Data protection
Privacy policy
This policy explains in plain language what data we process, why it is needed and what rights are available to people using the website and the practice's services.
1. Data controller
The controller of personal data is Jolanta Czerwik SPECJALISTYCZNA PRAKTYKA LEKARSKA, whose permanent place of business is ul. Wincentego Pola 4B, 32-020 Wieliczka.
For matters concerning personal data, contact E-mail or send a text message to SMS.
2. What data do we process?
When an appointment is booked, we may process the patient's full name, phone number, optional email address, selected appointment time and a voluntarily provided message. Please do not include detailed medical records or information unnecessary for organising the visit.
If you join the waiting list, we also process the contact details, preferred date range and short organisational note you provide. The list is currently handled manually and does not trigger automatic messages.
Health data may also be processed when healthcare is provided. It is covered by professional confidentiality and receives enhanced protection.
3. Purposes and legal grounds
Data is processed to book and organise appointments, provide healthcare, handle organisational correspondence, maintain the waiting list, fulfil accounting obligations, maintain security and establish or defend legal claims.
Depending on the circumstances, processing is based on Article 6(1)(b), (c) or (f) GDPR and, for the waiting list, consent; for health data, Article 9(2)(h) GDPR together with the applicable Polish healthcare and patient-rights legislation.
4. Is providing data mandatory?
Providing data through the form is voluntary, but fields marked as required are necessary to create and manage an online booking. Joining the waiting list is voluntary and requires separate consent. The practice can also be contacted by text message.
5. Recipients of data
Data may only be entrusted to providers supporting the practice—such as hosting, booking, email, text messaging, IT, accounting or legal service providers—to the extent required for their tasks and under appropriate agreements. Data may also be disclosed to authorised public bodies when required by law.
6. Retention period
Booking data is retained for the time needed to manage the visit and subsequently for accounting, security and legal-claims purposes. Waiting-list entries are kept until the request is handled or withdrawn and then deleted in line with data minimisation. Medical records are kept for periods required by law. Messages not resulting in a booking are deleted after correspondence ends unless further retention is reasonably necessary.
7. Your rights
Within the limits provided by the GDPR, you have the right to access and obtain a copy of your data, rectify it, restrict processing, request erasure or portability, and object to processing. Where processing is based on consent, that consent can be withdrawn without affecting earlier lawful processing.
Requests may be submitted using the controller's contact details. You may also lodge a complaint with the President of the Polish Personal Data Protection Office.
8. Automated decisions and transfers
The website does not make solely automated decisions about patients and does not profile them. Data is not transferred outside the European Economic Area without an appropriate legal basis and the required safeguards.
9. Cookies and browser storage
The public website does not use advertising cookies or analytics tools. The browser only stores an acknowledgement that the privacy notice has been closed. After an administrator signs in, an essential secure session cookie is used solely to maintain that session.
If analytics or marketing tools are added in the future, they will remain disabled until any required consent is obtained and this policy will be updated.
10. Security and updates
We minimise the data collected and select safeguards appropriate to the risk. This policy may be updated when the website or applicable law changes. Last updated: 31 August 2026.