PRIVACY AND COOKIES POLICY
Claudia Bałuta-Górecka — individual specialist medical practice — HOLISTICA
Last updated: May 2026
1. Introduction
Holistica respects the privacy of patients, people contacting the practice and users of the website. We take care to process personal data in accordance with applicable law, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR), data protection regulations, medical law and regulations concerning the provision of services by electronic means.
This Privacy and Cookies Policy explains:
who is the data controller,
how to contact the controller,
what data may be processed,
for what purposes and on what legal bases the data are processed,
to whom the data may be disclosed,
how long the data are retained,
what rights data subjects have,
whether data may be transferred outside the European Economic Area,
how cookies or similar technologies are used.
This Policy applies to data processed in connection with the use of the website, contact by telephone or e-mail, use of forms, appointment booking, use of services provided by the practice, including teleconsultations, and organizational communication with the patient.
2. Data controller
The data controller is:
Claudia Bałuta-Górecka, conducting business under the name: Claudia Bałuta-Górecka-indywidualna-specjalistyczna praktyka lekarska- HOLISTICA, operating under the brand Holistica, with its registered office at ul. Pustynnej 53 lok. R, 93-479 Łódź.
NIP: 7251793243
REGON: 101512578
E-mail: kontakt@holistica.pl
Phone: +48 730 888 010
The controller determines the purposes and means of processing personal data.
The controller has not appointed a Data Protection Officer. For all matters concerning data protection you may contact the Controller directly.
3. How can you contact the Controller?
For matters related to the processing of personal data and exercising rights under the GDPR you may contact:
by e-mail: kontakt@holisticaklinika.pl
by telephone: +48 730 888 010,
in writing: ul. Pustynna 53 lok. R, 93-479 Łódź.
4. What data may be processed?
The scope of processed data depends on the way of contact with Holistica and the type of matter.
The controller may process in particular:
identification data — first name, last name, PESEL, date of birth, identity document number, and in the case of minors also the data of the legal representative;
contact data — residential address, correspondence address, telephone number, e-mail address;
data provided in correspondence — the content of e-mail messages, contact form, SMS messages or other communications;
appointment registration data — preferred date, appointment date, type of appointment, organizational information regarding teleconsultation;
health data — information provided in connection with the provision of healthcare services, in particular data about health status, symptoms, medical history, medications taken, diagnoses, recommendations, e-prescriptions, e-referrals, e-sick notes (e-ZLA), certificates and medical records;
authorization data — data of persons authorized to obtain information about health status or access medical records;
billing data — data for invoice, bill or payment confirmation;
technical data — IP address, cookie identifiers, device type, browser type, date and time of visit to the site, pages viewed, referral source.
The controller recommends not to submit excessive medical data via contact forms or general correspondence. Health data should be provided only to the extent necessary to organize or provide a health service.
5. For what purposes and on what legal bases do we process data?
Personal data are processed for the following purposes:
5.1. Handling contact via the website, e-mail or telephone
Data are processed in order to respond to an inquiry, handle messages, conduct correspondence, clarify matters or take actions requested by the person contacting the practice.
Legal basis:
Article 6(1)(b) GDPR — if the contact aims to use a service or conclude a contract;
Article 6(1)(f) GDPR — legitimate interest of the Controller consisting in handling correspondence and contact.
5.2. Appointment registration and organization of teleconsultation
Data are processed to set an appointment date, confirm a booking, send organizational information, remind about an appointment, send a teleconsultation link, contact regarding the appointment and verify the patient's identity.
Legal basis:
Article 6(1)(b) GDPR — performance of a contract or taking steps prior to entering into a contract;
Article 6(1)(f) GDPR — legitimate interest of the Controller consisting in efficient organization of services;
with regard to health data — Article 9(2)(h) GDPR.
5.3. Provision of healthcare services
Data are processed for the provision of healthcare services, including psychiatric consultations and teleconsultations, assessment of health status, conducting diagnostic and therapeutic processes, issuing e-prescriptions, e-referrals, e-sick notes (e-ZLA), certificates and recommendations.
Legal basis:
Article 9(2)(h) GDPR — processing of health data for medical diagnosis, provision of health care or treatment;
Article 6(1)(c) GDPR — compliance with legal obligations incumbent on the Controller.
5.4. Maintaining medical records
Data are processed to maintain, store, secure, archive and provide medical records.
Legal basis:
Article 6(1)(c) GDPR;
Article 9(2)(h) GDPR;
the provisions of the Patients' Rights Act and the Ombudsman for Patients and provisions concerning medical records.
5.5. Providing access to medical records and health information
Data are processed to exercise patients' rights, in particular the right of access to medical records and the right to authorize others to obtain information about health status or access medical records.
Legal basis:
Article 6(1)(c) GDPR;
Article 9(2)(h) GDPR;
medical law provisions.
5.6. Billing, payments and invoices
Data are processed for receiving payments, issuing bills or invoices, keeping accounting records and fulfilling tax obligations.
Legal basis:
Article 6(1)(b) GDPR — performance of a contract;
Article 6(1)(c) GDPR — fulfillment of tax and accounting obligations.
5.7. Handling complaints, claims, requests and legal actions
Data may be processed to consider complaints, claims and requests from patients, to clarify matters, contact public authorities, establish, pursue or defend claims.
Legal basis:
Article 6(1)(f) GDPR — legitimate interest of the Controller in protecting rights and defending against claims;
Article 6(1)(c) GDPR — when an obligation arises from law;
with regard to health data — Article 9(2)(f) or (h) GDPR.
5.8. Exercising rights under the GDPR
Data are processed to handle requests concerning personal data, including the right of access, rectification, restriction of processing, objection, data portability or withdrawal of consent.
Legal basis:
Article 6(1)(c) GDPR.
5.9. Security of the website, systems and data
Technical data may be processed to ensure proper functioning of the website, detect abuse, protect against cyberattacks, keep technical logs, control access, perform backups, document breaches and ensure continuity of operations.
Legal basis:
Article 6(1)(f) GDPR — legitimate interest of the Controller in ensuring security of the site, systems and data;
Article 6(1)(c) GDPR — regarding obligations arising from the GDPR.
5.10. Marketing of own services
Data may be processed for marketing purposes, including sending a newsletter or information about services, only if a separate, voluntary consent has been given.
Legal basis:
Article 6(1)(a) GDPR — consent;
with regard to electronic or telephone communication — applicable rules on electronic communications.
Marketing consent is not a condition for receiving healthcare services and may be withdrawn at any time.
6. To whom do we disclose data?
Personal data may be disclosed to entities cooperating with the Controller only to the extent necessary to achieve the processing purposes.
Recipients of data may include in particular:
the provider of the electronic medical records system: [MedLife Club / Medfile — leave the actual name of the used system];
ZnanyLekarz / DocPlanner — in the scope of appointment registration, profile management, calendar, online bookings, organizational communication and possible payments, if such functionalities are active;
providers of hosting, e-mail, telecommunications services, IT systems and technical support;
providers of forms, booking tools, analytics tools or cookies, if used;
payment operators, banks or online payment providers, if used;
accounting office, law firms, advisors or insurers, if necessary for practice support, billing, claims or disputes;
public authorities and other entities authorized under applicable law, in particular courts, prosecutors, the Patient Ombudsman, the President of UODO, tax authorities or other competent institutions.
If the ZnanyLekarz / DocPlanner platform is used, the scope of processing depends on the active functionalities, in particular profile, appointment calendar, online booking, patient communication, payments and integrations with other services. The Controller periodically reviews the provider's documentation, including information about sub-processors and transfers.
7. Are data transferred outside the European Economic Area?
As a rule the Controller does not intend to transfer patients' data outside the European Economic Area.
However, if the use of certain technological, hosting, analytics, communication, payment services or external providers' functions were to result in a transfer outside the EEA, this would take place only using mechanisms provided for in the GDPR, in particular an adequacy decision, Standard Contractual Clauses or other required safeguards.
The scope of any transfers depends on the current documentation of providers and active functionalities used by the Controller.
8. How do we secure personal data?
The Controller implements technical and organizational measures appropriate to the nature, scope and risk of data processing, in particular:
access to data is granted only to authorized persons;
passwords, access control and — where possible — two-factor authentication are used;
communication with the website and systems should use encrypted transmission;
medical records are maintained and stored in a system intended for handling medical data;
data minimization principles and access restrictions are applied;
used systems and devices should be protected against unauthorized access;
the Controller maintains procedures for responding to personal data breaches;
the Controller periodically reviews applied solutions and providers.
9. How long are data retained?
Personal data are retained for the period necessary to achieve the purpose for which they were collected, and then for the period required by law or necessary to protect the Controller's rights.
In particular:
medical records are generally retained for 20 years, counting from the end of the calendar year in which the last entry was made, taking into account exceptions provided for by law;
accounting and tax data are generally retained for 5 years from the end of the tax year;
data from correspondence and contact forms are retained for the period necessary to handle the matter, and then for the time needed to protect against claims;
data related to appointment registration and organizational contact are kept for the period necessary to handle the appointment, the patient relationship and protection against claims, and if they become part of medical records — for the period of retention of those records;
data concerning authorizations, patient statements and disclosure of medical records are retained for the period required by provisions on medical records and the period necessary to demonstrate proper exercise of patient rights;
data processed on the basis of consent are retained until withdrawal of consent or cessation of the processing purpose;
technical data and logs are retained for the period necessary to ensure the security of the website and systems;
data concerning complaints, claims or legal actions are retained until the matter is concluded and the statute of limitations for claims has expired.
10. What rights do data subjects have?
Data subjects have the rights set out in the GDPR, in particular:
the right of access to data;
the right to receive a copy of the data;
the right to rectification;
the right to restriction of processing;
the right to erasure — to the extent not contradicted by provisions requiring retention of medical records or other legal obligations of the Controller;
the right to data portability — in cases provided for by the GDPR;
the right to object to processing based on legitimate interest;
the right to withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal;
the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes UODO).
To exercise rights you may contact the Controller at: kontakt@holistica.pl.
11. Voluntariness or obligation to provide data
Providing data in the contact form is voluntary but necessary to receive a response.
Providing data necessary for appointment registration, patient identification, provision of healthcare services, maintenance of medical records and fulfillment of legal obligations is necessary to use the healthcare service.
Providing data for marketing purposes is voluntary and does not affect the possibility of using healthcare services.
12. Source of data
Data are generally obtained directly from the person concerned.
In the case of minor patients data may be obtained from a legal representative, actual caregiver or the person making the appointment.
Data may also be obtained via registration platforms, online forms, e-mail, telephone or systems used to organize appointments.
13. Automated decision-making
The Controller does not make decisions concerning website users or patients based solely on automated processing, including profiling, which would produce legal effects concerning them or similarly significantly affect them.
Diagnostic and therapeutic decisions are always made by a physician.
14. Minor patients
In the case of minor patients the Controller may process data of legal representatives, actual caregivers and persons involved in organizing the provision of services.
If the patient is 16 or older, their consent to provide healthcare may be required alongside the legal representative's consent, in accordance with medical law.
The Controller exercises particular caution when processing minors' data and acts in accordance with the Minor Protection Standards applicable in the practice.