Personal Data Processing

Information clause

Detailed information on the processing of personal data by Rehasport Clinic Sp. z o.o. at ul. Górecka 30, 60-201 Poznań in connection with the requirements of Articles 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter “GDPR").

1. Personal data controller

The controller of your personal data will be Rehasport Clinic Sp. z o.o., ul. Górecka 30, 60-201 Poznań (refered to as “Us” or “We”). You can contact us as follows:

• by post to the following address: Rehasport Clinic Sp. z o.o., ul. Górecka 30, 60-201 Poznań (Poland)
• by e-mail: biuro@rehasport.pl
• by telephone:+48 / 616 281 181

2. Data Protection Officer

We have appointed a data protection officer. This is the person you can contact in all matters relating to the processing of your personal data and the exercise of your rights in relation to data processing. You can contact the officer as follows:

• by post to the following address: Joanna Wiese, Rehasport Clinic Sp. z o.o., ul. Górecka 30, 60-201 Poznań (Poland)
• by e-mail: iod@rehasport.pl

3. Purposes of processing your personal data and legal basis for processing

We will process your personal data to:

• provide you with medical services,
• to contract for the provision of health services,
• to provide and manage the provision of medical services,
• to cover of contracts for the lending of medical equipment and the sale of medical products,
• make business settlements,
• handle feedback complaints and reports, if received,
• assert and defend themselves against claims,
• provide materials to promote the controller's own products and services,
• archive your data in accordance with legal regulations,
• ensure security of persons and property (video surveillance of the clinic),
• carry out requests concerning your rights under the GDPR,
• conduct quality and satisfaction surveys (including those based on profiling),
• include you in a scientific study if you have agreed to it.

The legal bases for processing your data:

• contract for the provision of health services,
• providing you with health and medical services, protecting your health, preventive health care and managing the provision of these services. Such processing is regulated by legal provisions, in particular: the Act on Medical Activity, the Act on Patients’ Rights and the Patients’ Ombudsman and takes place in connection with Article 9(2)(H) of the GDPR,
• Your consent to the processing of your special category data for purposes other than those related to the process of your treatment, in relation to Article 9(1)(A) of the GDPR,
• Fulfilment of the contract for the provision of services and coverage under the medical care contract, in relation to Article 6(1)(B) of the GDPR,
• Your consent to the processing of personal data for the purpose specified directly in the consent, in relation to Article 6(1)(A) of the GDPR,
• Our legitimate interest, in relation to Article 6(1)(F) of the GDPR consisting of:

- researching your satisfaction and opinions on the use of Our services, (including profiling),

- asserting claims, defending against claims and handling complaints,

- handling of the notifications and opinions forwarded,

- ensuring the security of persons and property, in particular by means of video surveillance,

- to conduct marketing and sales in accordance with your expressed content preferences and communication channels (including profiling),

• the applicable legal provisions, in conjunction with Article 6(1)(C) of the GDPR concerning in particular:

- the maintenance of financial and tax accounts and the archiving of such data, in particular in connection with the Accountancy Act,

- the exercise of your rights arising directly from the GDPR,

• to take action for the prevention of diseases in connection with a task carried out in the public interest in the field of health in connection with Article 6(1)(E) of the GDPR.

4. Information on profiling

On the basis of your personal data, we perform profiling, which is the automated assessment of certain personal factors about you.

We undertake profiling to appropriately select communications and promotional materials for the activities of the data controller. We will select appropriate content for information and promotional materials based on your profile. We use the following data for profiling: patient number, first name, last name, age, gender, date of birth, city, facilities visited, type of product purchased, source of data acquisition. In addition, when profiling, we take into account statistical data on website behaviour.

5. Retention period of your personal data

We will keep the data we process on the basis of a contract for the provision of healthcare services for the purpose of providing healthcare services for the period specified by the contract, by law, and in the legitimate interests of the data controller (marketing including profiling) until you object. We will process the data we process on the basis of your consent until you revoke it.

6. Recipients of your personal data

We will forward your personal data to:

• entities that process data on our behalf, these are entities to whom we outsource various services such as IT and marketing.
• entities authorised by law, in particular:
• to medical entities to ensure continuity of treatment and availability of healthcare in the form of our own facilities and those of our collaborators;
• Insurance companies;
• to public authorities entitled to obtain your data in connection with the proceedings;
• National Health Service (NFZ), in the provision of services from public funds;
• to entities authorised by you.

7. Transfers of data outside the European Economic Area

Due to the fact that we use other suppliers, e.g. for ICT support, your personal data may be transferred outside the European Union. We assure you that in such a case the transfer of data will take place on the basis of an appropriate agreement between Rehasport Clinic Sp. z o.o. and the entity, containing standard data protection clauses adopted by the European Commission or on the basis of a relevant decision of the European Commission.

8. Your rights related to personal data processing

You have the following rights in relation to the processing of your personal data:

1. the right to object to processing for marketing purposes or to assess quality and satisfaction - as we are processing your data for marketing purposes on the basis of a legitimate interest,
2. the right to object to processing on grounds of special circumstances — where we process your data on the basis of our legitimate interests for purposes other than those sefinedx in point 1 above,
3. the right to access your personal data,
4. the right to request the rectification of your personal data,
5. the right to request the deletion of your personal data, only if we are not obliged by law to process it,
6. the right to request the restriction of the processing of your personal data,
7. the right to transfer your personal data, i.e. the right to receive your personal data from us , in a structured, commonly used and machine-readable computer format. You may transfer this data to another controller or request that we transfer your data to another controller. However, we will only do this if such a transfer is technically possible.

To exercise the above rights, please contact us or our Data Protection Officer (contact details — see points 1 and 2 above).

Right to lodge a complaint to an institution

You also have the right to lodge a complaint with the supervisory authority dealing with the protection of personal data, i.e. the President of the Office of the  Personal Data Protection.

9. Obligation to provide the data

The receipt of personal data was dictated by the condition of being covered by the contract for the provision of health services and by a statutory requirement.