Entry

The document contains a regulation introducing information from Article 13 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 within the framework of the protection of natural persons with regard to the use of personal data and in the case of free access to such data and use of services 95/46/EC (hereinafter referred to as "GDPR"), the principles of processing data of users of the Medfile and halodoctor systems, as well as the names used of the services used via access by BioStat Spółka z ograniczoną odpowiedzialnością by name in Rybnik.

Whenever within the framework of compliance is a phrase relating to Health Services, which should be included by understanding also the Service Recipient in the content concluded between BioStat and the Health Service Provider in the Medfile module agreement.

I. Personal data administrator

Processing of personal data for purposes related to the provision of electronic services

• The controller of personal data in relation to persons using the Medfile and halodoctor systems (excluding data processed in connection with the provision of health services by Health Service Providers) within the meaning of Article 4 point 7 of the GDPR is BioStat Spółka z ograniczoną odpowiedzialnością with its registered office in Rybnik at ul. Kowalczyka 17, 44-206 Rybnik, NIP: 6423125404, REGON: 241544443, entered into the register of entrepreneurs of the National Court Register under the KRS number: 0000351860, registration court: District Court in Gliwice, 10th Commercial Division of the National Court Register, share capital: PLN 110,000, hereinafter referred to as "BioStat".
• BioStat has appointed a Data Protection Officer (DPO), who also serves as a point of contact for users. The DPO can be contacted electronically at [email protected] or by post to BioStat Sp. z o.o., ul. Kowalczyka 17, 44-206 Rybnik, with the reference "Data Protection Officer."
• BioStat strictly adheres to the principle of personal data protection and applies appropriate technical and organisational measures to prevent accidental or unlawful destruction, loss, modification, unauthorised disclosure or unauthorised access to personal data processed in connection with its business activities.
• BioStat processes personal data only to the extent necessary to provide services to data subjects.
• Providing personal data by the user is voluntary, but necessary in order to use the services provided by BioStat.

Processing of personal data for purposes related to the provision of health services

• The controller of personal data within the meaning of Article 4(7) of the GDPR in relation to information on the health status of persons (patients) using health services provided by Health Service Providers using the systems made available by BioStat is the Health Service Provider providing health services to the data subject.
• In relation to the personal data referred to in point 1, BioStat is solely a data processor, i.e. an entity processing patient data on behalf of, for the purposes, in the manner and to the extent specified by the Health Service Provider on the basis of a personal data processing agreement.
• BioStat informs that providing personal data to receive healthcare services is a patient's obligation under the law. Refusal to provide personal data, including sensitive data in the form of health information, may result in the Health Service Provider refusing to provide healthcare services.
• In order to obtain information about the processing of personal data in connection with the provision of health services, the patient shall contact directly the Health Service Provider who provided the service to the patient.

II. Scope of personal data processed by BioStat

Health Service Providers

BioStat processes the following scope of personal data in relation to Health Service Providers using BioStat systems:

• name and surname,
• company name and NIP and REGON numbers,
• business address or residential address,
• e-mail address and contact telephone number,
• professional/academic title,
• specializations,
• authorization number,
• image,
• date of birth.

Patients and other non-professional users

BioStat processes the following scope of personal data in relation to patients and other non-professional users using BioStat systems or other services provided electronically:

• surname and name(s),
• date of birth,
• sex,
• residential address or registered address,
• PESEL number,
• phone number,
• email address,
• data concerning health condition – in the case of selected services provided by BioStat, including maintaining a patient account on the Patient Portal, the “Morning after pill” or “Ask a doctor” services.

BioStat may process personal data to a broader extent than indicated above, provided that this is necessary for the proper provision of the service to the data subject or is justified by the user's consent or applicable law.

III. Purpose and basis of personal data processing by BioStat

BioStat processes personal data for the following purposes:

• preparing a commercial offer, which is a legitimate interest of BioStat (Article 6, paragraph 1, letter f of the GDPR);
• concluding and implementing contracts, based on the concluded contract (Article 6, paragraph 1, letter b of the GDPR);
• provision of services electronically via IT systems, including the provision and technical maintenance of systems for Health Service Providers, on the basis of a concluded contract (Article 6, paragraph 1, letter b of the GDPR);
• handling the complaint process, based on the obligation incumbent on BioStat in connection with applicable legal provisions (Article 6, paragraph 1, letter c of the GDPR);
• accounting related to the issuance and acceptance of settlement documents, based on the provisions of tax law (Article 6, paragraph 1, letter c of the GDPR);
• archiving data for the possible establishment, exercise or defence against claims or the need to prove facts, which is a legitimate interest of BioStat (Article 6, paragraph 1, letter f of the GDPR);
• contact by telephone or e-mail, in particular in response to inquiries addressed to BioStat, which is a legitimate interest of BioStat (Article 6(1)(f) of the GDPR);
• sending technical information regarding the functioning of BioStat’s IT systems and services used by the user, which is a legitimate interest of BioStat (Article 6(1)(f) of the GDPR);
• marketing, which is the legitimate interest of BioStat (Article 6 paragraph 1 letter f of the GDPR) or is based on prior consent (Article 6 paragraph 1 letter a of the GDPR);
• In order to provide selected services electronically, in particular to maintain a patient account on the Patient Portal and to provide the "Morning-After Pill" or "Ask a Doctor" services, BioStat may process sensitive data related to health information. Sensitive data processing is based on the consent of the data subject (Article 9, paragraph 2, letter a of the GDPR).

IV. Data recipients. Data transfer to third countries

• The recipients of personal data processed by BioStat may be entities cooperating with BioStat when it is necessary for the performance of the contract concluded with the data subject.
• The recipients of personal data processed by BioStat may also be subcontractors – entities whose services BioStat uses when processing data, e.g. accounting offices, law firms, entities providing IT services (including hosting services).
• In connection with the provision of Health Services by Healthcare Providers, personal data of patients may be shared with or obtained from public entities, including the Social Insurance Institution (ZUS) or the Ministry of Health, in particular for the purpose of verifying the right to health services provided from public funds (eWUŚ system) or exchanging data between BioStat systems and the Online Patient Account and related services.
• Personal data of Health Service Providers in the form of a business card presenting the offer may be made available to BioStat's business partners, including related entities.
• BioStat may be obliged to disclose personal data on the basis of applicable legal provisions, in particular to disclose personal data to authorized state authorities or institutions.
• Personal data in connection with BioStat's and Health Service Providers' use of the Google Calendar system may be transferred to an entity located outside the European Economic Area, such as Google LLC. As an appropriate data protection measure, BioStat has agreed to standard contractual clauses in accordance with Article 46 of the GDPR with the provider of these services. More information on this is available here: https://ec.europa.eu/info/law/law-topic/data-protection/data-transfers-outside-eu_en.

V. Period of storage of personal data

• BioStat stores personal data for the duration of the contract concluded with the data subject and after its termination for the purposes of pursuing claims related to the contract and fulfilling obligations arising from applicable legal provisions, but for no longer than the limitation period in accordance with the provisions of the Civil Code.
• BioStat stores personal data contained in settlement documents for the period specified in tax law.
• BioStat stores personal data processed for marketing purposes for a period of 10 years, but no longer than until the consent to data processing is withdrawn or an objection to data processing is raised.
• BioStat stores personal data for purposes other than those indicated in paragraphs 1-3 for a period of one year, unless consent to data processing has been withdrawn earlier and data processing cannot be continued on any basis other than the consent of the data subject.
• Patient personal data processed in connection with the provision of health services are stored by the Health Service Provider for the period specified in the Act of 6 November 2008 on patients’ rights and the Patient Ombudsman.

VI. Rights of the data subject

• Every data subject has the right to:
  • Access – obtaining confirmation from the controller as to whether their personal data are being processed. If data about a person is being processed, they are entitled to access it and obtain the following information: the purposes of processing, the categories of personal data, information about the recipients or categories of recipients to whom the data has been or will be disclosed, the data storage period or the criteria for determining them, the right to request rectification, erasure, or restriction of processing of personal data, and to object to such processing (Article 15 of the GDPR);
  • to receive a copy of the data – to obtain a copy of the data being processed, the first copy being free of charge, and for subsequent copies the controller may charge a reasonable fee based on administrative costs (Article 15, paragraph 3 of the GDPR);
  • to rectify – to request the rectification of personal data concerning you that are incorrect or the completion of incomplete data (Article 16 of the GDPR);
  • to delete data – request the deletion of your personal data if the controller no longer has a legal basis for processing them or the data are no longer necessary for the purposes of processing (Article 17 of the GDPR);
  • to restrict processing – request to restrict the processing of personal data (Article 18 of the GDPR), when:
    • the data subject questions the accuracy of the personal data – for a period enabling the controller to check the accuracy of the data,
    • the processing is unlawful and the data subject opposes their deletion, requesting the restriction of their use,
    • the controller no longer needs the data, but the data subject needs it to establish, pursue or defend legal claims,
    • the data subject has objected to the processing – until it is determined whether the legitimate grounds on the part of the controller override the grounds for objection of the data subject;
  • to transfer data – to receive personal data concerning him/her, which he/she has provided to the controller, in a structured, commonly used and machine-readable format, and to request the transmission of such data to another controller, if the data are processed on the basis of the data subject’s consent or a contract concluded with him/her and if the data are processed by automated means (Article 20 of the GDPR);
  • To object – to object to the processing of their personal data for the legitimate purposes of the controller, for reasons relating to their particular situation, including profiling. In such a case, the controller assesses the existence of compelling legitimate grounds for processing that override the interests, rights, and freedoms of the data subjects, or grounds for establishing, pursuing, or defending legal claims. If, according to the assessment, the interests of the data subject outweigh the interests of the controller, the controller will be obliged to cease processing the data for these purposes (Article 21 of the GDPR).
• In order to exercise the above-mentioned rights, the data subject should contact the controller using the contact details provided and inform him/her which right and to what extent he/she wishes to exercise.
• The data subject has the right to lodge a complaint with the supervisory authority, which is the President of the Personal Data Protection Office in Warsaw.

VII. Profiling

Personal data obtained by BioStat will not be processed automatically, including through profiling.