Privacy policy

This policy explains how we process the personal data of patients of the FizjoStyl clinics and of visitors to the website www.fizjostyl.pl, in accordance with the GDPR (Regulation (EU) 2016/679 of the European Parliament and of the Council) and the regulations on patients' rights.

The data controller is FizjoStyl Konrad Niziankiewicz, ul. Wicherkiewicza 23/K, 30-389 Kraków, NIP (tax ID) 6842663939, REGON (business ID) 520991206 – a healthcare provider operating the following clinics:

• FizjoStyl Kliny – ul. Wicherkiewicza 23/K, 30-389 Kraków,
• FizjoStyl Wolska – ul. Wolska 2a, 30-663 Kraków.

For matters concerning personal data, write to fizjostyl.kn@gmail.com, call 881 505 588 or visit a clinic. We have not appointed a data protection officer.

• Booking an appointment (online form, telephone, email, Booksy, ZnanyLekarz): first name, surname, telephone number, email address, selected service and date, messages to the therapist. Purpose: arranging, reminding about, changing or cancelling an appointment. Legal basis: Art. 6(1)(b) GDPR (steps prior to entering into a contract and performance of the contract). Retention: until the appointment and, if it takes place, as for medical records.
• Provision of services and medical records: identification data (including PESEL (Polish national ID number), address, date of birth), information about health condition, course of therapy and recommendations and, for children, the data of a parent or guardian. Purpose: diagnosis and therapy, keeping records required by law. Legal basis: Art. 9(2)(h) and Art. 6(1)(c) GDPR in conjunction with the Act on Patients' Rights and the Patient Ombudsman and the Medical Activity Act. Retention: 20 years from the end of the calendar year of the last entry, unless the law provides for a different period.
• Payments and accounting (receipts, invoices, multi-visit passes, vouchers): data needed to issue a document. Legal basis: Art. 6(1)(c) GDPR (tax and accounting regulations). Retention: 5 years from the end of the year in which the tax obligation arose.
• Contact and enquiries (telephone, email, the “Call back” form, Facebook, Instagram): data you provide to us. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest – replying to your message). Retention: until the matter is closed, no longer than 12 months after the last contact.
• Protection against claims: data needed to establish, pursue or defend claims. Legal basis: Art. 6(1)(f) GDPR. Retention: until the limitation periods expire.
• Statistics and advertising on the website (Google Analytics, Meta pixel, conversion measurement): cookie identifiers, IP address, information about the device and browser, pages visited and clicks (e.g. “Book an appointment”, telephone). Purpose: traffic analysis, improving the website, measuring and tailoring advertising. Legal basis: Art. 6(1)(a) GDPR (consent). Retention: until consent is withdrawn and, in the tools, according to the provider's settings (up to 14 months for Google Analytics).

Providing your data is voluntary, but without it we cannot arrange an appointment or provide a service. Keeping medical records is our legal obligation. Consent to statistical and advertising cookies is entirely voluntary – declining does not limit your use of the website.

We do not make decisions about you based solely on automated processing, including profiling, that would produce legal effects concerning you or similarly significantly affect you.

We share data only to the extent necessary, on the basis of data processing agreements or legal provisions:

• Medfile – online appointment booking system,
• cyberFolks – website and email hosting,
• Telegram – notifications to the clinic about call-back requests from the “Call back” form,
• Google (Google Analytics, Google Ads, Google Maps, Google Fonts) and Meta Platforms (Meta pixel, Facebook, Instagram),
• the accounting firm and payment operators (card, BLIK),
• public authorities, including the National Health Fund (NFZ) and the Patient Ombudsman, and other entities – where required by law (e.g. disclosure of medical records).

If you book an appointment through Booksy or ZnanyLekarz, or write to us on Facebook or Instagram, these services also process data as separate controllers – under their own privacy policies. Reviews posted on Google are published under Google's terms.

You have the right to:

• access your data and receive a copy of it (we provide medical records in accordance with the Act on Patients' Rights and the Patient Ombudsman),
• rectification of your data,
• erasure of your data – except for data we are required by law to retain (e.g. medical records),
• restriction of processing,
• portability of data processed on the basis of a contract or consent,
• object to processing based on our legitimate interest,
• withdraw consent at any time – without affecting the lawfulness of processing carried out before its withdrawal.

To exercise your rights, contact us (details above). You also have the right to lodge a complaint with the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw.

Cookies are small files saved on your device when you use the website. We use them for three purposes:

• necessary – operation of the website, security and remembering your cookie choices; they do not require consent,
• statistical – Google Analytics (e.g. _ga files), with your consent,
• marketing – Meta pixel and Google conversion measurement (e.g. _fbp, _gcl files), with your consent.

Cookies may be session cookies (deleted when you close the browser) or persistent (stored for a set period or until you delete them). You can change your consent at any time in the cookie banner on the website or in your browser settings – deleting or blocking necessary cookies may make the website harder to use. Google Maps embedded on the clinic pages and the Medfile booking form may set their own cookies.

We apply technical and organisational measures to protect data against loss, unauthorised access and alteration, including an encrypted connection (HTTPS) on the website. Only authorised persons, bound by professional secrecy, have access to medical records.

We may update this policy, e.g. when the law or the tools we use change. The current version is always available on this page.

Effective from 10 October 2026.