Privacy notice

1. Who is responsible for your data?

The data controller is Natasza Wdowiak, trading as Nat Medica at Zawiszy Czarnego 6, 48-300 Nysa, Poland.

For privacy questions, contact Nat Medica:

• by telephone: +48 570 022 280;
• by email: kontakt@natmedica.pl;
• by post: Nat Medica, Zawiszy Czarnego 6, 48-300 Nysa, Poland.

2. What data may be handled?

Depending on how you use the website, Nat Medica may handle:

• technical information needed to display and protect the website, such as an IP address, device type, browser, request time and security logs;
• booking information such as your name, email address, telephone number, chosen service, appointment time and a short practical note;
• information included in an email or given during a telephone call;
• details needed for a receipt or accounting document, if requested.

The website does not have its own medical form or patient database. Do not send diagnoses, test results, medical records or detailed health information through an ordinary booking field. Information needed for a safe appointment is discussed through an appropriate private process.

3. Why is the data used?

Data may be used to:

• display, maintain and protect the website, based on the legitimate interest in operating a secure website;
• answer a question before booking, to take steps at your request before a contract or as part of the legitimate interest in handling correspondence;
• create, confirm, change or cancel an appointment and send reminders, to enter into or perform the appointment contract;
• keep accounts and meet legal duties, where tax, accounting or other laws require this;
• establish, exercise or defend legal claims, based on Nat Medica's legitimate interests;
• carry out another purpose based on consent, but only where separate and voluntary consent has been requested.

Nat Medica does not use booking information for profiling or automated decisions. Contact details are not used for marketing without an appropriate legal basis.

4. Do you have to provide the data?

Providing data is voluntary, but your name and contact details are needed to create and manage an appointment. Online booking may not be possible without them.

5. Who may receive the data?

Data is shared only where needed to operate the website, manage an appointment or meet a legal duty. Recipients may include:

• Cloudflare, for website hosting, delivery and security;
• Cal.eu / Cal.com, for the calendar, bookings, confirmations, changes, cancellations and reminders;
• the email provider, if you make contact by email;
• technical, accounting or legal providers, but only where access is needed for their work;
• public authorities, but only where disclosure is required by law.

If you follow a link to Booksy, Instagram, Google or another external service, you leave the Nat Medica website. That provider will then handle data under its own privacy rules.

6. Data outside the European Economic Area

Some technology providers may process data outside the European Economic Area. Where this happens, data is transferred using a safeguard permitted by the GDPR, such as a European Commission adequacy decision or standard contractual clauses.

Current provider information is available in their privacy notices:

• Cloudflare: www.cloudflare.com/policies/privacy;
• Cal.com: cal.com/privacy.

7. How long is data kept?

Data is kept only for as long as its purpose requires:

• ordinary enquiries: for up to 12 months after the conversation ends, unless connected with a booking, claim or legal duty;
• booking information: while the appointment is managed and then for up to 3 years where needed to explain a payment, complaint or legal claim;
• accounting documents: for the period required by applicable law;
• technical and security logs: for the period configured with the hosting provider and no longer than needed to protect the website;
• data based on consent: until consent is withdrawn or the purpose is reached sooner.

Backup copies may be removed later under the provider's secure backup cycle.

8. Your rights

Where the GDPR provides them, you have the right to:

• access your data and receive a copy;
• correct inaccurate data;
• ask for data to be erased;
• restrict the way data is used;
• receive and transfer certain data;
• object where processing is based on legitimate interests;
• withdraw consent at any time where consent is the legal basis.

Not every right applies in every situation. For example, a legal duty may require some documents to be kept.

Contact Nat Medica to exercise a right. We may ask for enough information to confirm your identity, but will not request more than is necessary.

You may also complain to the President of the Polish Personal Data Protection Office: uodo.gov.pl.

9. Cookies and external services

The main Nat Medica website does not use its own advertising or analytics cookies and does not store browser data for marketing.

The Cal.eu calendar may load on booking pages. The calendar provider may use necessary cookies or similar technologies to operate the selected appointment, maintain security and run the form. If optional analytics, advertising or other technology requiring consent is added later, it will be activated only after consent has been obtained.

A map or external directions page opens only after you select the relevant link or button. The external provider may then receive technical data such as your IP address.

10. Security and changes to this notice

Nat Medica uses reasonable organisational and technical measures to protect data against unauthorised access, loss or misuse. No method of sending information over the internet can be guaranteed to be completely secure.

This notice may change if the law, website configuration or service providers change. The current version and update date will always appear on this page.

---