How do we process personal data in Invicta Medical Clinics and Laboratories

Beata Gozdecka
email address: daneosobowe@invicta.pl
ul. Polna 64
81-740 Sopot

As regards the consent to receiving information and consent to target the provided information: the provision of data is voluntary but may hinder staying in contact and the ongoing service.

In other cases (e.g. using the Medipoint.pl account, taking part in the process of qualifying for being a donor), providing data is voluntary; however, a failure to provide data will preclude the patient from using certain services or taking part in selected processes.

To this end, your personal data will be processed:

• in order to establish your identity prior to the provision of services, or verify data when making an appointment remotely (by phone, through a form or registration system) and directly at our Clinics, collection facilities and vaccination centres;
• for the purposes of contacting you (by phone, email) to confirm a booking or remind you to book an appointment or test, inform you to prepare for a scheduled procedure, inform you to collect test results, process your request or complaint;
• for the purpose of implementing the obligation to keep and maintain medical records;
• in order to qualify you for a publicly funded Infertility Treatment Programme, and then carry out the treatment and settle it with the funding entity;
• in reports on immunisation rates, as well as providing data and information on infections and infectious diseases to the relevant authorities;
• in order to improve the quality of the service, provide constant monitoring of the patients’ needs and expectations, send requests for evaluation of the services or short surveys;

We will send the surveys in a way that does not violate your rights.

If you do not wish to receive such messages, please let us know.

• Article 9(2)(h) of the GDPR,
  processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services
• Act on Patients’ Rights and the Patients’ Rights Ombudsman of 6 November 2008
• Act on Infertility Treatment of 25 June 2015
• Regulation of the Minister of Health of 23 March 2006 on quality standards for medical diagnostic and microbiological laboratories
• Act of 5 December 2008 on prevention and control of infections and communicable diseases in humans
• Quality Management System EN ISO 9001

Data retention period: Your personal data shall be kept for the period required for the storage and archiving of medical records as specified by law, in particular the Act of 6 November 2008 on Patients’ Rights and Patients’ Rights Ombudsman (Article 29) and the Act of 25 June 2015 on Infertility Treatment..

• carrying out an initial qualification for the donation of reproductive cells in non-partner donation;
• carrying out medical qualification for cell donation;
• carrying out the process of reproductive cell donation;
• fulfilling obligations under the law – creating medical records and entering data into the register;

• Article 9(2)(a) of the GDPR

the data subject has given explicit consent (…)

Data retention period: until consent is revoked

• Article 9(2)(h) of the GDPR,
  processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services
• Act on Patients’ Rights and the Patients’ Rights Ombudsman of 6 November 2008
• Act on Infertility Treatment of 25 June 2015
• Act on Patients’ Rights and the Patients’ Rights Ombudsman of 6 November 2008
• Act on Infertility Treatment of 25 June 2015

Data retention period: Your personal data shall be kept for the period required for the storage and archiving of medical records as specified by law, in particular the Act of 6 November 2008 on Patients’ Rights and Patients’ Rights Ombudsman (Article 29) and the Act of 25 June 2015 on Infertility Treatment..

Sometimes the provision of the service requires additional data (e.g. PESEL number), for example, for creating the patient’s file.

• Article 6(1)(b) of the GDPR

Processing is necessary for the performance of the contract

Data retention period: 5 years counted from the end of the calendar year in which the purchase was made.

• Article 9(2)(a) of the GDPR

the data subject has given explicit consent (…)

Data retention period: until consent is withdrawn, unless the data becomes part of the medical record.

• The Accounting Act of 29 September 1994
• Tax regulations

Data retention period: 5 years counted from the end of the calendar year in which the tax liability arose

• Article 9(1)(f) of the GDPR

processing is necessary for the establishment, exercise or defence of legal claims

Data retention period: until the expiration of the statute of limitations for any claims.

Patients can have their medical data sent to their account from the patient’s file.

• Article 9(1)(a) of the GDPR

the data subject has given explicit consent to the processing of those personal data

Data retention period: until consent is revoked

• Article 6(1)(f) of the GDPR

processing is necessary for the purposes of the legitimate interests pursued by the Controller

Data retention period: 14 days

• Article 9(1)(a) of the GDPR

the data subject has given explicit consent to the processing of those personal data

Data retention period: until the expiration of the statute of limitations for any claims.

• Article 9(2)(h) of the GDPR

processing is necessary for the purposes of the provision of health or social care or treatment or the management of health or social care systems and services

Data retention period: Your personal data shall be kept for the period required for the storage and archiving of medical records as specified by law, in particular the Act of 6 November 2008 on Patients’ Rights and Patients’ Rights Ombudsman (Article 29). 

• Article 9(1)(a) of the GDPR

the data subject has given explicit consent to the processing of those personal data

Data retention period: until consent is revoked.

• Article 9(1)(a) of the GDPR

the data subject has given explicit consent to the processing of those personal data

Data retention period: until consent is revoked

If you give consent to the automated processing of personal data, including profiling for the purpose of tailoring the provided information, the data received from you will be linked to the information on characteristics, behaviours or preferences in order to match commercial information to known or anticipated needs or expectations (profiling). This will provide you with the kind of information that suits your needs and interests.

• Article 9(1)(a) of the GDPR

the data subject has given explicit consent to the processing of those personal data

Data retention period: until consent is revoked.

• you have the right to demand access to your personal data, its rectification, erasure or restriction of processing;
• you have the right to object to the processing of your data and the right to transfer your data. Please submit requests directly to the Clinic or by email to daneosobowe@invicta.pl;
• the following data: surname and first name (middle name), date of birth, gender designation, address of residence, PESEL number (if assigned), in the case of a newborn – the mother’s PESEL number, and in the case of persons who have not been assigned a PESEL number – the type and number of an identity document, if the patient is a minor, incapacitated or incapable of providing informed consent – the surname and first name (middle name) of the legal representative and the address of their residence, as well as data on past, present or future physical or mental health status, including genetic data, is part of the medical record and cannot be removed by the Controller. This does not apply to the consent to transfer information or consent to profiling;
• you have the right to lodge a complaint with a supervisory authority (President of the Personal Data Protection Office (PUODO)) if you recognise that the processing of your personal data violates the provisions of the GDPR or other data protection laws;
• you have the right to withdraw your consent to the processing of your email address and phone number, as well as your consent to the transmission of information and consent to profiling at any time, without affecting the lawfulness of the processing based on the consent given before the withdrawal.

• entities that participate in the handling of the treatment process, to whom we entrusted personal data under an entrustment agreement;
• other medical entities that cooperate with INVICTA in order to ensure continuity of treatment and are the subcontractors of medical services;
• providers of technical and marketing services, in particular, providers of ICT services, diagnostic equipment, courier and postal companies, providers of marketing services (advertising agencies, companies that handle sms and email sending campaigns),
• providers of legal services in the situation of exercising claims;
• persons authorised by you to access your medical records and health information;
• entities that provide financing to medical services, in particular the National Health Fund and state and local government entities, with regard to infertility treatment programmes.

The transfer of your personal data to a third country will only be possible upon your explicit request.