Privacy Policy

1. Data Controller

The controller of your personal data is Prof. Mateusz Koziej, MD, PhD, conducting business under the name FibraMed Mateusz Koziej, ul. Wrocławska 43a/36, 30-011 Kraków, Tax ID 7481570512 (hereinafter: the Controller).

For matters concerning personal data, you may contact the Controller in writing at the above address, by email at kontakt@mateuszkoziej.pl or via the contact form. The Controller has not appointed a data protection officer.

2. What data we process

• Data from the contact form: first name and surname, email address, phone number, message content and, if you decide to attach them, photos.
• Data from email correspondence and phone calls: data that you provide yourself when contacting us directly.
• Technical data: IP address, browser and device type, date and time of visit, automatically recorded in server logs.
• Information stored in cookies, described in section 10.

The message content and photos may contain information about your health, i.e. special category data. We process them solely on the basis of your explicit consent, given in the form. Attaching photos is voluntary and is not a condition for receiving a response.

3. Purposes and legal bases for processing

1. Reply to your message and contact regarding an appointment: Art. 6(1)(b) GDPR (actions taken at your request prior to any potential booking of services) and Art. 6(1)(f) GDPR (the Controller’s legitimate interest, which is responding to inquiries).
2. Processing health information provided in the message or in photographs: Art. 9(2)(a) GDPR (your explicit consent).
3. Ensuring the security and proper functioning of the website (server logs, protection against abuse): Art. 6(1)(f) GDPR.
4. Establishing, pursuing or defending claims: Art. 6(1)(f) GDPR, and with regard to health data, Art. 9(2)(f) GDPR.
5. Cookies other than those strictly necessary (analytical and marketing cookies, if activated): your consent, Art. 6(1)(a) GDPR in conjunction with Art. 399 of the Electronic Communications Law.

4. A message is not a medical consultation

A message sent via the website does not constitute a consultation, medical advice or the basis for creating medical records. The reply is of an informational and organisational nature. Eligibility for a treatment is determined exclusively during a visit.

Visits and treatments take place at medical facilities with which the Controller cooperates. Registration, maintenance of medical records and the rules for processing patient data in connection with the provision of healthcare services are defined by the facility where the visit takes place. You will receive this information at the facility.

5. Photographs submitted via the form

A photograph attached to the form is sent to the Controller by email together with the message and is immediately deleted from the website server. The website does not save form messages in a database. A copy of the message with the photograph is sent only to the Controller’s email inbox and is stored in accordance with section 8.

6. Recipients of data

Data may be disclosed only to entities that assist the Controller in operating the website and communication, on the basis of data processing entrustment agreements, and to authorities authorised under applicable law. These are:

• the hosting service provider on whose servers the website operates,
• the email service provider through which the Controller receives messages,
• the entity providing technical and maintenance services for the website, to the extent necessary for its upkeep.

When displaying the website, your browser also downloads resources from external servers, which receive your IP address in connection with this:

• Google Fonts (Google Ireland Ltd., Google LLC): fonts used on the website,
• unpkg (content delivery network, operated by Cloudflare, Inc.): website animation library.

7. Transfer of data outside the European Economic Area

Some of the listed providers (Google LLC, Cloudflare, Inc.) may process data in the United States. The basis for the transfer is the European Commission decision finding an adequate level of data protection under the EU-US Data Privacy Framework, and, for the remainder, the standard contractual clauses approved by the European Commission.

8. How long we retain data

• Messages and correspondence: for the time necessary to provide a response and maintain contact, and then no longer than 12 months from the last message, unless legal provisions require longer retention.
• Health information and photos sent in messages: until consent is withdrawn, no longer than 12 months from the last message.
• Data necessary for defence against claims: until the limitation periods for claims expire.
• Server logs: no longer than 12 months.
• Cookies: for the period indicated in the table in section 10.

9. Your rights

In connection with the processing of data, you have the right to:

• access to your data and receiving a copy of them,
• rectification of incorrect data,
• deletion of data,
• restriction of processing,
• data portability for data processed on the basis of consent or in connection with a contract,
• objection to processing based on the Controller’s legitimate interest,
• withdrawal of consent at any time; withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal,
• lodging a complaint with the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl), if you consider that the processing violates the regulations.

Providing data is voluntary, but without contact details it will not be possible to provide a response. Your data are not used for automated decision-making or profiling.

10. Cookies

Cookies are small text files stored in your browser. The website uses them on the basis of Article 399 of the Electronic Communications Law.

Essential cookies

They are necessary for the operation of the website and to remember your choices. They do not require consent.

Analytics and marketing cookies

Currently, the website does not use any analytical or advertising tools. If they are activated, they will operate only after you have given consent in the banner, and this policy will be updated with their description.

Managing consent

You can change your choice at any time by clicking “Cookie settings” in the website footer. You can also delete or block cookies in your browser settings; however, blocking essential cookies may make it difficult to use the website.

11. External services

The website contains links to external services, including ZnanyLekarz, Instagram, and medical facility websites. Once you navigate to these services, the privacy policies of their owners apply, as they are separate data controllers. This also applies to booking an appointment via ZnanyLekarz.

12. Changes to the privacy policy

The policy may be updated, for example in the event of changes to regulations or the introduction of new website features. The current version is always available on this page, and the date of the last change is displayed below the title.