HOW WE PROCESS PERSONAL DATA AT INVICTA GROUP COMPANIES

Beata Gozdecka

e-mail address  daneosobowe@invicta.pl

ul. Polna 64
81-740 Sopot

In the case of consent to receive information and consent to adapt the content of the information provided: providing data is completely voluntary, but it may hinder contact and ongoing service.

In other cases (e.g. using a Medipoint.pl account, participation in the donation qualification process), providing data is voluntary, but failure to provide data will prevent the use of certain services or participation in selected processes.

For this purpose, your personal data will be processed:

• in order to establish your identity prior to the provision of services, verifying your information when making a remote appointment (by phone, through a form or registration system) and directly at our Clinics, Sample Collection Points, Vaccination Points, Residence and Recovery Area and other departments;
• for contact (by telephone, e-mail) to confirm or remind you of your appointment or examination booking, inform you about the need to prepare for the planned treatment, inform you that test results are ready to be collected, to process your request or complaint;
• to fulfil the obligation to keep and retain medical records;
• to qualify you for a publicly subsidised infertility treatment program, and then carry out the treatment and settle it with the financing entity;
• to report on your vaccination status and provide data and information on infections and infectious diseases to the relevant authorities;
• to improve the quality of the services, and to continually monitor patient needs and expectations, we may make requests for service evaluations or short surveys;

We will send surveys in a way that does not violate your rights.

If you do not wish to receive such messages, please let us know.

• Article 9 (2) (h) GDPR
  processing is necessary for the purposes of preventive health or occupational medicine, to assess an employee’s fitness for work, medical diagnosis, the provision of healthcare or social security, treatment or the management of healthcare or social security systems and services
• Act of 6 November 2008 on Patient Rights and the Patients’ Ombudsman
• Act of 25 June 2015 on Infertility Treatment
• Regulation of the Minister of Health of 23 March 2006 on quality standards for medical diagnostic and microbiological laboratories
• Act of 5 December 2008 on Preventing and Combating Infections and Infectious Diseases in Humans
• EN ISO 9001 quality management system

Data retention period Your personal data is stored for the period required for the storage and archiving of medical records as defined by law, in particular the Act of 6 November 2008 on Patient Rights and the Patients’ Ombudsman (Article 29) and the Infertility Treatment Act of 25 June 2015.

• initial qualification for gamete donation in non-partner donation;
• medical qualification for cell donation;
• gamete donation process
• fulfilling the obligations resulting from provisions of law – creating medical documentation, entering data into registers;
• settlement and reimbursement of lump-sum costs of participation in the program, issuing and sending a tax return.

• GDPR Article 9 (2) (a)

The data subject has given their explicit consent (…)
Data retention period: until consent is withdrawn

• GDPR Article 9 (2) (h)

processing is necessary for the purposes of preventive health or occupational medicine, to assess an employee’s fitness for work, medical diagnosis, the provision of healthcare or social security, treatment or the management of healthcare or social security systems and services

• Act of 6 November 2008 on Patient Rights and the Patients’ Ombudsman
• Act of 25 June 2015 on Infertility Treatment
• Act of 6 November 2008 on Patient Rights and the Patients’ Ombudsman
• Act of 25 June 2015 on Infertility Treatment

Data retention period Your personal data is stored for the period required for the storage and archiving of medical records as defined by law, in particular the Act of 6 November 2008 on Patient Rights and the Patients’ Ombudsman (Article 29) and the Infertility Treatment Act of 25 June 2015.

Data retention period: Your personal data related to the payment of compensation and the issuance of a tax return will be stored for the period specified in the tax and accounting regulations.

• GDPR Article 9 (2) (a)

The data subject has given their explicit consent (…)
Data retention period: until consent is withdrawn or for the mandatory retention period for records of the study in question.

Sometimes, in order to perform the service, it is necessary to provide additional data (e.g. PESEL number), e.g. to set up a file.

• GDPR Article 6 (1) (b)

The processing is necessary for the performance of the agreement

Data retention period: 5 years counted from the end of the calendar year in which the purchase was made.  

• GDPR Article 9 (2) (a)

The data subject has given their explicit consent (…)
Data retention period: until consent is withdrawn, unless the data becomes part of the medical documentation.

• GDPR Article 6 (1) (b)

processing is necessary for the performance of the agreement

Data retention period: until the expiry of the limitation period for potential claims.

• The Accounting Act of 29 September 1994.
• Tax regulations

Data retention period: 5 years counted from the end of the calendar year in which the tax obligation arose

• GDPR Article 9 (1) (f)

processing is necessary to establish, assert or defend claims

Data retention period: until the expiry of the limitation period for potential claims. 

• GDPR Article 9 (1) (a)

the data subject has given their explicit consent to the processing of this personal data

Data retention period: until consent is withdrawn

• GDPR Article 6 (1) (f)

processing is necessary for the purposes of the legitimate interests pursued by the controller 

Data retention period: 14 days

• GDPR Article 9 (1) (a)

the data subject has given their explicit consent to the processing of this personal data

Data retention period: until the expiry of the limitation period for potential claims.

• GDPR Article 9 (2) (h)

processing is necessary for the purposes of providing healthcare and managing healthcare systems and services.

Data retention period: Your personal data is kept for the period required for the storage and archiving of medical records as specified by law, in particular the Act of 6 November 2008 on Patient Rights and Patients’ Ombudsman (Article 29).

• GDPR Article 9 (1) (a)

the data subject has given their explicit consent to the processing of this personal data

Data retention period: until you withdraw your consent.

• GDPR Article 9 (1) (a)

the data subject has given their explicit consent to the processing of this personal data

Data retention period: until consent is withdrawn

If you consent to the processing of personal data by automated means, including profiling in order to tailor the information provided to you, this will involve combining data received from you with information relating to characteristics, behaviour, preferences in order to tailor commercial information to known or anticipated needs or expectations (profiling). In this way, you will receive such information that corresponds to your needs and that is of interest to you.

• GDPR Article 9 (1) (a)

the data subject has given their explicit consent to the processing of this personal data

Data retention period: until you withdraw your consent.

• you have the right to request access to your personal data, rectification, erasure or restriction of processing;
• you have the right to object to the processing, as well as the right to data portability. Please make your requests directly to the Clinic or by email to daneosobowe@invicta.pl;
• data: first and last name, date of birth, gender designation, address of residence, PESEL number, if assigned, in the case of a newborn child – the mother’s PESEL number, and in the case of persons who have not been assigned a PESEL number – the type and number of the document confirming identity, if the patient is a minor, completely incapacitated or incapable of conscious consent – first and last name of the legal representative and the address of his or her place of residence, as well as data on past, present or future physical or mental health condition, including genetic data is part of the medical records and cannot be removed by the Controller.This does not apply to consent to the transmission of information and consent to profiling;
• you have the right to lodge a complaint with the supervisory authority (President of the Office for Personal Data Protection, POPDP) if you consider that the processing of your personal data violates the provisions of the GDPR or other regulations on personal data protection;
• you have the right to withdraw your consent to the processing of your email address and telephone number, as well as your consent to the transmission of information and consent to profiling, at any time without affecting the lawfulness of the processing carried out on the basis of consent before its withdrawal.

• entities to which we have entrusted your personal data under an entrustment agreement, which participate in the handling of the treatment process;
• other medical entities which cooperate with Invicta to ensure continuity of treatment and are subcontractors of medical services;
• providers of technical and marketing services, in particular providers of ICT services, diagnostic equipment, courier and postal companies, providers of services in the marketing area (advertising agencies, SMS and e-mail companies),
• providers of legal services in the event of redress;
• persons authorised by you to access your medical records and health information;
• entities financing medical services, in particular the National Health Fund and state and local government entities in the scope of infertility treatment programmes.

The transfer of personal data to a third country will only be possible upon your explicit request.

Beata Gozdecka

e-mail address daneosobowe@invicta.pl

ul. Polna 64
81-740 Sopot

Your personal data will also be used in proceedings for the award of contracts, including contracts carried out as part of projects financed by EU funds or other public funds.

• GDPR Article 6 (1) (b)

processing is necessary to take steps at the request of the data subject prior to entering into a contract

• GDPR Article 6 (1) (c)

the processing is necessary to fulfil the legal obligation imposed on the Controller

Data retention period: a maximum of 10 years for proceedings conducted as part of projects financed by EU funds or other public funds. 

Personal data may also be used in the performance and settlement of the contract concluded in the procurement procedure, including contracts carried out as part of projects financed by EU funds or other public funds.

• GDPR Article 6 (1) (b)

processing is necessary for the performance of the agreement 

Data retention period: until the expiry of the limitation period for potential claims.

• GDPR Article 6 (1) (c)

the processing is necessary to fulfil the legal obligation imposed on the Controller

• The Accounting Act of 29 September 1994.
• Tax regulations

Data retention period: 5 years counted from the end of the calendar year in which the tax obligation arose

• GDPR Article 6 (1) (f)

processing is necessary to establish, assert or defend claims

Data retention period: until the expiry of the limitation period for potential claims.  

• GDPR Article 6 (1) (a)

the data subject has given their explicit consent to the processing of this personal data

Data retention period: until you withdraw your consent.

• you have the right to request access to your personal data, rectification, erasure or restriction of processing;
• you have the right to object to the processing, as well as the right to data portability. Please submit your requests by email to daneosobowe@invicta.pl;
• data which is processed on the basis of legal regulations and whose storage is a legal obligation (e.g. on the basis of tax regulations) cannot be deleted by the Controller. Other data may be deleted at your request;
• you have the right to lodge a complaint with the supervisory authority (President of the Office for Personal Data Protection, POPDP) if you consider that the processing of your personal data violates the provisions of the GDPR or other regulations on personal data protection.

• providers of technical or banking services, in particular ICT service providers, courier and postal companies and banks;
• providers of legal services in the event of redress;
• management and intermediary bodies (in the case of participation in competitive procedures for projects financed by EU funds or other public funds).

The transfer of personal data to a third country will only be possible upon your explicit request.