stacjo Privacy Policy
Draft document. Legal approval is required before publication.
1. Who is responsible for data
[NAZWA SPÓŁKI], tax ID [NIP], register number [KRS], [ADRES], [E-MAIL KONTAKTOWY] is the controller for data of people who create and use stacjo accounts, contact us, and whose data is needed for our own billing and service security.
The practice is the controller for its patients' data and other data it enters into stacjo. For that data, stacjo generally acts as a processor on the practice's instructions. Patients who wish to exercise rights over the practice's data should contact the practice.
2. Data we process
To run accounts, we process users' identity and contact details, practice details, access and role data, billing details, messages to us, security data and records of acceptance of the terms.
To provide the service to a practice, we may process patient contact details, appointment times, notes, documents and health data. The practice decides the scope of this data.
In online booking, the patient provides the information needed to send an appointment request. We also collect technical data needed to run and protect the service.
3. Purposes and legal grounds
We process an individual practice owner's data to enter into and perform the agreement under Article 6(1)(b) GDPR. We process team members' and contacts' data to run accounts and handle contact under our legitimate interests, Article 6(1)(f) GDPR.
We process an individual payer's data under Article 6(1)(b) GDPR only when that person is party to the agreement. We process another payer's data to handle payment under Article 6(1)(f) GDPR. We process a payer's contact person data to handle billing under Article 6(1)(f) GDPR. We process data needed to issue and retain tax records under Article 6(1)(c) GDPR.
We use technical data and acceptance records to protect the service and establish or defend claims under Article 6(1)(f) GDPR.
Analytics may run on the site. Its scope and legal ground must be confirmed before this Policy is adopted. We may send marketing email or SMS after obtaining the required consent.
We process patient data for the practice under its instructions. The practice decides its ground under Article 6 GDPR and, for health data, the applicable condition under Article 9 GDPR. A patient checkbox in a form is not automatically the ground for every operation in stacjo.
4. Where data comes from
We receive account data from the user or the practice. Patient data comes from the practice or from a patient using online booking or the patient portal. Technical data comes from the device, browser and use of the service.
When we receive patient data from the practice, the practice generally has the duty to inform the patient, subject to legal exceptions.
5. Is providing data required
Fields marked as required in the account form are needed to submit a practice request and perform the agreement. Without them, we cannot review the request or provide the relevant features. Optional fields may be left blank without losing basic access.
Patient data required in online booking is needed to send the request to the practice; the practice gives details as the controller.
6. Recipients and transfers
Providers of services needed to run stacjo may receive data. These include providers of hosting, databases, email, SMS, payments, abuse prevention, analytics and monitoring. They receive only the data needed for their work.
Storage locations and any transfers outside the European Economic Area must be confirmed before this Policy is published.
7. Retention
We keep account data while the agreement is in force. After it ends, we keep data only as long as needed for billing, legal duties or claims. We keep billing records until the tax retention period ends.
We process patient data under the practice's instructions and the processing agreement. If the practice must keep medical records, it is responsible for preserving them.
The retention period for records of acceptance of the terms and technical data still needs approval and implementation.
9. Individual rights
Where stacjo is the controller, a person may ask to access, correct, erase or restrict their data, or obtain portability where the law provides it. They may object to processing based on legitimate interests.
If we process your data based on consent, you may withdraw it at any time. This does not affect earlier lawful processing. A complaint can be made to the President of the Polish Personal Data Protection Office.
For patient data processed for a practice, please contact the practice. We will help it handle the request under the processing agreement.
10. Security and contact
We use technical and organizational security measures suited to the risk, including access controls. Questions and requests about data for which we are the controller can be sent to [E-MAIL KONTAKTOWY].