GDPR information clause

Private Medical Practice Krzysztof Żółkowski – urology and aesthetic medicine

Each doctor is a separate controller of the personal data of patients in their own practice.

1. Personal data controller

The controller of your personal data is Krzysztof Żółkowski, carrying out medical activity under the business name Private Medical Practice Krzysztof Żółkowski, NIP: 6131590689, place where services are provided: Zielona 7, 59-800 Lubań.
Contact: tel. +48 571 271 999, email: gabinetzielona@gmail.com.

No data protection officer has been appointed, as the practice is not among the entities for which this is mandatory. For all matters concerning the protection of personal data, please contact us using the email address or telephone number above.

2. Purposes and legal bases for processing

• Provision of healthcare services (prevention, assessment and treatment – urology and aesthetic medicine) and maintaining medical records – Article 9(2)(h) GDPR in conjunction with the Act on Patient Rights and the Patient Rights Ombudsman, and the Medical Activity Act.
• Appointment booking and contact (telephone, WhatsApp, website form, email) – Article 6(1)(b) GDPR (steps prior to entering into a contract) and Article 6(1)(f) GDPR (legitimate interest – handling enquiries).
• Billing, invoices, pursuing claims – Article 6(1)(c) and (f) GDPR.
• Marketing communications (e.g. reminders about procedures) – only on the basis of separate, voluntary consent, Article 6(1)(a) GDPR.
• Photographic documentation of aesthetic procedures – as part of the medical records; any publication of an image requires separate written consent.

3. Data recipients and processors

I entrust some processing activities to entities that process data on my behalf under data processing agreements (Article 28 GDPR):

• Providers of IT systems for medical records and appointment booking – processing identification, contact and health data to the extent necessary for managing medical records and booking appointments, under data processing agreements.
• Website hosting provider – with regard to data transmitted through the website.
• Email service provider – Google (Gmail service). Email correspondence may be processed on servers outside the European Economic Area under standard contractual clauses.
• Accounting office – billing documents.
• Diagnostic laboratories and histopathology laboratories – for the purposes of commissioned examinations.
• Payment service providers – for the purpose of settling the appointment.
• Docplanner (ZnanyLekarz) – where a booking is made through this service.
• Meta Platforms (WhatsApp) – where contact is made through the messenger; data may be transferred to third countries under standard contractual clauses.

Independently of the above, data may be disclosed to entities authorised under the law (e.g. NFZ, courts, the Patient Rights Ombudsman). Disclosure to such entities is not processing on behalf of the controller; they become separate controllers of your data.

4. Processing on behalf of the controller and responsibility for data

Data processing agreements require each of the listed entities to process data only on the controller’s documented instructions, apply security measures appropriate to the risk (Article 32 GDPR), maintain confidentiality and promptly report every personal data breach to the controller (Article 33(2) GDPR).

The processor is responsible for data security in its own infrastructure. If damage arises because such an entity fails to fulfil obligations that the GDPR directly imposes on processors, or acts outside or contrary to the controller’s lawful instructions, that entity is liable in accordance with Article 82(2) GDPR.

For completeness: the controller remains responsible to you for ensuring processing complies with the GDPR (Article 24 GDPR) and cannot avoid that responsibility by referring to a provider. If more than one entity is involved in the same processing, they are jointly and severally liable to the person who suffered damage (Article 82(4) GDPR), and recourse between them takes place under Article 82(5) GDPR. In practice, this means you may direct your claim both to me and directly to the entity on whose side the breach occurred.

5. Personal data breaches

I report notifiable personal data breaches to the President of the Personal Data Protection Office in accordance with Article 33 GDPR. If a breach is likely to result in a high risk to your rights or freedoms, I will notify you without undue delay in accordance with Article 34 GDPR.

August 2026 – incident involving the provider of the MyDr system. On 12 August 2026, the Ministry of Digital Affairs confirmed that an unauthorised person had gained access to data at MyDr, the provider of the electronic medical records system. The incident did not take place in the practice’s systems. I publish current information on the matter, the status of findings and recommended steps on the website Patient information.

6. Retention period

• Medical records – as a rule 20 years from the end of the calendar year in which the last entry was made (exceptions are specified in the Patient Rights Act).
• Billing documents – 5 years for tax purposes.
• Data processed on the basis of consent – until it is withdrawn.

7. Your rights

You have the right to access your data and receive a copy, rectification, erasure (subject to statutory retention periods for medical records), restriction of processing, data portability (where processing is based on consent or a contract and is automated), to object to processing based on legitimate interests, and to withdraw consent at any time (without affecting the lawfulness of processing before withdrawal). You also have the right to lodge a complaint with the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl) and the right to compensation under Article 82 GDPR.

8. Voluntary provision of data

Providing data is voluntary but necessary to book an appointment and provide healthcare services – without it, we cannot keep the medical records required by law. The data is not subject to automated decision-making or profiling.