Privacy policy

01

Data controller

The controller of your personal data is Michał Swolkień, MD, running a private medical practice, tax ID (NIP) 6762209575, medical licence number (PWZ) 2404369, register of medical activity entry no. 57-11-2404369, seeing patients at Andromeda Centrum Medyczne, ul. Mogilska 69A, 31-545 Kraków, Poland.

I am responsible for data processed in connection with running this website and for correspondence sent to my e-mail address — including information about your health that you send me in a message; I process it as a physician, within my private practice, under medical confidentiality. I provide healthcare services under contracts with medical entities, at their facilities. Data collected at registration, during the visit and in medical records is processed by the medical entity where the visit takes place — it is the controller in that respect and it provides information on its processing. Visits in Kraków take place at Andromeda Centrum Medyczne, run by Urocentrum sp. z o.o.

02

Contact about your data

For any matter concerning personal data you can reach me:

• by e-mail - kontakt@michalswolkien.pl
• by post - Andromeda Centrum Medyczne, ul. Mogilska 69A, 31-545 Kraków, Poland

03

What data I process and where it comes from

Below I describe what data reaches me, and what happens to the data you give when booking a visit or over the phone.

E-mail contact

I process the data you provide in your message — usually your name, e-mail address and the content of your enquiry. The mailbox runs on Microsoft 365, licensed to my practice.

Health-related correspondence

If your message contains information about your health — for example records for review before a consultation, or follow-up results after a procedure — I process it as a physician, within my private practice, in order to assess your situation and to prepare or continue treatment. I am bound by medical confidentiality. Information relevant to the course of treatment is passed to the medical records kept by the facility where the treatment takes place — that is where your file is held.

Booking a visit

Booking runs in Medfile, operated by the facility where the visit takes place. The data you give when booking goes to that facility, not to me. Its own privacy policy sets out how it is processed.

Phone contact

The number given on the site is answered by the facility's reception. Calls, and the data given in them, are processed by the facility.

Server logs

Every visit to the site is logged automatically by the hosting provider, Cloudflare, Inc. This covers the IP address, the date and time of the request, the page visited, and the browser and operating system type.

Visit statistics

I use Cloudflare Web Analytics — a tool that sets no cookies and builds no profile of visitors. It collects aggregate traffic data: the number of visits, which pages are popular, where visits come from and how fast the site runs. I do not link this data to your identity. I also use Google Search Console, which shows aggregate statistics of the searches that lead to the site, with no identifying data.

Embedded content

Some data is collected directly by the services whose content is embedded on the site — section 09 describes this.

Providing data is voluntary. Without an e-mail address I cannot reply to your message.

04

Purposes and legal bases

• answering an e-mail message — Art. 6(1)(f) GDPR (legitimate interest in contact with an interested person);
• processing information about health provided in correspondence — Art. 9(2)(h) GDPR (preventive medicine, medical diagnosis, provision of health care — processing by a health professional bound by medical confidentiality);
• keeping statistics and keeping the site secure and working correctly — Art. 6(1)(f) GDPR;
• establishing, exercising or defending legal claims — Art. 6(1)(f) and Art. 9(2)(f) GDPR.

05

How long I keep data

• ordinary e-mail correspondence — up to 12 months from the end of the matter;
• correspondence containing information about health — up to 20 years, counted from the end of the calendar year of the last contact in the matter; the period matches the retention periods for medical records and serves continuity of care and the establishment, exercise or defence of claims;
• server logs and statistical data — in line with the retention period applied by the hosting provider (Cloudflare);
• data needed to establish, exercise or defend claims — until the limitation period expires.

06

Who receives the data

I do not sell data and do not pass it on for other organisations' marketing. Data may be shared with:

• Microsoft Ireland Operations Ltd. — provider of the e-mail service (Microsoft 365);
• Cloudflare, Inc., based in the USA — provider of the site's hosting (Cloudflare Pages) and of the visit statistics;
• bodies authorised by law.

07

Transfers outside the European Economic Area

The site embeds content from services whose providers may process data outside the European Economic Area - this concerns TikTok and Google (Google Maps, YouTube). Transfers follow the rules set by those providers, usually standard contractual clauses approved by the European Commission.

A transfer happens the moment your browser fetches the embedded content. TikTok videos load only after you click the video card - until then the page makes no connection to TikTok. The Google map, by contrast, loads on its own once you scroll to it.

The scope and purpose of any further processing are set by those services' own privacy policies, which I do not control.

The hosting and statistics provider — Cloudflare, Inc., based in the USA — may process data such as IP addresses and server logs outside the European Economic Area. The transfer is based on the European Commission's adequacy decision (Cloudflare's certification under the EU-US Data Privacy Framework), alongside standard contractual clauses in the agreement with the provider. E-mail runs in Microsoft 365, where data is stored in the European Union.

08

Your rights

In connection with the processing of your data you have the right to:

• access your data and receive a copy of it;
• have inaccurate data corrected and incomplete data completed;
• have your data erased;
• restrict processing;
• data portability, for data processed on the basis of consent or a contract;
• object to processing based on legitimate interest;
• withdraw consent at any time - without affecting the lawfulness of processing carried out before the withdrawal.

Rights concerning data processed in connection with a visit and with medical records are handled by the facility where the visit took place.

I do not make automated decisions about you and I do not profile your data.

If you believe your data is processed unlawfully, you may lodge a complaint with the President of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warsaw, Poland.

09

Cookies and embedded content

This site sets no cookies of its own. I keep visit statistics in a tool that uses no cookies and does not profile visitors. Data may, however, be stored on your device by the services whose content is embedded here:

• TikTok - videos embedded on treatment and consultation pages; the video and the TikTok script load only after you click the video card;
• Google Maps - the directions map on the home page; it loads together with the page;
• YouTube - videos embedded in privacy-enhanced mode (youtube-nocookie), which stores nothing until playback starts;
• Medfile - the booking widget on the home page; it loads together with the page.

You can delete and block cookies in your browser settings. Blocking third-party storage may stop the embedded videos and the map from displaying and the booking widget from working.

10

Medical records

The rules for keeping, storing and releasing medical records follow from the Act on Patient Rights and the Patient Ombudsman. Records are kept and released by the medical entity where the visit took place — you apply for a copy at that facility's reception, and it will tell you the rules and any fees. Booking a visit through this site does not in itself start treatment.

11

Changes to this policy

I update this policy whenever the way the site works or the scope of the data processed changes. The date of the last update is shown at the top of the document.