Information clause

Data controller

The controller of the data provided is NL Clinic Pierzyńscy Spółka Jawna with its registered office in Katowice, ul. Obroki 68, 40-833 Katowice, hereinafter “NL Clinic”.

For personal data protection matters, please write to a.kozlowska@nl-clinic.pl or by post to the clinic's registered office address.

Purposes and legal bases for processing

1. Providing healthcare services, medical consultations and diagnostic tests, cosmetology and cosmetic treatments offered by NL Clinic, settling accounts for the services provided, booking, confirming and cancelling consultation and treatment appointments, keeping, storing and making available medical records, and sending correspondence, pursuant to Article 6(1)(f) in conjunction with Article 9(2)(h) of the GDPR.
2. Verifying identity before providing a healthcare service, and keeping, making available and storing medical records, pursuant to Article 6(1)(c) in conjunction with Article 9(2)(h) of the GDPR and Article 24(1) et seq. of the Act of 6 November 2008 on Patient Rights and the Patient Rights Ombudsman.
3. Settling accounts related to the provision of healthcare services and pursuing claims related to conducting business activity, pursuant to Article 6(1)(f) in conjunction with Article 9(2)(h) of the GDPR.
4. Maintaining the accounting books, pursuant to Article 6(1)(c) of the GDPR in conjunction with Article 74(2) of the Accounting Act of 29 September 1994.
5. Sending commercial information and marketing materials by electronic means: only with prior, separate consent (Article 6(1)(a) of the GDPR and Article 398 of the Electronic Communications Law); consent can be withdrawn at any time.

Processing the data for purposes 1 and 3 is necessary to perform the contract for the provision of healthcare services and to pursue claims related to it.

We do not profile patients. If we introduce analytics or marketing tools in the future, we will update this information and ask for your consent.

Recipients of the data

Personal data are or may be shared with other entities providing healthcare services, solely for the purposes listed above. The data will not be transferred to a third country or to an international organisation.

Retention periods

• Medical records (purpose 2)20 years, in accordance with Article 29(1) of the Act on Patient Rights, with exceptions provided for in the Act
• Services and settlements (purposes 1 and 3)until the expiry of the limitation period for claims related to conducting business activity
• Accounting books (purpose 4)for the period required by the Accounting Act

Patient rights

You have the right to request access to your personal data, its rectification, erasure or restriction of processing, as well as the right to object to processing based on legitimate interests (Article 21 of the GDPR) and the right to data portability (Article 20 of the GDPR), to the extent that they apply. You have the right to lodge a complaint concerning data processing with the supervisory authority, that is the President of the Personal Data Protection Office.

Your data will not be used for automated decision-making that produces legal effects concerning you.

Is providing data mandatory

Providing data for purpose 1 is voluntary. For purpose 2, the obligation to provide data results from the legal provisions indicated there. Failure to provide the data will result in the inability to provide healthcare services.

Recruitment has a separate clause and separate retention periods. These are on the Careers page.