Privacy and Cookie Policy

Effective from 3 November 2026.

This Privacy Policy sets out the rules for the processing of personal data of visitors to the website available at vorobev-spl.com (the “Website”) and the rules for the use of cookies. It has been prepared in fulfilment of the information obligation under Article 13 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation; the “GDPR”).

§ 1. Controller

1. The controller of personal data is Andrei Vorobev, conducting business activity under the business name Andrei Vorobev Specjalistyczna Praktyka Lekarska, with the permanent place of business at: ul. Hetmańska 8/13, 85-039 Bydgoszcz, Poland, Tax ID (NIP): 9671498925, REGON: 544967838 (the “Controller”).
2. The Controller may be contacted on matters relating to personal data protection by e-mail at info@vorobev-spl.com or in writing at the address indicated in paragraph 1.
3. The Controller has not appointed a data protection officer.

§ 2. Nature of the Website and scope of data processed

1. The Website is informational. It cannot be used to conclude an agreement for the provision of healthcare services, to book an appointment or to make a payment. The Website does not contain any forms for collecting personal data. Appointments are booked outside the Website, as described in § 10.
2. The Controller does not process patients' personal data, including health data, via the Website.
3. The Controller processes the following categories of personal data:
   1. data recorded automatically in the server logs each time the Website is displayed: the IP address of the device, the date and time of the request, the address of the page displayed, the address of the referring page (if transmitted by the browser), and the type and version of the web browser and operating system;
   2. data provided in electronic correspondence – where a message is sent to the e-mail address indicated on the Website: the sender's e-mail address, first name and surname (if provided) and other data contained in the message.

§ 3. Purposes and legal bases of processing

1. Data recorded in the server logs are processed in order to ensure the proper functioning and technical security of the Website and to detect and prevent misuse – on the basis of Article 6(1)(f) GDPR, i.e. the legitimate interest of the Controller.
2. Data provided in electronic correspondence are processed in order to reply to the message and to conduct further correspondence – on the basis of Article 6(1)(f) GDPR, i.e. the legitimate interest of the Controller in communicating with persons who contact the Controller.
3. To the extent necessary, data may also be processed for the purpose of establishing, exercising or defending legal claims – on the basis of Article 6(1)(f) GDPR.

§ 4. Data retention period

1. Data recorded in the server logs are stored for the period necessary to achieve the purposes referred to in § 3(1), in accordance with the settings of the hosting service, and are then deleted automatically.
2. Data provided in electronic correspondence are stored for the period necessary to reply and to conclude the correspondence and thereafter – to the extent justified – until the limitation period for any claims has expired.

§ 5. Recipients of data

1. Personal data may be entrusted only to entities processing them on behalf of the Controller under data processing agreements, namely:
   1. Prociv Sp. z o.o., with its registered office in Wrocław, ul. Czerniawska 2A/27, 50-576 Wrocław, Poland, Tax ID (NIP) 8971776931, the operator of the VH.pl service, which provides the Controller with the hosting service on which the Website is maintained;
   2. the entity providing the Controller with e-mail services – with respect to handling electronic correspondence.
2. Data may also be disclosed to public authorities only in the cases and to the extent provided for by law.

§ 6. Transfers of data to third countries

Personal data are not transferred to countries outside the European Economic Area or to international organisations.

§ 7. Rights of data subjects

1. In accordance with the GDPR, the data subject has the right to:
   1. access their data and obtain a copy thereof (Article 15 GDPR);
   2. rectification of data (Article 16 GDPR);
   3. erasure of data (Article 17 GDPR);
   4. restriction of processing (Article 18 GDPR);
   5. object to processing on grounds relating to their particular situation – insofar as processing is based on the legitimate interest of the Controller (Article 21 GDPR).
2. To exercise these rights, please contact the Controller as indicated in § 1(2).
3. The data subject also has the right to lodge a complaint with the supervisory authority – the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland – if they consider that the processing of their personal data infringes the GDPR.

§ 8. Voluntary provision of data and automated decision-making

1. Providing data in electronic correspondence is voluntary but necessary in order to receive a reply. Data are recorded in the server logs automatically, which is a technical requirement for displaying the Website.
2. Personal data are not subject to automated decision-making, including profiling, as referred to in Article 22 GDPR.

§ 9. Cookies

1. Cookies are small text files stored on the user's terminal equipment (computer, phone, tablet) when using websites.
2. The Website does not use cookies or any other technologies for storing information or accessing information stored on the user's terminal equipment, in particular analytical, statistical or advertising tools. Consequently, it is not necessary to obtain the consent referred to in Article 399 of the Polish Electronic Communications Law of 12 July 2024 (Prawo komunikacji elektronicznej).
3. If cookies requiring the user's consent are introduced on the Website, the Controller will implement a mechanism for giving and withdrawing such consent and will update this Policy.
4. The user may manage cookies at any time using the settings of their web browser.

§ 10. Booking appointments and links to external services

1. Patient appointments are handled by the healthcare provider operating the Przychodnia „Przy Szpitalu” clinic, ul. Marii Skłodowskiej-Curie 26, 85-094 Bydgoszcz, Poland, which is a separate controller of patients' personal data, including health data.
2. The Website contains links to the ZnanyLekarz.pl service, through which appointments can be booked. Once the user moves to that service, personal data are processed by its operator and by the entity referred to in paragraph 1 as separate controllers, in accordance with their respective privacy policies.
3. The Controller is not responsible for the personal data processing rules applied by external services.

§ 11. Final provisions

1. The Controller reserves the right to amend this Policy, in particular in the event of changes in the law or in the way the Website operates.
2. The current version of the Policy is permanently available on the Website.