EN
Call:+48 534 951 340

Privacy policy

This translation is provided for information only — in the event of any discrepancy, the Polish version of this document prevails.

We respect the privacy of people who use our website and contact our practice. In this policy we explain who processes personal data, what data, for what purpose, on what legal basis and for how long, to whom we disclose it, what rights you have and how to exercise them. We also describe the cookies and third-party services used on the website.

This policy fulfils the information obligation under Articles 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation, GDPR). It also takes into account the Polish Personal Data Protection Act of 10 May 2018, the Act of 6 November 2008 on Patients’ Rights and the Patients’ Rights Ombudsman, the Act of 5 December 1996 on the Professions of Physician and Dentist, the Act of 18 July 2002 on the Provision of Electronic Services and the Electronic Communications Law of 12 July 2024.

1. Definitions

  • Controller — the entity indicated in section 2, which determines the purposes and means of processing personal data.
  • Website — the website available at ginekologswiatkowski.pl, together with its subpages.
  • Practice — Świątkowscy Specialist Medical Practices (Specjalistyczne Gabinety Lekarskie Świątkowscy), ul. Słowackiego 10, 81-871 Sopot.
  • User — any person using the Website.
  • Patient — a person receiving healthcare services provided at the Practice.
  • Personal data — information relating to an identified or identifiable natural person (e.g. full name, telephone number, email address, IP address).
  • Health data — special category data within the meaning of Article 9 GDPR, i.e. information about physical or mental health, including healthcare services provided.
  • Processing — any operation performed on data, e.g. collection, recording, storage, consultation, disclosure or erasure.
  • Processor — an entity that processes data on behalf of the Controller under a data processing agreement (e.g. a hosting provider).
  • Cookies — small text files saved on the User’s device by the browser.

2. Data controller

The controller of personal data is:

  • Indywidualna Praktyka Lekarska Mateusz Świątkowski
  • ul. Słowackiego 10
  • 81-871 Sopot
  • NIP: 5851435002
  • REGON: 388757840

The Controller runs Świątkowscy Specialist Medical Practices (Specjalistyczne Gabinety Lekarskie Świątkowscy) at ul. Słowackiego 10 in Sopot.

In matters concerning personal data, you can contact the Controller:

  • by email: [email protected],
  • by telephone: 534 951 340,
  • in writing: ul. Słowackiego 10, 81-871 Sopot,
  • via the contact form on the Contact page.

3. Where we obtain data and whom it concerns

We process data:

  • provided by you directly — in the contact form, in a telephone conversation, in an email, in a message via Facebook or Instagram, or during an appointment,
  • collected automatically while you use the Website — described in sections 4.7–4.11 and 11,
  • provided by a parent or legal guardian — where it concerns a child (section 5),
  • provided by another person who contacts the Practice on your behalf — to the extent necessary to deal with the matter.

4. Purposes, legal bases and data retention periods

4.1. Contact form

Data: full name, telephone number and/or email address, content of the message, as well as the IP address and date of sending (recorded to protect against abuse and spam).

  • Purpose: replying to the message, including arranging an appointment.
  • Legal basis: Article 6(1)(b) GDPR (steps taken at the request of the data subject prior to entering into a contract) and Article 6(1)(f) GDPR (the Controller’s legitimate interest — conducting correspondence and protecting the Website against abuse). If you provide information about your health in the message — Article 9(2)(a) GDPR (explicit consent given by ticking the box in the form).
  • Period: for the time needed to reply and deal with the matter, and then until the limitation period for any claims expires. If the message concerns treatment and becomes part of the medical records — for the medical records retention period (section 4.4).
  • Consent can be withdrawn at any time, e.g. by email — this does not affect the lawfulness of processing before its withdrawal.

Please do not send test results or a detailed description of your health condition via the form — we will discuss them by telephone or during an appointment.

4.2. Form protection (Cloudflare Turnstile)

The contact form is protected by Cloudflare Turnstile — a service that distinguishes people from bots without the need to type in codes. When the form is displayed, Cloudflare receives, among other things, the IP address, information about the browser and device, and technical signals needed for this assessment. Turnstile is not used for tracking or advertising.

  • Purpose: protecting the form against spam and abuse.
  • Legal basis: Article 6(1)(f) GDPR.
  • Provider: Cloudflare, Inc. — policy: https://www.cloudflare.com/privacypolicy/.

4.3. Contact by telephone, email and messages on social media

Data: full name, telephone number, email address, profile name, content of correspondence, proposed appointment date.

  • Purpose: answering a question, booking an appointment, providing organisational information.
  • Legal basis: Article 6(1)(b) and (f) GDPR; health data provided in connection with an appointment — Article 9(2)(h) GDPR.
  • Period: for the time needed to deal with the matter, and then until the limitation period for any claims expires.

4.4. Provision of healthcare services and medical records

Data: identification and contact details of the Patient (including full name, date of birth, PESEL number (Polish national identification number), address, telephone number), in the case of minors — also the details of the statutory representative, as well as data on the state of health and the healthcare services provided.

  • Purpose: providing healthcare services; keeping, storing and making available medical records; ensuring continuity of treatment.
  • Legal basis: Article 6(1)(c) and Article 9(2)(h) GDPR in conjunction with the Act on Patients’ Rights and the Patients’ Rights Ombudsman and the Act on the Professions of Physician and Dentist.
  • Period: as a rule, 20 years from the end of the calendar year in which the last entry was made, with the exceptions set out in Article 29 of the Act on Patients’ Rights and the Patients’ Rights Ombudsman.

Providing the data necessary for the provision of healthcare services and the keeping of medical records is a statutory requirement. Information about the Patient is subject to medical confidentiality.

4.5. Billing and legal obligations

Data: full name or business name, address, tax identification number (NIP) (if we issue an invoice), amount and date of payment.

  • Purpose: issuing and storing accounting documents, fulfilling tax obligations.
  • Legal basis: Article 6(1)(c) GDPR in conjunction with tax and accounting legislation.
  • Period: 5 years from the end of the calendar year in which the tax payment deadline expired.

4.6. Establishment, exercise and defence of legal claims

  • Legal basis: Article 6(1)(f) GDPR and, with regard to health data, Article 9(2)(f) GDPR.
  • Period: until the limitation period for claims expires.

4.7. Website security

Data: IP address, date and time, address of the subpage visited, information about the browser and operating system — recorded by the server, the Cloudflare network and the Website firewall in the event of suspicious events (e.g. intrusion attempts or mass requests).

  • Purpose: ensuring the security and proper functioning of the Website, detecting and blocking attacks.
  • Legal basis: Article 6(1)(f) GDPR.
  • Period: for the time needed to ensure security; server logs — in accordance with the hosting provider’s rules.

4.8. Statistics on the Website server

We count visits on our own server — without cookies and without third-party providers. We record the IP address, country (determined from the IP address), device type, operating system and browser, screen resolution, browser language, the subpage visited, the referring page and the time spent on the page.

  • Purpose: understanding how Users use the Website, and protection against abuse.
  • Legal basis: Article 6(1)(f) GDPR.
  • Period: IP address — 30 days, other statistical data — 13 months. We do not share them with anyone.

4.9. Google Analytics

The Website uses Google Analytics 4, a service of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). Statistics are active from your first visit to the Website. Google Analytics collects information about the subpages visited, the duration of the visit, the device, the browser, approximate location and traffic source, and stores the _ga and _ga_* cookies. We receive only aggregated reports from Google Analytics — we do not use them to identify specific individuals.

  • Purpose: analysing traffic and improving the Website.
  • Legal basis: Article 6(1)(f) GDPR (the Controller’s legitimate interest).
  • Period: no longer than 14 months.
  • How to switch it off: with the “Necessary only” button in the cookie window or in “Cookie settings” at the bottom of every page — once switched off, the Google Analytics script is not loaded. You can also install the Google browser add-on that blocks Google Analytics: https://tools.google.com/dlpage/gaoptout. You also have the right to object (section 8).

4.10. Google Maps and YouTube videos

A Google map is embedded on the home page and the Contact page, and videos from YouTube in privacy-enhanced mode (youtube-nocookie.com) are embedded on the Hysteroscopy page. They are displayed as soon as you open these pages. Your browser then connects to Google servers, which receive, among other things, your IP address and information about your browser and may store their own cookies. In privacy-enhanced mode, YouTube does not store information about viewing until the video is played.

  • Purpose: showing directions to the Practice and presenting procedures.
  • Legal basis: Article 6(1)(f) GDPR.
  • Google Ireland Limited is responsible, as a separate controller, for the data collected by the map and the player — policy: https://policies.google.com/privacy.

4.11. Facebook and Instagram

The Website contains only links to the Practice’s profiles on Facebook and Instagram — unless you click on them, we do not transfer any data to Meta Platforms Ireland Limited. Once you go to a profile, Meta processes the data under its own privacy policy: https://www.facebook.com/privacy/policy. On the Practice’s profiles, the Controller and Meta may be joint controllers of data with regard to profile statistics.

5. Children’s data

The Practice provides paediatric care from birth to 18 years of age. We process a child’s data to the extent necessary to provide healthcare services and keep medical records, on the bases described in section 4.4. The data are provided, and rights on behalf of the child are exercised, by a parent or legal guardian, taking into account the rights that the law grants to minor patients. The Website is not directed at children — we ask that messages sent via the form concerning a child be sent by a parent or guardian.

6. Recipients of data

We disclose data only to the extent necessary. Entities acting on our behalf process it under data processing agreements and in accordance with our instructions:

  • hosting and mail server provider — hosting the Website and database and sending messages,
  • Cloudflare, Inc. — the network through which traffic to the Website passes, protection against attacks and bots, Cloudflare Turnstile,
  • Google Ireland Limited — email, Google Analytics, Google Maps, YouTube,
  • IT service provider maintaining the Website and the admin panel,
  • laboratories and other healthcare providers — to the extent necessary to carry out tests and continue treatment,
  • Garden Clinic Hospital in Gdańsk — to the extent necessary to carry out surgical treatment, when the Patient is referred for surgery,
  • providers of accounting services — if the Controller uses them, with regard to billing data,
  • entities authorised by law — e.g. with regard to making medical records available in accordance with the Act on Patients’ Rights and the Patients’ Rights Ombudsman, public authorities, courts.

We do not sell data or share it for marketing purposes.

7. Transfer of data outside the European Economic Area

The use of Google and Cloudflare services may involve the transfer of data to the United States. This takes place on the basis of the European Commission implementing decision of 10 July 2023 on the adequate level of protection of personal data (EU-US Data Privacy Framework), to which these providers have signed up, and, additionally, standard contractual clauses approved by the European Commission. A copy of the safeguards can be obtained by contacting the Controller.

8. Rights of data subjects

You have the following rights:

  • right of access (Article 15 GDPR) — to information on whether and what data we process, and to receive a copy of it,
  • right to rectification (Article 16 GDPR) — when data are inaccurate or incomplete,
  • right to erasure (Article 17 GDPR) — e.g. when the data are no longer needed for the purposes for which they were collected, or after consent has been withdrawn,
  • right to restriction of processing (Article 18 GDPR) — e.g. for the time needed to verify the accuracy of the data,
  • right to data portability (Article 20 GDPR) — to receive the data in a structured format when we process it by automated means on the basis of consent or a contract,
  • right to object (Article 21 GDPR) — to processing based on the Controller’s legitimate interest, including statistics; after an objection, we stop processing the data for that purpose unless we demonstrate compelling legitimate grounds or the data are needed for the establishment, exercise or defence of legal claims,
  • right to withdraw consent at any time, without affecting the lawfulness of processing before its withdrawal (Article 7(3) GDPR),
  • right to lodge a complaint with the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl (Article 77 GDPR).

Some rights may be limited by law — e.g. we do not delete medical records before the end of their retention period, or data needed for billing before the end of the periods arising from tax legislation.

8.1. How to exercise your rights

  • A request can be submitted by email to [email protected], in writing to the Practice’s address or in person at the Practice.
  • We may ask for additional information needed to confirm your identity — so as not to disclose data to an unauthorised person.
  • We respond without undue delay, and no later than one month after receiving the request. In the case of complex or numerous requests, this period may be extended by a further two months — in that case we will inform you within one month.
  • Exercising your rights is free of charge. For further copies of data or for manifestly unfounded or excessive requests, we may charge a fee or refuse to act, in accordance with Article 12(5) and Article 15(3) GDPR.

8.2. Access to medical records

Irrespective of the rights under the GDPR, the Patient, their statutory representative and an authorised person have the right of access to medical records under the Act on Patients’ Rights and the Patients’ Rights Ombudsman — including to inspect the records and to obtain an extract, a transcript or a copy of them. The first copy or transcript of the records is provided free of charge; for subsequent ones the Practice may charge a fee within the limits set out in the Act.

8.3. Authorised persons

The Patient may authorise a designated person to obtain information about their state of health and the healthcare services provided, and to access their medical records. Without such authorisation, we do not share this information with other people, except as provided by law.

9. Is providing data mandatory?

Using the Website does not require providing any data. Providing data in the form, by telephone or by email is voluntary, but without a telephone number or email address we will not be able to reply to your message or arrange an appointment. Providing the data necessary for the provision of healthcare services and the keeping of medical records is required by law, and providing invoice data is required by tax legislation.

10. Automated decision-making and profiling

We do not make decisions by automated means, including on the basis of profiling, that would produce legal effects concerning you or similarly significantly affect you. Statistics (sections 4.8 and 4.9) are used solely for aggregated analysis of traffic on the Website.

11. Cookies

Cookies are small text files saved on the User’s device. They may be session cookies (deleted when the browser is closed) or persistent cookies (stored for a specified period). The Website uses the following cookies:

Necessary (always active — without them the Website cannot remember your choices):

  • oplixo_consent — 1 year — remembers your cookie choice,
  • oplixo_cv — 1 year — allows the version of the Website matching that choice to be displayed,
  • mqk_admin — until the browser is closed — admin panel session (only for people who maintain the Website),
  • mqk_pamietaj — up to 30 days — remembered login to the panel (only for people who maintain the Website).

Analytics (Google Analytics — active from your first visit, can be switched off):

  • _ga — 2 years — distinguishing users,
  • _ga_* — 2 years — maintaining session state.

Third-party — stored by embedded Google services (map, YouTube) under Google’s rules, described in section 4.10.

The Website does not use advertising cookies or cookies for marketing profiling.

11.1. How to manage cookies

  • On the Website: the “Cookie settings” button at the bottom of every page.
  • In your browser you can block or delete cookies: Chrome — https://support.google.com/chrome/answer/95647, Firefox — https://support.mozilla.org/pl/kb/usuwanie-ciasteczek, Safari — https://support.apple.com/pl-pl/guide/safari/sfri11471/mac, Edge — https://support.microsoft.com/pl-pl/microsoft-edge.
  • Blocking necessary cookies may mean that the Website cannot remember your choices and that the admin panel will not work.

12. Data security

We apply technical and organisational measures appropriate to the risk, in particular:

  • an encrypted connection (HTTPS) across the entire Website,
  • protection of traffic by the Cloudflare network, the Website’s own firewall and Cloudflare Turnstile on the form,
  • access to the admin panel only for authorised persons, with an individual password and two-step verification,
  • restricting access to data to persons who need it to perform their duties, are authorised by the Controller and are bound by confidentiality and medical secrecy.

In the event of a personal data breach that may pose a risk to your rights or freedoms, we will report it to the President of the Personal Data Protection Office (UODO) within 72 hours and, where the risk is high, we will also inform you (Articles 33 and 34 GDPR).

13. Links to other websites

The Website contains links to external websites (e.g. Facebook, Instagram, YouTube, Google Maps, Garden Clinic Hospital). Once you go to them, their owners’ privacy policies apply — we encourage you to read them.

14. Changes to the privacy policy

We update this policy when the law, the way the Website works or the services used change. We announce significant changes on the Website. The current version is always available at ginekologswiatkowski.pl/en/privacy-policy.

This policy is effective from 21.10.2026.

Call: +48 534 951 340