Privacy policy of the kacdoktor.pl website and of the services provided by KACDOKTOR Sp. z o.o.
§ 1. Data controller
1.1. The controller of personal data is KACDOKTOR Sp. z o.o. with its registered office at ul. Krochmalna 32A/U2, 00-864 Warsaw, Poland, entered in the Register of Entrepreneurs of the National Court Register (Krajowy Rejestr Sądowy) under KRS number 0000744112, NIP 1132980622, REGON 380968218, with a share capital of PLN 10,000.00, hereinafter referred to as “KacDoktor” or the “Controller”.
1.2. KacDoktor is an entity performing medical activity, entered in the Register of Entities Performing Medical Activities (Rejestr podmiotów wykonujących działalność leczniczą, RPWDL) under book number 000000209458.
1.3. The Controller states that it has not appointed a Data Protection Officer (DPO). Tasks relating to the protection of personal data are performed directly by the Controller.
1.4. In matters concerning the processing of personal data you may contact us:
b) in writing at the Controller’s registered office: ul. Krochmalna 32A/U2, 00-864 Warsaw, Poland.
§ 2. Scope of data and sources
2.1. Depending on how you use the website kacdoktor.pl, hereinafter the “Website”, and KacDoktor’s services, we may process:
a) identification data, such as first name and surname, date of birth, sex, PESEL number or identity-document data and, where applicable, data of a statutory representative;
b) contact and address data, in particular telephone number, e-mail address, residential address, correspondence address or the address at which the service is provided;
c) health data, in particular information on health status, symptoms, complaints, medicines or substances taken, medical history and other circumstances relevant to the assessment of the patient’s condition and the provision of the service;
d) information on the booked and performed service, medical records, payments, invoices, complaints and claims;
e) information provided in a form, correspondence, a telephone conversation or other contact with KacDoktor; this does not mean that telephone calls are recorded;
f) in the case of the newsletter – e-mail address, first name and surname if provided, information on the giving and withdrawal of consent and, where the relevant function is active, data on the sending, opening or clicking of a message;
g) technical data and Website-usage data, such as IP address, date and time of the connection, information about the device, system and browser, pages visited, referrer URL, online identifiers, events related to use of the Website and error information.
2.2. We obtain data:
a) directly from the data subject;
b) automatically from the device used to access the Website;
c) in connection with medical services – from the person booking the appointment for the patient, a statutory representative, a person acting on the patient’s behalf, or another medical entity, if the disclosure is related to a planned or provided healthcare service.
2.3. If another person books an appointment for a patient, we may also process that person’s contact data to the extent necessary to handle the request and arrange the visit. We do not use data received from other persons to subscribe the patient to the newsletter or to send the patient marketing information.
2.4. If we have obtained a patient’s data from a third party, the information obligation under Article 14 GDPR is fulfilled within a reasonable time after obtaining the data (no later than one month) or at the first communication with the patient, unless that obligation does not apply under the GDPR.
§ 3. Purposes, legal bases and retention periods
3.1. Operation and security of the Website
a) Purpose and scope: We process technical data in order to display the Website, ensure its proper and secure operation, diagnose errors and prevent abuse.
b) Legal basis: Article 6(1)(f) GDPR, i.e. the Controller’s legitimate interest in maintaining, protecting and properly administering the Website.
c) Retention period: The data are stored for as long as needed to ensure the operation and security of the Website and to clarify any errors or incidents. Data needed to establish, exercise or defend legal claims may be stored until the applicable limitation period expires.
3.2. Contact and appointment booking
a) Purpose and scope: We process data in order to answer an enquiry, return a call, provide information about services, book, change or cancel an appointment, assess whether and on what terms a service can be provided, and dispatch medical staff to the correct address.
b) Legal basis: Ordinary personal data are processed under Article 6(1)(b) GDPR where the contact is aimed at concluding or performing a contract, and under Article 6(1)(f) GDPR in the case of other communication or a request made by another person on the patient’s behalf (the Controller’s legitimate interest being to handle the enquiry and organise contact with the patient). Where health data are processed in connection with booking an appointment, the additional basis is Article 9(2)(h) GDPR, because the processing is necessary for the provision or organisation of a healthcare service.
c) Retention period: We store the data until the contact or matter is closed. If a healthcare service is provided or medical records are created, the data are then stored under the rules applicable to healthcare services and medical records. The data may be stored longer if this is necessary to handle a complaint or to protect legal claims.
3.3. Healthcare services and medical records
a) Purpose and scope: We process data in order to assess the patient’s health, provide a healthcare service, ensure continuity of care, keep, store and make available medical records, and manage the provision of healthcare services.
b) Legal basis: Ordinary personal data are processed under Article 6(1)(b) and (c) GDPR. Health data are processed under Article 9(2)(h) GDPR in conjunction with the provisions on medical activity and patients’ rights, in particular Article 24 of the Act of 6 November 2008 on Patients’ Rights and the Patient Ombudsman (ustawa o prawach pacjenta i Rzeczniku Praw Pacjenta). Health data are processed by authorised persons who are bound by a duty of confidentiality.
c) Retention period: As a rule, we store medical records for 20 years from the end of the calendar year in which the last entry was made. Where one of the special periods provided for in Article 29 of the Act on Patients’ Rights and the Patient Ombudsman applies, the records are stored for the period specified in that provision.
3.4. Contract, payments and legal obligations
a) Purpose and scope: We process data in order to perform and settle the contract, accept payment, issue an invoice and fulfil accounting and tax obligations.
b) Legal basis: Article 6(1)(b) and (c) GDPR.
c) Retention period: Data related to performance of the contract are stored for the duration of its performance, and accounting and tax records for the period required by law, as a rule 5 years calculated in accordance with the applicable tax and accounting provisions.
3.5. Complaints and claims
a) Purpose and scope: We process data in order to handle complaints and to establish, exercise and defend legal claims.
b) Legal basis: Depending on the type of matter, the basis is Article 6(1)(b), (c) or (f) GDPR (the Controller’s legitimate interest being to protect its rights and to demonstrate that the healthcare service or other service was provided correctly). If a complaint or claim includes health data, those data are also processed under Article 9(2)(f) or (h) GDPR.
c) Retention period: We store the data until the matter is closed and then until the applicable limitation period expires. For many claims related to business activity that period is 3 years; depending on the type of claim or the commencement of proceedings, a different period may apply.
3.6. Newsletter
a) Purpose and scope: We process data in order to send the newsletter and – where the relevant functions are used – to prepare basic statistics on its delivery and use.
b) Legal basis: The basis for processing is consent, i.e. Article 6(1)(a) GDPR. Commercial information is sent after obtaining the consent required by Article 398 of the Act of 12 July 2024 – Electronic Communications Law (Prawo komunikacji elektronicznej).
c) Retention period: The data are processed until consent is withdrawn or the newsletter is discontinued. After withdrawal of consent, limited information on the giving and withdrawal of consent may be stored for as long as needed to demonstrate that the Controller acted correctly, to prevent further sending and to protect against claims.
3.7. Analytics and measurement of advertising effectiveness
a) Purpose and scope: After the required consent has been obtained, technical data and data on activity on the Website may be processed in order to produce Website-usage statistics, identify sources of visits and contacts (including telephone calls), measure the effectiveness of advertising and conversions, detect problems with the operation or usability of the Website, and improve the Website’s content and functions.
b) Legal basis: Personal data are processed under Article 6(1)(a) GDPR. The storing of information on the user’s device or access to information already stored on it takes place in accordance with Article 399 of the Electronic Communications Law. If, in a given case, information on use of the Website could reveal interest in a specific healthcare service and thereby constitute health data, its processing also requires explicit consent under Article 9(2)(a) GDPR.
c) Retention period: The data are processed until consent is withdrawn or for the period resulting from the settings of the individual technologies. Detailed information on those periods is set out in the Cookie Policy.
§ 4. Voluntary nature and obligation to provide data
4.1. Providing data when contacting us and booking an appointment is voluntary, but the absence of data necessary to handle the request may make it impossible to reply, book an appointment or perform the service.
4.2. Providing data required to keep medical records is an obligation arising from the law. The absence of data needed to assess health or to provide the service safely may mean that the service cannot be provided.
4.3. Providing data required to issue an invoice is necessary if the patient requests an invoice.
4.4. Subscribing to the newsletter and consenting to optional analytics and advertising technologies are voluntary. Refusal or withdrawal of consent does not prevent use of the basic functions of the Website or use of medical services.
§ 5. Recipients of data
5.1. Access to the data may be had by persons authorised by the Controller, including employees, contractors and medical staff acting within KacDoktor.
5.2. Data may be disclosed to the following categories of recipients, solely to the extent needed to achieve the relevant purpose:
a) providers of hosting, e-mail, domains, software, patient-management and medical-records systems, Website-management tools and other IT services;
b) providers of marketing, analytics, advertising, newsletter and automation services;
c) payment operators, banks, invoicing-system providers, accounting firms, auditors and law firms;
d) postal operators and courier companies, where needed to conduct correspondence or deliver a shipment;
e) other entities providing healthcare services, where necessary to ensure continuity of care or where another legal basis so requires;
f) tax authorities, courts, law-enforcement authorities, the Patient Ombudsman (Rzecznik Praw Pacjenta), authorities supervising medical activity and authorities of the professional self-governments of medical professions – if they are entitled to receive the data under the law.
5.3. Service providers may act as processors on the Controller’s instructions or as independent controllers, depending on the nature of the service and the applicable law. In this Policy we indicate the categories of entities that process data on our instructions. Entities that, in connection with tools used on the Website, act as joint controllers or independent controllers are named in § 6.
§ 6. Google and Meta
6.1. Meta Pixel
6.1.1. After the required consent has been obtained, we may use Meta Pixel and other Meta Business Tools provided by Meta Platforms Ireland Limited, with its registered office at Merrion Road, Dublin 4, D04 X2K5, Ireland, hereinafter “Meta Ireland”.
6.1.2. These tools are used to measure advertising effectiveness, attribute conversions and produce reports and statistics. We do not use them to create our own remarketing audiences based on the user’s interest in a specific healthcare service.
6.1.3. As regards the collection of data on events on the Website by means of Meta Business Tools and the transmission of those data to Meta Ireland, KacDoktor and Meta Ireland are joint controllers under Article 26 GDPR. Joint control covers only collection and transmission. It does not cover subsequent processing by Meta Ireland, which in that respect acts as an independent controller.
6.1.4. KacDoktor is responsible in particular for ensuring the legal basis for use of the tool, obtaining the required consent and providing information about the processing. Meta Ireland is responsible for fulfilling the obligations set out in the joint-controller arrangement, including enabling the exercise of rights in respect of data stored by Meta Ireland.
6.1.5. The essence of the joint-controller arrangement is available in the Meta Controller Addendum. Information on subsequent processing by Meta Ireland and on how to exercise rights vis-à-vis Meta Ireland is set out in Meta’s Privacy Policy at https://www.facebook.com/privacy/policy/.
6.2. Google Analytics and Google Ads
6.2.1. After the required consent has been obtained, we may use Google Analytics 4 and Google Ads measurement tools, including technologies for measuring conversions and the effectiveness of telephone calls. These services are provided by Google Ireland Limited, with its registered office at Gordon House, Barrow Street, Dublin 4, Ireland, hereinafter “Google”.
6.2.2. Google Analytics is used to produce statistics, analyse use of the Website, identify sources of visits and conversions, and improve the Website. In the standard scope in which Google processes data in accordance with KacDoktor’s documented instructions, Google acts as a processor.
6.2.3. If data sharing with Google for Google products and services is enabled in the Google Analytics settings, Google may process the shared data as an independent controller.
6.2.4. In the case of Google Ads services to which controller-to-controller terms apply, KacDoktor and Google act as separate controllers and are each responsible for their own processing operations. This does not mean that KacDoktor and Google are joint controllers.
6.2.5. Information on how Google uses data from sites and apps that use its services is available on the page “How Google uses information from sites or apps that use our services”. Information on processing by Google as an independent controller is set out in Google’s Privacy Policy at https://policies.google.com/privacy.
6.3. Scope of data transmitted to the tools
6.3.1. The Meta and Google tools may receive technical data and activity data, such as IP address, online identifiers, browser and device information, date and time of the event, and information on impressions, clicks or conversions.
6.3.2. We do not transmit to analytics and advertising tools:
a) the patient’s first name and surname, telephone number or e-mail address;
b) the address at which the service is provided;
c) the content of forms, correspondence or information provided during a call;
d) medical records;
e) information on symptoms, health status, medicines or substances taken;
f) the PESEL number or identity-document data.
6.3.3. Analytics and advertising tools should not be activated on pages or stages of patient handling on which they could obtain access to form content, patient data or medical records.
§ 7. Transfers of data outside the European Economic Area
7.1. In connection with the use of IT, newsletter, automation, analytics, advertising or marketing services, data may be transferred outside the European Economic Area, or access to the data may take place from such countries.
7.2. A transfer takes place only on the basis of a mechanism provided for in Chapter V GDPR, in particular:
a) an adequacy decision of the European Commission, including – in respect of organisations covered by that mechanism – the decision on the EU-US Data Privacy Framework;
b) standard contractual clauses adopted by the European Commission, supplemented where necessary by additional safeguards;
c) another mechanism permitted by the GDPR.
§ 8. Cookies and external links
8.1. The Website uses cookies and similar technologies:
a) necessary for the operation and security of the Website;
b) analytics and advertising technologies, activated after the user’s consent.
8.2. Consent is not required for technologies necessary to carry out the transmission of an electronic communication or to provide a service explicitly requested by the user, in accordance with Article 399(3) of the Electronic Communications Law.
8.3. Detailed information on the technologies used, their providers, purposes, operating periods and how to change or withdraw consent is set out in the Cookie Policy available at https://www.kacdoktor.pl/en/deklaracja-cookies.
8.4. External links. The Website may contain links to external websites or social-media services. The data collected by those entities are governed by their own privacy policies. The Controller is not responsible for the practices of those entities.
§ 9. Rights of data subjects
9.1. On the terms laid down in the GDPR you may request:
a) access to your data and a copy of them, as well as information about their processing, including – where applicable – the actual recipients of the data (Article 15 GDPR);
b) rectification or completion of the data (Article 16 GDPR);
c) erasure of the data (the “right to be forgotten”) (Article 17 GDPR);
d) restriction of processing (Article 18 GDPR);
e) portability of data processed by automated means on the basis of consent or a contract (Article 20 GDPR);
f) withdrawal of consent at any time, without affecting the lawfulness of processing carried out before the withdrawal;
g) objection to processing based on Article 6(1)(f) GDPR on grounds relating to your particular situation (Article 21 GDPR);
h) objection at any time to the processing of data for direct-marketing purposes (Article 21 GDPR).
9.2. Individual rights depend on the purpose and legal basis of the processing. In particular, the obligation to store medical records, tax records or other data required by law may prevent their earlier erasure.
9.3. To exercise your rights, you may write to info@kacdoktor.pl or to the Controller’s registered office. Where necessary, the Controller may ask for additional information allowing the identity of the person making the request to be confirmed.
9.4. If you consider that the data are being processed unlawfully, you may lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO): ul. Stawki 2, 00-193 Warsaw, Poland, https://uodo.gov.pl. You may also lodge a complaint with a supervisory authority in the Member State of your habitual residence, place of work or place of the alleged infringement.
§ 10. Changes to the Privacy Policy
10.1. The Privacy Policy may be updated in particular in the event of changes in the law, in the operation of the Website, in the technologies used or in the ways in which data are processed.
10.2. Last update: 21st September 2026.
This website uses cookies, thanks to which it works better.
Find out more »
