Information Clause

Detailed information about the processing of personal data by Medicover Sp. z o.o., Al. Jerozolimskie 96, 00-807 Warszawa, in connection with the requirements set out in article 13 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter referred to as “GDPR”).

Data Controller	Medicover Sp. z o.o., Al. Jerozolimskie 96, 00-807 Warszawa
Purposes of the processing	To be covered by a medical care contract, provision of medical services, provision of non-medical services (including in particular choosing the right spectacles and corrective lenses), direct marketing of the Data Controller’s services (including profiling), financial settlements and debt collection, handling of complaints, archiving and statistics
Legal basis for the processing	Legal obligation/medical care contract/non-medical services contract/our legitimate interest
Recipients of data	Entities processing personal data on behalf of the Data Controller, entities authorised under the law, entities authorised by you
Data sources and data obtained	Entity that has entered into a medical care contract (applies to individuals for whom services are provided under group contracts), natural person that has entered into a medical and non-medical care contract
Rights related to data processing	Right to object to data processing for marketing purposes, right to object to data processing on account of specific circumstances, right to data portability, right of access to data, other rights referred to in the detailed information about the processing of data

1. Personal Data Controller

The Controller of your personal data is Medicover Sp. z o.o., Al. Jerozolimskie 96, 00-807 Warszawa (“we”). You can contact us:

• by writing a letter to the following address: Dział Obsługi Klienta [Customer Service Department], Medicover Sp. z o.o., Al. Jerozolimskie 96, 00-807 Warszawa;
• using the contact form available at www.medicover.pl;
• by email (dok@medicover.pl);
• by calling us at +48 500 900 500.

2. Data Protection Officer

We have appointed a Data Protection Officer. This is a person you can contact in all matters related to the processing of personal data and exercising the rights related to data processing. You can contact the Data Protection Officer:

• by writing a letter to the following address: Medicover sp. z o.o., Al. Jerozolimskie 96, 00-807 Warszawa, with a note: “Data Protection Officer”;
• by email (IOD@medicover.pl).

Ms Monika Sobczyk is our Data Protection Officer.

3. Purposes of the processing of your personal data and legal basis for the processing

We will process your personal data for the following purposes:

• to sell you services via our online store;
• to provide you with medical services;
• to include you in a contract for the provision of services, to provide you with other types of services, such as choosing the right spectacles and corrective lenses;

• to manage the provision of services by us;
• to make business settlements;
• to handle received complaints, opinions and requests;
• to provide materials to promote products and services, including based on profiling;
• to archive your data in accordance with regulations;
• to exercise and defend claims;
• to ensure security and safety of people and property, in particular with the use of the CCTV surveillance system;
• to comply with requests concerning your rights under GDPR;
• to conduct quality and satisfaction surveys (including based on profiling).

Legal basis for the processing of your data:

• provision of healthcare and medical services, protection of your health, preventive health care and management of the provision of these services. Such processing is governed by laws and regulations, including in particular the Health Care Services Act and the Patients’ Rights and Commissioner for Patients’ Rights Act, and is done in conjunction with article 6(1)(c) and 9(2)(h) of GDPR;
• your consent to the processing of your special category data for purposes other than those related to your treatment, in conjunction with article 9(1)(a) of GDPR;
• performance of a contract for the provision of services and being covered by a medical care contract, in conjunction with article 6(1)(b) of GDPR;
• performance of a contract for keeping the online store account and the sale of services, in conjunction with article 6(1)(b) of GDPR;
• your consent to the processing of personal data for the purpose specified directly in the consent, in conjunction with article 6(1)(a) of GDPR;
• our legitimate interest, in conjunction with article 6(1)(f) of GDPR, involving the following:
  • satisfaction and opinion surveys on the use of our services (including profiling);

• exercising claims, defending claims and handling complaints;
• handling received complaints, requests and opinions;
• ensuring security and safety of people and property, in particular with the use of the CCTV surveillance system;
• carrying out marketing and sales operations in accordance with your preferences as to the content and using the communication channels (including profiling);
• provision of information material concerning the use of our services, e.g. concerning improvements in access to our services;
• applicable laws and regulations, in conjunction with article 6(1)(c) of GDPR, concerning in particular the following:
  • keeping financial and tax accounts and archiving these data in particular in conjunction with the Accounting Act;
  • exercising your rights under GDPR;
• taking action to prevent diseases in connection with a task carried out in the public interest as far as health is concerned in conjunction with article 6(1)(e) of GDPR.

4. Information about profiling

Your personal data are subject to profiling, i.e. automatic evaluation of certain personal aspects relating to you.

We perform profiling to appropriately select communication and promotional materials to promote Data Controller’s business. Based on your profile, we will select appropriate content of information and promotional materials.

We use the following data for profiling: patient number, first name, last name, age, gender, language, date of birth, location, centres visited, type of product purchased and data source. In addition, when profiling, we take into account statistics on your behaviour on websites and in mobile applications, your use of the Medicover Online patient portal and your preferences on Medicover Polska’s websites and in Medicover Polska’s applications.

Your data will also be profiled in connection with our provision of the highest quality services. Therefore, in certain situations, including when issuing a referral, we will process your personal data related to the provision of services by means of an algorithm that assists the persons who provides services to you. We ensure that decisions about you are always made directly by the person providing the service. If you feel that the algorithm may have misjudged your situation, you can exercise your right to be subject only to human judgement and ask us to explain how the algorithm works.

5. Personal data retention period

As a rule, we will process your data:

• for 20 years – in connection with keeping and archiving medical records from the time of the last entry made in these medical records, except for situations described in article 29(1) in accordance with the Patients’ Rights and Commissioner for Patients’ Rights Act;
• for 6 years – in connection with the exercise and defence of claims related to the provided services;
• 5 years – for accounting and tax purposes; this period is calculated from the end of the calendar year in which the tax became chargeable;
• for 30 days – in connection with the use of the CCTV surveillance system;
• until you object or withdraw your consent to the processing of your personal data if we have processed your data based on such consent.

6. Recipients of your personal data

We will transfer your personal data to the following categories of recipients:

• sub-suppliers that provide services purchased via the online store;
• entities processing data on our behalf; these are entities which provide various services, e.g. IT and marketing services, for us;
• entities authorised under the law, including in particular the following:
• health care providers in order to ensure continuity of treatment and availability of healthcare, being our own centres and partner centres;
• insurance companies;
• public authorities having the right to obtain your data in connection with the conducted proceedings;
• the National Health Fund in connection with the provision of services financed from public funds;
• entities authorised by you.

If you are a patient of another Medicover Polska entity (Medicover Sp. z o.o., Medicover Forsakring AB (Publ) S.A. Oddział w Polsce, Medvit Sp. z o.o. or Denta Care Sp. z o.o.), your contact details, i.e. your home address, e-mail address and phone number, will also be updated at this entity to ensure the highest quality of the treatment process, in particular to make it easier to contact you.

7. Your rights related to the processing of personal data

You have the following rights in relation to the processing of your personal data:

1. the right to object to the processing of your data for marketing purposes or quality and satisfaction surveys – as we process your data based on a legitimate interest;
2. the right to object to the processing of your data on account of specific circumstances – where we process your data based on our legitimate interest for purposes other than those listed in item 1 above;
3. the right of access to your personal data;
4. the right to request rectification of your personal data;
5. the right to request the erasure of your personal data (only where we are not required by the law to process them);
6. the right to request that the processing of your personal data be restricted;
7. the right to data portability, i.e. the right to receive your personal data from us in a structured, commonly used and machine-readable format. You may transmit those data to another data controller or request that we transmit your data to another data controller. However, we will only do this where it is technically feasible.

To exercise the above rights, contact us or our Data Protection Officer (contact details are given in section 1 and 2 above).

Right to lodge a complaint with a supervisory authority

You also have the right to lodge a complaint with a personal data protection supervisory authority, i.e. the President of the Personal Data Protection Office.

The right to withdraw consent to the processing of personal data

If your data are processed based on your consent, you have the right to withdraw it at any time without bearing any negative consequences. This will not affect the lawfulness of processing based on your consent before its withdrawal.

8. Transfer of data to third-party countries

To ensure the highest possible quality of our services, we use third-party providers, e.g. as far as IT support is concerned. As a result, your personal data may be transferred outside the European Union. We assure you that in such a case your data will be transferred based on an appropriate agreement between us and such provider containing standard data protection clauses adopted by the European Commission or based on a relevant decision of the European Commission.

9. Obligation to provide data

In the case of using medical services, provision of personal data is required by the law. Providing data in order to use other types of services or to enter into a contract is voluntary, but failure to provide them will make it impossible to provide services and to enter into a contract.