Privacy and cookie policy

We care about the privacy of patients and website users. Below we explain what data we process, for what purpose and what rights you have. This policy covers the website, the shop and contact with the clinic.

1. Data controller

The data controller is PrimaCora Medical Centre [legal form and full name of the entity], ul. Ogrodowa 31, [postcode] Warsaw, Tax ID [Tax ID], REGON [REGON], [KRS / CEIDG], entered in the Register of Entities Performing Medical Activities under number [RPWDL register number]. Contact regarding personal data: [e-mail]. Data protection officer: [full name, e-mail – a medical facility processing health data on a large scale is usually required to appoint a DPO].

2. Purposes and legal bases of processing

Providing health services and keeping medical records	Art. 6(1)(c) and Art. 9(2)(h) GDPR in connection with the regulations on patient rights and medical activity. Health data is a special category of data.
Booking visits (online, by phone, at reception)	Art. 6(1)(b) and (c) GDPR; [name of the booking system as a data processor]
Shop sales (packages, vouchers, products), payments, invoices	Art. 6(1)(b) (contract) and (c) GDPR (tax and accounting obligations)
Replying to messages from the contact form	Art. 6(1)(f) GDPR (legitimate interest); please don't enter health details in the form. We delete messages automatically after [12] months.
Statistics and ad measurement (analytics and marketing cookies)	Art. 6(1)(a) GDPR – only with your consent, which you can withdraw at any time.
Establishing and defending against claims	Art. 6(1)(f) GDPR

3. Retention period

We keep medical records for the period required by law (as a rule, 20 years from the end of the year of the last entry, with exceptions provided by law). Sales data – for the period required by tax law (5 years from the end of the tax year). Contact form data – for up to [12] months. Data processed on the basis of consent – until it is withdrawn.

4. Data recipients

Data may be shared with entities that support our work under data processing agreements: hosting provider ([name]), booking system ([name]), payment operator ([PayU / Przelewy24]), e-mail provider, accounting office, partner laboratories and – if you consent to cookies – Google Ireland Ltd. (Google Analytics, Google Ads). Data is transferred outside the EEA only on the basis of mechanisms provided for in the GDPR (e.g. a European Commission decision, standard contractual clauses).

5. Your rights

You have the right to access your data, rectify, erase or restrict its processing, to data portability, to object to processing based on legitimate interest and to withdraw consent at any time (without affecting the lawfulness of earlier processing). The right to erasure does not cover medical records during the mandatory retention period. You have the right to lodge a complaint with the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw).

6. Cookies and similar technologies

You can change your consent at any time using the “Cookie settings” button in the page footer.

Necessary (always active)	pc-consent-v2 (remembers your consent choices, 12 months, browser storage); woocommerce_cart_hash, woocommerce_items_in_cart, wp_woocommerce_session_* (cart and order, up to 48 hours); wordpress_* (logging in to the admin panel); accessibility settings (text size, contrast).
Analytics (with consent)	_ga, _ga_* – Google Analytics 4, up to 2 years.
Marketing (with consent)	_gcl_* and Google Ads files – ad conversion measurement, up to 90 days.

We use Google Consent Mode v2: until you give consent, Google tools do not store analytics or advertising cookies. [If the clinic enables advanced mode: a description of sending anonymous signals without cookies]

7. Policy changes

We will announce significant changes on this page. Version of [date].