Centrum Medyczne Dr Ozimek, based in Warsaw at ul. Wilanowska 43D, 02-765 Warsaw, fulfills the obligations arising from applicable laws regarding the protection of personal data, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (GDPR).

This privacy policy is intended to provide you with information regarding the principles of processing and protection of personal data, including in particular health-related data.

The information contained in this privacy policy will allow you to understand what personal data is collected and processed by Centrum Medyczne Dr Ozimek, for what purpose it is processed, and what rights you have in connection with the protection of personal data.

1. Who is the data controller – who processes your personal data
   

   Centrum Medyczne Dr Ozimek (Wojciech Ozimek Praktyka Lekarska), based in Warsaw at ul. Wilanowska 43D, 02-765, hereinafter referred to as Centrum Dr Ozimek or the data controller.

2. Contact with Centrum Dr Ozimek:
   E-mail: recepcja@centrumozimek.pl
   Phone: +48 601 290 999
   By post: ul. Wilanowska 43D, 02-765 Warsaw

3. What data is processed by Centrum Dr Ozimek?

• Data used for identification, including: first name, last name, PESEL number, date of birth
• Contact data, such as address, phone number, email address
• Data collected and processed for the purpose of diagnosis and treatment, including in particular data concerning health condition, medical history, test results, submitted medical documentation. It is noted that this data concerns only persons using the services of Centrum Dr Ozimek
  
  

4. For what purpose do we process data?
   Data processed by Centrum Dr Ozimek is used solely for the purpose of providing proper patient care. This includes:

• Provision of healthcare services, including maintaining medical records; performance of a contract for medical services or taking actions requested before concluding a contract
• Ensuring healthcare and managing healthcare systems and services, e.g. identity verification during registration and before a visit, changing appointment dates, informing about results, providing medical recommendations
• Registration by phone or email and registration through a service provider
• Ensuring social security and managing social security systems and services, e.g. issuing certificates or sick leave
• Health prevention (including reminders about follow-up visits, preventive examinations such as periodic or check-up tests)
• Issuing e-prescriptions, including:
  – patient identification (first name, last name, PESEL), processing of medical data (diagnosis, recommendations),
  – transferring data to the P1 system (e-health system),
  – providing data to pharmacies,
  – archiving documentation
• Obligations resulting from legal regulations (including maintaining medical records, storing documentation for 20 years, providing data to authorized entities such as courts, tax settlements, inspections by sanitary authorities or NFZ).
• Processing for analytical and statistical purposes, including improving the quality of medical services. If data is used for scientific purposes, it is anonymized or pseudonymized in accordance with Article 89 of the GDPR. Anonymous data does not constitute personal data within the meaning of the GDPR
• Monitoring – image and voice of persons in the reception area are processed to ensure the safety of patients and staff and to protect the property of the data controller. Monitoring covers only the reception area (excluding medical rooms). The legal basis for processing is Article 6(1)(f) of Regulation (EU) 2016/679 – legitimate interest of the controller. Recordings are stored for up to 30 days, and access is granted only to persons authorized by the controller
  
  

5. Who are personal data shared with?
   Your personal data may be shared with the following categories of recipients:

• Persons authorized by you as part of exercising patient rights
• Providers of legal and advisory services supporting Centrum Dr Ozimek
• Providers of services supplying Centrum Dr Ozimek with technical and organizational solutions enabling the provision of healthcare services and management of our facility (in particular IT service providers, including external appointment booking systems)
• Diagnostic laboratories
  
  

6. How long is personal data processed?
   In the case of processing your medical data, we are obliged to store it for at least 20 years from the date of the last entry in the documentation. Subject to this period, if the data was processed by Centrum Dr Ozimek for the purpose of pursuing claims (e.g. in debt collection proceedings), we process the data for the period of limitation of claims resulting from the Civil Code. After the above periods, your data is deleted or anonymized.
   
   

7. Providing personal data is completely voluntary; however, failure to provide it will result in refusal to provide healthcare services.
   
   
8. Patient rights
   

   As the controller of your data, we ensure your right to access your data, rectify it, request its deletion or restriction of processing. You may also exercise the right to object to the processing of your data and the right to data portability to another controller. We also inform you that you have the right to lodge a complaint with the authority supervising compliance with personal data protection regulations. We process data based on:

   GDPR – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016
   Patient Rights Act – Act of 6 November 2008 on patient rights and the Patient Rights Ombudsman
   Regulation of the Minister of Health – Regulation of 6 April 2020 on the types, scope and templates of medical documentation and the method of its processing

9. Data Protection Officer (DPO)
   The controller has not appointed a Data Protection Officer. In all matters related to the processing of personal data, including exercising patient rights, you can contact the controller directly at: recepcja@centrumozimek.pl
   
   

10. Source of data
    

    As a rule, we obtain personal data directly from the Patient. In some cases, data may be provided by a third party acting on behalf of the Patient, in particular when registering an appointment by a family member, legal guardian, or another authorized person.

    Data may also be provided through online appointment booking systems or other entities cooperating with Centrum Dr Ozimek in the organization of healthcare services.

11. Security of personal data
    The controller applies appropriate technical and organizational measures to ensure the protection of processed personal data appropriate to the risks and categories of data protected. In particular, we protect data against unauthorized access, loss, destruction, or unauthorized modification. Access to personal data is granted only to persons authorized by the controller, who are obliged to maintain confidentiality.
    
    
12. Third-party cookies
    The website https://centrumozimek.pl/ may use solutions provided by third parties, in particular the iGabinet online appointment booking system. In connection with the use of this tool, cookies from the system provider may be stored on the user’s device.
    

    The controller of data processed within the operation of the booking system and its cookies is the provider of the iGabinet system, in accordance with its own privacy policy and cookie policy.

    The administrator of this website does not have direct access to data collected by cookies used by the iGabinet system and does not manage these cookies. Detailed information regarding data processing and the use of cookies by this system is available in the service provider’s privacy policy.

    Using the appointment booking module means consent to data processing in accordance with the rules defined by the system provider. Privacy policy available at:
    https://igabinet.pl/polityka-prywatnosci
    

    Centrum Dr Ozimek reserves the right to make changes to this privacy policy in the event of changes in legal regulations or the method of processing personal data. The current version of the privacy policy is published on the Centre’s website.