Privacy policy
This policy describes how NL Clinic processes the data of people who use the naturallook.com.pl website, write to us, call us or book an appointment. Patient data in medical records is described separately in the GDPR information clause for patients.
Data controller
The data controller is NL Clinic Pierzyńscy Spółka Jawna, with its registered office in Katowice, ul. Obroki 68, 40-833 Katowice, NIP 6443075075, KRS 0000103646, REGON 277804910. Contact: recepcja@nl-clinic.pl, tel. +48 881 202 202. For matters relating to personal data, write to a.kozlowska@nl-clinic.pl.
What data, for what purpose and for how long
Contact, booking, or “Call me back” form
- Data
- Name, phone, email, preferred date, subject, message content
- Target
- Reply, callback, booking an appointment
- Basis
- Article 6(1)(b) of the GDPR (steps taken at your request before entering into a contract) and point (f) (answering questions)
- How long
- Until the matter is settled, no longer than 12 months; after the visit, the data becomes part of the records described in the clause for patients
Phone and email
- Data
- Phone number, email address, message content
- Target
- As above
- Basis
- As above
- How long
- As above
Booking via Booksy
- Data
- Data provided in Booksy: first name, surname, phone, email, service and date
- Target
- Managing bookings and appointment reminders
- Basis
- Article 6(1)(b) of the GDPR
- How long
- Until the visit and settlement; Booksy's rules are described in its privacy policy
Booking via ZnanyLekarz
- Data
- Data provided in ZnanyLekarz: first name, surname, phone, email, service and date
- Target
- Managing bookings and appointment reminders
- Basis
- Article 6(1)(b) of the GDPR
- How long
- Until the visit and settlement; ZnanyLekarz's rules are described in its privacy policy
Payment by link
- Data
- First name and surname, email, amount, payment title and status
- Target
- Accepting a deposit or payment, and any refund
- Basis
- Article 6(1)(b) and (c) of the GDPR
- How long
- For the period required by tax and accounting regulations
Visit statistics, only with consent
- Data
- Address of the page visited, device type, the service the visit came from, clicks; a one-day marker with no possibility of identification
- Target
- Knowing which information is useful
- Basis
- Article 6(1)(a) of the GDPR and Article 399 of the Polish Electronic Communications Law
- How long
- 90 days
Server log
- Data
- IP address, date and time, page address, browser type
- Target
- Website security and diagnostics
- Basis
- Article 6(1)(f) of the GDPR
- How long
- Up to 12 months, in accordance with the hosting provider's rules
WhatsApp and social media
- Data
- Phone number or profile name, message content, photos you send
- Target
- Reply
- Basis
- Article 6(1)(f) of the GDPR; health information: Article 9(2)(h) of the GDPR
- How long
- Until the matter is resolved; the platform processes data under its own rules
Claims
- Data
- Data from the above situations
- Target
- Establishment, pursuit or defence of claims
- Basis
- Article 6(1)(f) of the GDPR
- How long
- Until claims become time-barred
Health data in messages
You can send photos and health information via WhatsApp to +48 881 202 202 or as attachments in the Contact form, preferably in a password-protected ZIP file whose password you give us by phone. We will use them solely to arrange and prepare for the appointment (Article 9(2)(h) of the GDPR). WhatsApp messages are received by the patient care team on the clinic's phone. The website does not save attachments from the form: they are sent only by e-mail to the patient coordinator's mailbox.
Marketing messages
We send commercial communications (marketing messages) by email or text message only with your prior, separate consent (Article 398 of the Polish Electronic Communications Law and Article 6(1)(a) of the GDPR); you can withdraw your consent at any time, and health data is not used for marketing. Reminders about a booked appointment are not marketing messages.
Recipients
Data is received only by entities that help us run the website and support patients, under data processing agreements or as separate controllers: the hosting provider (cyber_Folks S.A.), the email provider, IT support, Booksy International sp. z o.o. and ZnanyLekarz sp. z o.o. (bookings), WhatsApp Ireland Limited (messages via WhatsApp), the payment operator indicated in the message with the link, the accounting office and law firm to the extent needed, and authorities authorised by law.
Outside the European Economic Area
We do not transfer data outside the European Economic Area ourselves. The Google directions map on the “Contact” page only loads after you give your consent; Google may then also process data in the USA, on the basis of the European Commission's decision on the EU–US Data Privacy Framework. When you write to us via WhatsApp, WhatsApp may also process data outside the EEA, on the terms described in its privacy policy. Before we enable any other Google or Meta tools, we will update this policy and ask for your consent.
Your rights
You have the right to access your data, and to its rectification, erasure, restriction of processing and portability, as well as the right to object to processing based on legitimate interest. You can withdraw your consent at any time; this does not affect the lawfulness of processing carried out before its withdrawal. Send your request to a.kozlowska@nl-clinic.pl or by post to our registered address. You also have the right to lodge a complaint with the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warszawa.
Do you have to provide your data
Providing your data is voluntary, but without a telephone number or email address, we will not reply to your message or arrange an appointment.
Automated decisions
We do not make decisions solely through automated means, and we do not profile visitors to the website.
Security
The connection to the website is encrypted. Forms do not record your IP address, only the patient service team has access to submissions, and copies of submissions are deleted automatically.
Cookies
The rules for storing information in your browser are described in the cookie policy.
Recruitment
Candidates' data is covered by a separate clause on the Careers page.
Changes
Version 2 of 30 September 2026: attachments in the Contact form and WhatsApp. Version 1 was in effect from the date the new website was published. We inform you of significant changes on this page.