Privacy Policy

Privacy Policy of the ODONTO Dental Clinic

1. Data Controller

The controller of your personal data is ODONTO Sp. z o.o., with its registered office at ul. Słowackiego 12, Unit U6, 01-627 Warsaw, Poland, registered with the District Court for the Capital City of Warsaw, 13th Commercial Division of the National Court Register under KRS No. 0000798121, Tax Identification Number (NIP): 525-279-79-28, REGON: 384065602.

2. Contact Details

If you have any questions regarding the processing of your personal data, you may contact us by:

• E-mail: kontakt@odonto-klinika.pl
• Telephone: +48 22 545 62 43
• Mail: ODONTO Sp. z o.o., ul. Słowackiego 12, Unit U6, 01-627 Warsaw, Poland

3. Scope of Personal Data Processing

As part of our activities, we process the following categories of personal data:

• Identification data: first name, last name, PESEL number
• Contact details: residential address, telephone number, e-mail address
• Medical data: medical history, examination results, X-ray images
• Appointment information: appointment dates and service booking details
• Financial information: payment details, payment methods, bank account number (where applicable)
• Technical data: IP address, location data, cookies, and information regarding activity on the Clinic’s website

4. Purposes and Legal Bases for Processing Personal Data

Your personal data are processed for the following purposes:

• Provision of medical services – pursuant to Article 9(2)(h) of the GDPR (processing necessary for preventive healthcare, medical diagnosis, the provision of healthcare or treatment, and the management of healthcare systems and services).
• Appointment registration and management – including contacting patients regarding scheduled services, appointment confirmations and reminders, pursuant to Article 6(1)(b) of the GDPR (processing necessary for the performance of a contract).
• Patient support and communication – including informing patients about changes in the Clinic’s operations and maintaining patient relationships, pursuant to Article 6(1)(f) of the GDPR (legitimate interests pursued by the controller).
• Maintenance of medical records – in accordance with applicable legal requirements, pursuant to Article 9(2)(h) of the GDPR.
• Financial and tax accounting – pursuant to Article 6(1)(c) of the GDPR (compliance with a legal obligation).
• Direct marketing of the Clinic’s services – including sending information about services, new offers and promotions, based on the patient’s consent pursuant to Article 6(1)(a) of the GDPR.
• Ensuring IT security – pursuant to Article 6(1)(f) of the GDPR (legitimate interests pursued by the controller).

5. Data Recipients

Your personal data may be disclosed to the following categories of recipients:

• Service providers supporting the Controller in the provision of medical services, including IT, archiving, analytics and marketing service providers.
• Healthcare providers cooperating with the Clinic, to the extent necessary to perform commissioned examinations or consultations.
• Public authorities and other entities authorized under applicable law.
• Data processors acting on our behalf under data processing agreements.
• Payment service providers, where online payments are processed.

6. Transfers of Personal Data to Third Countries

Your personal data are not transferred outside the European Economic Area (EEA), unless such transfer is necessary for the provision of our services and is carried out in compliance with applicable laws, ensuring an adequate level of personal data protection.

7. Data Retention Period

Your personal data will be retained for the following periods:

• Medical records: 20 years from the date of the last entry in the medical records, in accordance with applicable legal requirements.
• Financial data: for the period required under tax legislation (5 years from the end of the relevant tax year).
• Data processed on the basis of consent: until the consent is withdrawn.

8. Your Rights

You have the right to:

• Access your personal data.
• Rectify inaccurate or incomplete personal data.
• Request the erasure of your personal data (“right to be forgotten”) where provided by law.
• Request the restriction of processing.
• Data portability.
• Object to processing where processing is based on the Controller’s legitimate interests.
• Withdraw your consent at any time where processing is based on consent.
• Lodge a complaint with the competent supervisory authority, namely the President of the Personal Data Protection Office (UODO).

9. Cookies and Other Tracking Technologies

Our website uses cookies and other tracking technologies to improve the quality of our services, personalize content according to your preferences, and analyze website traffic.

10. Data Security

We make every effort to ensure that your personal data are processed securely. We have implemented appropriate technical and organizational measures, including data encryption, IT system security measures and staff training, to protect your personal data against unauthorized access, loss, destruction or alteration.

11. Changes to This Privacy Policy

This Privacy Policy may be updated from time to time to reflect changes in applicable laws or the Clinic’s operations. Any amendments will be published on our website and made available at our registered office.

12. Contact

If you have any questions or concerns regarding the processing of your personal data, please contact us using the contact details provided above.

ODONTO Sp. z o.o.
ul. Słowackiego 12, Unit U6
01-627 Warsaw, Poland

Telephone: +48 22 545 62 43
E-mail: kontakt@odonto-klinika.pl

This Privacy Policy complies with the applicable laws in force as of the date of its publication and may be amended if legal regulations change.

Last updated: 22 June 2026