RODO

PERSONAL DATA PROCESSING AND PROTECTION NOTICE

You can contact Centrum‘s Data Protection Officer by email at iodo@klinikabocian.pl

The processing of personal data is carried out pursuant to the Polish Act of 10 May 2018 on the Protection of Personal Data, as well as Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter referred to as the “GDPR”). In particular, all statutory safeguards required for the protection of personal data are duly ensured. The Data Controller, appointed in line with statutory requirements, applies technical and organisational measures appropriate to the risks involved and to the categories of personal data being processed. In particular, the Controller ensures that personal data are safeguarded against unauthorised access, against unauthorised acquisition, against unlawful processing and against alteration, loss, damage or destruction. The Data Controller is especially responsible for keeping records describing the methods by which data are processed. Only individuals who have been granted express authorisation by the Controller are permitted to process data within Centrum.

In order for health services to be delivered by Centrum and accessed by patients, it is necessary that the patient provide their personal data in registration forms, consent statements, agreements and in other documents connected, whether directly or indirectly, with the services provided by Centrum. Personal data will be verified and processed on the basis of an identity document bearing a photograph. Such activities may be undertaken only by staff members of Centrum who have been duly authorised, in accordance with the applicable legal regulations. Patients are required to provide the categories of personal data specified under healthcare legislation in connection with the medical services provided by Centrum. Any additional data may be given at the patient’s discretion. Where the patient refuses to provide their personal data required by the legal regulations, Centrum will be unable to provide any medical services.

Purposes of collecting and processing personal data:

• conducting healthcare activities as defined in the Polish Act of 15 April 2011 on Medical Activity, in particular by providing health services, implementing preventive measures, delivering other medical services, entering into and performing agreements, carrying out laboratory medicine operations or providing any other medical services necessary for the treatment process, as well as managing the delivery of healthcare;
• carrying out recruitment processes and participating in clinical trials and other scientific research projects;
• participating in public health programmes;
• fulfilling the legal obligations imposed on Centrum as data controller, including those arising under, inter alia, the Polish Act of 25 June 2015 on Infertility Treatment; the Polish Act of 15 April 2011 on Medical Activity; the Polish Act of 6 November 2008 on Patients’ Rights and the Ombudsman for Patients’ Rights; the Polish Act of 5 December 1996 on the Profession of Physician and Dentist; and the Polish Act of 15 September 2022 on Laboratory Medicine; such obligations include, in particular, keeping and storing medical records, reporting infectious diseases and providing information regarding a patient’s health status, diagnosis, proposed and possible diagnostic or therapeutic methods, the foreseeable consequences of applying or failing to apply them, the outcomes of treatment and prognosis;
• conducting marketing activities concerning the services, products, events and special offers provided by Centrum;
• pursuing Centrum’s legitimate interests, such as asserting or defending claims arising from its business activity, in particular in connection with submitted complaints or grievances;
• fulfilling tax obligations;
• complying with duties arising from the social insurance system;
• enabling patients to use applications that contain medical data;
• maintaining video surveillance systems for the purpose of safeguarding people and property;
• recording telephone calls as a supporting tool in the provision of healthcare services.

Retention and storage of personal data:

• for the timeframe required by law, in particular under the Polish Act of 6 November 2008 on Patients’ Rights and the Ombudsman for Patients’ Rights (Article 29) and the Polish Act of 25 June 2015 on Infertility Treatment, especially with regard to medical records;
• for as long as healthcare services and any related services are being provided;
• for the period necessary to safeguard Centrum’s legitimate interests, such as asserting or defending claims arising from its business activity, in particular in connection with submitted complaints or grievances;
• for as long as Centrum may be held legally accountable for failure to perform obligations under applicable law;
• for the term of agreements concluded by Centrum with you, and subsequently until the limitation period for any claims under such agreements has expired (for example, agreements concerning the storage of reproductive cells and embryos); in the event that Centrum pursues claims or notifies the competent authorities – for the duration of the relevant proceedings.

Patients’ personal data may be shared with the following entities:

• other healthcare providers with which Centrum has concluded agreements for the provision of services or medical procedures not directly carried out by Centrum;
• entities engaged by Centrum under data processing agreements, such as legal or IT service providers;
• the Ministry of Health in situations prescribed by law, in particular under the Polish Act of 25 June 2015 on Infertility Treatment, for example, in connection with the donation of reproductive cells other than partner donation, embryo donation, significant adverse events or reactions or inspections carried out at Centrum;
• the Social Insurance Institution (ZUS), in cases provided for by law;
• institutions that provide financing for healthcare out of public funds, such as the National Health Fund, the Ministry of Health and other state or local government bodies in relation to public health programmes;
• state and local government authorities, judicial bodies or other entities, where required by applicable law or pursuant to the patient’s authorisation;
• persons authorised by the patient and their legal representatives;
• postal, courier or transport operators;
• banks and payment institutions, for the purpose of verifying the correct execution of payments, handling complaints, making refunds, pursuing or defending claims, and for the purpose of preparing statistics and analyses.

Centrum may obtain your personal data from public registers, for example, the EWUŚ database or the Social Insurance Institution (ZUS), where necessary to verify or determine information essential for the proper delivery of healthcare services.

If your personal data are processed by Centrum in breach of the law, you have the right to lodge a complaint with the President of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warsaw.

Patient rights with respect to personal data processing:

• rectification (correction) of your personal data;
• erasure of your personal data processed without a legal basis;
• restriction of processing (suspension of operations on your data or preservation of your data without further use, as requested);
• access to your personal data (including information about the data held by Centrum and a copy of that data);
• transfer of your data to another data controller or directly to you (to the extent provided for in Article 20 of the GDPR).

Requests concerning the above rights, signed either by hand or electronically, may be submitted in writing by email at kontakt@klinikabocian.pl

Requests may also be lodged in person at any medical facility operated by Centrum. The scope of these rights, and the circumstances in which they may be exercised, are determined by law. Personal data may be transferred to a third country only at the request of the individual whose data are expected to be processed.

Specific obligations of the Data Controller under the Polish Act of 25 June 2015 on Infertility Treatment

The Polish Act of 25 June 2015 on Infertility Treatment, together with regulations issued by the Minister of Health pursuant to that Act, imposes a number of duties on medically assisted procreation centres as well as on reproductive cell and embryo banks in connection with the performance of medically assisted procreation procedures. Before making use of services provided by Centrum, it is necessary to provide the following personal details: full name, PESEL number (or, where no PESEL has been assigned, the series and number of an identity document together with the country of issue), date of birth, place of residence/address for service and sex. In order to undergo any medically assisted procreation procedure, patients must also provide phenotypic data, including height, weight, eye colour, hair colour, hair type, body build, race and ethnic origin.

During the course of medical services, Centrum will obtain further information concerning your health, such as medical history, laboratory and clinical test results, details of prior treatment and other sensitive data necessary for issuing a medical opinion that directly determines eligibility for further medically assisted reproduction procedures.

At Centrum, responsibility for processing personal data rests solely with persons whose professional duties involve providing medical care, delivering other medical services or overseeing the organisation of such services, and who have been authorised by the Controller.