2. Personal Data We Collect

• Identity and contact data: name, email address, telephone number, country of residence and other contact details you provide.
• Health data: symptoms, medical concerns, diagnoses, medical history, medication, allergies, treatment needs, referral information, waiting-list status, test results, images and medical documents you choose to provide.
• Enquiry and coordination data: preferred speciality, doctor, clinic, city, appointment dates, treatment timeframe and information needed to coordinate your enquiry.
• Communication data: emails, form submissions, WhatsApp messages, telephone notes and other correspondence.
• Travel and practical preferences: travel dates, accommodation or transfer requirements where you ask us to assist.
• Transaction and record data: invoices, quotations, payment confirmation or reimbursement documentation where relevant. MedTrip Poland does not store payment-card details.
• Technical and website data: IP address, device and browser information, cookies, consent choices and website usage information.

3. Why We Use Your Data and Our Legal Bases

• Responding to enquiries and taking requested steps: to assess your request, discuss suitable options and coordinate contact with an appropriate provider. We rely on steps taken at your request before entering into an arrangement and, where applicable, performance of an arrangement (Article 6(1)(b) GDPR).
• Health data: health information is special-category data. We process it for the specified purpose of handling your enquiry and, where necessary, sharing relevant information with an appropriate doctor or clinic only after you provide explicit consent (Article 9(2)(a) GDPR).
• Communication and administration: to provide appointment information, preparation instructions and practical coordination requested by you.
• Legal and record-keeping duties: to comply with legal, tax, accounting and regulatory obligations (Article 6(1)(c) GDPR).
• Legitimate interests: to maintain appropriate business records, secure our website and systems, prevent misuse, handle complaints and establish, exercise or defend legal claims (Article 6(1)(f) GDPR), provided those interests are not overridden by your rights.
• Cookies and optional analytics or advertising: where required, we rely on your consent, which can be changed through the website’s cookie settings.

4. Explicit Consent for Health Data

When a form requests health information, you will be asked to give a separate, explicit consent to the processing of that information and to the sharing of necessary information with an appropriate doctor or clinic in Poland for the purpose of handling your enquiry and arranging healthcare.

• The consent box is not pre-selected and must be completed by you.
• Your acceptance of the Terms & Conditions and confirmation that you have read this Privacy Policy are separate from your explicit consent to health-data processing.
• Your health information is not used for unrelated marketing and is not sold.
• You may withdraw consent at any time by emailing contact@medtrippoland.ie. Withdrawal does not affect processing already carried out lawfully. If the information is necessary to assess or coordinate your request, withdrawal may mean that we cannot continue providing that assistance.

5. Who May Receive Your Data

We disclose personal data only where necessary for the stated purpose, where you have requested or authorised the disclosure, or where disclosure is legally required. Recipients may include:

• an appropriate independent doctor, specialist, clinic, hospital or healthcare provider in Poland;
• the HSE or another reimbursement or public authority where you ask us to assist with documentation, or where disclosure is legally required;
• website-hosting, email, customer-relationship-management, cloud-storage, communications, security and IT support providers acting for us;
• professional advisers, insurers, accountants, regulators, courts or law-enforcement authorities where necessary;
• accommodation or transfer providers only where you specifically request practical assistance.

We share only information reasonably necessary for the relevant enquiry or service. Doctors and clinics generally act as independent controllers of the information they receive and must provide their own privacy information for their medical processing. Service providers acting on our instructions may process data only for the contracted purpose and subject to appropriate confidentiality and security obligations.

6. Information About Another Person

If you submit information about another person, you confirm that you are authorised to do so and that you have provided them with this Privacy Policy. Where health information is involved, you must have the person’s explicit authority to provide it and allow its necessary sharing. If you do not have that authority, please ask the person to contact us directly.

7. Data Minimisation and Security

Please provide only information relevant to your enquiry. We use reasonable technical and organisational measures to protect personal data against accidental or unlawful loss, alteration, access or disclosure and limit access to persons who need it for the relevant purpose. No internet, email or messaging service can be guaranteed to be completely secure.

8. Retention

We retain personal data only for as long as necessary for the purpose for which it was collected. The period depends on whether an enquiry proceeds, the nature of the assistance provided, ongoing communications, applicable legal and accounting obligations, complaint and limitation periods, and the need to demonstrate consent and compliance. Records that are no longer required are deleted or anonymised securely. A request for deletion may be refused or limited where retention is required by law or is necessary for the establishment, exercise or defence of legal claims.

9. International Transfers

Ireland and Poland are both within the European Economic Area (EEA). Where a service provider processes data outside the EEA, we use an appropriate lawful transfer mechanism and safeguards required by GDPR, such as an adequacy decision or approved standard contractual clauses, where applicable.

10. Your Data-Protection Rights

Subject to applicable law, you may request access, correction, deletion, restriction, portability or object to certain processing. Where processing relies on consent, you may withdraw it at any time. You also have the right to lodge a complaint with the Irish Data Protection Commission at www.dataprotection.ie.

To exercise your rights, email contact@medtrippoland.ie. We may need to verify your identity before acting on a request.

11. Automated Decisions and Marketing

MedTrip Poland does not make decisions producing legal or similarly significant effects about patients solely by automated means. We do not use health information for direct marketing. Any optional marketing communication will require an appropriate lawful basis and will include a way to opt out.

12. Cookies

Our website uses cookies and similar technologies for essential functionality and, subject to your choices, preferences, statistics and marketing. You can review or change your choices through the website’s cookie settings.