Privacy policy
Effective from:
This is a translation provided for convenience. In case of any discrepancy, the Polish version prevails.
This document explains what personal data we process in connection with the harasiewicz.pl website (in all language versions) and contact with the clinic, for what purposes, to whom we disclose it and what rights you have. We apply Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation, GDPR) and Polish data protection law.
1. Who is responsible for your data
The controller of your data is the person indicated in the box at the top of this page. In matters concerning personal data, you can write to gabinet@harasiewicz.pl, call 665 876 767 or send a letter to the clinic’s address (ul. ks. Jerzego Popiełuszki 42a/8, 30-898 Kraków). The controller has not designated a data protection officer, as it is not required to do so.
2. What data we process and where we get it from
Browsing the website. The website has no forms, user accounts or analytics tools. To deliver the website and protect it against attacks, our hosting provider (Cloudflare) processes technical data of each request, including the IP address and information sent by the browser (e.g. its type and operating system version). We do not combine this data with other information about you.
Language choice and consents. If you choose a language version using a flag or make a decision in the consent window, your browser will store that choice on your device. This information is not sent to us. Details are set out in the Cookie Policy.
Google map. If you consent to the map being displayed, your browser will connect to Google’s servers, which will receive, among other things, your IP address. Without your consent the map does not load and no data is sent to Google.
Contact by e-mail and telephone. We receive the data you provide yourself, most often your first name and surname, telephone number, e-mail address and the content of your message.
Online booking. The “Book online” buttons lead to the Medfile booking system operated by BioStat sp. z o.o. We, as the clinic, receive the data provided when booking (e.g. first name and surname, telephone number, e-mail address, chosen date and type of appointment) in order to arrange and carry out the appointment.
Please do not send detailed health information or medical records in your messages. It is enough to tell us what you would like to book an appointment for. We will discuss the details at the appointment.
3. Purposes and legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Making the website available, maintaining it and protecting it against attacks | Article 6(1)(f): our legitimate interest, namely the secure and efficient operation of the website |
| Displaying the Google map | Article 6(1)(a): your consent, given in the consent window or using the button on the map |
| Answering general enquiries and conducting correspondence | Article 6(1)(f): our legitimate interest, namely responding to people who contact us |
| Arranging an appointment at your request and preparing for it | Article 6(1)(b): steps taken prior to providing the service, and for health information necessary to organise it Article 9(2)(h), subject to professional secrecy (Article 9(3)) |
| Keeping and storing medical records and settling accounts | Article 6(1)(c) and Article 9(2)(h), in conjunction with the Polish Act on Patient Rights and the Patient Ombudsman (ustawa o prawach pacjenta i Rzeczniku Praw Pacjenta) and tax law |
| Establishment, exercise or defence of legal claims | Article 6(1)(f): protection of our rights, and for health data Article 9(2)(f) |
We do not carry out marketing activities on the website and do not profile visitors for marketing purposes. We do not make decisions about you based solely on automated processing, including profiling, within the meaning of Article 22 GDPR.
You can withdraw your consent to the map being displayed at any time in “Cookie settings” in the website footer. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
4. Do you have to provide data
Browsing the website involves processing technical data without which it cannot be displayed. Providing data when contacting the clinic is voluntary, but without a telephone number or e-mail address we will not be able to reply to your message. Booking an appointment requires the data needed to arrange it, and the provision of a health service requires the data required by the law on medical records.
5. To whom we disclose data
Processors acting on our behalf, under data processing agreements:
- Cloudflare, Inc. - website hosting, content delivery network and protection against attacks;
- the e-mail service provider operating the gabinet@harasiewicz.pl mailbox;
- BioStat sp. z o.o., operator of the Medfile system - for appointment booking and clinic management;
- IT service providers and the accounting firm - where necessary in a given matter.
Separate controllers, who decide on data according to their own rules:
- Google Ireland Limited - when you consent to the map being displayed; we may be jointly responsible with Google for the collection and transmission of data to Google, and further processing takes place in accordance with Google’s privacy policy;
- BioStat sp. z o.o. - with regard to the Medfile service’s own services provided to patients, on the terms described in that service’s documents;
- law firms - where necessary to protect our rights;
- public authorities - where the obligation to disclose data arises from the law.
6. Transfers of data outside the European Economic Area
Cloudflare and Google group companies may process data in the United States. The transfer takes place on the basis of the European Commission’s decision of 10 July 2023 on the adequate level of protection under the EU-US Data Privacy Framework, in which these companies participate, and additionally on the basis of standard contractual clauses approved by the Commission. You can obtain a copy of the standard contractual clauses by contacting us.
7. How long we keep data
- Technical data processed by Cloudflare - for the short time necessary to deliver the website and protect it against attacks, in accordance with the provider’s rules.
- Correspondence on general matters - up to 12 months after the matter is closed.
- Correspondence needed to protect claims - until the limitation period for those claims expires.
- Data related to bookings and treatment - for the periods required by law; as a rule, we keep medical records for 20 years from the end of the calendar year in which the last entry was made (Article 29 of the Polish Act on Patient Rights and the Patient Ombudsman).
- Record of consent and chosen language in the browser - up to 12 months or until the site data is deleted.
After these periods, we delete or anonymise the data.
8. Your rights
Under the conditions set out in the GDPR, you have the right to:
- obtain confirmation as to whether we process your data and receive a copy of it;
- rectify inaccurate data and complete incomplete data;
- request erasure of data or restriction of its processing;
- data portability for data provided to us on the basis of a contract or consent, where we process it by automated means;
- withdraw consent at any time, where processing is based on it.
Right to object. You have the right to object at any time, on grounds relating to your particular situation, to the processing of your data based on our legitimate interest (Article 6(1)(f) GDPR). Once we receive your objection, we will stop processing the data for that purpose, unless we demonstrate compelling legitimate grounds which override your interests or grounds for the establishment, exercise or defence of legal claims.
To exercise your rights, write to gabinet@harasiewicz.pl. We will respond without undue delay, as a rule within one month. In the case of complex or numerous requests, this period may be extended by a further two months, and we will inform you of this. Some rights are limited by law; for example, we will not erase medical records before the end of their mandatory retention period.
If you believe that we process your data unlawfully, you can lodge a complaint with the supervisory authority, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO) (uodo.gov.pl).
9. Security
The website operates exclusively over an encrypted HTTPS connection. We apply technical and organisational measures appropriate to the risk to protect data against loss, unauthorised access and disclosure.
10. Changes to this policy
We update this policy when the law, the way the website works or the providers we use change. The current version is always available at this address, and the date at the top of the page shows when it took effect.