1. Data controller
The controller of personal data processed in connection with the use of fizjo-fan.pl (the "Website") and the provision of physiotherapy services is Fizjo-Fan Robert Bulik, Aleje Jerozolimskie 200, 02-486 Warsaw, Poland, NIP (tax ID): 8371722832 (the "Controller").
Contact regarding personal data: fizjofan88@gmail.com, tel. +48 780 646 601.
2. What data we process and why
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Replying to phone or e-mail enquiries | name, phone number, e-mail, message content | Art. 6(1)(f) GDPR – legitimate interest (communication) | until the correspondence ends, max. 12 months |
| Booking via Booksy | data entered in Booksy (name, phone, e-mail, date and type of service) | Art. 6(1)(b) GDPR – performance of a contract | for the duration of the service and the limitation period for claims |
| Physiotherapy records | identification data, health data, course of treatment | Art. 9(2)(h) GDPR in conjunction with Polish law on the physiotherapist profession and patients' rights | as required for medical records (generally 20 years) |
| Invoicing and accounting | data required to issue an invoice | Art. 6(1)(c) GDPR – legal obligation | 5 years from the end of the tax year |
| Website statistics and traffic analysis | device, browser, approximate location, pages visited (pseudonymised) | Art. 6(1)(a) GDPR – consent (analytics cookies) | until consent is withdrawn, max. cookie lifetime |
| Establishing, pursuing or defending claims | data from the purposes above | Art. 6(1)(f) GDPR | until the limitation periods expire |
3. Recipients of data
Data may be shared with processors acting on the Controller's behalf, to the extent necessary: the Website hosting provider, e-mail provider, accounting office, analytics tool providers and the booking system operator Booksy International sp. z o.o. (ul. Prosta 67, 00-838 Warsaw), which is an independent controller with regard to your Booksy user account – see the Booksy privacy policy.
Through Google tools (Google Tag Manager, Google Analytics, Google Maps) data may be transferred to Google Ireland Ltd. and, in some cases, to Google LLC in the USA – on the basis of the European Commission's adequacy decision (EU-U.S. Data Privacy Framework) or standard contractual clauses.
4. Cookies and analytics
- Necessary – ensure the Website works properly (e.g. remembering your cookie choice or theme). No consent required.
- Analytics – Google Analytics (via Google Tag Manager) to measure traffic and usage. IP addresses are anonymised. Loaded only after consent.
- Third-party – the embedded Google Map on the contact page and the Booksy booking widget may set their own cookies under those providers' policies.
You can withdraw consent to analytics cookies at any time by changing your browser settings or deleting cookies. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
5. Your rights
You have the right to access, rectify, erase, restrict processing of and port your data, to object to processing based on legitimate interest, and to withdraw consent at any time. To exercise these rights, contact fizjofan88@gmail.com. You may also lodge a complaint with the President of the Polish Personal Data Protection Office (UODO, ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl) or your local supervisory authority.
6. Is providing data mandatory?
Providing data is voluntary but necessary to book and carry out a visit or to answer an enquiry. Keeping physiotherapy records is a statutory obligation.
7. Automated decision-making
The Controller does not make decisions based solely on automated processing, including profiling, that produce legal effects for you.
8. Social media
The Website links to Fizjo-Fan's profiles on Facebook, Instagram and Booksy. Once you leave the Website, processing is governed by those platforms' policies (Meta Platforms Ireland Ltd., Booksy International sp. z o.o.).
9. Changes
This policy may be updated to reflect changes in law or in the Website's functionality. The current version is always available at fizjo-fan.pl/en/privacy-policy/.