Information
Privacy policy.
How we process data when you browse the website, contact the clinic or arrange an appointment.
Version dated 21 October 2026.
1. Controller and contact details
The controller for the processing described below is Esti Clinic Tatiana Jasińska Specjalistyczna Praktyka Lekarska, ul. Karola Miarki 13, 42-700 Lubliniec, Poland, operating Atlanta & Esti Clinic. For privacy enquiries or to exercise your rights, contact dermatologia@atlantaclinic.pl or write to the address above. Reception: +48 34 373 18 18.
This policy covers the clinic’s new website and its preview. It explains processing connected with the website, correspondence and appointment arrangements. It does not replace the information provided to patients about healthcare and medical records.
dermatologia@atlantaclinic.pl · +48 34 373 18 18
2. What data we receive and where it comes from
When you open the website, the server infrastructure processes technical data: your IP address, request time, page address, browser and device details, and errors. No account is required. The website has no contact form of its own, newsletter sign-up or payment facility.
When you email or telephone us, you provide contact details, possibly your name, and the content of your enquiry. For bookings, we receive from you or your chosen booking service the details needed to arrange and manage the appointment, such as your name, telephone number, appointment time and service. Do not send your PESEL number or medical records by ordinary email; reception will explain how to provide the information appropriately.
Contacting us via WhatsApp is optional. The button opens the external messaging service with reception’s number, +48 572 816 618; the website does not embed a chat or automatically send a message or the address of the page you are viewing. If you message us, reception receives the information shared by your WhatsApp profile and the content of your message to respond to your enquiry. Use of the messaging service is also subject to WhatsApp’s privacy policy. You can still contact us by phone or email.
3. Purposes and legal bases
Operating and securing the website, diagnosing errors and preventing misuse: Article 6(1)(f) GDPR, our legitimate interest in providing a secure service. Answering general enquiries and handling correspondence: the same basis, in our interest in dealing with your enquiry.
Arranging and managing an appointment you request: Article 6(1)(b) GDPR, taking steps at your request before entering into a contract or performing it. Where health data is necessary for healthcare, Article 9(2)(h) GDPR also applies, subject to professional confidentiality.
Meeting legal obligations, including handling data-rights requests: Article 6(1)(c) GDPR. Establishing, exercising or defending legal claims: Article 6(1)(f) GDPR, our legitimate interest in protecting our rights; where health data is necessary, Article 9(2)(f) GDPR. Simply browsing the website or using a contact link does not constitute marketing consent.
4. Booksy and ZnanyLekarz
The selected provider’s calendar loads only when you click the button to display available appointments. Your browser then connects to that provider and sends technical data, including your IP address; the provider may use its own cookies. Information entered into the calendar is handled by Booksy or ZnanyLekarz/Docplanner, and the clinic receives the details needed for your booking.
The providers process data under their own policies, including as controllers for their own services. The clinic is responsible for its own appointment-related purposes. Opening a calendar does not mean consenting to all the provider’s optional purposes; use its privacy settings. You can book by telephone without loading a calendar.
5. Cookies, search and external links
Optional measurement runs only with the relevant consent on atlantaesti.pl.
Your consent choice is stored on this device for 180 days. With analytics consent, GA4 cookies (_ga and _ga_*) may last up to 180 days; with marketing consent, Meta cookies (_fbp and, where applicable, _fbc) usually last up to 90 days. You can withdraw consent in Privacy settings in the footer; this removes accessible measurement cookies and stops further measurement.
With analytics consent, GA4 runs only on home, about, contact and team pages. With marketing consent, Meta runs only on the clean home-page URL. Treatment, indication, price and booking pages and URLs with queries or fragments are not measured. A contact or booking click is not a confirmed appointment.
Google Analytics 4 (Google Ireland Limited) provides general statistics only on the home, about, contact and team pages. Meta Pixel (Meta Platforms Ireland Limited) provides limited advertising measurement only on the clean home-page URL. Separate consents are required (Article 6(1)(a) GDPR). We do not send treatment names, searches or patient details to Google or Meta. Google Signals, Google ad personalisation and Meta automatic matching are disabled. Providers may process technical data and cookie identifiers outside the EEA under their policies and transfer safeguards. Contact the controller and consult Google and Meta policies for provider retention and rights information.
Maps and social profiles open only when you follow a link. Other websites apply their own policies. You can control booking providers’ cookies through their settings and your browser. Blocking cookies may affect booking functionality, but not the main clinic website.
6. Who receives data
Data may be received by authorised clinic personnel and providers of hosting (Netlify), email and IT support, to the extent required for their tasks. Providers acting on our behalf must protect data under processing agreements. If you use a booking system, its operator also receives data. Information may be disclosed to authorised public bodies when required by law. We do not sell website users’ data.
7. Processing outside the EEA
Netlify hosting may involve the USA. Its agreement provides for the EU–US Data Privacy Framework, with EU standard contractual clauses as a fallback. Safeguard information is available from us or the provider’s documentation.
External booking, map and social media services describe their own international transfers in their privacy policies. Links to the booking providers’ documents appear below.
8. How long data is kept
We retain ordinary correspondence for 5 years. Where specific information remains necessary to meet a legal obligation or establish, exercise or defend legal claims, we retain the relevant part for as long as necessary for that purpose.
We retain appointment administration data for 5 years. This period does not apply to medical records, which are subject to separate statutory retention periods. Information needed for accounting or specific legal claims may be subject to separate obligations; please contact the clinic for details.
Technical data is retained within the hosting provider’s log cycle to maintain and secure the service; records of a particular incident may be needed until the incident and related proceedings are resolved. Contact the controller for current information on retention of a particular category and the criteria applied. External providers specify their own periods in their policies.
9. Your rights
You may request access to and a copy of your data, rectification, erasure or restriction. Data portability applies under the GDPR’s conditions to automated processing based on a contract or consent. You may object to processing based on legitimate interests on grounds relating to your particular situation. Where processing relies on consent, you may withdraw it for the future without affecting the lawfulness of earlier processing.
These rights are not absolute: a duty to retain medical records may, for example, prevent erasure. Send requests to the controller’s email or postal address above. We may request information necessary to verify your identity. We normally respond within one month; any extension allowed by the GDPR and its reason will be communicated within that period.
You may complain to the President of Poland’s Personal Data Protection Office (uodo.gov.pl), or, where the GDPR permits, the relevant authority in another Member State.
10. Voluntary provision and automated decisions
Providing data when contacting us is voluntary, but without details allowing us to respond we may be unable to deal with your enquiry. Required booking details are necessary to arrange an appointment. Some information required for healthcare is also mandated by law. On our own website we do not make decisions producing legal or similarly significant effects solely by automated means, or create advertising profiles.
11. Policy updates
We update this policy when the website, providers or legal requirements change. The version date appears above. Adding tools that require consent will require appropriate information and a choice before they are activated.