Privacy
policy.

The controller of your personal data is Viktar Krukouski Fizjo, a sole proprietorship registered at ul. Wodociągowa 25 lok. 7, 11-500 Giżycko, Poland, NIP 8452007967, REGON 542774549.

Visits take place at the practice at ul. Stanisława Moniuszki 22/113, ground floor, 11-500 Giżycko.

Physiotherapist license number (NPWZ): PWZFz 86062, issued by the Polish National Chamber of Physiotherapists.

Contact regarding data processing: [email protected].

Depending on the form of contact or service you use, I may process:

• Identification and contact data: first name, last name, phone number, email address.
• Visit data: visit date and time, type of service, invoicing data (if you request one).
• Health data (special category — art. 9 GDPR): medical history, description of complaints, test results you share with me, and notes on the treatment plan and progress.
• Technical data: IP address, browser type, site analytics data — only if you have consented to analytics cookies. See the Cookie policy.
• Correspondence: if you write an email or SMS — the content of your message and information you voluntarily include.

Provision of physiotherapy services

I process your data to provide healthcare services — to take your history, examine you and provide therapy. Legal basis: art. 6(1)(b) GDPR (contract) and art. 9(2)(h) GDPR in conjunction with the Polish Physiotherapist Profession Act (medical data).

Maintaining medical records

As a physiotherapist I am obliged to maintain medical records. Legal basis: art. 6(1)(c) GDPR (legal obligation) in conjunction with Polish regulations on medical documentation.

Communication and handling inquiries

If you write an email or SMS or call me — I process your data to respond. Legal basis: art. 6(1)(b) GDPR (contract or pre-contractual steps) and art. 6(1)(f) GDPR (legitimate interest).

Tax and accounting obligations

Issuing invoices, keeping books. Legal basis: art. 6(1)(c) GDPR (legal obligation).

Analytics — only with your consent

Analytics cookies are only activated if you consented in the cookie banner. Legal basis: art. 6(1)(a) GDPR (consent) and art. 399 of the Polish Electronic Communications Law of 12 July 2024.

• Treatment notes and health data: for the duration of our cooperation and the period required by law. To the extent that medical documentation is kept, the retention period is generally 20 years from the last entry (Polish Patient Rights Act).
• Invoice and accounting records: 5 years from the end of the year in which the tax obligation arose.
• Correspondence (email, SMS): for the period necessary to conclude correspondence and another 12 months for archival purposes.
• Analytics data: no longer than 14 months (the data retention setting in Google Analytics 4).
• Data processed on consent basis: until consent is withdrawn.

Your data may be shared only with:

• IT, hosting, email and online booking providers (e.g. Booksy) — under processing agreements.
• Google (Analytics) — only statistical data about website traffic, and only if you consent to cookies. Google (Google Maps) — your IP address and possibly cookies, only if you click "Show Google map". No health data or treatment content is shared this way.
• The accounting office handling tax settlements.
• Physicians and other specialists — only with your explicit consent or at your request.
• Authorities entitled to obtain data on the basis of applicable law (e.g. NFZ, court, prosecutor) — to the extent required by law.

Your health data and treatment notes are never shared for marketing purposes or sold. I use Google Analytics — within that scope data may be processed by Google outside the European Economic Area (including in the USA) under safeguards provided by the GDPR (Data Privacy Framework / standard contractual clauses). Your medical data never leaves the practice this way.

In connection with the processing of your data you have the right to:

• Access — to view your data and obtain a copy.
• Rectification — to correct incorrect or incomplete data.
• Erasure ("right to be forgotten") — with the exception of medical data subject to mandatory retention.
• Restriction of processing — in specified cases.
• Data portability — to another controller.
• Objection — to processing based on legitimate interest.
• Withdrawal of consent at any time, without affecting the lawfulness of earlier processing.
• Lodging a complaint with the President of the Polish Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl.

To exercise any of these rights — write to [email protected]. I will respond within 30 days.

Data concerning your health is a special category of data under art. 9 GDPR. I treat it with elevated care:

• I am the only person with access to the medical records as the treating physiotherapist.
• Records are stored in a manner secured against access by unauthorised persons.
• I do not share them with third parties without your explicit consent, except where required by law.

I apply technical and organisational measures adequate to the risk — including: encrypted connections (HTTPS), passwords and two-factor authentication, secured backups, controlled access to paper records.

In the event of a data breach posing a high risk to your rights — I will inform you without undue delay, in accordance with art. 34 GDPR.

I update this policy whenever the processing methods or legal situation change. The current version is always on this page with its effective date. Actively-treated patients will be notified of material changes.

Any questions concerning the processing of your personal data can be directed to:

• Email: [email protected]
• Address: Viktar Krukouski Fizjo, ul. Wodociągowa 25 lok. 7, 11-500 Giżycko, Poland