Who is the Data Controller?
In accordance with the General Data Protection Regulation (RODO/GDPR), the controller of your personal data is NZOZ Poradnia Lekarza Rodzinnego Mariola Karolak‑Tomczuk Sp. z o.o., ul. Świt 34/36 lok. E1, 60‑376 Poznań, Polska, NIP: 7792598151, REGON: 543357055, KRS: 0001207285 ("Controller").
Contact with the Controller: 61 898 77 77, lekarzmkt@gmail.com.
The Controller is responsible for the security of the provided personal data and its processing in accordance with the law.
Who is the Data Protection Officer?
Our Data Protection Officer (DPO) is Michał Muzyka. To contact the Data Protection Officer, please send an e-mail to rodo@jamano.pl.
For what purpose and on what legal basis do we use the data?
We will use your personal data to the extent necessary to process inquiries and fulfill requests, including maintaining communication and providing answers to questions via your chosen method of contact (Art. 6 para. 1 lit. f RODO - legitimate interest).
Sending health information does not in itself constitute explicit consent to its processing. Do not provide it in chat or Messenger. Data needed for healthcare is processed through designated channels under Art. 9(2)(h) GDPR; consent under Art. 9(2)(a) GDPR requires a separate explicit statement where it is the appropriate basis.
Providing data is voluntary but necessary for the execution of the aforementioned inquiries and requests. Refusal to provide data to this extent may result in the inability to provide an answer or fulfill the request.
Please be informed that your data will not be used for decision-making based solely on automated processing of personal data, including profiling within the meaning of Art. 22 RODO.
How long will we use the data?
We will use the data for the period necessary to achieve the goals described above. Depending on the legal basis, this will be respectively:
- the period until a possible effective withdrawal of consent for the processing of personal data,
- the period necessary to fulfill the request, including providing an answer to the sent question or resolving matters related to the contact,
- the period until a possible effective objection is filed.
Regarding medical records, data is stored for the period specified by law, as a general rule - 20 years from the date of the last entry in the medical records.
How do we store data provided through the website?
We apply data minimisation - we collect only what is necessary and do not keep data longer than its purpose or the law requires.
- E‑prescription request form - form data (name, PESEL, contact details, medicines) is sent over an encrypted connection only by e‑mail to the Clinic and is not saved in the website database. Once the message is sent, the data does not remain on the website. The message in the Clinic mailbox is kept while the request is handled, and information about the issued prescription is entered into the medical records (20 years). Legal basis: Art. 6(1)(c) and Art. 9(2)(h) GDPR.
- Form abuse protection - we store only an irreversible hash of the IP address, which cannot be read back, for the time needed to limit the number of requests, no longer than 24 hours. Legal basis: Art. 6(1)(f) GDPR (website security).
AI chat: privacy and personal data
Do not enter personal data or health information.
Your messages and recent chat history are sent to the AI service to generate an answer. The chat is not a medical consultation.
The data controller is NZOZ Poradnia Lekarza Rodzinnego Mariola Karolak-Tomczuk Sp. z o.o., ul. Świt 34/36 lok. E1, 60-376 Poznań. Chat is optional; you can contact reception instead: 61 898 77 77.
Messages are processed to answer organisational questions and keep the service secure, based on the controller’s legitimate interest (Art. 6(1)(f) GDPR). No name or patient account is required. Sending a message is not explicit consent to process health data. AI does not make decisions about diagnosis, treatment or access to care.
Messages pass through website hosting and Lovable AI Gateway to the AI model provider. Technical data, such as IP address and request time, may be processed to operate and protect the service. Provider logs, retention periods and any transfers outside the EEA depend on the applicable service terms and data-processing agreements; we do not guarantee immediate deletion by providers or absence of model training without confirmation of those terms.
The website does not save chat history in the Clinic database or in browser local/session storage. The visible conversation is held in page memory: it continues when switching between the main chat and floating window or navigating the site, and is cleared when the page is reloaded or closed. This does not delete any provider logs. Messenger has separate storage and privacy rules operated by Meta; using website chat does not automatically send the conversation to Messenger.
Under GDPR you may request access, rectification, erasure or restriction, object to processing based on legitimate interest, and lodge a complaint with the Polish data protection authority (UODO). Contact the Data Protection Officer for details about recipients, retention and transfer safeguards: rodo@jamano.pl.
- Messenger — Messenger is governed by the rules of Meta Platforms Ireland Limited. When the automated assistant is enabled, the Clinic stores message content, the Messenger sender identifier and conversation timestamps in its database, and sends recent messages to the AI service to generate replies. Clinic-side retention and deletion procedures must be confirmed with the DPO; automatic deletion after 12 months is not guaranteed. Meta and AI provider rules are separate from website chat history.
- ZnanyLekarz appointments - booking takes place on the DocPlanner Sp. z o.o. (ZnanyLekarz) service, which is a separate controller of the data provided when booking.
- Cookie consent - your choice is saved in your browser storage (date, time, country) until you change it or clear browser data. Google Analytics 4 data is retained for no longer than 14 months and Meta Pixel data under Meta's rules.
After the retention periods expire, data is permanently deleted or anonymised.
How to withdraw consent?
You have the right to withdraw your consent for the processing of personal data at any time - in the case of data processed on its basis. If you exercise this right, we will stop processing such data and it will be deleted. The withdrawal of consent does not affect the lawfulness of the data use during the period when the consent was valid.
What are your rights?
You may request from us: access to personal data (information about processed personal data and a copy of the data), rectification of data (if incorrect), data portability (in cases specified in RODO), erasure or restriction of processing of personal data - under the conditions specified in RODO.
Regardless of the above rights, you may at any time object to the processing of your data if the legal basis for using the data is a legitimate interest (Art. 6 para. 1 lit. f RODO).
You also have the right to lodge a complaint with the President of the Personal Data Protection Office (UODO) if you believe that the processing of your personal data violates the law.
To whom do we transfer your data?
While maintaining all data security guarantees, we may transfer your data (other than persons authorized by the Controller) to other entities, in particular: entities authorized to receive them under the law, entities processing them on our behalf (e.g., technical service providers and entities providing us with advisory services), and other controllers (e.g., notary offices or law firms).
How can you contact us regarding personal data protection?
In matters related to personal data protection, please contact our Data Protection Officer (DPO): rodo@jamano.pl.
Additional information for persons whose data was provided during contact with the Controller
Your data was obtained during contact with the Controller. The Controller will process it to the extent necessary to handle inquiries and fulfill requests, including maintaining communication and providing answers to questions.
Last updated: 21 October 2026.