Your GDPR rights

Physiogenic processes your health data under the European Union General Data Protection Regulation (Regulation 2016/679 — "GDPR") and Polish data protection law (UODO). Health data is a "special category" under GDPR Article 9; we may only process it with your explicit consent or where a specific legal exception (e.g. medical care) applies.

1. What data we process

• Identity — name, date of birth, address, PESEL (if you choose to provide it for invoicing).
• Contact — email, phone, preferred language.
• Health — chief complaint, intake answers, past medical history, body-chart pain points, diagnostic test results, imaging you upload, treatment plans, session notes.
• Operational — appointment times, payment status (BLIK/cash markers — never card numbers), invoice records.
• Technical — IP address and User-Agent are written to our audit log when you sign in or download a document.

2. Your rights under GDPR

Right of access (Art. 15)

You can request a copy of every record we hold about you. We respond within 30 days at no charge.

Right to rectification (Art. 16)

You can correct any inaccurate or incomplete record directly from your patient profile, or by email.

Right to erasure / "right to be forgotten" (Art. 17)

You can request deletion of your data. We will erase what is not required by Polish health-records law (which requires us to retain medical records for 20 years from the last entry, per Ustawa o prawach pacjenta art. 29).

Right to restriction (Art. 18) and objection (Art. 21)

You can pause our processing of your data or object to specific uses (e.g. marketing — for which we never use medical data without your explicit consent).

Right to data portability (Art. 20)

We export your medical records as a structured PDF or JSON file you can send to another provider.

Right to withdraw consent (Art. 7)

Wherever processing relies on consent, you can withdraw it at any time without affecting prior lawful processing.

Right to lodge a complaint

You can complain to the Polish supervisory authority — Prezes Urzędu Ochrony Danych Osobowych (UODO), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl.

3. Legal basis for processing

We rely on your explicit consent (Art. 9(2)(a)) for the intake and treatment-planning data you give us, and on the medical-care exception (Art. 9(2)(h)) for clinical care delivered during sessions.

4. Retention

Medical records: 20 years from the last entry (Polish health-records law).
Audit logs and authentication events: 2 years.
Financial / invoice records: 5 years from end of fiscal year (Polish accounting law).

5. Recipients of your data

We do not sell or rent your data. Limited categories of recipients:

• Your clinic's clinicians and admin staff (need-to-know basis, logged in audit trail).
• Sub-processors: Resend (transactional email), Emergent Object Storage (EU-region encrypted document storage), MongoDB Atlas (EU region).
• Tax authority (Polish KAS / US) when required by law for invoice reporting.