GDPR information for patients of the “Psychological Centre Sztuka Harmonii”

§1

Identity of the personal data controller

• The controller of the personal data provided while using psychological, psychotherapeutic and related services is Magdalena Raba, running a business under the business name RABA Magdalena Raba, ul. Konstantego Bergiela 4/10, 80-180 Gdańsk, NIP: 5833557278, who runs the “Psychological Centre Sztuka Harmonii”, e-mail contact for the data controller: rodo@sztukaharmonii.pl.
• The rules for processing personal data are set out in the Cookie Policy, available at: www.sztukaharmonii.pl/polityka-cookies
• The rules for processing the personal data of visitors to the website www.sztukaharmonii.pl are described in the Privacy Policy, available at: www.sztukaharmonii.pl/polityka-prywatnosci
• Data are processed in accordance with the laws currently in force, i.e. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter: GDPR), the Act of 10 May 2018 on data protection, and the Electronic Communications Law of 12 July 2024 (Prawo komunikacji elektronicznej).

§2

Purposes of processing the patient's personal data

1. Magdalena Raba, running a business under the business name RABA Magdalena Raba, processes patients' personal data for the following purposes:

• booking an appointment and/or online consultation, changing and/or cancelling an appointment, and providing a reply - on the basis of Art. 6(1)(b) GDPR, i.e. the necessity of the data for concluding and performing a contract at the request of the data subject,
• providing psychological, psychotherapeutic and related services - on the basis of Art. 9(2)(a) GDPR, i.e. voluntary consent to the processing of sensitive data which the data subject may provide in the course of psychological/psychotherapeutic services and/or online consultations at the “Psychological Centre Sztuka Harmonii”, including data revealing: state of health, sexuality or sexual orientation, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data or biometric data for the purpose of uniquely identifying a natural person,
• performing a contract to which the data subject is a party, or taking steps at the request of the data subject, i.e. preparing and concluding a cooperation agreement and/or service agreement and/or sales agreements, and performing it, on the basis of Art. 6(1)(b) GDPR,
• replying to a question asked using the contact details available on the site, on the basis of Art. 6(1)(b) GDPR, i.e. the necessity of the data for performing a contract or before its conclusion, at the request of the data subject,
• documenting the performance of services, including issuing a bill or invoice to a natural person, on the basis of Art. 6(1)(c) GDPR, i.e. in order to fulfil the legal obligations to which the personal data controller is subject, under Art. 70 of the Tax Ordinance Act of 29 August 1997 (Ordynacja podatkowa),
• sending requested commercial information by electronic means, in accordance with Art. 6(1)(a) GDPR, i.e. on the basis of the consent of the data subject,
• pursuing rights and claims by the data controller or the data subject, on the basis of Art. 6(1)(f) GDPR, i.e. for the purposes of the legitimate interests pursued by the data controller or the data subject.
• Providing the data is necessary for preparing and performing contracts for the provision of psychological/psychotherapeutic and related services, as well as for issuing an accounting document, pursuing claims and answering questions. Providing any other data is voluntary.
• Failure to provide the required data makes it impossible to perform the contract properly, to issue a bill or invoice or to make contact at the request of the data subject.

§3

Period of processing the patient's personal data

The patient's personal data are processed for the period necessary to achieve the purpose for which they were collected, i.e.:

• personal data processed for the purpose of conducting psychological/psychotherapeutic therapy and/or online consultations will be processed for the duration of the therapy and then for 5 years from the end of the calendar year in which cooperation with the patient ended, except where consent to the processing of special categories of data is withdrawn, unless a provision of a specific act provides otherwise or if longer storage is justified by the pursuit or defence of claims,
• ordinary data may be processed for up to 5 years from the end of the calendar year in which your last appointment took place and the accounting documents relating to the service were issued, in connection with Art. 70 of the Tax Ordinance Act of 29 August 1997 (Ordynacja podatkowa). In the case of a structured invoice, however, once it has been sent to the National e-Invoice System (KSeF), the data will be stored for 10 years from the end of the year in which it was issued, under Art. 112aa(1) of the Act of 11 March 2004 on tax on goods and services,
• for the purpose of replying by electronic means of communication (enquiries, information about available appointment dates, etc.) - data are processed only for the period necessary to reply, but no longer than 6 months from the date the enquiry was received, if no contract for the provision of services has been concluded,
• for the purpose of recruitment, i.e. no longer than 6 months from the date the application documents were sent. After this period, the personal data are deleted. If the data subject consents, the data will be processed for the purposes of future recruitment. The basis for processing data for the purposes of subsequent recruitment will be Art. 6(1)(a) GDPR, i.e. consent. The personal data will then be processed for up to 12 months or until consent for this purpose is withdrawn,
• for the purpose of sending requested commercial information by electronic means - until consent is withdrawn, without affecting the lawfulness of processing before its withdrawal.

§4

Recipients of the patient's personal data

The patient's personal data may be entrusted to other entities to perform services on behalf of the data controller, in particular for the purpose of:

• hosting and maintaining the e-mail of the personal data controller,
• servicing and maintaining the IT systems in which the data are processed, in particular systems for online booking, online consultations, live chat on the website, telephone and/or SMS contact, etc.,
• providing accounting, HR and payroll, and administrative and marketing services.

§5

Processing of patient data outside the European Economic Area

• As the Controller uses hosting tools and IT systems whose providers may have their registered office or technical infrastructure located outside the European Economic Area, personal data may be transferred to:
• the United States of America, on the basis of the European Commission decision of 10 July 2023 finding an adequate level of protection of personal data ensured by the so-called “EU–US Data Privacy Framework” for providers entered on the US Department of Commerce list, such as Google LLC, Microsoft Corporation, Meta Platforms, Inc., Twilo Inc.
• China - only when communicating with the Controller on the TikTok platform, data may be processed by entities of the TikTok group, including ByteDance Ltd., whose infrastructure may be located in China; accordingly, personal data may be transferred outside the EEA on the basis of European Commission Decision 2021/914 on standard contractual clauses for the transfer of personal data to third countries, included in the terms of service agreed between the data controller and the provider of the solution.

§6

Facebook and joint controllership of data

• The Controller is also a joint controller of the data of its followers on social media - in particular of persons who use means of electronic communication (messenger) on the fan page run by the data controller on the Facebook social network. Otherwise, the controller of the data of Users of this social network is Meta Platforms Ireland Limited (formerly: Facebook Inc., with its registered office at 1 Hacker Way, Menlo Park, CA 94025, USA), and these data are processed in accordance with the rules described in the terms and privacy policies for users of these services, including at: https://www.facebook.com/privacy
• The personal data of the fan page User will be processed in a third country, i.e. in the United States of America (USA). Data are transferred to the USA on the basis of the European Commission decision of 10 July 2023 finding an adequate level of protection of personal data ensured by the so-called “EU-US Data Privacy Framework” for providers entered on the US Department of Commerce list, such as: Meta Platforms, Inc., Menlo Park, California, USA.

§7

Rights of data subjects

• The data subject has:
• the right of access to the content of the data and to rectify them, as well as to receive a copy of the data,
• the right to erasure of the data, unless other legal provisions require the data controller to archive the data for a specified period,
• the right to data portability, if the processing is based on a contract or the consent of the data subject and is carried out by automated means,
• the right to object to the processing of data for the purposes of direct marketing carried out by the data controller on the basis of its legitimate legal interest, as well as to the restriction of processing,
• the right not to be subject to automated profiling, if the data controller were to take decisions based solely on automated profiling that produce legal effects concerning the data subject or similarly affect them,
• the right to control the processing of data and to information on who the data controller is, as well as to obtain information about the purpose, scope and manner of processing the data, the content of the data, the source of the data and the manner of sharing it, including the recipients or categories of recipients of the data,
• the right to withdraw consent at any time, if the processing was based on the consent of the data subject. Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal,
• the right to lodge a complaint with the President of the Personal Data Protection Office (PUODO), if the person considers that the processing of their data does not comply with the regulations currently in force in this area.