INFORMATION ON THE PROCESSING OF PATIENTS’ PERSONAL DATA

INFORMATION ON THE PROCESSING OF PATIENTS’ PERSONAL DATA

In connection with the processing of your personal data, we inform you – in accordance with Article 13(1) and (2) of the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27.04.2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation) ( Official Journal of the EU L of 04.05.2016, No. 119, p. 1) hereinafter referred to as “RODO” that:

I.DATA CONTROLLER

The administrator of your personal data is the company “Psychoterapia Ewa Żupnik”, doing business at the address: Lubelska 4/1 Street, 30-003 Krakow, with assigned tax identification number (NIP): 6772482309. The administrator can be contacted at 4/1 Lubelska Street, 30-003 Kraków; tel. no. +48 880 33 22 35; e-mail address: yourself.krakow@gmail.com.

II. LEGAL BASIS AND PURPOSES OF PERSONAL DATA PROCESSING

1. Patients’ personal data may be processed by us for the purpose and to the extent necessary to provide health services, i.e.:

• Medical diagnosis and treatment in the provision of health services, execution of the health care contract, including the maintenance and storage of medical records (legal basis: Article 6(1)(b), (c), 9(2)(h) of the RODO in conjunction with Article 24(1) of the Patient Rights Act and the Regulation of the Minister of Health of April 6, 2020 on types, scope and models of medical records and the manner of their processing),
• When using the services of a psychologist/psychotherapist, your personal data (and that of the person under your legal guardianship) is covered by the secrecy of the profession of psychologist and psychotherapist. They will be processed for the purpose of:

1. maintaining psychological records, conducting sessions in the office and online and issuing bills, invoices and submitting them to accounting. With the exception of a written court order to abrogate the secrecy of the profession of psychologist and/or psychotherapist or a situation of direct or indirect threat to life or health, which must be reported to the appropriate services, no other external entity is the recipient of your data except when using the service of online sessions via Skype, Whatsapp or other communicator – the company “Psychoterapia Ewa Żupnik” undertakes to perform the service while respecting the privacy of the conversation through the chosen communicator, but does not guarantee the security of data in the Internet space.
2. Sensitive data for which consent has been given will only be shared in the implementation of the supervision process, based on a separately executed agreement between the psychotherapist and the supervisor, in which the psychotherapist, works with a more experienced practicing psychotherapist or other psychotherapists, as supervisors, to expand professional skills and, importantly, to ensure your safety in the ongoing psychotherapy. Sensitive data includes, for example, racial or ethnic origin, political views, religious or philosophical beliefs, trade union membership, genetic data, biometric data to identify an individual, health data, data on a person’s sexuality and sexual orientation, data on the use of medical facilities.

• To provide healthcare and manage healthcare systems and services, i.e., to:

1. Establish the identity of the patient before providing the service,
2. verification of patient data when making a remote appointment, either at the reception desk or in the office,
3. making patient registration,
4. Ensure continuity of health care, including coordination of service delivery (e.g., contacting you at the phone number or email address you provided to remind you of a service date, confirm an appointment or cancel it),
5. receiving and storing patients’ statements of intent (e.g., authorizations to access medical records),

– legal basis: art. 6 paragraph. 1(c , f and Article 9(2)(h) of the RODO, Article 3 of the Law on Medical Activity and Article 24 of the Law on Patient’s Rights and Spokesman for Patient’s Rights, Regulation of the Minister of Health of April 6, 2020 on types, scope and models of medical records and the manner of their processing.

2.Patients’ personal data may furthermore be processed by us for:

• Fulfillment of our legal obligations in terms of bookkeeping and related tax obligations (legal basis: Article 6(1)(c) of the DPA),
• Protecting or pursuing claims for business activities (legal basis: Article 6(1)(f) RODO),
• Sending newsletter messages, solely on the basis of the consent given (legal basis: Article 6(1)(a) RODO).

III. RECIPIENTS OF PERSONAL DATA

1. Recipients of Patients’ personal data will be only entities authorized to obtain them under the law, such as the State Sanitary Inspectorate, Social Security, National Tax Administration.
2. Personal data may also be transferred to entities that process it on our behalf, such as companies that provide IT software, companies that provide registration services, management of healthcare systems, and medical record keeping.

IV. RETENTION PERIOD OF PERSONAL DATA

We will process your personal data for the periods referred to in Article 29 of the Law on Patients’ Rights and Patients’ Ombudsman and other special laws, i.e.:

• Medical records – for a period of 20 years, counting from the end of the calendar year in which the last entry was made.
• Personal data will be stored by the Administrator for a period of 5 years from the last visit. If consent is not obtained for further storage, the data will be destroyed.
• Settlement documentation (invoices, bills) – for a period of 5 years counting from the end of the calendar year in which the deadline for payment of tax expired.
• We will process data processed on the basis of consent (newsletter) until you withdraw your consent.

V. INFORMATION ABOUT THE REQUIREMENT/VOLUNTARINESS OF PROVIDING DATA AND THE CONSEQUENCES OF NOT PROVIDING PERSONAL DATA

It is mandatory to provide the data collected in the medical records and the electronic registration system, including the determination of the patient’s identity using his/her personal data. Failure to provide us with the data may result in a refusal to book an appointment or provide health services.

Provision of other personal data (e.g. telephone number or e-mail address) for contact purposes – failure to do so may result in refusal to book an appointment or provide healthcare services.

VI. RIGHTS OF DATA SUBJECTS

You have the right to demand from us:

1) Access to the content of your personal data,

2) Receive a copy of personal data,

3) Correction of personal data,

4) Restrictions on the processing of personal data,

5) Revoke consent to the processing of personal data at any time without affecting the legality of the processing carried out before its revocation – if the processing is carried out on the basis of consent granted to us,
– in the cases and under the conditions specified in the RODO. The rights listed above can be exercised by contacting the Administrator or the Data Protection Officer.

With respect to personal data processed pursuant to Article 9(2)(h) of the RODO, in particular with respect to data processed as part of medical records, the Patient does not have the right to erasure or temporary or permanent restriction of the processing of such data, the right to portability of such data, and the right to object to the processing of such data.

VII. RIGHT TO LODGE A COMPLAINT WITH A SUPERVISORY AUTHORITY

You have the right to lodge a complaint with the President of the Office for Personal Data Protection when it is justified that your personal data is processed by us in violation of the provisions of the RODO.

VIII. AUTOMATED DECISION-MAKING INCLUDING PROFILING

Your personal data will not be processed by automated means, including profiling.