Privacy policy

1. Who controls your data

The data controller is Centrum Rehabilitacji „Pomoc" Kateryna Melnyk, a sole trader registered at ul. Pańska 96 / lokal 207A, 00-837 Warszawa, tax number (NIP) 5273054463, statistical number (REGON) 525178770 — referred to below as “the Clinic” or “we”.

For anything concerning personal data, contact us at kontakt@crpomoc.pl, by telephone on +48 573 323 068, or by post to the address above.

We have not appointed a Data Protection Officer. All data protection matters are handled through the contact details above.

2. What data we collect, and where it comes from

We collect only the data we need in order to book and deliver an appointment and to keep the records the law requires us to keep.

• Contact form on the website: first name, telephone number, optionally an email address and — if you choose to fill it in — a description of your complaint. That description is health data, a special category of personal data. The field is optional.
• Appointment booking: the service, specialist and time you selected, together with the contact details given in the booking form.
• Patient account: your telephone number and a one-time SMS code confirming the number is yours. Alternatively an email address with a password, or signing in with a Google account — in which case Google passes us your email address, first name and account identifier.
• Appointments and records: dates, services delivered, payments, your physiotherapist's notes, and files you exchange with your physiotherapist.
• History from the previous system: patient and appointment records previously kept in the Altegio booking system were migrated into our own system so that the documentation remains continuous.
• Technical data: the IP address of the device you use for our forms and sign-in. We never store the IP address in readable form — only an irreversible cryptographic digest of it, used to count attempts and detect abuse.

3. Purposes and legal bases

The legal bases come from the GDPR (Regulation 2016/679) and from Polish medical law.

• Calling you back and arranging an appointment — Art. 6(1)(b) GDPR, steps taken at your request before entering into a contract.
• The description of your complaint submitted through the form before you become our patient — Art. 9(2)(a) GDPR, your explicit consent given by ticking the box under the form. You may withdraw that consent at any time; withdrawal does not affect the lawfulness of processing carried out beforehand.
• Providing health services and keeping and storing medical records — Art. 6(1)(c) and Art. 9(2)(h) GDPR in conjunction with the Polish Act on medical activity (ustawa o działalności leczniczej) and the Act on patients' rights (ustawa o prawach pacjenta i Rzeczniku Praw Pacjenta). The data is processed by people bound by professional secrecy.
• Running your patient account — Art. 6(1)(b) GDPR.
• Settlements, invoices and accounting — Art. 6(1)(c) GDPR in conjunction with tax legislation and the Accounting Act.
• System security: limiting sign-in attempts and SMS code sends, and keeping an administrative event log — Art. 6(1)(f) GDPR, our legitimate interest in protecting patient data against unauthorised access.
• Establishing, exercising and defending legal claims — Art. 6(1)(f) GDPR.
• We do not market to patients migrated from the previous system and we send them no marketing messages. A reminder about a booked appointment is not marketing — it is part of the service you asked for.

4. Is providing your data mandatory

Providing your data is voluntary, but without a name and a telephone number we cannot call you back or book an appointment. The description of your complaint is entirely optional — you may leave only your name and number and tell us the rest by phone or at the appointment.

Once you become our patient, some data must be collected under the rules on medical records; there we have no discretion.

5. How long we keep data

• Medical records — 20 years, counted from the end of the calendar year in which the last entry was made (Art. 29(1) of the Act on patients' rights).
• Exceptions under the same provision: 30 years where the patient died as a result of bodily injury or poisoning, 22 years for the records of children up to the age of 2, 10 years for X-ray images stored outside the records, and 5 years for referrals and doctors' orders.
• Contact form enquiries that did not lead to an appointment — until reception closes the enquiry. You may ask us to delete such an enquiry at any time and we remove it from the system.
• Settlement data — 5 years from the end of the tax year in which the tax obligation arose.
• One-time sign-in codes — 10 minutes, after which they expire; a code can be used only once.
• A signed-in session — expires after a short period of inactivity and when the browser is closed. You can end it yourself by signing out.
• Security event records and the log of staff access to records — for as long as needed to demonstrate that processing was lawful and to establish or defend legal claims.

6. Who we share data with

We do not sell data and we pass it to no one for marketing purposes. Data reaches only those parties we need in order to run the clinic, and only to the extent required.

• Vercel Inc. — the hosting provider for this website.
• Altegio — the booking system in which reception keeps the current appointment diary.
• Google Ireland Limited — only once you click the map yourself and go through to Google Maps. The map on our page is an image from our own server and passes Google nothing on its own.
• Google Ireland Limited — if you choose to sign in with a Google account.
• SMSAPI (ComVision sp. z o.o.) — the operator delivering one-time codes and SMS reminders. It receives only the telephone number and the message text.
• People and companies maintaining our IT systems — under data processing agreements.
• Bodies and authorities entitled under the law, where they make a request grounded in a legal provision.
• No other patient and no outside party has access to your data. Within the system a physiotherapist sees only their own diary and their own patients; only reception and management see everything.

7. Transfers outside the European Economic Area

Some of our suppliers are US companies or their European subsidiaries whose infrastructure may sit outside the EEA. In those cases the transfer relies on standard contractual clauses approved by the European Commission or on an adequacy decision (the EU–US Data Privacy Framework).

Medical records kept by the Clinic are not disclosed outside the EEA for any purpose other than those stated above.

8. Cookies and browser storage

We use only what is strictly necessary for the site to work, within the meaning of Art. 399 of the Polish Electronic Communications Law. We run no web analytics, embed no advertising pixels and do not profile visitors — which is why you see no cookie consent banner.

The location map on the contact page is an ordinary image served from our own server — we fetched it once and saved it. Browsing our site does not connect you to Google's servers. Only clicking the map opens Google Maps in a new tab, and that is your decision.

• A session cookie for signed-in users — keeps you signed in; it disappears when the browser closes or when you sign out.
• A language cookie — remembers whether you are reading the site in Polish, Ukrainian or English.
• A browser local-storage entry holding your light or dark theme choice — it stays on your device and is never sent to us.
• Typefaces are served from our own server, not from a third party.

9. Your rights

In relation to your data you have the following rights:

• the right of access and to receive a copy of your data, including a copy of your medical records,
• the right to have inaccurate or incomplete data corrected,
• the right to erasure,
• the right to restriction of processing,
• the right to portability of data processed on the basis of consent or a contract,
• the right to object to processing based on our legitimate interest,
• the right to withdraw consent at any time, without affecting the lawfulness of processing carried out beforehand.

Two of those rights have statutory limits and we would rather say so plainly: while the statutory retention period for medical records is running we cannot erase them, nor stop processing them in response to an objection, even if you ask us to. We can, however, delete data that is not part of the records — a contact form enquiry, for instance, or your patient account.

To exercise any of these rights, write to kontakt@crpomoc.pl or call +48 573 323 068.

10. Complaint to the supervisory authority

If you believe we process your data unlawfully, you may lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa. We would be grateful for the chance to resolve the matter with you directly first.

11. Automated decisions and profiling

We take no decisions about you based solely on automated processing, including profiling. Your appointment time, your specialist and the course of your therapy are decided by a person.

12. How we protect data

• Passwords are stored only as digests designed to resist cracking; no member of staff knows your password.
• Access to records follows the role: a physiotherapist sees only their own patients, and reception has no access to clinical notes.
• Every staff access to patient data is written to an event log.
• Database backups are encrypted.
• IP addresses are stored only as an irreversible digest, and health information never reaches system logs or page addresses.

13. Changes to this policy

We update this policy when the way our systems work changes, or when the law does. The date of the last update appears at the top of this page.