Privacy policy

PRIVACY POLICY, INCLUDING THE RULES FOR USING COOKIES

1. The privacy policy includes:

   1. all necessary information regarding the processing of personal data by MALO CLINIC Polska sp. z o.o. with its registered office in Warsaw (02-672) at ul. Domaniewska 37, entered into the Register of Entrepreneurs of the National Court Register maintained by the District Court for the Capital City of Warsaw in Warsaw, XII Commercial Division of the National Court Register under KRS number: 0000242331, holding NIP: 5252341737, REGON: 140078686, hereinafter referred to as "MALO CLINIC", in connection with the entry into force of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), hereinafter referred to as the "General Data Protection Regulation" or "GDPR" (POINTS 2 TO 39);

   2. rules for using cookies (POINTS 40 TO 45).

PROCESSING OF PERSONAL DATA IN CONNECTION WITH

1. THE APPLICATION OF GDPR

2. Since 25 May 2018, the "General Data Protection Regulation" ("GDPR") has been in force.

3. The GDPR applies directly, without the need to implement it into Polish law, which means that Polish acts or executive regulations do not need to be issued. Pursuant to Art. 91 (3) of the Polish Constitution, the provisions of the GDPR have priority of application in the event of a conflict with Polish acts.

4. The GDPR applies to the processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system (see Art. 2 (1) of the GDPR).

5. The GDPR introduces the following concepts important from the point of view of personal data protection:

   1. "personal data" means any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

   2. "processing" means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction (Art. 4 (2) of the GDPR);

   3. "controller" means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data (Art. 4 (7) of the GDPR);

   4. "processor" means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller;

   5. "recipient" means a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not;

   6. "data concerning health" means personal data related to the physical or mental health of a natural person, including the provision of health care services, which reveal information about his or her health status.

6. It follows from the cited legal provisions that the controller within the meaning of the GDPR is the medical entity and not the head of this entity, a doctor, or another employee.

7. The controller of MALO CLINIC patients' personal data, and thus the entity that independently determines the purposes and methods of processing personal data, is MALO CLINIC Polska sp. z o.o. with its registered office in Warsaw (02-672) at ul. Domaniewskiej 37, entered into the Register of Entrepreneurs of the National Court Register kept by the District Court for the Capital City of Warsaw in Warsaw, XII Commercial Division of the National Court Register under KRS number: 0000242331, holding NIP: 5252341737, REGON: 140078686.

8. The GDPR provides in Art. 5 for the following "Principles relating to processing of personal data":

   1. principle of lawfulness, fairness and transparency – personal data must be processed lawfully, fairly and in a transparent manner in relation to the data subject;

   2. principle of purpose limitation – personal data must be collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes;

   3. principle of data minimisation – personal data must be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed;

   4. principle of accuracy – personal data must be accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay;

   5. principle of storage limitation – personal data must be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed;

   6. principle of integrity and confidentiality – personal data must be processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.

9. MALO CLINIC, as a controller within the meaning of the GDPR, is responsible for, and must be able to demonstrate compliance with, the above-mentioned principles (accountability principle).

10. MALO CLINIC may process the data of various categories of persons, such as: potential patients, patients, employees, job applicants, employees of commercial law companies and other business entities being contractors of MALO CLINIC.

11. MALO CLINIC may act as a personal data processor on behalf of another entity (e.g. another medical entity) – in which case the entity deciding on the processing and responsible for the lawfulness of processing will be another data controller.

12. The lawfulness principle implies that data processing is lawful if it is based on the consent of the data subject or on another legitimate basis provided for by law, i.e. in the GDPR or in another EU legal act or in the law of a Member State referred to in the GDPR.

13. According to Art. 6 (1) (c) of the GDPR, processing is lawful when it is necessary for compliance with a legal obligation to which the controller is subject. If the processing is carried out in order to fulfill a legal obligation to which the controller is subject, the basis for processing should be Union law or Member State law; it is sufficient for the legal provision to form the basis for various processing operations resulting from the legal obligation to which the controller is subject. In the recitals of the GDPR, it is assumed that Union or Member State law should also determine the purpose of processing.

14. The purpose and legal basis for the processing of personal data by MALO CLINIC depend primarily on the context in which the data was collected and who the data concerns. In some cases, MALO CLINIC may process the data of the same person for different purposes and based on different legal bases. The purpose and legal basis of the processing are related to the category of persons whose data MALO CLINIC collects, what the data is needed for, and what legal obligations lie with MALO CLINIC in connection with the circumstances. These issues primarily determine why MALO CLINIC needs to process certain personal data.

15. MALO CLINIC provides information on data processing at the time of collecting data from the data subject, and in the case where the data is collected in another way, informs immediately after obtaining the data or at the first contact with such person. If providing information is excessively difficult, MALO CLINIC may refrain from informing directly, instead publishing the information publicly, e.g. on its website.

16. Data processing by MALO CLINIC is necessary to fulfill legal obligations resting on the controller, such as:

    1. establishing identity before providing a healthcare service (including application for medical care, verification of data when arranging an appointment remotely or in a doctor's office – Art. 6 (1) (c) and Art. 9 (2) (h) of the GDPR in connection with Art. 25 point 1 of the Act of 6 November 2008 on Patient Rights and the Patients' Rights Ombudsman (Journal of Laws of 2017, item 1318, as amended), hereinafter referred to as the "Patient Rights Act", and § 10 (1) point 2 of the Regulation of the Minister of Health of 9 November 2015 on the types, scope and templates of medical documentation and the method of its processing (Journal of Laws of 2015, item 2069, as amended), hereinafter referred to as the "Regulation on medical documentation";

    2. keeping, storing and sharing medical records – Art. 6 (1) (c) and Art. 9 (2) (h) of the GDPR in connection with Art. 24 (1) of the Patient Rights Act and the Regulation on medical documentation;

    3. realisation of patient rights of MALO CLINIC, including receiving
       and storing declarations authorising access to medical documentation and providing information on the state of health of MALO CLINIC patients – Art. 6 (1) (c) and Art. 9 (2) (h) of the GDPR in connection with Art. 9 (3) and 26 (1) of the Patient Rights Act and § 8 (1) of the Regulation on medical documentation;

    4. keeping accounting records, fulfilling tax obligations, issuing invoices – Art. 6 (1) (c) of the GDPR in connection with Art. 74 (2) of the Accounting Act of 29 September 1994.

17. The processing of patients' personal data by MALO CLINIC is also carried out in cases where it is necessary for the purposes of the legitimate interests pursued by MALO CLINIC as a controller, such as:

    1. patient service, including maintaining contact with patients using the telephone numbers and e-mail addresses provided by them (confirming or cancelling appointments, reminding patients about appointments, informing about facts regarding provided healthcare services, including the need to prepare for a visit or procedure or the possibility of collecting test results – Art. 6 (1) (b) and (f) of the GDPR;

    2. asserting claims arising from the conducted economic activity – Art. 6 (1) (b) and (f) of the GDPR.

18. MALO CLINIC may direct marketing correspondence to patients regarding its activities, including offers, information about goods, services or promotions (in accordance with the consent granted by the patient – e-mail addresses or telephone numbers (SMS, MMS or incoming calls) are used) – Art. 6 (1) (a) of the GDPR in connection with Art. 172 (1) of the Telecommunications Law Act of 16 July 2004 (Journal of Laws of 2017, item 1907, as amended) in connection with Art. 10 (2) of the Act
    of 18 July 2002 on providing services by electronic means (Journal of Laws of 2017, item 1219, as amended). The above means that the telecommunication terminal equipment and automatic calling systems used by MALO CLINIC for direct marketing purposes will only be used if the subscriber or end user has previously given consent. The use of these means for direct marketing purposes may not be at the expense of the consumer (patient). Commercial information will only be sent if the recipient (patient) agrees to receive it, in particular by providing an electronic address identifying them for this purpose.

19. MALO CLINIC processes the following scope of personal data for the purposes indicated above, in particular:

    1. health data;

    2. identification data, including in particular those found in identity documents of persons who use MALO CLINIC health services or represent other persons or entities in contacts with MALO CLINIC (e.g. names and surnames, PESEL numbers, identity document numbers);

    3. contact and address details (such as residential address, correspondence address, telephone numbers, or e-mail address);

    4. financial data, including data regarding the financing of completed healthcare services;

    5. data concerning marital status and family situation;

    6. technical and search data on the website, which may be personal data (e.g. IP addresses, cookie identifiers, browsing history data of MALO CLINIC websites, etc.).

20. Personal data processed by MALO CLINIC include "data concerning health". Pursuant to Art. 9 (1) of the GDPR – in principle – the processing of data concerning health is prohibited. Exceptions where this prohibition does not apply are set out in Art. 9 (2) of the GDPR. In the case of MALO CLINIC, the provision of Art. 9 (2) (h) of the GDPR applies, according to which the prohibition of processing "data concerning health" does not apply when processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of Union or Member State law or pursuant to contract with a health professional and subject to the conditions and safeguards referred to in Art. 9 (3) of the GDPR.

21. Personal data processed by MALO CLINIC including "data concerning health" are contained in medical documentation, including the Medical History, which is covered by medical secrecy.

22. In order to provide the patient with medical care and verify their identity, MALO CLINIC requires the completion of a personal questionnaire, which includes the following data:

    1. patient's surname and first name(s);

    2. contact phone number and e-mail address;

    3. date of birth;

    4. PESEL;

    5. residential address.

23. For marketing reasons, MALO CLINIC obtains, optionally, information on whether the patient's employer has signed a cooperation agreement with MALO CLINIC and whether the patient's family members are also patients of MALO CLINIC, as well as information on the reasons for using MALO CLINIC services and the source of information about MALO CLINIC.

24. In connection with the provision of healthcare services, MALO CLINIC creates medical documentation in which it records information regarding the treatment process, in particular information about the state of health, as well as information
    about addictions or sexual preferences of patients. This information is collected if it is necessary for diagnosis and proper management of the treatment process.

25. MALO CLINIC asks the patient to provide an e-mail address or telephone number to ensure communication during the treatment process and to carry out marketing correspondence.

26. Persons whose personal data are processed by MALO CLINIC can contact at telephone number: (+48 22 393 6333).

27. The recipients of personal data of persons whose data are processed by MALO CLINIC may be the persons and entities mentioned in the Act of 6 November 2008 on Patient Rights and the Patients' Rights Ombudsman (i.e. Journal of Laws of 2017, item 1318, as amended), to whom the Controller is obliged to share medical documentation.

28. MALO CLINIC does not transfer personal data to a third country (a country outside the European Union) or to an international organisation.

29. The purpose of the GDPR is to ensure that everyone has the opportunity to protect their rights and freedoms and to ensure control over the processing of their data. The person whose data is processed by MALO CLINIC has the right of access to the content of their data and the right to rectify, erase, and restrict processing – within the scope and on the conditions specified in Art. 15, 16, 17 and 18 of the General Data Protection Regulation, respectively.

30. Right of access to data – the data subject has the right to obtain information, among others, on what data MALO CLINIC processes, for what purposes they are processed, and to obtain a copy of them. A natural person may request MALO CLINIC for information on whether MALO CLINIC processes their personal data.

31. Right to data erasure (the right to be forgotten) – the data subject may indicate the scope and circumstances justifying the requested data erasure. e.g. the data are no longer necessary for the purposes for which they were collected, and there are no legal grounds for further data processing, the data are processed unlawfully. The right to data erasure can be exercised in cases where MALO CLINIC has no legal basis for data processing. In the case of personal data contained in medical records, personal data cannot be deleted from them for the time specified in the Patient Rights Act.

32. Right to data portability – the data subject has the right to receive
    in a structured, commonly used and machine-readable format personal data concerning them, which they have provided to MALO CLINIC. A request for data portability can be made by the data subject. The information will be provided in the form of a file transferred on a password-protected CD.

33. Right to restriction of data processing – the data subject indicates that the premises specified in Art. 18 of the GDPR for restricting the processing of their data have occurred, e.g. MALO CLINIC does not need certain data, there are no grounds for further processing and the data subject requests to stop operations on the data or not to delete the data. Each request for restriction of data processing will require individual consideration in terms of existing bases for data processing, the purpose and scope of their processing.

34. Right to data rectification – at any time, when the need arises, the data subject informs MALO CLINIC of a change in their personal data. The person whose personal data is processed by MALO CLINIC may ask MALO CLINIC to rectify incorrect or complete incomplete personal data.

35. Right to object – at any time, you can object to the automated processing of data, including profiling, as well as object to the processing of data for marketing purposes. An objection to data processing can be submitted, for example, at the registered office of MALO CLINIC, or by letter to the address of MALO CLINIC's registered office.

36. The person whose data is processed by MALO CLINIC has the right to lodge a complaint with the supervisory authority – the President of the Personal Data Protection Office, when you consider that the processing of personal data concerning you violates the provisions of the GDPR.

37. In cases where consent to the processing of personal data is required
    and MALO CLINIC has obtained such consent, the person whose data is processed by MALO CLINIC has the right to withdraw consent at any time, without any negative consequences. Withdrawal of consent to the processing of personal data is possible only in cases where consent is the sole legal basis for data processing (e.g. consent to data processing cannot be withdrawn when they are processed for the purpose of executing an agreement, including MALO CLINIC asserting claims related to it). Consent can be the sole legal basis for the processing of data of, for example, potential patients of MALO CLINIC. All consents are granted voluntarily and can always be withdrawn. Withdrawal of consent does not affect the right of MALO CLINIC to process data up to the moment of its withdrawal.

38. Providing by the patient personal data necessary for keeping medical records is a condition for undertaking the treatment process. The consequence of failing to provide personal data may be refusal to provide medical services.

39. Data is processed in IT systems.

RULES FOR USING COOKIES.

40. For the convenience of persons using the website, maloclinics.pl uses cookies in order to adapt the website to the needs of users, as well as for statistical purposes.

41. Cookies are small text files sent by the visited website to the user's device (computer, smartphone, etc.). They do not contain any personal data.

42. The maloclinics.pl website uses two types of cookies:

    1. performance cookies (collecting information on how visitors use the website, e.g. most visited pages or error messages, etc.);

    2. functional cookies (saving user settings, e.g. language, expressed consents, etc.), such as:
       a) google-analytics.com cookies – used to maintain statistics for the gov.pl website; the exact way of functioning and privacy policy of Google Analytics can be found at: http://www.google.com/analytics/learn/privacy.html,
       b) inspectlet.com cookies – used to determine how users use the website; the exact way of functioning and privacy policy can be found at: https://www.inspectlet.com/legal,
       c) session cookies – these are temporary information stored in the browser memory until the end of the session, i.e. its closing.

43. Third-party websites, to which we sometimes refer, may also use cookies that enable logging in and delivering advertisements corresponding to the user's preferences and behavior. In particular, such cookies are:

    1. on the youtube.com website – containing user preferences and a click counter; YouTube's privacy policy is described at: http://www.google.pl/intl/pl/policies/privacy/;

    2. on player.vimeo.com and av.vimeo.com – allowing to log in, as well as cookies placed by advertisers to adjust the content and forms of advertisements; the cookie policy of Vimeo is available at http://vimeo.com/cookie_policy.

44. In most web browsers, you can: delete cookies from your computer's hard drive (from the browser settings level), block all sent cookies or set a warning before saving them on the disk. It should be borne in mind that changing the settings of these files by restricting their use may affect some functionalities available on websites using them, e.g. preventing logging into an email account. No change in these settings means acceptance of the use of cookies.

45. Changing cookie settings in the most popular browsers:

    1. Google Chrome: Menu > Settings > Show advanced settings > Privacy > Content settings > Cookies – select the appropriate option;

    2. Internet Explorer: Menu > Tools > Internet Options > Privacy – select the appropriate option;

    3. Mozilla Firefox: Menu > Options > Privacy > History – select the appropriate option;

    4. Opera: Menu > Preferences > Advanced > Cookies – select the appropriate option;

    5. Safari: Menu > Preferences > Privacy > Cookies – select the appropriate option.

This website uses cookies. We use cookies to personalise content and ads, to provide social media features and to analyse our traffic. We also share information about your use of our site with our social media, advertising and analytics partners. Partners may combine this information with other data they have received from you or that they have collected during your use of their services.

Cookies are small text files that can be used by websites to make a user's experience more efficient.

The law states that we can store cookies on your device if they are strictly necessary for the operation of this site. For all other types of cookies we need your permission.

This site uses different types of cookies. Some cookies are placed by third party services that appear on our pages.

You can at any time withdraw your consent from the Cookie Declaration on our website.

Learn more about who we are, how you can contact us and how we process personal data under our Privacy Policy.

Please provide your consent ID and date of contact with us regarding your consent.

Your consent applies to the following domains: www.maloclinics.pl

Your current state: Denied. 

Your consent ID: q670+yjc+VZ2WwvKKbxvpT4OUbRyVvgLaKVcmTwWuEDoO6BN5JoJYQ==Consent date: Wednesday, July 29, 2026 1:12:47 PM GMT-3

Change your consent