Privacy Policy

1. Personal Data Controller

The controller of your personal data is Dr Katarzyna Hanus-Durlej, conducting business under the name Gynecology Practice Dr Katarzyna Hanus-Durlej based in Warsaw, Poland.

For matters related to personal data processing, you can contact us through the contact form on the website.

2. Purposes and Legal Basis for Processing

Your personal data is processed for the following purposes:

• Provision of medical services — based on Art. 6(1)(b) GDPR (performance of contract) and Art. 9(2)(h) GDPR (healthcare purposes)
• Maintaining medical records — based on Art. 6(1)(c) GDPR (legal obligation) in accordance with Polish Patient Rights Act
• Appointment booking — based on Art. 6(1)(b) GDPR (steps taken at your request prior to entering into a contract)
• Responding to inquiries — based on Art. 6(1)(f) GDPR (legitimate interest of the controller)
• Accounting and tax purposes — based on Art. 6(1)(c) GDPR (legal obligation)

3. Categories of Processed Data

Depending on the purpose, we process the following categories of data:

• Identification data (name, surname, national ID number, date of birth)
• Contact data (email address, phone number, residential address)
• Health data (medical history, test results, treatment history)
• Data related to appointments (appointment dates, payments)

4. Data Recipients

Your data may be shared with the following categories of recipients:

• Entities providing hosting and IT services
• Entities operating booking systems (ZnanyLekarz, HaloDoctor)
• Diagnostic laboratories (in case of ordered tests)
• Entities authorized by law (National Health Fund, courts, law enforcement agencies)
• Accounting office to the extent necessary for bookkeeping

5. Data Retention Period

Personal data will be retained for the following periods:

• Medical records — 20 years from the end of the calendar year in which the last entry was made (in accordance with Polish Patient Rights Act)
• Accounting documentation — 5 years from the end of the tax year
• Correspondence — until the matter is closed or for the statute of limitations period
• Contact form data — until the response is provided and the matter is closed

6. Rights of Data Subjects

Under GDPR, you have the following rights related to the processing of personal data:

• Right of access — you can obtain information about processed data and a copy of the data
• Right to rectification — you can request correction of incorrect or incomplete data
• Right to erasure — you can request deletion of data (subject to medical record retention obligations)
• Right to restriction of processing — you can request restriction of processing in certain situations
• Right to data portability — you can receive data in a structured format
• Right to object — you can object to processing based on legitimate interest
• Right to lodge a complaint — you can file a complaint with the President of the Personal Data Protection Office

7. Cookies

The website uses cookies to ensure proper functioning of the service and analyze website traffic. Cookies are small text files stored on your device.

We use the following types of cookies:

• Necessary — required for proper functioning of the website
• Functional — remembering user preferences (e.g., language selection)
• Analytical — helping to understand how users use the website

You can manage cookie settings in your web browser.

8. Data Security

We apply appropriate technical and organizational measures to ensure the security of processed personal data, including protection against unauthorized access, loss, destruction, or damage. Medical data is stored in accordance with the requirements of the Polish Patient Rights Act and medical documentation regulations.

9. Changes to Privacy Policy

We reserve the right to make changes to this Privacy Policy. We will inform about any changes by updating the date at the top of the document. We encourage you to review this policy regularly.