Privacy Policy | Flymedica

§ 1 Definitions

Website — the Flymedica websites available at flymedica.pl and start.flymedica.pl.

External Service — websites of partners, service providers, or service recipients cooperating with the Controller.

Website / Data Controller — the Controller of the Website and the Data Controller (hereinafter the "Controller") is the company "Flymedica Sp. z o.o.", operating at: ul. Dąbrowskiego 77a, 60-529 Poznań, NIP: 7792443359, KRS: 0000622685, providing electronic services through the Website.

User — a natural person for whom the Controller provides electronic services through the Website.

Device — an electronic device, together with its software, through which the User accesses the Website.

Cookies — text data collected in the form of files placed on the User's Device.

GDPR — Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).

Personal data — any information relating to an identified or identifiable natural person ("data subject"); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.

Processing — any operation or set of operations performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.

Restriction of processing — the marking of stored personal data with the aim of limiting its processing in the future.

Profiling — any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location, or movements.

Consent — any freely given, specific, informed, and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.

Personal data breach — a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored, or otherwise processed.

Pseudonymisation — the processing of personal data in such a manner that the data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures designed to ensure that the personal data are not attributed to an identified or identifiable natural person.

Anonymisation — an irreversible process of operating on data that destroys / overwrites "personal data", making it impossible to identify or link a given record to a specific user or natural person.

§ 2 Data Protection Officer

The Controller has appointed a Data Protection Officer, namely Attorney Marcin Lipiński.

The Data Protection Officer may be contacted by email at marcin.lipinski@kancelarialipinski.com, by telephone at +48 609 930 008, or in writing at ul. Hallera 6/2, 53-318 Wrocław.

The Data Protection Officer may be contacted regarding all matters relating to the processing of personal data.

§ 3 Types of Cookie Files

Internal Cookies — files placed on and read from the User's Device by the Website's IT system.

External Cookies — files placed on and read from the User's Device by the IT systems of External Services. Scripts belonging to External Services which may place Cookie files on Users' Devices have been knowingly included on the Website through scripts and services made available and installed on the Website.

Session Cookies — files placed on and read from the User's Device by the Website during a single session of a given Device. Once the session ends, the files are deleted from the User's Device.

Persistent Cookies — files placed on and read from the User's Device by the Website, which remain on it until deleted or until they expire.

We use necessary cookies (for the Website to function and remember your choice) — without consent; analytics cookies — only when you select “Analytics”; and marketing cookies — only when you select “Marketing”. Your choice is stored for 180 days. You can change or withdraw it at any time using the “Cookie settings” button shown on the Website.

§ 4 Security of Data Storage

Mechanisms for storing and reading Cookie files — these are implemented through mechanisms built into web browsers and do not allow the retrieval of any other data from the User's Device, or data from other websites visited by the User, including personal data or confidential information. Transferring viruses, Trojan horses, or other worms to the User's Device via this means is also practically impossible.

Internal Cookies — the Cookie files used by the Controller are safe for Users' Devices and do not contain scripts, content, or information that could threaten the security of personal data or the security of the Device used by the User.

External Cookies — the Controller takes all possible measures to verify and select website partners with regard to User security, and chooses to cooperate with well-known, large partners enjoying broad public trust. However, the Controller does not have full control over the content of Cookie files originating from external partners. To the extent permitted by law, the Controller is not liable for the security of Cookie files, their content, or their licence-compliant use by scripts installed on the Website that originate from External Services. A list of partners is provided further in this Privacy Policy.

Control of Cookie files — the User may independently change, at any time, the settings governing the storage, deletion, and access to data saved by Cookie files by any website. Information on how to disable Cookie files in the most popular desktop browsers is available at how to disable cookies or from one of the providers listed below:

The User may, at any time, delete any Cookie files saved so far, using the tools of the Device through which the User uses the Website's services.

Risks on the User's side — the Controller applies all possible technical measures to ensure the security of data placed in Cookie files. However, ensuring the security of this data depends on both parties, including the User's own conduct. The Controller is not liable for the interception of this data, impersonation of the User's session, or its deletion as a result of the User's conscious or unconscious activity, or as a result of viruses, Trojan horses, and other spyware which may be, or may have been, present on the User's Device. In order to protect themselves against these risks, Users should follow the rules for safe use of the internet.

Storage of personal data — the Controller ensures that it makes every effort to keep personal data voluntarily provided by Users secure, that access to such data is limited and carried out in accordance with its intended purpose and the purposes of processing, and that it makes every effort to protect the data it holds against loss by applying appropriate physical and organisational safeguards.

Storage of passwords — passwords are stored in encrypted form, using the latest standards and guidelines in this regard. Decrypting account access passwords provided on the Website is practically impossible.

§ 5 Health Data and Photographs

If you use the form relating to procedures (e.g. hair transplant), we may process photographs and information about your state of health. We do this solely on the basis of your explicit consent (Article 9(2)(a) GDPR) for the purpose of consultation and organisation of the process.

§ 6 Purposes for Which Cookie Files Are Used

Improving and facilitating access to the Website
Personalising the Website for Users
Enabling logging in to the Website
Marketing, remarketing on external services
Advertisement-serving services
Affiliate services
Keeping statistics (users, number of visits, types of devices, connection, etc.)
Serving multimedia services
Providing social networking services

§ 7 Purposes of Personal Data Processing

Personal data voluntarily provided by Users is processed for one of the following purposes:

Provision of electronic services:

Registration and maintenance services for the User's account on the Website and related functionalities
Newsletter services (including sending advertising content, subject to consent)
Services for commenting on / liking posts on the Website without the need to register
Services for sharing information about content posted on the Website on social networking sites or other websites

Payment-related services: processing data to handle payments for services offered by Flymedica Sp. z o.o., including procedure bookings and online payments. We process first and last name, email address and transaction data (amount, date, payment status and transaction identifier). Payment card details are processed exclusively by payment providers. Flymedica has no access to them.

Communication by the Controller with Users in matters relating to the Website and to data protection.

Securing the Controller's legitimate interest.

Data about Users collected anonymously and automatically is processed for one of the following purposes:

Keeping statistics
Remarketing
Serving advertisements tailored to Users' preferences
Operating affiliate programmes
Securing the Controller's legitimate interest

§ 8 Purposes and Legal Bases

We process data for the following purposes:

contact and handling of enquiries (Article 6(1)(b) or (f) GDPR)
organisation of the booking process and handling of the trip/procedure (Article 6(1)(b) GDPR)
Issuing invoices and keeping accounting and tax records under Article 6(1)(c) GDPR in conjunction with Articles 106b–106e of the Polish Act of 11 March 2004 on Value Added Tax and the Accounting Act of 29 September 1994. We process: first and last name (or business name), address, NIP (if applicable) and transaction data (date, amount and service description).
establishment / pursuit / defence of claims (Article 6(1)(f) GDPR)
direct marketing of our own services — if you give your consent (Article 6(1)(a) GDPR)

§ 9 Cookie Files of External Services

On the Website, the Controller uses JavaScript scripts and web components of partners, which may place their own cookie files on the User's Device. Please remember that, in your browser settings, you may decide for yourself which cookies are permitted to be used by particular websites. Below is a list of partners or their services implemented on the Website that may place cookies:

Multimedia services:

Content-sharing services:

Newsletter services:

Advertisement-serving services and affiliate networks:

Keeping statistics:

Other services:

Services provided by third parties are beyond the Controller's control. These entities may at any time change their terms of service, privacy policies, purposes of data processing, and the ways in which they use cookie files.

§ 10 What Data We Process

In Flymedica forms and questionnaires, when age is needed for an initial consultation, we ask for age rather than a full date of birth. We do not ask for a passport or identity-card number. Please do not enter these details in free-text fields or attach photos of identity documents.

The Website collects data about Users. Some data is collected automatically and anonymously, while some is personal data provided voluntarily by Users when signing up for particular services offered by the Website.

Invoice details: first and last name and residential address (street, building/apartment number, postcode, town/city, country); for businesses, also the business name, registered address and tax identification number (NIP). Providing these details is a statutory requirement (Article 106e(1)(3) and, for NIP, point 5 of the Polish VAT Act), to the extent required for the relevant type of invoice. We cannot issue an invoice without the required details.

Transaction data: amount, date, payment status and transaction identifier. Payment card details are processed exclusively by payment providers. Flymedica has no access to them.

Anonymous data collected automatically:

IP address
Browser type
Screen resolution
Approximate location
Website subpages viewed
Time spent on the relevant subpage of the Website
Type of operating system
Address of the previous subpage
Address of the referring page
Browser language
Internet connection speed
Internet service provider
Demographic data (age, gender)

Data collected during registration:

First name / surname / username
Email address
Phone number
IP address (collected automatically)
Other ordinary data

Data collected when signing up for the Newsletter service:

First name / surname / username
Email address
IP address (collected automatically)

Data collected when adding a comment:

First name and surname / username
Email address
Website address
IP address (collected automatically)

Some data (excluding identifying data) may be stored in cookie files. Some data (excluding identifying data) may be transferred to a statistical-services provider.

§ 11 Recipients of Data

Personal data may be shared with the following recipients only to the extent necessary for the stated purpose or required by law. We do not resell personal data.

Krajowy Integrator Płatności S.A. (operator of Tpay), plac Andersa 3, 17th floor, 61-894 Poznań, Poland, to handle online payments.
Revolut Bank UAB, Konstitucijos ave. 21B, 08130 Vilnius, Lithuania, with a Polish branch registered as Revolut Bank UAB spółka z ograniczoną odpowiedzialnością Oddział w Polsce, to handle payments via Revolut Business payment links.
The accounting firm providing accounting services to us, to the extent necessary for bookkeeping and tax settlements.
Tax authorities, including the Head of the Polish National Revenue Administration (also via the National e-Invoicing System, KSeF, where an invoice is issued through that system), to the extent required by law.

Payment providers process data as independent controllers under their own privacy policies: Tpay and Revolut.

Access to data (usually on the basis of a data-processing agreement) may be held by entities responsible for maintaining the infrastructure and services necessary to run the Website, i.e.:

Hosting companies providing hosting or related services to the Controller
Companies through which the Newsletter service is provided

Entrustment of personal data processing — Newsletter. In order to provide the Newsletter service, the Controller uses the services of a third party — the MailChimp service and GetResponse. Data entered in the newsletter sign-up form is transferred to, stored, and processed on the external service of that provider. Please note that the partner in question may modify the referenced privacy policy without the Controller's consent.

Data processing entrusted to hosting providers. The Controller uses hosting offered under the kei.pl brand, now cyber_Folks S.A., a Polish hosting provider. Use of this hosting does not itself mean that all data is stored outside the European Union. The processing scope and maintenance access are governed by the agreement with the provider, including a data processing agreement under Article 28 GDPR. Any transfers outside the EEA require a separate legal mechanism as described in § 11a.

§ 11a Transfers Outside the EEA

Within the Revolut group, data may be transferred to countries outside the EEA, including the United Kingdom, for which the European Commission has adopted an adequacy decision. Transfers to the United Kingdom are based on Article 45 GDPR. Revolut's privacy policy explains its onward transfers.

For other service providers, including analytics tools, data may be transferred outside the EEA. The mechanism is a European Commission adequacy decision (Article 45 GDPR) or appropriate safeguards, particularly standard contractual clauses (Article 46 GDPR). An ordinary agreement with a provider is not itself a transfer mechanism. Contact the Controller for information on the mechanism applicable to a particular transfer and a copy of the safeguards used.

§ 12 Manner of Processing Personal Data

Personal data voluntarily provided by Users may be processed by service providers to the extent necessary to deliver the relevant service. Any transfers outside the EEA follow the rules and mechanisms in § 11a. Content published by a User, such as comments, is available to visitors to the Website.

Payment-related data is shared only with the recipients listed in § 11, to the extent necessary to handle transactions and meet accounting and tax obligations.

Personal data is used for automated decision-making (profiling). Profiling of personal data does not produce legal effects, nor does it otherwise significantly affect the person whose data is subject to automated decision-making. Personal data will not be sold to third parties.

Anonymous data (without personal data) collected automatically will be transferred outside the European Union and may be used for automated decision-making (profiling). Profiling of anonymous data does not produce legal effects, nor does it otherwise significantly affect the person whose data is subject to automated decision-making. Anonymous data will not be sold to third parties.

§ 13 Legal Bases for Processing Personal Data

The Website collects and processes Users' data on the basis of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR):

Article 6(1)(a): the data subject has given consent to the processing of his or her personal data for one or more specific purposes
Article 6(1)(c): processing is necessary for compliance with a legal obligation to which the controller is subject
Article 6(1)(d): processing is necessary in order to protect the vital interests of the data subject or of another natural person
Article 6(1)(f): processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party
Article 6(1)(b): processing is necessary for the performance of a contract, i.e. carrying out payment for the chosen services

as well as on the basis of: the Act of 10 May 2018 on the Protection of Personal Data (Journal of Laws of 2018, item 1000), the Telecommunications Law Act of 16 July 2004 (Journal of Laws of 2004, No. 171, item 1800), and the Act of 4 February 1994 on Copyright and Related Rights (Journal of Laws of 1994, No. 24, item 83).

§ 14 Security of Payment-Related Data

The Controller applies appropriate technical and organisational measures to secure payment-related data, including encryption of data transmission and other forms of protection.

The storage of payment-related data is limited to the period required by law, in particular the provisions relating to accounting and tax settlements.

§ 15 Personal Data Retention Period

Personal data voluntarily provided by Users is, as a rule, stored only for the period during which the Controller provides the service through the Website. It is deleted or anonymised within 30 days of the completion of the service provision (e.g. deletion of a registered user account, unsubscribing from the Newsletter list, etc.).

Invoices and accounting/tax records: data in invoices and tax records is generally retained for 5 years from the end of the calendar year in which the tax payment deadline expired (Article 112 of the Polish VAT Act and Articles 70 § 1 and 86 § 1 of the Tax Ordinance). Accounting records are retained under Article 74 of the Accounting Act, generally for at least 5 years from the beginning of the year following the financial year to which they relate. We apply the longer applicable period; it may be extended where required by law, particularly if the limitation period is suspended or interrupted. Deleting an account or withdrawing consent does not shorten this period.

An exception applies to situations that require the Controller to secure legitimate purposes for the further processing of such data. In such a situation, the Controller will store the indicated data from the time the User requests its deletion for no longer than a period of 3 years, in the event of a breach or suspected breach of the Website's terms of service by the User.

Anonymous data (without personal data) collected automatically — anonymous statistical data, which does not constitute personal data, is stored by the Controller for the purpose of keeping Website statistics for an indefinite period.

§ 16 Users' Rights in Connection with the Processing of Personal Data

Right of access to personal data — Users have the right to obtain access to their personal data, exercised upon a request submitted to the Controller.

Right to rectification of personal data — Users have the right to request that the Controller promptly rectify personal data that is inaccurate, and complete incomplete personal data, exercised upon a request submitted to the Controller.

Right to erasure of personal data — Users have the right to request that the Controller promptly erase their personal data, exercised upon a request submitted to the Controller. In the case of user accounts, deletion of data consists of anonymising the data that enables identification of the User. The Controller reserves the right to withhold fulfilment of a deletion request in order to protect its legitimate interest (e.g. where the User has breached the Terms of Service, or the data was obtained as a result of ongoing correspondence). In the case of the Newsletter service, the User may independently delete their personal data using the link included in every email sent.

Right to restriction of processing of personal data — Users have the right to restrict the processing of personal data in the cases specified in Article 18 GDPR, including, among others, contesting the accuracy of personal data, exercised upon a request submitted to the Controller.

Right to data portability — Users have the right to receive from the Controller personal data concerning them in a structured, commonly used, machine-readable format, exercised upon a request submitted to the Controller.

Right to object to the processing of personal data — Users have the right to object to the processing of their personal data in the cases specified in Article 21 GDPR, exercised upon a request submitted to the Controller.

Right to lodge a complaint — Users have the right to lodge a complaint with the supervisory authority responsible for data protection.

§ 17 Contacting the Controller

The Controller may be contacted in one of the following ways:

Postal address — Flymedica Sp. z o.o., ul. Dąbrowskiego 77a, 60-529 Poznań
Email address — kontakt@flymedica.pl
Phone call — +48 699 585 105
Contact form — available at flymedica.pl

§ 18 Website Requirements

Restricting the writing of and access to Cookie files on the User's Device may cause certain features of the Website to malfunction.

The Controller bears no liability whatsoever for malfunctioning features of the Website in the event that the User restricts, in any way, the ability to write and read Cookie files.

§ 19 External Links

The Website — including its articles, posts, entries, or User comments — may contain links to external websites with which the Website Owner does not cooperate. These links, and the pages or files they point to, may be dangerous to your Device or pose a threat to the security of your data. The Controller is not liable for content located outside the Website.

§ 20 Changes to the Privacy Policy

The Controller reserves the right to make any changes to this Privacy Policy, without the obligation to inform Users, with respect to the application and use of anonymous data or the use of Cookie files.

The Controller reserves the right to make any changes to this Privacy Policy with respect to the processing of Personal Data, of which it will inform Users who hold a user account or are subscribed to the Newsletter service via email within 7 days of the change being made. Continued use of the services signifies acknowledgment and acceptance of the changes introduced to the Privacy Policy. Where a User does not agree with the changes introduced, they are obliged to delete their account from the Website or unsubscribe from the Newsletter service.

Changes introduced to the Privacy Policy will be published on this subpage of the Website. The current version always includes the date of the last update.

PrivacyPolicy.