INFORMATION ON THE PROCESSING AND PROTECTION OF PERSONAL DATA
Your personal data is administered by the group of companies listed below (hereinafter: the Centre):
- Centrum Bocian spółka z ograniczoną odpowiedzialnością spółka komandytowa (a Polish limited liability limited partnership), with its registered office at ul. Akademicka 26, 15-267 Białystok, registered with the District Court in Białystok, 12th Commercial Division of the National Court Register, under KRS No. 0000621247, NIP: 5422971792, REGON: 200067699, BDO: 000042050.
- IVI spółka z ograniczoną odpowiedzialnością (a Polish limited liability company) with its registered office in Poznań, 60-529 Poznań, ul. Jana Henryka Dąbrowskiego 77a, registered with the District Court Poznań – Nowe Miasto i Wilda in Poznań, 7th Commercial Division of the National Court Register, under KRS No. 0000483359, NIP 7792417617, REGON 30257574100000, share capital PLN 68 500, BDO registration number 000088006.
- Ab ovo spółka z ograniczoną odpowiedzialnością (a Polish limited liability company) with its registered office at ul. Relaksowa 26, 20-819 Lublin, registered with the District Court Lublin-Wschód in Lublin, based in Świdnik, 6th Commercial Division of the National Court Register, ul. Kardynała Stefana Wyszyńskiego 18, 21-040 Świdnik, under KRS No. 0000029240, NIP: 7120153425, REGON: 43001693300000, BDO 000064.
Data Protection Officer contact details at the Centre: iodo@klinikabocian.pl
The data is processed in accordance with the Act of 10 May 2018 on the Protection of Personal Data and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR). In particular, full safeguards required by law have been implemented to protect personal data.
The data controller appointed in accordance with legal requirements applies technical and organizational measures that ensure protection of the processed personal data appropriate to the risks and categories of data covered by protection. In particular, the data is protected against disclosure to unauthorized persons, acquisition by unauthorized persons, processing in breach of the law, alteration, loss, damage, or destruction. The controller maintains documentation describing the method of data processing. Only persons authorized by the controller are allowed to process data at the Centre.
A prerequisite for receiving healthcare services at the Centre is prior provision of the patient’s personal data in registration forms, consent forms, agreements, and other documents directly or indirectly related to services provided by the Centre.
The processing of personal data and its verification based on a photo identification document will be carried out by authorized personnel of the Centre in accordance with applicable law. Providing personal data required by medical regulations applicable to the services offered by the Centre is mandatory; in all other cases it is voluntary. Refusal to provide personal data required by law will result in the Centre being unable to provide medical services.
Purposes of collecting and processing personal data
- conducting medical activity within the meaning of the Act of 15 April 2011 on Medical Activity, in particular the provision of healthcare services, preventive care, other medical services, conclusion and performance of agreements, laboratory medicine activities, or other services necessary to carry out the treatment process, as well as management of the provision of medical services;
- conducting recruitment and participation in clinical trials and other scientific studies;
- participation in public health policy programs;
- fulfilling legal obligations incumbent on the Centre as the controller, including obligations arising in particular from the Infertility Treatment Act of 25 June 2015, the Act on Medical Activity of 15 April 2011, the Act of 6 November 2008 on Patients’ Rights and the Patients’ Rights Ombudsman, the Act of 5 December 1996 on the Professions of Doctor and Dentist, and the Act of 15 September 2022 on Laboratory Medicine, especially with regard to maintaining and storing medical records, reporting infectious diseases, and providing information on health status, diagnosis, proposed and possible diagnostic and therapeutic methods, foreseeable consequences of their application or omission, treatment results, and prognosis;
- carrying out marketing activities concerning services, products, events, and special offers provided by the Centre;
- pursuing the legitimate interest of the Centre consisting in asserting claims and defending against claims arising from business activity, in particular in connection with complaints or claims;
- fulfilling tax obligations;
- fulfilling obligations arising from the social insurance system;
- enabling patients to use applications containing medical data;
- providing CCTV monitoring to ensure the safety of persons and property;
- recording conversations as an auxiliary tool in the provision of medical services;
Personal data is processed and stored
- for periods specified by law, in particular the Act of 6 November 2008 on Patients’ Rights and the Patients’ Rights Ombudsman (Article 29) and the Act of 25 June 2015 on Infertility Treatment, especially with regard to medical records;
- for the duration of medical services and related services;
- for the period necessary to pursue the legitimate interest of the Centre, including asserting and defending claims in connection with business activity, especially complaints or claims;
- for the period during which the Centre may incur legal consequences for failure to perform a legal obligation;
- for the duration of agreements and then for the period after which claims arising from agreements between you and the Centre become time-barred, for example agreements on storage of reproductive cells and embryos, and if the Centre pursues claims or notifies competent authorities, for the duration of such proceedings.
Recipients of patients’ personal data
- other medical entities with which the Centre has agreements for the performance of medical services that the Centre does not provide directly;
- entities to which the Centre has entrusted personal data under a data processing agreement, e.g. legal or IT service providers;
- the Ministry of Health in cases specified by law, in particular pursuant to the Infertility Treatment Act of 25 June 2015, for example in connection with transfer of reproductive cells for non-partner donation or embryo donation, serious adverse events and reactions, or inspections carried out at the Centre;
- the Social Insurance Institution in cases specified by law;
- entities financing healthcare services from public funds, such as the National Health Fund, the Ministry of Health, and other state or local government units within public health policy programs;
- state and local administration authorities, courts, and other entities on the basis of applicable law or authorization granted by the patient;
- persons authorized by patients and their legal representatives;
- postal, courier, and transport operators;
- banks or payment institutions for the purpose of verifying proper payment performance and in connection with complaints, refunds, asserting and defending claims, and preparing statistics and analyses.
The Centre may obtain your data from public registers, such as the EWUŚ database or ZUS, in order to verify or establish data relevant to the proper provision of healthcare services.
If the processing of your personal data by the Centre violates the law, you may lodge a complaint with the President of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warsaw, Poland.
Patient rights with regard to personal data processing
- rectification (correction) of personal data;
- erasure of personal data processed without legal basis;
- restriction of processing (suspension of operations on data or retention of data, depending on the submitted request);
- access to personal data (information about data processed by the Centre and a copy of that data);
- data portability to another controller or to you (to the extent provided for in Article 20 GDPR).
A request bearing a handwritten or electronic signature concerning the above rights may be submitted in writing to: kontakt@klinikabocian.pl. Such a request may also be filed at any medical facility operated by the Centre.
The scope of each of the above rights and the situations in which they may be exercised result from the applicable law. Transfer of personal data to a third country is possible only at the request of the person whose data is to be processed.
Special obligations of the controller under the Infertility Treatment Act of 25 June 2015
The Infertility Treatment Act of 25 June 2015 and executive regulations issued by the Minister of Health impose a number of obligations on medically assisted reproduction centers and on banks of reproductive cells and embryos in connection with medically assisted reproduction procedures.
Before using the Centre’s services it is necessary to provide the following data: first name and surname, PESEL number (or, in its absence, the series and number of an identity document together with the country of issue), date of birth, place of residence or correspondence address, and sex. In order to participate in medically assisted reproduction procedures, it is additionally necessary to provide phenotypic data: height, weight, eye color, hair color, hair structure, body build, race, and ethnic origin.
During the provision of medical services, the Centre will obtain other information concerning your health, such as medical history, laboratory and medical test results, previous course of treatment, and other sensitive data necessary to issue a medical opinion that directly qualifies a person for further medically assisted reproduction procedures. Personal data at the Centre is processed by persons professionally involved in treatment, provision of medical services, or management of medical services, who have received authorization from the controller.
OVUMED.PL Privacy Policy
OVUMED.PL is a website available at https://ovumed.pl and operated by the following group of companies (hereinafter: the Group of companies):
- Centrum Bocian spółka z ograniczoną odpowiedzialnością spółka komandytowa (a Polish limited liability limited partnership), with its registered office at ul. Akademicka 26, 15-267 Białystok, registered with the District Court in Białystok, 12th Commercial Division of the National Court Register, under KRS No. 0000621247, NIP: 5422971792, REGON: 200067699, BDO: 000042050.
- IVI spółka z ograniczoną odpowiedzialnością (a Polish limited liability company) with its registered office in Poznań, 60-529 Poznań, ul. Jana Henryka Dąbrowskiego 77a, registered with the District Court Poznań – Nowe Miasto i Wilda in Poznań, 7th Commercial Division of the National Court Register, under KRS No. 0000483359, NIP 7792417617, REGON 30257574100000, share capital PLN 68 500, BDO registration number 000088006.
- Ab ovo spółka z ograniczoną odpowiedzialnością (a Polish limited liability company) with its registered office at ul. Relaksowa 26, 20-819 Lublin, registered with the District Court Lublin-Wschód in Lublin, based in Świdnik, 6th Commercial Division of the National Court Register, ul. Kardynała Stefana Wyszyńskiego 18, 21-040 Świdnik, under KRS No. 0000029240, NIP: 7120153425, REGON: 43001693300000, BDO 000064.
- e-mail: kontakt@ovumed.pl (hereinafter: the Service).
This Privacy Policy contains detailed information on how the personal data of users of the OVUMED.PL website, available at https://ovumed.pl, is processed, and on the procedures used to protect that data.
Definitions used in this Privacy Policy
- DATA CONTROLLER – the Group of companies.
- USER – a natural person visiting the Service or using services made available in the Service.
- GDPR – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016.
- PERSONAL DATA – any information relating to an identified or identifiable natural person.
- PATIENT – a natural person intending to use or using services of OVUMED.PL and the Group of companies, or a female patient, candidate egg-cell donor, or donor participating in the Egg Cell Donation Program by donating her egg cells free of charge for non-partner donation.
- EGG CELL DONATION PROGRAM – the free-of-charge transfer of reproductive cells from a donor to an anonymous recipient and their use for non-partner donation, consent to posthumous use of collected reproductive cells, and embryo donation created using those cells.
- PROCESSING – any operation or set of operations performed on personal data, whether or not by automated means, such as collection, recording, organization, ordering, storage, adaptation, modification, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.
- PROCESSOR – a natural or legal person, public authority, agency, or other body that processes personal data on behalf of the Controller.
- COOKIES – IT data, in particular text files, stored on the User’s device and intended for use on the Service’s websites.
Personal data controller
The personal data controller is the Group of companies, e-mail: kontakt@ovumed.pl (hereinafter: the Controller).
The Controller processes personal data in accordance with Regulation (EU) 2016/679 of 27 April 2016 (GDPR) and the Act of 10 May 2018 on the Protection of Personal Data.
The Controller makes every effort to protect Users’ privacy. The Controller applies all legally required precautions to ensure that all data, including personal data provided by Users, is protected against loss, destruction, disclosure, access by unauthorized persons, and misuse.
Purposes and legal bases for processing personal data
OVUMED.PL processes Users’ personal data such as IP address, access logs, and information collected through cookies for analytical and statistical purposes, to ensure proper configuration of the Service, monitor traffic in the Service, diagnose problems related to the operation of the Service, and ensure the IT security of the Service.
This data is processed on the basis of the legitimate interest of OVUMED.PL (Article 6(1)(f) GDPR), namely optimization of the functionality of services provided by the Service and carrying out analyses of activity in the Service.
Providing this data is voluntary. Users can manage cookies used by OVUMED.PL by changing their browser settings. Rejection of cookies may cause some functions of the Service to work improperly and, in some cases, may make it impossible to use certain functions.
Patient data is processed in connection with the provision of specific medical services and includes: first name and surname, e-mail address, phone number, PESEL number (or, if unavailable, the series and number of an identity document and the country of issue), date of birth, place of residence or correspondence address, sex, phenotypic data such as height, weight, eye color, hair color, hair structure, body build, race and ethnic origin, as well as payment data (bank account number, tax number).
Providing this data is voluntary, but in certain scope necessary for the provision of the service. The above data is processed on the basis of a contract or in order to take steps at the request of the data subject before entering into a contract (Article 6(1)(b) GDPR). The data is also processed on the basis of the legitimate interest of the Controller (Article 6(1)(f) GDPR) in order to secure potential claims. On the basis of the User’s voluntary consent (Article 6(1)(a) GDPR), data is also processed for marketing purposes.
Application to the Egg Cell Donation Program
If a patient completes the application form for the Egg Cell Donation Program available in the Service, OVUMED.PL processes the data as a Processor, which means that it acts on behalf of and under the instructions of the Controller. Accordingly, the controller of the data included in the application is the Group of companies to which the application form was sent. OVUMED.PL processes the data only for the purpose of delivering that application to the Group of companies.
For the purposes of processing the data necessary to deliver the application form to the Group of companies, OVUMED.PL requires the patient to consent to the processing of personal data by OVUMED.PL for this purpose and to enable her participation in the Egg Cell Donation Program. Consent is given by the patient while completing the application form in the Service. Failure to give consent makes it impossible for OVUMED.PL to transmit the patient’s application form to the Group of companies.
Rights related to the processing of personal data
Users have the following rights:
- right of access to data – the right to obtain information about the processing of personal data, including the purposes and legal bases of processing, the scope of data held, the entities to whom the data is disclosed, and the planned date of erasure, as well as the right to obtain a copy of the processed data under Article 15 GDPR;
- right to rectification – the right to request correction or updating of personal data if it is inaccurate or incomplete under Article 16 GDPR;
- right to erasure – the right to request deletion of data whose processing is no longer necessary for any processing purpose under Article 17 GDPR;
- right to restriction of processing – the right to request that the Controller temporarily or permanently cease processing all or part of personal data in situations and under the conditions set out in Article 18 GDPR;
- right to data portability – the right to receive personal data provided by the data subject in a structured, commonly used, machine-readable format and to transmit that data to another controller under Article 20 GDPR;
- right to object – the right to object to the use of personal data under the terms set out in Article 21 GDPR;
- right to lodge a complaint with a supervisory authority – if the data subject considers that the processing of personal data infringes GDPR or other data protection laws, they may lodge a complaint with the President of the Personal Data Protection Office.
Whenever possible, the request should precisely indicate what it concerns, that is, which of the above rights the applicant wishes to exercise, which processing operation the request concerns, and which processing purposes are covered by the request.
A request concerning the exercise of the above rights may be submitted electronically to: kontakt@ovumed.pl.
If clarification of the request is necessary, the Service will ask for additional information. A response is provided without undue delay and no later than within one month from the date of receipt of the request, to the e-mail address from which the request was sent.
Personal data retention period
The data retention period depends on the type of service provided, the purpose of processing, and the legal basis:
- where processing is based on consent – until that consent is withdrawn;
- where processing is based on the legitimate interest of the Controller – until that interest ceases (e.g. limitation period for civil claims) or until the data subject objects to such processing in situations where such an objection is available under the law;
- where processing is based on legal provisions, in particular the Act of 6 November 2008 on Patients’ Rights and the Patients’ Rights Ombudsman (Article 29) and the Act of 25 June 2015 on Infertility Treatment, especially with regard to medical records;
- for the duration of agreements and then for the period after which claims arising from the agreement become time-barred, and if the Group of companies pursues claims or notifies competent authorities – for the duration of such proceedings;
- in the case of cookies – for the period during which cookies remain stored on the device of the person using the Service.
Disclosure of data to other entities
In connection with the provision of strictly specified services to the Service by external entities, those entities may gain access to personal data to the extent necessary to perform those services.
Personal data may therefore be disclosed in particular to hosting providers, e-mail system providers, banks and payment operators, as well as authorized public authorities, including the Ministry of Health in cases specified by law, especially pursuant to the Act of 25 June 2015 on Infertility Treatment, for example in connection with transfer of reproductive cells for non-partner donation or embryo donation, serious adverse events and reactions, and inspections carried out within the Group of companies.
Security of processed personal data
As part of ensuring the security of personal data processing, risk analysis is performed regularly, which makes it possible to modify security measures. Data is processed only by authorized persons bound by confidentiality. The Service exercises due care to ensure that Processors whose services it uses provide appropriate data security guarantees.
Publishing the personal data of third parties without their consent is prohibited.
Cookie Policy
The Service uses both session cookies (temporary) and persistent cookies. Session cookies are temporary files stored on the User’s device until logging out, leaving the website, or closing the browser. Persistent cookies are stored on the User’s device for the period specified in the cookie files or until they are deleted by the User.
Cookies are used for the following purposes:
- providing requested services connected with sending the application form and moving around the Service;
- adapting the Service content to the User’s preferences and optimizing the Service;
- security;
- statistical purposes showing how the Service is used and measuring traffic with Google Analytics cookies.
At any time it is possible to change cookie settings. At the same time, it should be noted that limiting the use of cookies may make it difficult to use some features of the Service or even make selected services unavailable.
Changes to the Privacy Policy
The Controller reserves the right to amend this Privacy Policy. Changes will be published in the Service and become effective upon publication.
Contact with the Controller
In matters concerning personal data, please contact the Controller:
- electronically: kontakt@ovumed.pl;
- in writing: Centrum Bocian spółka z ograniczoną odpowiedzialnością spółka komandytowa, ul. Akademicka 26, 15-267 Bialystok, KRS 0000621247, NIP 5422971792, REGON 200067699, BDO 000042050
If you have additional questions concerning security and the processing of personal data, please contact us at: kontakt@ovumed.pl.
13 October 2025 — Service Administrator