Personal data controller:
VitroLive, a limited liability company with a registered office in Szczecin
ul. Marcina Kasprzaka 2A, 71-074 Szczecin
Telephone: +48 91 486 43 45
Fax +48 91 88 69 138
Data Protection Supervisor
MD, PhD Anna Janicka
ul. Kasprzaka 2A, 71-074 Szczecin
Telephone: +48 91 486 43 45
Mobile: +48 691 676 305
Fax +48 91 88 69 138
VitroLive Sp. z o.o. with a registered office in Szczecin at ul. Marcina Kasprzaka 2a is a controller of personal patient data and thus responsible for the use of data obtained from patients in the context of the safe provision of health services in accordance with the agreement and the applicable laws, including:
1) Regulation (EU) No 2016/679 of the European Parliament and of the Council from 27 April 2016 concerning the protection of individuals with regard to the processing of personal data and the free movement of such data as well as the repeal of Directive 95/46/EC (General Data Protection Regulation), hereinafter referred to as: GDPR;
2) The Polish Act from 6 November 2008 on patients’ rights and the Polish Patients’ Rights Ombudsman;
3) The Polish Act on Health Care Provision from 15 April 2011;
4) The [Polish] Infertility Treatment Act from 25 June 2015;
5) The Regulation of the Polish Ministry of Health from 9 November 2015 concerning the types, scope and formats of medical documentation as well as its processing.
The submission of personal information by the Patient is voluntary, however necessary for the provision of services by VitroLive under the agreement. The absence of consent to the processing of personal data for the purposes outlined under section 2 may result in VitroLive’s inability to conclude the agreement with the Patient.
The purpose and the legal grounds for the processing of the Patients’ personal details
The patients’ personal details obtained during the registration process as well as for the duration of the agreement on providing health services or other services will be used for the following purposes:
- preventive healthcare, medical diagnosis, the provision of healthcare, treatment or the healthcare management of systems and services within the meaning of Article 9(1)(h) of GDPR — for the period of providing healthcare and the mandatory period for archiving medical documentation as required by law,
- realising the agreement made with the Patient within the meaning of Article 6(1)(b) of GDPR — during the term of the agreement,
- performing VitroLive’s legal obligations within the meaning of Article 6(1)(c) of GDPR, e.g. for tax, administrative, recording or archiving purposes — for the period needed to discharge particular obligations under the law,
- the protection of the vital interests of Patients or other individuals within the meaning of Article 6(1)(d) of GDPR, e.g. within the context of the data subject’s physical integrity or life — for the period needed to intervene,
- to safeguard the legitimate interests of VitroLive or a third party within the meaning of Article 6(1)(f) of GDPR, e.g. in the case of legal claims — for the period of maturity of possible claims arising from the provision of services, to vet the Patients’ creditworthiness by consulting the national debt register — for the period preceding the concluding of the agreement, the duration of the agreement as well as the investigation period of the claim and furthermore, in relation with the use of CCTV surveillance to ensure the safety of individuals and property on VitroLive’s premises — for a period of up to 2 years, except where the recordings are used for court or administrative proceedings, for which the period of processing personal data will be extended for the duration of the proceedings,
- providing the Patient with electronic newsletters featuring personalised advertising about VitroLive’s services and furthermore, improving the quality of the delivered services and safeguarding and supporting the service provision to Patients on the basis of the consent granted by you [Article 6(1)(a) of GDPR].
Information about the entities to which the data may be communicated
Personal details obtained from Patients are transmitted by VitroLive:
- to entities directly participating in the provision of services delivered by VitroLive (e.g. doctors),
- to entities providing advisory, legal, accounting and HR services to VitroLive,
- to entities responsible for the delivery of IT services to VitroLive,
- to banks in the context of providing financial services to VitroLive,
- public administration bodies,
- to entities carrying out postal/courier activities.
Personal data obtained from other sources
VitroLive hereby informs that under certain circumstances Patients’ personal data may be obtained by indirect means, i.e. from third parties.
VitroLive obtains data in ways described above from banks or other financial institutions through payments made by Patients and also from the Polish national debt register in the context of vetting the Patients’ creditworthiness.
The data obtained from banks includes the account number and will be processed in order to verify the correctness of transactions as well as in the case of any claims for damages for the duration of the claim proceedings.
Data obtained from the Polish national debt register includes information about any potential debts incurred by the Patients and will be processed for the period preceding the agreement, the duration of the agreement as well as the period of the debt recovery.
In addition, VitroLive is entitled to obtain Patients’ personal details from other entities in the context of cooperation for which electronic platforms or other service systems are being used.
Apart from generic personal details such as the first name, surname and contact details, the data obtained from these sources also includes particular data categories (the so called sensitive data), such as, inter alia, test results and information about the health status in connection to the treatment undertaken at VitroLive.
The data will be processed in order to fulfil the agreement for the period of its implementation or for the purpose of investigating possible claims in the maturity period and in addition, to enable VitroLive to fulfil its legal obligations with regards to archiving.
Transmitting personal data to third countries outside the European Economic Area (EEA)
VitroLive does not intend to transmit the Patients’ personal data to third countries (outside the European Economic Area), unless this has been requested by the Patient.
The retention period for personal data
The archived Patient documentation will be retained for a period of 20 years, counting from the end of the calendar year, in which the last entry was made, with the exception of:
- medical documentation of patients diseased as a result of personal injury or poisoning, in which case the documentation will be retained for a period of 30 years, counting from the end of the calendar year, in which the death occurred;
- X-ray images retained separately from the Patients’ medical documentation, which is to be retained for a period of 10 years, counting from the end of the calendar year, in which the X-ray image was made;
- referrals for medical examinations or prescriptions, which are to be retained for a period of 5 years, counting from the end of the calendar year, in which the referral or prescription occurred;
- medical documentation of children under 2 years of age, which is to be retained for a period of 22 years.
- documentation regarding the activities undertaken by medically assisted reproduction clinics and gamete and embryo banks, including: the type and number of reproductive cells and embryos collected, tested, preserved, processed, stored and distributed or used in any other way as well as information indicating their origin as well as destination necessary for purposes of the monitoring of reproductive cells and embryos in all stages of development as well as enabling the identification of donors and recipients of reproductive cells and embryos; the documentation mentioned above is retained for a period of 90 years from the day of its creation.
VitroLive is pleased to inform that Patients have the following entitlements within VitroLive’s scope as the Administrator:
- the right to access personal data — including obtaining information about the data processed by VitroLive as well as a copy of the data,
- the right to rectify (correct) data,
- the right to remove data processed in an unlawful manner or in cases, where data is not necessary for VitroLive for the purpose for which it has been collected,
- the right to request a restriction of the processed data,
- the right to transfer the data to a different data administrator,
- the right to object to the processing of data,
- the right to withdraw the consent to the processing of personal data, if the processing of data is not necessary for the fulfilment of the agreement, the fulfilment of its legal obligations or does not constitute a legitimate interest of VitroLive,
The above said entitlements can be exercised by the Patient through the submission of an appropriate declaration to VitroLive — in person or either by e-mail or post.
VitroLive is entitled to verify the identity of the person making the declaration.
The possibility to access an appropriate entitlement by the Patient depends on the objective and legal grounds for data processing.
VitroLive may refuse its consent to the removal, restriction or transferral of data as well as to objections against its processing in relation to the obligations resulting from specific legal provisions.
Patients are entitled to object to the processing of data for direct marketing purposes at any time and the Administrator is obliged to discontinue the processing of data for this purpose.
In addition, the Patient is entitled to file a complaint to the President of the Polish Office for the Protection of Personal Data, where it is concluded that the processing of personal data is unlawful.