RODO

Information about processing personal data of Patients at Luxdentica Dental Center.

Who is the data controller?

The data controller of your personal data is NZOZ Centrum Stomatologii LUXDENTICA Dariusz Wilisowski, with its registered office at Lubostroń 22g/7, 30-383 Kraków and Luxdentica Sp. z o.o. with its registered office at Lipska 4/9 i 10, 30-721 Kraków.

Who can you contact with questions related to data processing?

You can contact the data protection officer by writing to the following address: biuro@personal-data.pl

What is the scope of processed personal data?

We require the following set of your data: first name, last name, PESEL number, gender, and date of birth (for individuals without a PESEL number), residential address, relationship status (for individuals referred by a family member). We may also collect your email address and phone number, but these data are not essential for experiencing medical services.

During the course of receiving healthcare, we create your medical records, in which we record all information regarding the treatment process, particularly information about your health condition. We collect this information if it is necessary for diagnosis and proper management of the treatment process.

What is the purpose and legal basis for processing personal data?

1. Establishing the patient's identity before providing services, verifying data when scheduling remote or on-site appointments: at the reception or in the medical office.

Article 6(1)(c) and Article 9(2)(h) of the GDPR in conjunction with Article 25(1) of the Patient Rights Act and Section 10(1)(2) of the Ministry of Health Regulation of November 9, 2015, on the types, scope, and templates of medical documentation and its processing method.

2. Maintaining and storing medical records.

Article 9(2)(h) of the GDPR in conjunction with Article 24(1) of the Patient Rights Act and the Ministry of Health Regulation of November 9, 2015.

3. Receiving and storing declarations authorizing other individuals to access medical documentation and provide them with information about the patient's health condition.

Article 6(1)(c) of the GDPR in conjunction with Article 9(3) and Article 26(1) of the Patient Rights Act and Section 8(1) of the Ministry of Health Regulation of November 9, 2015.

4. Contacting the patient via the provided phone number or email address to confirm reservations, cancel consultation appointments, inform about necessary preparations for scheduled procedures or examinations.

Article 6(1)(b) and (f) of the GDPR.

5. Maintaining accounting records, issuing invoices or bills, and fulfilling tax obligations.

Article 6(1)(c) of the GDPR in conjunction with Article 74(2) of the Accounting Act of September 29, 1994.

6. Pursuing claims related to conducted business activities.

Article 6(1)(b) and (f) of the GDPR, as a legitimate interest of the data controller, which is the pursuit of our claims.

7. For scientific research purposes.

Article 6(1)(a) and Article 9(2)(a) of the GDPR.

8. For marketing purposes.

Article 6(1)(a) of the GDPR.

Failure to provide your consent will prevent us from providing you with medical services.

What are the consequences of not providing personal data?

Using our services is entirely voluntary, but as a healthcare provider, we are obliged by law to maintain medical documentation. In such cases, failure to provide data may result in the refusal to reserve an appointment or provide healthcare services. We also have a legal obligation to process your data due to accounting requirements. Not providing data may result in the inability to issue an invoice or itemized bill.

If you provide us with your phone number or email address, it is on a voluntary basis – not providing them will not result in the refusal of healthcare services, but you won't receive confirmation of your appointment from us or have the ability to cancel it through means such as SMS.

How long will the data be processed?

If you are our patient and we have created your medical documentation, we keep the medical documentation for a period of 20 years, counting from the end of the calendar year, with exceptions:

• in the case of a patient's death due to injury or poisoning - 30 years;

• X-ray images stored separately from the patient's medical documentation - 10 years;

• referrals for tests or orders - 5 years or 2 years (in cases where healthcare services were not provided due to the patient not showing up within the specified timeframe, unless the patient received the referral);

• medical documentation related to children until the completion of the 2nd year of life, which is kept for a period of 22 years.

If data was processed by us for the purpose of pursuing claims related to our business activities, we process the data for this purpose for the limitation period of claims as specified in the civil code regulations.

All data processed for accounting and tax purposes is processed for 5 years from the end of the calendar year in which the tax obligation arose. After the expiry of the aforementioned periods, your data is deleted or anonymized.

To whom can personal data be disclosed?

• other medical entities, prosthetic laboratories, and laboratories cooperating to ensure the continuity of treatment and availability of healthcare;

• suppliers of technical and organizational solutions enabling the provision of healthcare services and management;

• providers of teleinformatics, IT services, software, diagnostic, and dental equipment;

• courier and postal service companies;

• legal and advisory service providers and support for pursuing rightful claims;

• individuals authorized as part of patient rights enforcement.

When using external software or medical equipment services, your personal data may be transferred outside the European Economic Area. Such transfers may only occur based on an agreement or another legal instrument that contains standard data protection clauses adopted by the European Commission.

What rights do you have?

You have the right to withdraw your consent at any time without affecting the lawfulness of processing based on consent before its withdrawal. You have the right to access your personal data, obtain copies of processed data, rectify, erase, or restrict processing. You have the right to object to the processing of personal data for marketing purposes, as well as the right to lodge a complaint with the President of the Data Protection Office. Data will not be used for automated decision-making or profiling.