Privacy Policy
Last updated: 5 October 2026
This Privacy Policy explains how personal data, including health data, is processed when you use doctorinpoland.com, contact our patient coordinators, or use the services we arrange with doctors and medical facilities in Poland. It is written to comply with Regulation (EU) 2016/679 (GDPR), the Polish Act on Patient Rights and the Patient Ombudsman, and other applicable Polish law.
1. Who is the controller
The controller of your personal data is Agencja Diagnostyki Medycznej Prosta Spółka Akcyjna (“ADM”, “we”), ul. Kaliny Jędrusik 9 lok. U2, 03-772 Warszawa, Poland, entered in the National Court Register under KRS 0001143339, NIP 5253027463, REGON 540381283, and in the Register of Healthcare Entities (RPWDL) under book no. 000000287995.
Contact in all data protection matters: privacy@doctorinpoland.com, by post to the address above, or by phone +48 787 000 329.
2. How the service works and who is responsible for what
- Enquiry and coordination. When you contact us, ADM is the controller of the data you provide: we review your enquiry, match you with a suitable doctor or facility, and organise appointments, diagnostics, transport and related services.
- Medical care. The doctor, practice or medical facility that treats you is a separate controller of your medical documentation and keeps it as required by Polish law. Where ADM itself provides healthcare services as a registered healthcare entity, ADM is the controller of that documentation.
- Professional secrecy. Everyone involved in your care — doctors and other medical professionals — is bound by professional secrecy under Polish law. Our coordinators who handle health information are bound by a written duty of confidentiality.
3. What data we process
- Identification and contact data: name, e-mail address, phone or messenger number, country of residence, preferred language and contact preferences.
- Enquiry data: the topic of your enquiry, the speciality and services you are interested in, timing, who the patient is, and the content of your messages.
- Health data that you choose to share with us, or that is needed to organise your care (e.g. symptoms, diagnosis, results, referrals, medical history).
- Data of the patient, if you contact us on behalf of another person (e.g. a family member or a child).
- Service and payment data: services booked, invoices, payment status. Card data are handled directly by our payment provider and are not stored by us.
- Technical data: IP address, device and browser information, security logs and cookie data — see our Cookie Policy.
4. Purposes and legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Answering your enquiry and contacting you in the way you selected | Art. 6(1)(b) – steps taken at your request before entering into a contract; Art. 6(1)(f) – our legitimate interest in responding to enquiries |
| Processing health information you include in your enquiry, to match you with a doctor and organise care | Art. 9(2)(a) – your explicit consent |
| Arranging and coordinating medical services, diagnostics, transport and related services; sharing necessary information with the doctors and facilities involved | Art. 6(1)(b) – performance of a contract; Art. 9(2)(h) and 9(3) – provision of health care under professional secrecy; Art. 9(2)(a) – your explicit consent where required |
| Payments, invoicing, accounting and tax | Art. 6(1)(b) and 6(1)(c) – legal obligations under tax and accounting law |
| Keeping medical documentation where ADM provides healthcare services | Art. 6(1)(c) and 9(2)(h) – obligations under the Act on Patient Rights and the Patient Ombudsman |
| Follow-up after a service, handling complaints and quality improvement | Art. 6(1)(b) and 6(1)(f) – legitimate interest in the quality and safety of the service |
| Establishing, exercising or defending legal claims, including mediation and arbitration | Art. 6(1)(f); Art. 9(2)(f) |
| Website security, preventing abuse and spam | Art. 6(1)(f) |
| Newsletters and marketing communication by e-mail, phone or SMS | Art. 6(1)(a) – your consent, and consent under the Polish Electronic Communications Law; only if you opt in |
Providing data is voluntary, but without the data needed to answer or organise your care we may not be able to help you. Please do not send medical records through the contact form; a coordinator will tell you how to share documents securely if they are needed.
5. Who receives your data
We share only the data needed for a given purpose, with:
- doctors, dental practices, clinics, hospitals, diagnostic laboratories and imaging centres that provide or prepare your care;
- providers of services you ask us to arrange, such as medical transport, interpreters, accommodation or travel assistance;
- your insurer, your doctor in your home country or another person — only at your request or with your consent;
- our service providers acting on our instructions (processors): website hosting and e-mail, IT and security services, communication tools, accounting and legal advisers bound by confidentiality;
- payment providers (e.g. Stripe), acting as separate controllers for payment data;
- public authorities, where required by law.
If you choose to communicate via WhatsApp or another messenger or video service, the provider of that service also processes your data under its own terms.
6. Transfers outside the European Economic Area
Some of our service providers (e.g. our hosting provider) may process data outside the EEA. In such cases we use safeguards provided by the GDPR, in particular European Commission adequacy decisions or Standard Contractual Clauses. Israel is covered by an adequacy decision of the European Commission.
If you ask us to send information to a doctor, insurer or other person in a country without an adequacy decision (for example your home country), we will do so to perform the service you requested or on the basis of your explicit consent (Art. 49(1)(a)–(c) GDPR). Such countries may not offer the same level of data protection as the EU.
7. How long we keep data
- Enquiries that do not lead to a service: up to 3 years from the last contact, for follow-up questions and the protection of legal claims.
- Data related to services we arranged: for the duration of the service and then until the limitation period for claims expires (as a rule 6 years, counted to the end of the calendar year).
- Medical documentation: for the periods required by Art. 29 of the Act on Patient Rights and the Patient Ombudsman (as a rule 20 years from the end of the calendar year of the last entry), by the entity that keeps it.
- Accounting and tax documents: 5 years from the end of the calendar year in which the tax obligation arose.
- Marketing: until you withdraw your consent or object.
- Security logs: for a short period necessary to protect the website.
8. Your rights
You have the right to access your data, receive a copy, rectify it, request erasure or restriction of processing, data portability, and to object to processing based on our legitimate interests. Where processing is based on consent, you may withdraw it at any time; this does not affect the lawfulness of processing before withdrawal. Withdrawing consent to the processing of health data may mean we can no longer coordinate your care, and it does not affect medical documentation that must be kept by law.
To exercise your rights, write to privacy@doctorinpoland.com. We reply within one month, and may ask you to confirm your identity.
You also have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa, Poland, or with the data protection authority in your country of residence.
9. Children
Enquiries concerning a child under 18 should be made by a parent or legal guardian, who acts on the child’s behalf.
10. Automated decisions
We do not make decisions about you based solely on automated processing, including profiling, that produce legal effects or similarly significantly affect you. Matching with a doctor is always done by a person.
11. Security
We use encrypted connections (TLS), access control limited to authorised persons, confidentiality obligations and protection against spam and abuse. We share health information only to the extent necessary for your care.
12. Changes
We may update this Privacy Policy when our services or the law change. The current version is always available on this page with the date of its last update.