book a consultation” button on our site leads to Altegio's own booking page: what you enter there goes straight to them, and from that point their own privacy policy applies as well.
• Google Ireland Limited — only once you click the map yourself and go through to Google Maps. The map on our page is an image from our own server and passes Google nothing on its own.
• Google Ireland Limited — if you choose to sign in with a Google account.
• SMSAPI (ComVision sp. z o.o.) — the operator delivering one-time codes and SMS reminders. It receives only the telephone number and the message text.
• Resend — the outbound email provider. It receives the contents of an enquiry sent through the form on our site — first name, telephone number, email address and the description you write yourself — solely in order to deliver it to our own mailbox. We do not send messages to patients through it.
• Telegram — the messenger through which our physiotherapists and reception receive two kinds of work notification. An appointment notification carries the date, the time and the duration, the name of the procedure, the room, the patient's first name and surname, a short preparation note for the specialist (“first visit”, “speaks Ukrainian”) and a link to the patient's card in our own system; it carries no telephone number, no description of symptoms and no content from the medical records. A notification about an enquiry sent from the form on our website carries the first name, the telephone number and the chosen language, and the fact that you described a complaint — never the text of that description. Every notification reaches only those members of staff we have named for it.
• People and companies maintaining our IT systems — under data processing agreements.
• Bodies and authorities entitled under the law, where they make a request grounded in a legal provision.
• No other patient and no outside party has access to your data. Within the system a physiotherapist sees only their own diary and their own patients; only reception and management see everything.

7. Transfers outside the European Economic Area

Some of our suppliers are US companies or their European subsidiaries whose infrastructure may sit outside the EEA. In those cases the transfer relies on standard contractual clauses approved by the European Commission or on an adequacy decision (the EU–US Data Privacy Framework).

The work notifications our physiotherapists and reception receive in the Telegram messenger reach an operator seated in the United Arab Emirates. The European Commission has issued no adequacy decision for that country. We therefore keep those messages to the minimum that lets a member of staff do the task, and we delete them from the messenger after 24 hours. In an appointment notification that is the date, the time, the duration, the name of the procedure, the room, the first name and surname, and a link to the card in our own system. In an enquiry notification it is the first name, the telephone number and the chosen language: without the number reception has no way to call you back, and being called back is the only reason you sent the enquiry. We pass no email address, no PESEL, no content from the medical records and no description of symptoms typed into the form by that route. Notifications addressed to patients go by SMS only, through an operator based in Poland — no message addressed to you reaches Telegram.

A copy of those notifications stays in our own system so reception can check that a message arrived. We keep it for 90 days, after which it is deleted automatically.

The medical records the Centre keeps rest on servers in Paris, inside the EEA. The provider of that database is, however, an American company — Supabase, Inc. — whose staff may reach it while handling a technical support request. That transfer runs on the European Commission's standard contractual clauses (decision 2021/914), incorporated into the data processing agreement. Beyond that we do not share the medical records outside the EEA.

8. Cookies and browser storage

We use only what is strictly necessary for the site to work, within the meaning of Art. 399 of the Polish Electronic Communications Law. We run no web analytics, embed no advertising pixels and do not profile visitors — which is why you see no cookie consent banner.

The location map on the contact page is an ordinary image served from our own server — we fetched it once and saved it. Browsing our site does not connect you to Google's servers. Only clicking the map opens Google Maps in a new tab, and that is your decision.

• A session cookie for signed-in users — keeps you signed in; it disappears when the browser closes or when you sign out.
• A language cookie — remembers whether you are reading the site in Polish, Ukrainian or English.
• A browser local-storage entry holding your light or dark theme choice — it stays on your device and is never sent to us.
• Typefaces are served from our own server, not from a third party.

9. Your rights

In relation to your data you have the following rights:

• the right of access and to receive a copy of your data, including a copy of your medical records,
• the right to have inaccurate or incomplete data corrected,
• the right to erasure,
• the right to restriction of processing,
• the right to portability of data processed on the basis of consent or a contract,
• the right to object to processing based on our legitimate interest,
• the right to withdraw consent at any time, without affecting the lawfulness of processing carried out beforehand.

Two of those rights have statutory limits and we would rather say so plainly: while the statutory retention period for medical records is running we cannot erase them, nor stop processing them in response to an objection, even if you ask us to. We can, however, delete data that is not part of the records — a contact form enquiry, for instance, or your patient account.

To exercise any of these rights, write to kontakt@crpomoc.pl or call +48 573 323 068.

10. Complaint to the supervisory authority

If you believe we process your data unlawfully, you may lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa. We would be grateful for the chance to resolve the matter with you directly first.

11. Automated decisions and profiling

We take no decisions about you based solely on automated processing, including profiling. Your appointment time, your specialist and the course of your therapy are decided by a person.

12. How we protect data

• Passwords are stored only as digests designed to resist cracking; no member of staff knows your password.
• Access to records follows the role: a physiotherapist sees only their own patients, and reception cannot create or change clinical notes.
• Every staff access to patient data is written to an event log.
• Database backups are encrypted.
• IP addresses are stored only as an irreversible digest, and health information never reaches system logs or page addresses.

13. Changes to this policy

We update this policy when the way our systems work changes, or when the law does. The date of the last update appears at the top of this page.