Privacy policy

We care about your privacy and process your data only to the extent necessary to provide healthcare services. This policy has been prepared in accordance with the GDPR and explains how we collect, use and protect your data. A detailed information clause is available on the GDPR page.

Who is the data controller

Aurora Medical Sp. z o.o., ul. Marcina Kasprzaka 7 lok. U8, 01-211 Warszawa, KRS 0001124170, NIP 5223309375, REGON 52950141600000.

For matters concerning personal data, please contact us: biuro@aurora-medical.pl or +48 884 807 400.

What data we collect

• Data provided by you in the registration form or by phone: first name, surname, phone number, email, selected service and appointment date, any message to the doctor.
• Health data: information about complaints, treatment history, test results, recommendations and medical records.
• Billing data: invoicing details, amount and form of payment.
• Technical data: IP address, device and browser type, the address of the page visited — to the extent necessary for the security and operation of the website.

The purposes for which we process data

1. Booking and confirming an appointment and contacting you about it.
2. Providing healthcare services and keeping medical records.
3. Issuing a receipt or invoice and settling payment, including online payment.
4. Reminding you of an appointment and informing you of changes to the doctor's schedule.
5. Handling complaints and pursuing or defending against claims.
6. Developing our services and ensuring service quality — solely to the extent permitted by law.

We do not carry out automated profiling and we do not sell data to anyone.

How long we keep data

• medical records: 20 years from the end of the year in which the last entry was made;
• invoices and accounting documents: 5 years;
• unfulfilled enquiries from the form: 12 months;
• correspondence: 3 years;
• consents to contact and reminders: until withdrawn.

Cookies and technologies on the website

The website uses files necessary for its operation (including maintaining a secure connection and protecting forms against spam). Such files do not require your consent.

Files used for visit statistics or marketing are enabled only with your consent, expressed in the banner on the website. You may withdraw your consent or change its scope at any time — without affecting processing carried out earlier. If you do not give consent, the website works the same way, and you can book an appointment without any restrictions.

Who we share data with

• the operator of the online booking system (Medfile) — for the purpose of maintaining the appointment calendar;
• laboratories and diagnosticians — for carrying out and delivering test results;
• doctors, midwives and physiotherapists cooperating with the clinic;
• our hosting, email and payment systems provider;
• the accounting office and the company handling the records archive.

Each of these entities processes data on the basis of a data processing agreement and may not use it for its own purposes.

Data outside the European Economic Area

Some technical providers may process data outside the EEA. In such cases we apply the European Commission's standard contractual clauses or use providers covered by the EU-US Data Privacy Framework, so that the level of protection remains consistent with the GDPR.

How we protect data

The website operates over an encrypted HTTPS connection. Only authorised persons have access to data, and accounts are protected by a password and two-step verification. We store medical records in systems with restricted access and activity logging. We have concluded processing agreements with every entity processing data on our behalf. We notify the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych) of any security breach that may affect your rights within 72 hours and, where necessary, we notify you as well.

Your rights

You have the right to access your data, to have it rectified, erased or its processing restricted, to data portability and to object. You may also withdraw your consent and lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych) (ul. Stawki 2, 00-193 Warszawa). We respond to requests within one month — write to biuro@aurora-medical.pl.

Children and minors

We provide services to persons under 16 years of age through their legal guardian, who consents to the processing of data and receives the records.

Changes to the policy

We publish new versions of the policy on this page, indicating the effective date. We additionally inform you of significant changes on the homepage.

Effective date: 29 September 2026.

Aurora Medical Sp. z o.o.