INFORMATION ON THE PROTECTION OF PERSONAL DATA
In accordance with Article 13(1) and (2) of the General Data Protection Regulation of 27 April 2016 (hereinafter: GDPR), we inform you that:
- The controller of your personal data is EMC Instytut Medyczny S.A.
with its registered office at ul. Pilczycka 144-148, 54-144 Wrocław, Poland (hereinafter: the Company, the data controller). - The contact person for personal data protection matters is the Data Protection Officer, who can be reached at: EMC Instytut Medyczny S.A., Inspektor Ochrony Danych (Data Protection Officer), ul. Pilczycka 144-148, 54-144 Wrocław, Poland, or by e-mail at: iod@emc-sa.pl.
- Your personal data will be processed for the following purposes:
a) concluding and performing the agreement between us, if you use private medical care (legal basis: Article 6(1)(b) GDPR);
b) fulfilling the legal obligations of EMC related to providing publicly funded healthcare services and carrying out medical activity (legal basis: Article 6(1)(c) and Article 9(2)(h) GDPR); depending on the medical services you use, we process your personal data, among other things, in order to:
– provide healthcare services;
– keep medical records;
– make medical records available to you, your statutory representative or a person authorised by you;
– verify your identity before providing a service, making medical records available or giving information about you;
– settle accounts with the National Health Fund (NFZ) for the healthcare services provided;
c) pursuing the legitimate interests of EMC (legal basis: Article 6(1)(f) GDPR), including in order to:
– book and cancel appointments in our medical facilities, including through our website and the telephone number or e-mail address you gave when registering;
– ensure the physical safety of people and property in the Company’s facilities, including through internal and external video monitoring and recording people entering and leaving the Company’s facilities;
– inform you about new medical services, innovative solutions and facilities for our Patients;
– carry out internal proceedings to ensure that the activities of EMC and its employees comply with the law and with EMC’s internal regulations;
– monitor and improve the quality of the services provided by EMC, including monitoring telephone calls and surveying Patient satisfaction with EMC’s services, if you have agreed to such telephone calls;
– conduct disputes and proceedings before public authorities, including to pursue and defend against claims;
– report internally within the EMC capital group, including management reporting;
– carry out analyses and prepare statistics for our internal needs.
If you have given us consent to process your personal data, we will process your data to the extent and for the purpose set out in the consent. - Your personal data will be processed only by authorised employees of the data controller. The recipients of your personal data will be:
a) entities processing personal data on behalf of EMC, including:
– entities supporting EMC in providing medical services, e.g. suppliers of medical equipment,
– our subcontractors who provide some medical services on our behalf,
– external IT service providers who maintain our IT systems,
– law firms that provide us with legal services;
b) entities of the EMC capital group in connection with reporting and administrative obligations;
c) public bodies, e.g. the Patient Ombudsman, the National Health Fund, the self-governing bodies of the medical professions and national and regional consultants, to the extent necessary for these bodies to perform their tasks, in particular supervision and inspection;
d) healthcare providers, if transferring the data is necessary to ensure the continuity of healthcare services (for example, we may ask you to have certain tests or a specific procedure performed by our partner);
e) (if applicable in your case) insurance companies, e.g. in connection with your joining a group insurance policy to which EMC is a party. - Your personal data will not be transferred to third countries or international organisations.
- Your personal data will be stored for the following period:
a) for the purposes referred to in point 3(a), (b) and (c) – for the period of providing the medical service or the term of the agreement, and afterwards for the period required by the regulations on keeping medical records and by tax law, and for the period resulting from the statute of limitations for claims; for video monitoring – for up to 30 days from the moment the image is recorded;
b) for the purpose referred to in point 3(d) – for the period of providing the medical service or until you withdraw your consent. - You have the right to access your data and the right to rectification, erasure, restriction of processing, data portability and to object, and where the processing is based on consent, the right to withdraw consent at any time without affecting the lawfulness of processing carried out on the basis of consent before its withdrawal.
- You have the right to lodge a complaint with the President of the Personal Data Protection Office (Urząd Ochrony Danych Osobowych, UODO) if you consider that the processing of your personal data infringes the GDPR.
- Providing your personal data is a condition of using EMC’s medical services (if you do not provide your data, you will not be able to use our services).
Some legal provisions oblige us to collect data from you, such as the Act on Patients’ Rights and the Patient Ombudsman or the Act on publicly funded healthcare services. In these cases, the obligation to provide us with your personal data results from the law.
Where we collect your data on the basis of your consent, providing personal data is voluntary. - Your personal data will not be subject to profiling.
This is an English translation provided for information. In case of any discrepancy, the Polish version prevails.
