Privacy and Cookies Policy for the Wellysa Application and the www.wellysa.com Website

1. Introduction

1.1. NZOZ Wellysa Sp. z o.o. (hereinafter “NZOZ Wellysa” or the “Controller”), that is, Niepubliczny Zakład Opieki Zdrowotnej Wellysa spółka z ograniczoną odpowiedzialnością (a private healthcare provider organised as a limited liability company), with its registered office in Warsaw at ul. Grójecka 22/24/32, 02-301 Warsaw, entered in the Register of Entrepreneurs of the National Court Register kept by the District Court for the Capital City of Warsaw in Warsaw, 12th Commercial Division of the National Court Register, under KRS number 0001092700, NIP 5252996220, REGON 528027906, entered in the Register of Entities Performing Medical Activity under number 000000289562, with a share capital of PLN 5,000, treats the privacy and security of personal data with due seriousness and commitment.

1.2. NZOZ Wellysa is a subsidiary of Wellysa Spółka Akcyjna (a joint-stock company), with its registered office in Warsaw at ul. Grójecka 22/24/32, 02-301 Warsaw, entered in the Register of Entrepreneurs of the National Court Register kept by the District Court for the Capital City of Warsaw in Warsaw, 12th Commercial Division of the National Court Register, under KRS number 0000995956, NIP 7011112054, REGON 522712067, with a share capital of PLN 1,677,773.02.

1.3. We undertake to comply with the highest data protection standards, in full accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR), as well as other relevant provisions of Polish and European Union law on the protection of personal data.

1.4. In this document, the term “Privacy and Cookies Policy for the Wellysa Mobile Application and the www.wellysa.com Website” will hereinafter be referred to by the shortened name “Privacy Policy” for the sake of clarity and ease of reading. This term refers to all the rules and practices we apply to protect the User’s privacy and to process any personal and medical data when using our services.

2. Data Controller

2.1. The controller of personal data is NZOZ Wellysa, which determines the purposes and means of the processing of data. We are committed to protecting the User’s privacy and ensuring the security of personal and medical data in accordance with applicable law.

2.2. The controllers of some personal and medical data are also authorised entities, such as Laboratories, Collection Points and Wellysa Medical Partners, which are required to keep medical records confirming the healthcare services provided. These controllers are given access to the minimum scope of data necessary to provide the healthcare service to the User, on the instruction of NZOZ Wellysa. These controllers are required to protect the User’s privacy and to ensure the security of all personal and medical data in accordance with applicable law.

2.3. If you have any questions about how data is processed, or if the User wishes to exercise their rights, please contact our Data Protection Officer (DPO) by e-mail at iod@wellysa.com or by post to the address of our registered office at ul. Grójecka 22/24/32 in Warsaw (02-301), marked “IOD” (the Polish abbreviation for DPO).

3. Collection and Processing of Personal Data

3.1. NZOZ Wellysa undertakes to manage the personal and medical data of our Users transparently and responsibly. Data is always processed with full respect for privacy and in accordance with applicable law, including the so-called GDPR, that is, Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (Official Journal of the EU L 119, 2016, p. 1, as amended).

4. Collection and Processing of Medical Data

4.1. NZOZ Wellysa undertakes to keep medical records in connection with the healthcare services provided under the Healthcare Services Agreement concluded with the User, with the exception of the healthcare service consisting of a blood draw or the testing of other biological material, for the keeping of medical records of which the Laboratory, the Collection Point and Wellysa Medical Partners will be responsible.

4.2. Medical records will be kept, stored and made available by NZOZ Wellysa in accordance with the rules arising from generally applicable law, in particular the provisions of the Act of 6 November 2008 on Patient Rights and the Patient Ombudsman, the Act of 28 April 2011 on the Healthcare Information System, and the Regulation of the Minister of Health of 6 April 2020 on the types, scope and templates of medical records and the manner of their processing.

5. Purposes of Data Processing

5.1. Provision of services, including medical services. Personal and medical data are necessary for the performance of agreements concerning our services, including delivering the content of the mobile application, handling user accounts, providing healthcare services to the User (hereinafter the “Wellysa Services”), and providing technical support and customer support.

5.2. Management of the User’s account. We process data in order to manage user accounts, including maintaining account security, handling enquiries and carrying out transactions.

5.3. Marketing. After receiving the User’s explicit consent, given in the Wellysa Application, we use the personal data collected for marketing purposes, including sending information about new features, promotions and special offers.

5.4. Analysis and improvement of services. Data is used for analysis and statistics, which allows NZOZ Wellysa to continually improve the quality of the services provided, personalise content and develop new functionalities.

6. Types of Data Processed

6.1. Identification and Contact Data. Where providing such data is necessary for the performance of a given Service, we process basic identification data such as: first name and surname, PESEL (Polish national identification number), correspondence address, telephone number, e-mail address, and the individual NZOZ Wellysa customer number (the so-called Wellysa ID or WID).

6.2. Medical Data. If, as a result of the performance of a given Service, the User authorises NZOZ Wellysa to provide a healthcare service, then, depending on the scope of the service provided, NZOZ Wellysa may process data such as: sex, the family genogram number, the history of certain diseases (e.g. family history of cancer), a behavioural profile of health-related behaviours (e.g. smoking, sleep or physical activity), the results of certain tests (e.g. blood count results, lipid profile or a trace elements level test), identified DNA genetic mutations (e.g. BRCA1, NBN, CHEK2 or PALB2), identified diagnoses and risk markings, or assigned preventive recommendations. NZOZ Wellysa also stores the Wellysa Report, which is a holistic summary of the prevention profile built and of the medical recommendations.

6.3. Transaction Data. We collect data relating to transactions carried out as part of our services, including the history of purchases and selected services.

6.4. Supplementary Data. We also process other personal data provided voluntarily by the user when using the mobile application or the website, such as preferences, opinions and interests.

6.5. Technical Data. We collect technical information about devices and the way our services are used, including data about logging in and about the time and manner in which the application or the website is used. With the User’s additional consent, it is also possible to collect location information (GPS).

7. Legal Basis

7.1. The legal basis for processing personal data is a key element that ensures our activities comply with the law. Below we state precisely the basis on which we process users’ data, which makes our practices transparent and helps to build trust.

7.2. Performance of a Contract (Article 6(1)(b) GDPR). The most commonly used legal basis is the need to process personal data in order to enter into and perform a contract to which the data subject is a party. This covers all the activities necessary to provide the services offered by our application or website, such as registering an account, fulfilling orders related to a diagnosis, or providing customer support. Data is processed only to the extent necessary to carry out these activities.

7.3. Explicit Consent (Article 6(1)(a) GDPR). In some cases, in particular for marketing activities or in other situations that are not strictly connected with the performance of a contract, we base the processing of personal data on the explicit consent given by the user. This consent may be withdrawn at any time, which is one of the fundamental rights guaranteed by the GDPR.

7.4. Legal Obligations (Article 6(1)(c) GDPR). Sometimes the processing of data is necessary to comply with legal obligations to which the data controller is subject, e.g. storing sales documentation for tax or accounting purposes.

7.5. Legitimate Interests (Article 6(1)(f) GDPR). In certain situations we process personal data on the basis of legitimate interests pursued by our company or by third parties, provided that these are not overridden by the rights and freedoms of the data subject. Examples of such activities include the analysis and optimisation of our services, the management of network and information security, and market and statistical research carried out to improve our offer.

7.6. The processing of special categories of personal data, such as medical and genetic data, takes place in accordance with Article 9(2)(h) of the GDPR, that is, to the extent necessary for the purposes of preventive medicine, medical diagnosis, the provision of healthcare, or the management of healthcare systems and services, and in accordance with the relevant provisions of national law, including those concerning the keeping of medical records.

7.7. Whenever we rely on legitimate interests, we endeavour to assess and balance our business interests against the rights and freedoms of the data subjects. We ensure that these interests are pursued transparently and with full respect for the privacy of users.

7.8. We make every effort to ensure that the Controller’s processing of personal data is carried out with the utmost care and in accordance with applicable law, always bearing in mind the rights and well-being of the data subjects.

7.9. Additional obligations of the controller arising from the GDPR and national law:
7.9.1. Data Protection Impact Assessment (DPIA). In accordance with Article 35 of the GDPR, NZOZ Wellysa carries out a data protection impact assessment (DPIA) where the planned processing operations may result in a high risk to the rights and freedoms of natural persons, in particular when processing special categories of data, such as medical and genetic data.
7.9.2. Record of Processing Activities. The Controller keeps a record of personal data processing activities in accordance with Article 30 of the GDPR, which also covers activities related to the processing of medical and genetic data, ensuring full documentation in accordance with applicable law.
7.9.3. Application of national provisions on genetic data. The processing of genetic data in the course of cooperation with laboratories providing diagnostic services takes place in accordance with the Act of 27 July 2001 on Laboratory Diagnostics (Journal of Laws of 2023, item 1404), to the extent applicable to medical and diagnostic activity.

8. Data Security

8.1. We attach great importance to protecting your personal data against unauthorised access, disclosure, alteration or destruction. Ensuring an appropriate level of security for our users’ personal data is the foundation of our activity and is inseparably linked with our corporate values. Awareness of the key role played by user trust motivates us to implement the most advanced and effective data protection strategies. We have introduced a number of security measures, both technical and organisational, to ensure the highest level of protection.

8.2. Protective Technologies:
8.2.1. Encryption. We use strong end-to-end encryption for all data transmitted between the user’s device and our servers, as well as encryption of data “at rest”, ensuring its protection at every stage of processing. 8.2.2. IT infrastructure and network security. Our network security measures are a key layer of defence for our IT infrastructure, providing solid protection against a wide range of cyber threats. By deploying state-of-the-art firewalls and intrusion detection and prevention systems (IDS/IPS), we have created a complex protective barrier that effectively monitors and regulates network traffic, identifying and blocking potentially harmful activity before it can breach our systems.
8.2.3. Firewalls. As the first line of defence, they are configured to selectively allow only secure network traffic, in accordance with strictly defined security policies. As a result, unauthorised access attempts are detected and neutralised immediately. IDS/IPS systems, in turn, act as an advanced supervision mechanism that not only detects potential attacks in real time but also actively intervenes to prevent them, protecting the network against complex threats such as zero-day attacks, malware or attempts to intercept data.
8.2.4. IDS/IPS updates. Our IDS/IPS systems are continuously updated with the latest threat signatures and heuristics, which ensures effective protection against a dynamically changing cyber threat landscape. The implementation of this advanced technology, combined with the continuous monitoring and analysis of network traffic by our team of security experts, enables the rapid identification of and response to potential security incidents before they can endanger the integrity of our systems and users’ data.
8.2.5. Audits. Committed to continuous improvement, we regularly carry out audits and updates of our network security to make sure it is always several steps ahead of potential attackers. This allows us to provide our users with calm and secure access to our services, building trust by demonstrating our professionalism and commitment to protecting their data.
8.2.6. SIEM and Advanced Monitoring. We have introduced SIEM-class systems (Security Information and Event Management) for the central monitoring and analysis of security events, which, combined with EDR (Endpoint Detection and Response) and NDR (Network Detection and Response) technologies, allows threats to be detected and neutralised effectively.
8.2.7. Artificial Intelligence. Artificial intelligence (AI) and machine learning algorithms are the foundation of our defence strategy, providing the tools needed for the in-depth analysis and interpretation of huge amounts of data in real time. Thanks to these advanced technologies, our systems are able to identify anomalies and potential threats before they become a problem, which allows them to be neutralised quickly. Machine learning continuously improves on the basis of newly encountered challenges, which makes our protection increasingly effective as the digital threat landscape evolves. In this way, by using AI and machine learning, we not only respond to known threats but also effectively anticipate and prevent new ones, giving our users the highest level of security.
8.2.8. Secure Patch Management. Secure Patch Management plays a key role in our strategy for protecting IT infrastructure against digital threats. To this end, we have implemented advanced, automated patch management systems that continuously monitor and analyse software for any known vulnerabilities. As soon as a security update or a new patch is detected, these systems immediately apply the necessary changes, ensuring that all components of our infrastructure are kept up to date against the latest threats. Automating this process significantly reduces the time window in which attackers could exploit unpatched security gaps, which is particularly important in the rapidly changing cyber threat environment. This ensures that our systems and users’ data are protected against the exploitation of known vulnerabilities, increasing the overall level of security of our network and services. Our approach to patch management is part of a broader security strategy that includes regular reviews and penetration tests to make sure that all aspects of our IT ecosystem are protected against potential threats. The introduction of automated patch management systems is proof of our commitment to providing the highest quality of protection and maintaining the trust of our users.

8.3. Procedures and Training
8.3.1. Access Control. Ensuring that access to personal data is strictly limited is the foundation of our security strategy. We apply multi-level authentication methods and access permissions, which are regularly reviewed and updated to adapt them to current data protection needs. In this way, we guarantee that only authorised persons who need access to data in the course of their professional duties can obtain it.
8.3.2. Audit and Monitoring. Our audit activities and real-time monitoring are the foundation of continuous data protection. Using advanced network and system monitoring tools, we are able to detect any unusual activity or potential data breaches, which allows remedial action to be taken immediately. Regular security audits ensure that our practices and procedures remain in line with the latest data protection standards.
8.3.3. Incident Management. We have well-developed incident management procedures that define clear escalation and response paths for different types of security incidents. Our teams are prepared to act quickly to minimise the impact of any data security breaches, and to inform the parties concerned and regulatory authorities in accordance with applicable requirements.
8.3.4. Training and Awareness. Regularly organised employee training on data security and privacy protection is crucial for maintaining a high level of security awareness and culture in our organisation. Through education and continuous reminders of best practices, we ensure that every member of our team understands their role in protecting personal data and is equipped with the knowledge necessary to act responsibly.
8.3.5. Commitment to Improvement. Our commitment to continuously improving security procedures reflects a deep conviction that the protection of personal data is a dynamic process, requiring constant attention and adaptation to a rapidly changing threat environment. To this end, we maintain close cooperation with leading experts and specialists in the field of cybersecurity, drawing on their knowledge and experience so that our strategies are always up to date and effective in the face of new challenges.
8.3.6. Development. We regularly take part in industry conferences, workshops and training, which allow us to exchange experience and best practices with other professionals in the sector. As a result, we are able not only to keep our security procedures up to date but also to anticipate potential threats and work proactively on solutions that will minimise the risk to our systems and users’ data.
8.3.7. Research. Our involvement in research and development in the field of cybersecurity also enables us to explore new technologies and approaches, such as artificial intelligence, machine learning or advanced cryptography, which can significantly improve our ability to protect against cyberattacks. By implementing innovative solutions, we aim not only to respond to current threats but also to shape the future of a secure digital world.
8.3.8. Process. Our commitment to improvement is not only a response to growing regulatory requirements and user expectations but, above all, results from our responsibility for protecting the valuable information of the users who have placed their trust in us. It is a continuous process in which all levels of our organisation are involved, from management to every employee, which ensures that data security is an integral part of our corporate culture and of all the actions we take. At Wellysa, care for the security of our users’ data is an expression of our professionalism and dedication. We undertake to ensure that your data is not only secure but also protected as a top priority and in accordance with the best industry standards.

9. Recipients of Data

9.1. At NZOZ Wellysa, we undertake to protect data and to share it only with entities for which this is necessary for the performance of our services and of the functions offered by our mobile application and website. Every disclosure of data takes place in compliance with the highest security standards and with applicable law.

9.2. All entities to which we disclose data are required to process the data in accordance with our instructions and applicable data protection law, and to implement appropriate security measures to protect your personal data.

9.3. Below we present the categories of recipients to which your personal data may be transferred:
9.3.1. Technology Providers. We cooperate with trusted providers of technology and IT services, including hosting providers, cloud solution providers and companies offering support and maintenance of our IT systems. Their access to data is limited to what is necessary to carry out their tasks and to provide services to us.
9.3.2. Courier and Logistics Companies. For the purpose of delivering products and services that you order through our mobile application or website, your data may be transferred to courier and logistics companies. The data disclosed includes the information necessary to deliver the order, such as your first name and surname, delivery address and contact number.
9.3.3. Marketing Partners. If you have consented to receiving marketing information, your data, such as your e-mail address, may be shared with our marketing partners in order to send you personalised offers and promotions.
9.3.4. Legal and Regulatory Bodies. In some cases we may be required to disclose your personal data to public authorities or regulators in connection with applicable law, court proceedings, a request from law enforcement authorities or for audit purposes.
9.3.5. Payment Service Providers. In order to process payments made by you when using our services, your data may be transferred to payment service providers, including banks and institutions handling electronic payments.
9.3.6. Analytics and Statistics Service Providers. In order to analyse how our application and website are used and to improve our services, we may share data in anonymised form with analytics and statistics service providers.

9.4. Below we present the categories of recipients to which your personal and medical data may be transferred:
9.4.1. Laboratories. In order to perform the Wellysa Service, Laboratories providing medical services gain access to certain personal and medical data of the User.
9.4.2. Collection Points. In order to perform the Wellysa Service, Laboratories providing medical services gain access to certain personal and medical data of the User.
9.4.3. Wellysa Medical Partners. In order to perform the Wellysa Service, Wellysa Medical Partners providing medical services gain access to certain personal and medical data of the User.

10. User Rights

10.1. Right of access to data. The User has the right to obtain confirmation as to whether your personal data is being processed, and access to that data and to information about the purposes of processing, the categories of data processed, and the recipients or categories of recipients of the data.

10.2. Right to Rectification. Where your personal data is inaccurate or incomplete, you have the right to request its rectification or completion without undue delay.

10.3. Right to Erasure (“Right to be Forgotten”). You may request the erasure of your personal data if it is no longer necessary for the purposes for which it was collected, you have withdrawn your consent, you have lodged a valid objection, or the data is being processed unlawfully.

10.4. Right to Restriction of Processing. You have the right to request restriction of the processing of your personal data in certain cases, e.g. where you contest the accuracy of the data or object to the processing.

10.5. Right to Data Portability. You have the right to receive the personal data that you have provided in a structured, commonly used and machine-readable format, and the right to transmit that data to another controller without hindrance from us.

10.6. Right to Object. You may object to the processing of your personal data where the processing is based on a legitimate interest, including profiling, unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms.

10.7. Right to Withdraw Consent. Where processing is based on your consent, you have the right to withdraw that consent at any time, which does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.

10.8. Exercising Your Rights. To exercise the above rights, it is enough to contact our Data Protection Officer (DPO) by e-mail at iod@wellysa.com or by sending your enquiry in writing to the address of our registered office, marked “IOD”. We will endeavour to reply to your enquiry without delay, and no later than within one month of receiving the request. We are here to help you exercise your personal data protection rights and to ensure full transparency and control over the information processed.

11. Information on Whether Providing Data Is Voluntary or Obligatory

11.1. At NZOZ Wellysa we value transparency and want our users to be fully aware of the conditions for using our services. We understand that protecting privacy is a key element of trust between us and our users. We therefore wish to explain in what circumstances providing personal data is voluntary and when it is necessary.

11.2. Voluntary Provision of Data. Providing personal data by users of our mobile application or website is, in principle, voluntary. The User is entirely free to decide whether to share their personal data with us. Where it is not required by law or directly necessary for the performance of a contract, we always clearly state that providing the data is voluntary.

11.3. Necessity of Providing Data for the Provision of Services. In some cases, providing specific personal data is a necessary condition for:
11.3.1. Entering into a contract and our providing services in a way that is effective and in line with the user’s expectations. This applies, for example, to the contact details needed to create an account, fulfil orders or provide customer support.
11.3.2. Complying with legal obligations to which we are subject as the data controller, for example those related to tax settlements or accounting obligations.
11.3.3. Responding to users’ enquiries and providing access to the full functionality of our services.

11.4. Consequences of Not Providing Data. If a user does not provide personal data that is necessary for the provision of our services or for us to comply with legal obligations, this may make it impossible for us to enter into a contract, fulfil an order, make the full functionality of the mobile application or website available, or respond to enquiries.

12. User Rights and Control Over Data

12.1. Notwithstanding the above, the user has the right at any time to access their data, to have it rectified, erased or its processing restricted, as well as the right to object to the processing of data and the right to data portability. Detailed information on exercising these rights is provided in the “User Rights” section of this privacy policy.

12.2. We encourage you to contact our Data Protection Officer (DPO) directly if you have any questions or concerns about the processing of personal data. You can do so by e-mail: iod@wellysa.com or in writing to the address of our registered office, marked “IOD”.

13. Data Retention Period

13.1. At NZOZ Wellysa we attach great importance to the justification and minimisation of personal data storage. In line with our commitment to protecting privacy, our users’ personal data is stored only for the period strictly necessary to achieve the purposes for which it was collected, or until the user decides to withdraw their consent. Below we present the rules on the period for which personal data is stored in different contexts.

13.2. Provision of Services. Personal data processed in order to enter into and perform an agreement for the provision of services will be stored for the duration of the agreement and then for the time required by law, e.g. on accounting and taxation (this is usually up to 5 years after the end of the year in which the agreement was fully performed).

13.3. Marketing Consent. Where personal data is processed on the basis of consent to receive marketing information, this data will be stored until you withdraw your consent.

13.4. Analysis and Statistics. Data used for analyses, market research and statistics will be stored in anonymised form, which does not allow the user to be identified, for the period necessary to carry out those analyses, usually up to 2 years from the end of the year in which the data was collected.

13.5. Complaints and Pursuit of Claims. Data processed for the purpose of handling complaints and pursuing claims will be stored for the period necessary to resolve the matter, and then for the period required by law on the limitation of claims (usually up to 3 years from the date on which the matter was resolved or the last legal act).

13.6. Whenever the retention period for personal data comes to an end, the data will be erased or anonymised in such a way that it is no longer identifiable.

14. Withdrawal of Consent

14.1. You have the right to withdraw your consent to the processing of personal data at any time. Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal. After consent has been withdrawn, your personal data will be kept by us only to the extent and for the time required by law or until potential claims become time-barred.

14.2. NZOZ Wellysa undertakes to review and update its data retention policy regularly in order to ensure that it complies with current law and industry best practice.

15. Automated Decision-Making and Profiling

15.1. In the course of our activity at NZOZ Wellysa, we wish to emphasise our commitment to transparency and accountability in the processing of personal data. We therefore inform you that in our mobile application and on our website we do not use automated decision-making processes, including profiling, that would have legal effects on natural persons or similarly significantly affect them.

15.2. Automated Decision-Making. Automated decision-making refers to processes in which decisions concerning natural persons are made automatically, on the basis of collected data, without meaningful human involvement. Our company does not use such systems in a way that would have legal effects on users or significantly affect their situation.

15.3. Profiling. Profiling is a type of data processing that consists in using personal data to evaluate certain personal factors, in particular to analyse or predict aspects concerning performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements. In our activity we do not use profiling in a way that would have legal effects on natural persons or significantly affect their situation. This means that we do not analyse or predict your preferences, behaviour or location in a way that could automatically generate decisions affecting your rights or your access to services.

15.4. Transparency and control. A commitment to transparency and respect for our users’ privacy is a priority for us. If we were to introduce any changes to our practices concerning automated decision-making or profiling in the future, users would be informed of this without delay, and the procedures used would be presented in a clear and understandable way.

15.5. Your Rights. We remind you that you have the right to obtain human intervention, to express your point of view and to contest decisions based solely on automated processing, including profiling. To exercise this right, please contact our Data Protection Officer by e-mail: iod@wellysa.com or in writing to the address of our registered office.

16. Transfers of Data Outside the EEA

16.1. At NZOZ Wellysa, we are deeply committed to protecting the privacy and personal data of our users. We therefore comply with rigorous data protection standards, in accordance with the requirements of the General Data Protection Regulation (GDPR) and other applicable law.

16.2. Principle of No Transfers Outside the EEA. We inform you that the personal data we collect is processed and stored exclusively within the European Economic Area (EEA), which ensures a high level of protection for it. We do not transfer personal data outside the territory of the EEA, which means that it is not subject to transfers to third countries or international organisations that might not ensure an adequate level of data protection.

16.3. Commitment to Data Protection. Our commitment to protecting your personal data reflects our mission of ensuring security and privacy at every stage of using our services. All operations on personal data are carried out in accordance with the highest information security standards and with respect for your rights and freedoms.

16.4. Exceptions to the Principle. Where a transfer of data outside the EEA proves necessary for any reason, we will take all necessary measures to ensure that such a transfer takes place in accordance with applicable data protection law, including by
16.4.1. Applying standard contractual clauses approved by the European Commission,
16.4.2. Making sure that the destination country ensures an adequate level of data protection, in accordance with a decision of the European Commission,
16.4.3. Implementing appropriate safeguards, such as agreements based on binding corporate rules (BCR).

16.5. User Rights. We wish to assure you that you have full control over your personal data at all times. We therefore provide you with access to information about any data transfers and the right to object to such transfers.

16.6. Contact and Further Information. If you have questions about the processing and transfer of personal data outside the EEA, please contact our Data Protection Officer (DPO) directly by e-mail: iod@wellysa.com or in writing to the address of our registered office.

17. Right to Lodge a Complaint

17.1. At NZOZ Wellysa, we make every effort to ensure that your personal data is processed in full compliance with the highest data protection standards, including the General Data Protection Regulation (GDPR). Despite our commitment, we understand that there may be situations in which users feel dissatisfied with the way their data is processed.

17.2. Lodging a Complaint. If you believe that the processing of your personal data by Wellysa Spółka Akcyjna infringes the GDPR or other data protection law, you have the right to lodge a complaint with the competent supervisory authority. In Poland, this authority is the President of the Personal Data Protection Office (UODO).

17.3. Complaint Procedure. We encourage you to contact the Controller first, that is, us directly, through our Data Protection Officer (DPO) at iod@wellysa.com or by post, which may allow any problems to be resolved quickly.

17.4. Lodging a Complaint with UODO. If contacting us does not bring a solution, or you prefer to take this step straight away, you can lodge a complaint directly with the President of the Personal Data Protection Office. A complaint can be submitted in writing, by post, electronically or in person at the UODO office. It is advisable to attach any information and documents that may be relevant to the case. Information Required When Lodging a Complaint:
17.4.1. Your full contact details,
17.4.2. A detailed description of the data protection infringement you have experienced,
17.4.3. An indication of the steps you have taken so far to resolve the problem,
17.4.4. Copies of any correspondence or documents related to the case.

17.5. Support and Assistance. Please remember that the President of UODO is at your disposal not only when you lodge a complaint, but also as a source of information and support in the field of personal data protection.

17.6. Our Commitment. We are committed to cooperating with supervisory authorities and users to ensure that all privacy concerns are properly addressed and resolved in a spirit of openness and respect for your rights.

18. Cookies

18.1. At Wellysa Spółka Akcyjna, we use cookies and similar technologies on our website and in the mobile application to provide the best possible experience for our users. Cookies are small text files that are saved on your device (computer, phone, tablet, etc.) when you use our services. They make it possible to recognise the user’s device and to adapt our services to their needs accordingly.

18.2. Types of Cookies and Data Storage Technologies Used 18.2.1. Necessary Cookies. These cookies and their technological equivalents in the mobile application are required for the basic functionality of both the website and the application, such as security, network management and accessibility. Without them our services may not work properly. 18.2.2. Functional Cookies. They make it possible to remember choices made by the user (e.g. user name, language, region) in the application and on the website, offering more personalised features. 18.2.3. Analytics and Performance Cookies. They enable us to understand how users use our website and mobile application, which helps us improve functionality and the presentation of content. 18.2.4. Advertising and Targeting Cookies. They are used to deliver advertisements that better match the user’s interests, both in the application and on the website, and to measure the effectiveness of advertising campaigns.

18.3. Managing Cookies and Data Storage Technologies. As a user, you have full control over the cookies and similar data storage technologies used in our mobile application and on our website. Most web browsers and some mobile operating systems offer options for managing data storage settings. You can change your browser settings or the system settings of the mobile application to reject new cookies, disable existing ones, or be informed when new cookies or data are saved on your device. Please note, however, that if you decide to block or delete cookies and other data storage technologies, this may affect the availability and functionality of our services. To manage the settings for cookies and similar technologies, visit the “Help” menu in your web browser or the privacy/data protection settings section in the operating system of your mobile device.

18.4. Your Rights and Privacy. Respect for your privacy is a priority for us. The use of cookies and similar technologies is always in accordance with applicable personal data protection law, including the GDPR. We provide you with transparency about the information collected and control over it.

18.5. More Information. If you have any questions or concerns about our use of cookies, please contact us by e-mail: kontakt@wellysa.com or by other means of communication given on our website.

19. Changes to the Privacy Policy

19.1. At NZOZ Wellysa we are aware that technology and privacy regulations are evolving, which may require us to adapt and update our Privacy Policy. We therefore reserve the right to make changes to the Privacy Policy at any time so that it reflects the latest practices concerning the processing of personal data and ensures compliance with applicable law.

19.2. Policy Update Process
19.2.1. Regular Review. We regularly review our Privacy Policy to make sure it is up to date and reflects the way we process personal data.
19.2.2. Making Changes. Where material changes are made to the Privacy Policy that may affect the way personal data is processed or users’ rights, we will make those changes with due care and taking into account privacy protection best practice.
19.2.3. Communication of Changes
19.2.3.1. Notifications. We will inform you of any changes to our Privacy Policy through a clear notice on our website and, where possible, through other communication channels, such as e-mail, for users who have consented to receive such information.
9.2.3.2. Date of last update. At the top of the Privacy Policy you will always find the date of its last update, which will allow you to easily identify when the most recent changes were made.
19.2.3.3. Transparency of Changes. We make every effort to present all changes in a clear and understandable way. It is important to us that you are always aware of how we protect your personal data and what rights you have.
19.2.3.4. Your Rights and Choices. We remind you that you have full control over your personal data. At any time you have the right to access, rectify, erase or restrict the processing of your data. No changes to the Privacy Policy will affect these rights without your explicit consent.

20. Contact

20.1. We encourage you to check the Privacy Policy regularly and to contact us if you have any questions or concerns about changes to this policy or about the way we process your personal data. You can contact us by e-mail: kontakt@wellysa.com , helpdesk@wellysa.com , iod@wellysa.com or through other available channels.