Data Controller Information

OŚRODEK MEDYCZNY “OSTEOMED” S.C. MIROSŁAW SZLACHCIC, EWA SZLACHCIC, UL. KAZIMIERZA WIELKIEGO 57/IV, 30-074 KRAKÓW, Tax Identification Number (NIP): 6771706534, Business Registry Number (REGON): 350805497, is the controller of personal data.

Data Protection Officer

The Data Protection Officer is: Maciej Gibiński, PhD in Law, Attorney-at-Law. Telephone: 883-925-879. Email: IOD@cdpm.pl. The Data Protection Officer meets with data subjects by prior appointment.

Purpose of Data Processing

Personal data is processed for the following purposes:

Provision of healthcare services (referrals, prescriptions)
Exercise of patient rights and storage of medical records
Creation of individual medical documentation
Conducting statistical research
Reporting information to the State Sanitary and Epidemiological Inspectorate
Issuing VAT invoices
Telephone contact regarding appointments (with consent)
Performance of tasks arising from the Act on the Healthcare Information System
Conducting promotional activities (on the basis of legitimate interest)

Recipients of Personal Data

Data may be disclosed to the following entities:

Medical personnel providing healthcare services
Authorized employees of the controller
The patient’s representatives
Other entities providing healthcare services
Public authorities (Patient Rights Ombudsman, National Health Fund (NFZ), self-governing bodies of medical professions)
National and regional medical consultants
Supervisory and auditing bodies
Courts, public prosecutor’s offices, forensic physicians
Social insurance authorities and adjudicating panels
Entities maintaining registries of medical services
Insurance companies (with the patient’s consent)
Medical commissions
Regional commissions for medical incidents
Heirs
Accounting office
Medical software provider
IT specialist
e-Health Center (Centrum e-Zdrowia)

Data is not transferred to third countries.

Data Retention Period

Data contained in individual medical records

2 years from the end of the calendar year – unused referrals
5 years from the end of the calendar year – referrals and orders
10 years from the end of the calendar year – X-ray images
20 years from the last entry – all other documentation
22 years – documentation of children up to 2 years of age
30 years from the end of the year of death – death resulting from bodily injury or poisoning
30 years from the last entry – blood and blood component monitoring records

Other retention periods

Collective documentation – 20 years from the last entry
Register of disclosed documentation – 20 years
VAT invoices – 5 years
Register of complaints and requests – 5 years

Data Processed by the Controller

Mandatory data

First and last name
National identification number (PESEL)
Date of birth
Address of residence
Email address (if electronic documentation is requested)
First and last name of the legal representative
Identity document series and number
Telephone number
Number of the entitlement document confirming the right to healthcare services

Voluntary data

Telephone number
Email address

Failure to provide voluntary data will make it impossible to receive medical documentation in electronic form.

Rights of the Data Subject

The data subject is entitled to the following rights:

Right of access to data
Right to rectification of data
Right to erasure of data (to the extent permitted by law)
Right to restriction of processing (to the extent permitted by law)
Right to object to processing
Right to data portability (to the extent permitted by law)
Right to withdraw consent to processing
Right to lodge a complaint with the supervisory authority

Processing of Data Through Profiling

Data may be processed through profiling for the purpose of obtaining information about health status, establishing a diagnosis, and preparing a treatment plan. The patient will be informed by medical personnel before such processing begins.

Privacy policy