Privacy information notice (RODO)
Please read this before leaving your data in the registration form. Below you will find the full information required by Articles 13 and 14 of the General Data Protection Regulation (RODO/GDPR).
Who is responsible for your data
The data controller is Aurora Medical Sp. z o.o. with its registered office in Warsaw:
- ul. Marcina Kasprzaka 7 lok. U8, 01-211 Warszawa
- KRS: 0001124170, NIP: 5223309375, REGON: 52950141600000
- e-mail: biuro@aurora-medical.pl
- phone: +48 884 807 400
What data we process
- identification data: first name, surname, date of birth (if provided);
- contact data: phone, e-mail, correspondence address;
- health data: reason for the visit, treatment history, test results, medical records;
- billing data: invoice number, amount, payment method;
- technical data: IP address and browser data, to the extent necessary for the website to function.
For what purpose and on what legal basis
| Purpose | Legal basis |
|---|---|
| Provision of a healthcare service and contact regarding the visit | Art. 6(1)(b) RODO (contract) |
| Keeping medical records and billing | Art. 6(1)(c) RODO (legal obligation) |
| Appointment reminders, contact on organisational matters | Art. 6(1)(a) RODO (consent) |
| Pursuit or defence against claims | Art. 6(1)(f) RODO (legitimate interest) |
Health data is a special category of data (Art. 9 RODO). We process it because it is necessary to provide the healthcare service (Art. 9(2)(h) RODO), and where we contact you by phone or e-mail — also on the basis of your consent (Art. 9(2)(a) RODO).
How long we keep the data
- medical records: 20 years from the end of the year in which the last entry was made (Art. 26 of the Patient Rights Act);
- invoices and billing documents: 5 years;
- form submissions that did not result in a visit: 12 months;
- e-mail and phone correspondence: 3 years;
- marketing consents and reminders: until withdrawn.
Who we share the data with
We share data only with entities that help us provide our services: the operator of the Medfile online registration system, laboratories performing tests, our e-mail and website hosting provider, our accounting office, and the physicians and physiotherapists cooperating with the clinic. Each of these companies processes data under a contract and only on our behalf.
Your data outside the European Economic Area
Some providers (hosting and e-mail) may process data outside the EEA. In such cases, we ensure the protection required by law — the European Commission's standard contractual clauses or certification under the EU-US Data Privacy Framework.
Your rights
You may:
- request access to your data and receive a copy of it;
- request rectification, erasure or restriction of processing;
- withdraw any consent at any time — without affecting the lawfulness of processing carried out before the withdrawal;
- object to processing based on legitimate interest;
- transfer your data to another controller;
- lodge a complaint with the President of the Personal Data Protection Office (UODO) (ul. Stawki 2, 00-193 Warszawa).
For matters concerning personal data, write to biuro@aurora-medical.pl — we respond within a month.
Is providing data mandatory
Yes, so that we can provide you with a healthcare service and issue documentation. Without this data we cannot schedule a visit. Providing a phone number and e-mail address is used to confirm and remind you about the visit — you may choose not to provide them, in which case we will confirm the visit in another way.