Information Clause Regulating the Processing Data for Marketing Processes

According to Article 13 of the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), we inform you that:

The Administrator of your personal data is: Centrum Kompleksowej Rehabilitacji Sp.z o.o, located at ul. Gąsiorowskiego 12/14, Konstancin Jeziorna, Poland Telephone: +48 22 703 00 00

The Data Protection Officer is: Marta Lesisz-Jakubowska, contact information: email address: iod@ckr.pl

The purpose of data processing is: The possibility of sending information (including new offers, products, services, and newsletters) related to the services provided by CKR Sp. z o. o. to the provided email address, telephone number, or residential address.

The legal basis for processing: The legal basis for processing is your consent under Article 6(1)(a).

Your personal data will be stored until the data controller discontinues promotional activities or as long as you agree to it. If you withdraw your consent, we will immediately cease processing your data for marketing purposes, which will be done within a reasonable time to fulfill your request.

You have the right to:

• Access your data (Article 15)
• Rectify your data (Article 16)
• Erase your data (“right to be forgotten”) (Article 17)
• Restrict the processing of your data (Article 18)
• Data portability (Article 20)
• Object to the processing of your data (Article 21)

The data you provide may be processed in an automated manner, which means it can be profiled based on your preferences (e.g., frequency of using our services). As a result, you will receive more information from us, such as about our services that you have recently or frequently ordered, or that we have not yet informed you about but may interest you.

To withdraw your consent, please send an email to iod@ckr.pl with the subject line “withdrawal of consent for data processing.”

Processed personal data will not be disclosed to other entities except in cases where such an obligation arises from applicable laws and regulations.

The Administrator does not transfer or intend to transfer data to third countries or international organizations.

INFORMATION CLAUSE FOR E-PLATFORM ACCOUNT

According to Article 13 of the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), we inform you that:

The Administrator of your personal data is: Centrum Kompleksowej Rehabilitacji Sp.z o.o, located at ul. Gąsiorowskiego 12/14, Konstancin Jeziorna, Poland Telephone: +48 22 703 00 00

The Data Protection Officer is: Marta Lesisz-Jakubowska, contact information: email address: marta.lesisz.jakubowska@ckr.pl

The purpose of data processing is: Access to the E-platform system and activities related to the provision of medical services.

The legal basis for processing:

• The Patient Rights and the Patient Rights Ombudsman Act of 6 November 2008;
• The Medical Activity Act of 15 April 2011;

• Health Information System Act of 28 April 2011;
• Act on Health Services Financed from Public Funds of 27 August 2004;
• Regulation of the Minister of Health of 6 April 2020 on the types, scope, and templates of medical documentation and the method of its processing.

The collected data will be stored in accordance with applicable regulations:

• The Patient Rights and the Patient Rights Ombudsman Act of 6 November 2008;
• Regulation of the Minister of Health of 16 October 2017 on the treatment of blood and its components in medical entities providing inpatient and round-the-clock health care services.

You have the right to:

• Access the content of your data and the right to rectify them.
• Lodge a complaint with the supervisory authority, the President of the Office for Personal Data Protection, in case of a violation of the regulations on personal data protection.

We inform you that processed personal data will not be disclosed to other entities except in cases where such an obligation arises from applicable laws and regulations.

The Administrator does not transfer or intend to transfer data to third countries or international organizations.