GDPR information clause
ENT Practice – Dorota Żółkowska
Each doctor is a separate controller of the personal data of patients in their own practice.
1. Personal data controller
The controller of your personal data is Dorota Żółkowska, carrying on an individual specialist medical practice (otorhinolaryngology), NIP: 6131014655, place where services are provided: Zielona 7, 59-800 Lubań.
Contact: tel. +48 600 810 832, email: gabinetzielona@gmail.com.
No data protection officer has been appointed, as the practice is not among the entities for which this is mandatory. For all matters concerning the protection of personal data, please contact us using the email address or telephone number above.
2. Purposes and legal bases for processing
- Provision of healthcare services (prevention, assessment and ENT treatment for children and adults) and maintaining medical records – Article 9(2)(h) GDPR in conjunction with the Act on Patient Rights and the Patient Rights Ombudsman, and the Medical Activity Act.
- Appointment booking and contact (telephone, email) – Article 6(1)(b) GDPR and Article 6(1)(f) GDPR (legitimate interest – handling enquiries).
- Billing, invoices, pursuing claims – Article 6(1)(c) and (f) GDPR.
- For minor patients, data of legal representatives (parents/guardians) is processed to the extent necessary to provide services and maintain records.
3. Data recipients and processors
We entrust some processing activities to entities that process data on behalf of the controller under data processing agreements (Article 28 GDPR):
- Providers of IT systems for medical records and appointment booking – processing identification, contact and health data to the extent necessary for managing medical records and booking appointments, under data processing agreements.
- Website hosting provider – with regard to data transmitted through the website.
- Email service provider – Google (Gmail service). Email correspondence may be processed on servers outside the European Economic Area under standard contractual clauses.
- Accounting office – billing documents.
- Diagnostic laboratories – for the purposes of commissioned examinations.
- Payment service providers – for the purpose of settling the appointment.
Independently of the above, data may be disclosed to entities authorised under the law (e.g. NFZ, courts, the Patient Rights Ombudsman). Disclosure to such entities is not processing on behalf of the controller; they become separate controllers of your data.
4. Processing on behalf of the controller and responsibility for data
Data processing agreements require each of the listed entities to process data only on the controller’s documented instructions, apply security measures appropriate to the risk (Article 32 GDPR), maintain confidentiality and promptly report every personal data breach to the controller (Article 33(2) GDPR).
The processor is responsible for data security in its own infrastructure. If damage arises because such an entity fails to fulfil obligations that the GDPR directly imposes on processors, or acts outside or contrary to the controller’s lawful instructions, that entity is liable in accordance with Article 82(2) GDPR.
For completeness: the controller remains responsible to you for ensuring processing complies with the GDPR (Article 24 GDPR) and cannot avoid that responsibility by referring to a provider. If more than one entity is involved in the same processing, they are jointly and severally liable to the person who suffered damage (Article 82(4) GDPR), and recourse between them takes place under Article 82(5) GDPR. In practice, this means you may direct your claim both to the controller and directly to the entity on whose side the breach occurred.
5. Personal data breaches
We report notifiable personal data breaches to the President of the Personal Data Protection Office in accordance with Article 33 GDPR. If a breach is likely to result in a high risk to your rights or freedoms, we will notify you without undue delay in accordance with Article 34 GDPR.
August 2026 – incident involving the provider of the MyDr system. On 12 August 2026, the Ministry of Digital Affairs confirmed that an unauthorised person had gained access to data at MyDr, the provider of the electronic medical records system. The incident did not take place in the practice’s systems. We publish current information on the matter, the status of findings and recommended steps on the website Patient information.
6. Retention period
- Medical records – as a rule 20 years from the end of the calendar year in which the last entry was made; medical records of children up to the age of 2 – 22 years (exceptions are specified in the Patient Rights Act).
- Billing documents – 5 years for tax purposes.
7. Your rights
You have the right to access your data and receive a copy, rectification, erasure (subject to statutory retention periods for medical records), restriction of processing, data portability (where processing is based on consent or a contract and is automated) and to object to processing based on legitimate interests. You also have the right to lodge a complaint with the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl) and the right to compensation under Article 82 GDPR.
8. Voluntary provision of data
Providing data is voluntary but necessary to book an appointment and provide healthcare services – without it, the medical records required by law cannot be maintained. The data is not subject to automated decision-making or profiling.