INFORMATION FROM THE PERSONAL DATA CONTROLLER

INFORMATION CLAUSE

We would like to inform you that we apply the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (
hereinafter referred to as the “Regulation”).

The administrator of your personal data is Warsaw Dental Center Leończak Kupryś Sp.k.
(previously: Warsaw Dental Center Spółka z ograniczoną odpowiedzialnością Sp.k.) with its registered office in Warsaw (00-342) at ul.
Topiel 11, KRS number 0000749308.

Personal data are processed by the Administrator for the purposes of:

1. taking action at the request of the data subject before concluding the contract and performing the contract to which the data subject is a party (Article 6(1)(b) of the Regulation);
2. fulfillment of binding legal obligations imposed by law (Article 6(1)(c) of the Regulation);
3. health prevention, medical diagnosis, provision of health care, treatment, management of health care systems and services (Article 9(2)(h) of the Regulation);
4. establishing, pursuing, defending and defending against claims (Article 6(1)(b) and (f) of the Regulation; a legitimate interest is the right to pursue and protect against claims).

If consent is given to the use of one’s own personal data, the content of the consent will specify the purpose of processing this data (Article 6(1)(a) of the Regulation).

Medical records kept by the Administrator contain at least the patient’s identification, allowing for the identification of the patient: surname and first name(s), date of birth, gender, address of residence, PESEL number, if assigned (in the case of a newborn – the mother’s PESEL number),
and in the case of persons who do not have a PESEL number – the type and number of the document confirming identity, description of the patient’s health condition or health services provided to him.
If the patient is a minor,

completely incapacitated or incapable of giving informed consent – surname and name(s) of the legal representative or guardian and the address of his place of residence.

The administrator may also process data such as e-mail address and telephone number, but they are not necessary to maintain medical records.

Your personal data is transferred to entities processing data on behalf of the Administrator in connection with the cooperation (including those operating ICT systems, providing advisory services, cooperating in the field of medical services provided by the Administrator), and is also made available to other data administrators processing data in their own
on behalf of (including public authorities competent in the field of health care, ZUS, National Health Fund, other public law entities, in particular competent in the field of health care, conducting postal, courier and legal activities).

Your personal data will not be transferred to a third country or international organization.

The processing of personal data will not be subject to automated decision-making, including profiling.

Medical documentation containing your personal data will be stored for a period of 20 years, counting from the end of the calendar year in which the last entry was made (exceptions to this rule are indicated in Article 29(1) of the Act of November 6, 2008 on patient rights and
Patient Ombudsman).

In the case of personal data processed in connection with obligations arising from legal provisions, the data storage period results from individual legal acts.

In the case of data processing in connection with the performance of a contract or for purposes arising from the legitimate interests of the Administrator, the data will be stored for 6 years from the date of performance of the contract or until a justified objection to data processing is raised.

Personal data processed on the basis of your consent will be deleted after withdrawal of consent.

In connection with the processing of your personal data by the Administrator, you have the following rights:

1. the right to request access to your data,
2. the right to correct and rectify your data,
3. the right to delete your data (“the right to be forgotten”; does not apply to personal data processed pursuant to Article 9(2)(h) of the Regulation contained in medical documentation),
4. the right to limit the processing of your data,
5. the right to transfer your data,
6. the right to object to data processing,
7. the right to lodge a complaint with the supervisory authority, i.e. the Personal Data Protection Office, ul.
   Stawki 2, 00-193 Warsaw.

In the case of data processing based on consent, you also have the right to withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

The use of medical services provided by the Administrator is voluntary.
Providing personal data for the purpose of maintaining medical records and in connection with the Administrator’s fulfillment of legal obligations is your obligation, and failure to provide them will prevent you from using medical services.
Providing an e-mail address, telephone number and data when the legal basis for processing is consent is voluntary.
However, failure to provide data may make it difficult or completely impossible to provide medical services by the Administrator.